The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
Energy Sector Faces Sophisticated AiTM Phishing and BEC Attack in 2026
In January 2026, a sophisticated adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaign targeted multiple organizations within the energy sector. Attackers exploited SharePoint's file-sharing services to distribute phishing payloads, leading to the compromise of numerous user accounts. The campaign involved creating malicious inbox rules to maintain persistence and evade detection, subsequently launching large-scale phishing attacks both internally and externally. This operation underscores the evolving complexity of AiTM campaigns and highlights the necessity for organizations to implement comprehensive remediation strategies beyond standard identity compromise responses. The incident serves as a critical reminder of the importance of robust security measures, including the revocation of active session cookies and the removal of unauthorized inbox rules, to effectively mitigate such threats.
7 months ago
Kill Chain
Critical Vulnerability in iba Systems ibaPDA Exposes Industrial Systems to Unauthorized Access
In January 2026, a critical vulnerability (CVE-2025-14988) was identified in iba Systems' ibaPDA software, version 8.12.0. This flaw allowed unauthorized actions on the file system, potentially compromising the confidentiality, integrity, and availability of affected systems. The vulnerability was reported by Siemens and disclosed by CISA on January 27, 2026. ([iba-ag.com](https://www.iba-ag.com/en/security/iba-2025-04?utm_source=openai)) Given ibaPDA's widespread use in critical manufacturing sectors worldwide, this vulnerability posed significant risks to industrial operations. Organizations were urged to update to version 8.12.1 or later to mitigate potential exploitation. ([iba-ag.com](https://www.iba-ag.com/en/security/iba-2025-04?utm_source=openai))
7 months ago
Kill Chain
Rockwell Automation's ArmorStart LT Vulnerabilities: A Wake-Up Call for Industrial Security
In January 2026, Rockwell Automation disclosed multiple vulnerabilities in its ArmorStart® LT motor control devices, specifically models 290D, 291D, and 294D up to and including version V2.002. These vulnerabilities, identified as CVE-2025-9464 through CVE-2025-9283, can lead to denial-of-service conditions. Exploitation methods include fuzzing of CIP classes, execution of Achilles Comprehensive grammar tests, and active scanning with tools like Burp Suite, causing devices to become unresponsive or reboot unexpectedly. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai)) The affected devices are widely used in the critical manufacturing sector globally. As of the disclosure, no patches or upgrades were available. Rockwell Automation recommends applying security best practices to mitigate risks, such as minimizing network exposure, placing devices behind firewalls, and using secure remote access methods like VPNs. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai))
7 months ago
Kill Chain
Sandworm's DynoWiper Targets Poland's Energy Sector in 2025 Cyberattack
In late December 2025, Poland's energy infrastructure was targeted by a cyberattack involving a data-wiping malware named DynoWiper. The attack aimed to disrupt operations at two combined heat and power plants and several renewable energy facilities. ESET researchers attributed the attack to the Russian state-sponsored group Sandworm, noting similarities to previous incidents involving the group. Fortunately, the malware was intercepted before causing any substantial damage, and no operational disruptions were reported. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors to critical infrastructure. The timing, coinciding with the tenth anniversary of Sandworm's first known assault on Ukraine’s power grid in 2015, highlights the group's continued focus on energy sector targets and disruptive operations. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai))
7 months ago
Kill Chain
Critical Privilege Escalation Vulnerability Discovered in Iconics Suite
In early 2024, a security assessment revealed a vulnerability in the Iconics Suite, a SCADA system used across various industries. Tracked as CVE-2025-0921, this flaw allows local authenticated attackers to exploit privileged file system operations, potentially leading to a denial-of-service (DoS) condition by corrupting critical system binaries. The vulnerability affects all versions of GENESIS64, MC Works64, and GENESIS version 11.00. Mitsubishi Electric has released advisories detailing measures to address the issue. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/?utm_source=openai)) This incident underscores the critical importance of securing SCADA systems, especially given their role in industrial operations. The discovery of CVE-2025-0921 highlights the need for continuous security assessments and prompt application of vendor-released patches to mitigate potential threats.
7 months ago
Kill Chain
2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface
In early 2024, security researchers uncovered a critical vulnerability affecting widely used Telnet server software running on hundreds of thousands of legacy and IoT devices worldwide. Attackers exploited the bug, which allowed unauthenticated remote access using unencrypted Telnet sessions, to compromise network and industrial systems, bypass access controls, and rapidly pivot laterally. Many affected devices remained unpatched due to lack of vendor support, making remediation difficult and exposing organizations in healthcare, manufacturing, and critical infrastructure to potential downtime and data theft. This incident highlights the enduring risk of forgotten, legacy protocols like Telnet persisting in enterprise environments. Attackers increasingly scan for and exploit such overlooked attack surfaces, emphasizing the need for proactive inventory, segmentation, and the retirement of obsolete network services to defend against emergent threats.
7 months ago
Kill Chain
Electrum-Linked Wiper Attack Disables Key Systems in Polish Energy Grid
In late December 2025, a coordinated cyberattack targeted Poland’s distributed energy resource (DER) sites, including combined heat and power, wind, and solar dispatch facilities. The attackers, identified as the Russian-linked Electrum (overlapping with APT44/Sandworm), exploited misconfigurations and exposed operational technology, corrupting or destroying key OT and Windows systems at nearly 30 sites. While no electrical outages were reported and power generation largely continued, remote monitoring and control capabilities were disabled and some equipment rendered inoperable, exposing critical vulnerabilities in Poland’s decentralized energy grid. This incident highlights a significant evolution in threat actor tactics toward industrial systems, specifically targeting the backbone of modern hybrid energy infrastructure. Increased focus on OT security, zero-trust segmentation, and resilient operational controls is crucial as sophisticated groups continue probing for weaknesses in vital infrastructure globally.
7 months ago
Kill Chain
Russian ELECTRUM APT Strikes Polish Power Grid with Coordinated December 2025 Attack
In December 2025, a coordinated cyber attack disrupted multiple sites within Poland's national power grid, marking the first significant compromise of distributed energy operational technology in the region. The campaign, attributed with medium confidence to Russian state-sponsored APT group ELECTRUM, leveraged supply chain vulnerabilities and advanced lateral movement techniques to infiltrate the grid's OT networks. Attackers exploited unencrypted east-west traffic and segmentation gaps, enabling persistent access and operational disruption that triggered brief power outages and forced manual intervention by Polish operators. The incident showcased a notable escalation in critical infrastructure targeting methods by highly skilled actors. This incident highlights the increasing risk of state-sponsored attacks on energy infrastructure, especially in the context of rising geopolitical tensions and adversarial use of sophisticated supply chain compromise and network segmentation evasion. Organizations should reassess their visibility and controls for east-west and encrypted traffic to mitigate similar risks.
7 months ago
Kill Chain
Sandworm Wiper Campaign Frustrated at Poland Power Grid
In May 2024, cyber researchers reported a high-profile attack attempt targeting Poland’s power grid infrastructure. The operation was attributed to Sandworm, a Russian APT group notorious for wiper malware and sabotage against critical national infrastructure. Attackers leveraged custom malware designed to disrupt grid operations, but strong detection and security controls reportedly thwarted the attempt, preventing widespread outages. The incident highlighted Sandworm’s persistent focus on critical infrastructure in Central Europe and their evolving tactics for sabotaging operational technology environments. This case underscores a larger trend of state-aligned threat actors targeting energy and critical infrastructure in Europe, leveraging specialized wiper tools and lateral movement techniques. It also emphasizes increasing cross-border cyber risk as geopolitical tensions escalate and underscores new regulatory scrutiny for critical sectors.
8 months ago
Kill Chain
Sandworm’s Failed DynoWiper Attack on Poland’s Energy Grid: A 2025 Nation-State Case Study
In late December 2025, Polish energy infrastructure was targeted in a sophisticated cyberattack attributed to Sandworm, a notorious Russian state-sponsored hacking group. The attackers attempted to deploy 'DynoWiper', a destructive data-wiping malware, against two combined heat and power facilities and key management systems for renewable energy assets. Although the wiper aimed to erase files and render systems inoperable, Polish officials confirmed the attack was detected and mitigated before operational disruption occurred. Attribution to Sandworm, linked to Russia’s GRU, underscores continued targeting of critical infrastructure by advanced persistent threats. This incident is highly relevant given the continued escalation of cyber operations against national infrastructure, particularly in Europe. It highlights the evolving use of destructive malware by state-backed actors and signals the necessity for robust cross-sector cyber defenses and detection mechanisms.
8 months ago
Kill Chain
Sandworm’s DynoWiper Attack on Poland’s Power Grid: How Cyberdefenders Stopped a Nation-State Threat
In late December 2025, Poland’s power sector faced the largest cyberattack in its history, attributed to the notorious Russian state-backed Sandworm group. The attackers deployed a new destructive malware strain dubbed DynoWiper, attempting to disrupt critical energy operations by wiping systems within operational networks. Polish cyber defense teams identified the attack early through advanced threat monitoring and contained the threat before any operational damage occurred. No loss of service or data was reported, and authorities confirmed that core infrastructure remained uncompromised. The incident has intensified scrutiny of nation-state threats to Europe’s energy grid, reinforcing calls for resilient cybersecurity postures across all critical infrastructure assets. Sandworm’s use of a novel wiper malware and focus on lateral movement echo a sharp uptick in high-impact, geopolitically motivated attacks targeting EU utilities. This case highlights the growing sophistication and persistence of nation-state cyber operations, raising fresh challenges for defenders in the energy sector and beyond.
8 months ago
Kill Chain
Sandworm’s 2025 DynoWiper Attack on Poland’s Power Grid: Lessons in Critical Infrastructure Resilience
In late 2025, a highly targeted cyberattack attributed to the Sandworm group struck Poland's national power grid. Using custom data-wiping malware identified as DynoWiper, the attackers infiltrated critical infrastructure networks, demonstrating sophisticated knowledge of operational technology environments. The initial compromise involved lateral movement through segmented OT/IT networks, facilitated by exploitation of unprotected east-west traffic and weak segmentation controls. The subsequent deployment of DynoWiper caused destructive impacts, including service outages and loss of operational data across several regional substations, with cascading effects on grid stability and dependent sectors. Immediate containment was complicated by attacker persistence and the rapid spread of the wiper. This incident underscores the rising trend of advanced, nation-state wiper malware targeting critical infrastructure, reflecting a shift from espionage to destructive tactics. Organizations face elevated urgency to harden network segmentation, implement robust egress security, and adopt zero trust operational models in light of these evolving threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports