The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025
In October 2025, AutomationDirect disclosed multiple critical vulnerabilities affecting its Productivity Suite and a range of Productivity 1000, 2000, and 3000 PLC models, widely deployed in the manufacturing sector. Discovered by Nozomi Networks, the flaws—such as remote code execution, weak password recovery, and unrestricted file system access—could allow unauthenticated attackers to gain full control of affected devices, compromise sensitive project files, and disrupt industrial processes. The vulnerabilities could be exploited remotely with low attack complexity and no user interaction. This incident highlights rising risks posed by legacy and poorly segmented OT networks, as threat actors increasingly target industrial control systems. The sharp jump in the number and severity of disclosed PLC software vulnerabilities underscores the urgent need for enhanced segmentation, access controls, and monitoring in critical infrastructure environments.
8 months ago
Kill Chain
Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations
In October 2025, Schneider Electric disclosed a critical vulnerability (CVE-2024-10085) affecting its EcoStruxure OPC UA Server Expert and Modicon Communication Server. The flaw, identified as improper allocation of resources without limits or throttling, allows a remote attacker to overwhelm the targeted server with excessive OPC UA requests, resulting in a denial-of-service (DoS) and loss of real-time process data. The vulnerability, scored at CVSS v4 8.2, threatens industrial operations worldwide, particularly in critical sectors like energy and manufacturing, if not promptly mitigated. This incident underscores the increasing risk to industrial control systems (ICS) from remote, low-complexity attacks exploiting resource exhaustion bugs. It highlights ongoing attacker interest in operational technology environments and the urgent need for robust ICS security best practices and timely patch management.
8 months ago
Kill Chain
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.
8 months ago
Kill Chain
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.
8 months ago
Kill Chain
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.
8 months ago
Kill Chain
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.
8 months ago
Kill Chain
Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025
In early 2025, multiple organizations experienced cyberattacks stemming from the exploitation of a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). Threat actors leveraged this flaw to gain unauthorized access, deploy covert tools, and move laterally within victim environments. Notably, high-profile companies such as Schneider Electric may have been impacted, highlighting the sophistication and stealthiness of the attackers, who exploited encrypted and east-west traffic blind spots. The compromise of sensitive business data and disruption of enterprise resource planning systems underscore the far-reaching operational and financial consequences of this campaign. This incident sheds light on the escalating trend of supply chain attacks targeting widely used enterprise software through previously unknown vulnerabilities. The breadth of the campaign and the use of zero-day exploits signal a need for continuous vigilance, rapid patching, and advanced detection controls to defend critical systems against emerging threats.
8 months ago
Kill Chain
PassiveNeuron APT: 2024 Cyber Espionage Targets Asia, Africa & LatAm with Neursite Malware
In late 2024, cybersecurity researchers identified a sophisticated cyber espionage campaign targeting government, financial, and industrial organizations across Asia, Africa, and Latin America. Dubbed "PassiveNeuron," the operation leveraged custom malware strains, Neursite and NeuralExecutor, deployed by an advanced persistent threat (APT) group to infiltrate networks, maintain persistence, and exfiltrate sensitive data over several months. The entry vector appears to involve highly targeted spear-phishing and exploitation of vulnerable internet-facing assets, allowing attackers to bypass perimeter defenses and conduct stealthy lateral movement. The attack resulted in significant exposure of confidential communications and potentially state or financial secrets, raising concerns among affected sectors and governments. This incident exemplifies ongoing evolution in state-sponsored cyber attacks, with advanced malware leveraging encrypted traffic and zero trust evasion techniques. Given the increasingly global scope of APT operations and regulatory pressure on critical sectors, organizations must reexamine east-west security, policy enforcement, and anomaly detection capabilities to mitigate rising espionage risks.
8 months ago
Kill Chain
Volt Typhoon Breach Exposes Critical Infrastructure Vulnerabilities via Back-Office Data
In early 2024, multiple US critical infrastructure operators discovered that nation-state actors, most notably Volt Typhoon, exploited unsecured and unmonitored 'back-office' systems to gain persistence within operational technology (OT) and industrial control system (ICS) networks. The attackers bypassed perimeter defenses by identifying unencrypted data in transit, lateral east-west traffic vulnerabilities, and data sprawl in business support systems. Their operations evaded detection for months, leveraging encrypted channels and exploiting gaps in policy enforcement, leading to sensitive OT-adjacent data exfiltration and operational risk. This breach highlights a wider trend: sophisticated APTs are moving beyond headline-grabbing OT entry points, targeting unmonitored business data and hybrid network blind spots. Regulators, including CISA and NIST, emphasize organizations must urgently address visibility gaps and strengthen zero trust controls as attackers grow bolder and more evasive.
8 months ago
Kill Chain
Flax Typhoon Turns ArcGIS Geo-Mapping Server into APT Backdoor
In early 2024, Chinese state-sponsored threat group Flax Typhoon compromised an organization’s ArcGIS geospatial mapping server, turning the platform into a covert backdoor for persistent access. The attackers exploited vulnerabilities and weak segmentation, modifying core ArcGIS components to avoid detection while establishing reliable remote control and lateral movement capabilities. This stealthy intrusion allowed for unauthorized data access without typical alert triggers, posing significant operational and reputational risks for the victim, and demonstrated advanced tactics utilized by APT groups targeting critical infrastructure software. This incident highlights a growing trend where APTs compromise auxiliary business applications—like geo-mapping and analytics platforms—to evade detection and spread across internal networks. Organizations must reassess east-west security, encrypted traffic visibility, and zero trust segmentation to keep pace with evolving attacker tradecraft.
8 months ago
Kill Chain
'PassiveNeuron' SQL Server Attacks Expose Global Sectors to Espionage
In early 2024, a cyber-espionage campaign attributed to the 'PassiveNeuron' threat group targeted organizations in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers exploited vulnerable SQL servers as entry points, deploying custom malware to stealthily exfiltrate sensitive data and facilitate lateral movement within compromised environments. The adversaries demonstrated a high degree of operational security, leveraging encrypted channels and bespoke tooling to evade conventional detection, resulting in significant data exposure and operational disruptions for affected entities. This incident reflects the increasing sophistication of cyber-espionage actors leveraging less-monitored databases and novel malware. It highlights a shift toward stealthy, persistent attacks against critical sectors—signaling the need for robust internal monitoring, segmentation, and east-west traffic controls to counter evolving threats.
8 months ago
Kill Chain
How Flax Typhoon Used ArcGIS Server as a Backdoor: 2025 Breach Breakdown
In mid-2025, threat intelligence researchers uncovered a year-long, state-sponsored attack committed by Chinese APT group Flax Typhoon (also known as Ethereal Panda/RedJuliett). The group exploited unpatched ArcGIS servers to establish persistent unauthorized access and covertly operated a backdoor for over twelve months. Using sophisticated techniques to evade detection and maintain long-term access, the attackers leveraged lateral movement and encrypted communication within targeted networks. The breach compromised sensitive data and potentially exposed critical infrastructure, highlighting a significant risk to affected organizations. This incident exemplifies a growing threat from well-resourced nation-state actors targeting enterprise geospatial systems, exploiting overlooked or under-patched software for initial entry. Attacks on infrastructure platforms are increasingly sophisticated, raising urgency for IT and security leaders to enhance detection, zero trust segmentation, and patch management programs in response to evolving APT campaigns.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports