Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Oil/Energy/Solar/Greentech

Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.

499 threat reports
Page 41 of 42
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Oil/Energy/Solar/Greentech Threat Reports

Showing 481–492 / 499 reports
Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations
Critical Manufacturing10 months ago

Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations

In October 2025, Schneider Electric disclosed a critical vulnerability (CVE-2024-10085) affecting its EcoStruxure OPC UA Server Expert and Modicon Communication Server. The flaw, identified as improper allocation of resources without limits or throttling, allows a remote attacker to overwhelm the targeted server with excessive OPC UA requests, resulting in a denial-of-service (DoS) and loss of real-time process data. The vulnerability, scored at CVSS v4 8.2, threatens industrial operations worldwide, particularly in critical sectors like energy and manufacturing, if not promptly mitigated. This incident underscores the increasing risk to industrial control systems (ICS) from remote, low-complexity attacks exploiting resource exhaustion bugs. It highlights ongoing attacker interest in operational technology environments and the urgent need for robust ICS security best practices and timely patch management.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
Utilities10 months ago

CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)

In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
Oil/Energy/Solar/Greentech10 months ago

Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)

In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
Automotive10 months ago

ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025

In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
Utilities10 months ago

Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024

In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025
Utilities10 months ago

Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025

In early 2025, multiple organizations experienced cyberattacks stemming from the exploitation of a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). Threat actors leveraged this flaw to gain unauthorized access, deploy covert tools, and move laterally within victim environments. Notably, high-profile companies such as Schneider Electric may have been impacted, highlighting the sophistication and stealthiness of the attackers, who exploited encrypted and east-west traffic blind spots. The compromise of sensitive business data and disruption of enterprise resource planning systems underscore the far-reaching operational and financial consequences of this campaign. This incident sheds light on the escalating trend of supply chain attacks targeting widely used enterprise software through previously unknown vulnerabilities. The breadth of the campaign and the use of zero-day exploits signal a need for continuous vigilance, rapid patching, and advanced detection controls to defend critical systems against emerging threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PassiveNeuron APT: 2024 Cyber Espionage Targets Asia, Africa & LatAm with Neursite Malware
Government Administration10 months ago

PassiveNeuron APT: 2024 Cyber Espionage Targets Asia, Africa & LatAm with Neursite Malware

In late 2024, cybersecurity researchers identified a sophisticated cyber espionage campaign targeting government, financial, and industrial organizations across Asia, Africa, and Latin America. Dubbed "PassiveNeuron," the operation leveraged custom malware strains, Neursite and NeuralExecutor, deployed by an advanced persistent threat (APT) group to infiltrate networks, maintain persistence, and exfiltrate sensitive data over several months. The entry vector appears to involve highly targeted spear-phishing and exploitation of vulnerable internet-facing assets, allowing attackers to bypass perimeter defenses and conduct stealthy lateral movement. The attack resulted in significant exposure of confidential communications and potentially state or financial secrets, raising concerns among affected sectors and governments. This incident exemplifies ongoing evolution in state-sponsored cyber attacks, with advanced malware leveraging encrypted traffic and zero trust evasion techniques. Given the increasingly global scope of APT operations and regulatory pressure on critical sectors, organizations must reexamine east-west security, policy enforcement, and anomaly detection capabilities to mitigate rising espionage risks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Volt Typhoon Breach Exposes Critical Infrastructure Vulnerabilities via Back-Office Data
Utilities10 months ago

Volt Typhoon Breach Exposes Critical Infrastructure Vulnerabilities via Back-Office Data

In early 2024, multiple US critical infrastructure operators discovered that nation-state actors, most notably Volt Typhoon, exploited unsecured and unmonitored 'back-office' systems to gain persistence within operational technology (OT) and industrial control system (ICS) networks. The attackers bypassed perimeter defenses by identifying unencrypted data in transit, lateral east-west traffic vulnerabilities, and data sprawl in business support systems. Their operations evaded detection for months, leveraging encrypted channels and exploiting gaps in policy enforcement, leading to sensitive OT-adjacent data exfiltration and operational risk. This breach highlights a wider trend: sophisticated APTs are moving beyond headline-grabbing OT entry points, targeting unmonitored business data and hybrid network blind spots. Regulators, including CISA and NIST, emphasize organizations must urgently address visibility gaps and strengthen zero trust controls as attackers grow bolder and more evasive.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Flax Typhoon Turns ArcGIS Geo-Mapping Server into APT Backdoor
Government Administration10 months ago

Flax Typhoon Turns ArcGIS Geo-Mapping Server into APT Backdoor

In early 2024, Chinese state-sponsored threat group Flax Typhoon compromised an organization’s ArcGIS geospatial mapping server, turning the platform into a covert backdoor for persistent access. The attackers exploited vulnerabilities and weak segmentation, modifying core ArcGIS components to avoid detection while establishing reliable remote control and lateral movement capabilities. This stealthy intrusion allowed for unauthorized data access without typical alert triggers, posing significant operational and reputational risks for the victim, and demonstrated advanced tactics utilized by APT groups targeting critical infrastructure software. This incident highlights a growing trend where APTs compromise auxiliary business applications—like geo-mapping and analytics platforms—to evade detection and spread across internal networks. Organizations must reassess east-west security, encrypted traffic visibility, and zero trust segmentation to keep pace with evolving attacker tradecraft.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
'PassiveNeuron' SQL Server Attacks Expose Global Sectors to Espionage
Government Administration10 months ago

'PassiveNeuron' SQL Server Attacks Expose Global Sectors to Espionage

In early 2024, a cyber-espionage campaign attributed to the 'PassiveNeuron' threat group targeted organizations in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers exploited vulnerable SQL servers as entry points, deploying custom malware to stealthily exfiltrate sensitive data and facilitate lateral movement within compromised environments. The adversaries demonstrated a high degree of operational security, leveraging encrypted channels and bespoke tooling to evade conventional detection, resulting in significant data exposure and operational disruptions for affected entities. This incident reflects the increasing sophistication of cyber-espionage actors leveraging less-monitored databases and novel malware. It highlights a shift toward stealthy, persistent attacks against critical sectors—signaling the need for robust internal monitoring, segmentation, and east-west traffic controls to counter evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Flax Typhoon Used ArcGIS Server as a Backdoor: 2025 Breach Breakdown
Government Administration10 months ago

How Flax Typhoon Used ArcGIS Server as a Backdoor: 2025 Breach Breakdown

In mid-2025, threat intelligence researchers uncovered a year-long, state-sponsored attack committed by Chinese APT group Flax Typhoon (also known as Ethereal Panda/RedJuliett). The group exploited unpatched ArcGIS servers to establish persistent unauthorized access and covertly operated a backdoor for over twelve months. Using sophisticated techniques to evade detection and maintain long-term access, the attackers leveraged lateral movement and encrypted communication within targeted networks. The breach compromised sensitive data and potentially exposed critical infrastructure, highlighting a significant risk to affected organizations. This incident exemplifies a growing threat from well-resourced nation-state actors targeting enterprise geospatial systems, exploiting overlooked or under-patched software for initial entry. Attacks on infrastructure platforms are increasingly sophisticated, raising urgency for IT and security leaders to enhance detection, zero trust segmentation, and patch management programs in response to evolving APT campaigns.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Two CVSS 10.0 Flaws in Red Lion RTUs Expose Industrial Control Environments
Oil/Energy/Solar/Greentech10 months ago

Two CVSS 10.0 Flaws in Red Lion RTUs Expose Industrial Control Environments

In October 2025, two critical vulnerabilities (CVE-2023-40151 and CVE-2023-42770) were publicly disclosed in Red Lion Sixnet RTU devices, which are widely used for industrial automation and critical infrastructure. Both flaws received a CVSS 10.0 rating, underscoring their exploitability and impact. Attackers exploiting these vulnerabilities could achieve remote code execution with the highest privileges, granting them full control over affected devices. These RTUs are often deployed in energy, utilities, and manufacturing, raising concerns about the potential for business disruption, safety risks, and further attacks via compromised operational technology networks. This incident is particularly relevant as it highlights how legacy and specialized industrial control systems remain a prime target for threat actors leveraging zero-day vulnerabilities. The convergence of IT and OT, combined with growing regulatory scrutiny and an uptick in supply chain exposures, means that organizations must refocus on asset visibility and patch management for embedded and hard-to-update devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports