✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Siemens SIPROTEC 5 Vulnerability Exposes Critical Infrastructure to Potential Attacks
In June 2026, Siemens disclosed a vulnerability (CVE-2025-40808) in its SIPROTEC 5 devices, which are critical components in energy and industrial sectors. The flaw allows authenticated users to upload arbitrary files via the DIGSI 5 protocol, potentially leading to denial-of-service conditions or remote code execution. Siemens has released firmware updates to address this issue and recommends users upgrade to the latest versions to mitigate the risk. This incident underscores the importance of securing industrial control systems against authenticated insider threats. As cyberattacks targeting critical infrastructure become more sophisticated, organizations must prioritize timely patching and robust access controls to safeguard operational technology environments.
1 month ago
Kill Chain
OceanLotus Targets Vietnamese Investors via FireAnt Metakit Supply Chain Attack
Between mid-2024 and March 2026, the Vietnam-aligned threat actor OceanLotus (APT32) conducted cyber espionage campaigns targeting domestic entities. Notably, from October 2025 to March 2026, they executed a supply chain attack by compromising the update mechanism of FireAnt Metakit, a widely used stock investment platform in Vietnam. This allowed them to distribute the SPECTRALVIPER backdoor to a select group of investors, facilitating unauthorized access and data exfiltration. This incident underscores a strategic shift by OceanLotus towards domestic targets, highlighting the evolving threat landscape where nation-state actors exploit trusted software supply chains to infiltrate critical sectors. Organizations must enhance their software supply chain security and implement robust monitoring to detect such sophisticated attacks.
1 month ago
Kill Chain
Cyberattacks on U.S. Fuel Tank Monitoring Systems: A 2026 Overview
In June 2026, U.S. critical infrastructure sectors, including energy and transportation, faced cyberattacks targeting internet-exposed Automatic Tank Gauge (ATG) systems. These systems, essential for monitoring fuel and liquid levels, were compromised by threat actors exploiting vulnerabilities such as default passwords and command execution flaws. The attackers manipulated system settings, altered tank readings, and disabled alerts, posing significant operational and safety risks. In response, agencies like CISA, NSA, and FBI issued joint advisories urging organizations to secure ATG systems by removing them from public internet access, enforcing strong credentials, and applying necessary patches. This incident underscores the escalating threat to industrial control systems and the urgent need for enhanced cybersecurity measures to protect critical infrastructure from sophisticated cyber threats.
1 month ago
Kill Chain
Over 900 US Gas Station Tank Gauge Systems Exposed to Cyberattacks
In June 2026, over 900 Automatic Tank Gauge (ATG) systems across the United States were found exposed online, making them vulnerable to cyberattacks. ATG systems are critical for monitoring fuel and chemical storage tanks in various sectors, including energy and transportation. Threat actors exploited security flaws such as hardcoded credentials and authentication bypasses to gain unauthorized access, potentially leading to operational disruptions and safety hazards. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/over-900-us-gas-station-tank-gauge-systems-exposed-to-attacks/amp/?utm_source=openai)) This incident underscores the growing threat to critical infrastructure from cyberattacks targeting industrial control systems. Organizations must prioritize securing internet-exposed devices to prevent similar vulnerabilities from being exploited in the future.
1 month ago
Kill Chain
Critical Vulnerability in ABB's PPT30 Operating System: CVE-2025-11482
On May 26, 2026, ABB disclosed a vulnerability (CVE-2025-11482) in its PPT30 Operating System versions prior to 1.8.0. This flaw resides in the OPC-UA Server component, where an unauthenticated attacker can exploit resource allocation issues to cause a denial-of-service condition, rendering the server unresponsive and disrupting industrial control processes. The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high severity level. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-11482?utm_source=openai)) The disclosure underscores the critical need for timely patching in industrial control systems to prevent potential operational disruptions. Organizations are advised to upgrade to version 1.8.0 or later and implement network segmentation to mitigate risks associated with this vulnerability. ([feed.craftedsignal.io](https://feed.craftedsignal.io/briefs/2026-05-abb-ppt30-cve-2025-11482/?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerability in Hitachi Energy's MACH HiDraw: CVE-2026-7310
In May 2026, a heap-based buffer overflow vulnerability (CVE-2026-7310) was identified in the XML parser functionality of Hitachi Energy's MACH HiDraw versions up to 9.22. An authenticated user with local access could exploit this flaw using a specially crafted XML file, leading to memory corruption and potential arbitrary code execution. Successful exploitation could result in application crashes (denial of service) and compromise the confidentiality and integrity of the affected system. This incident underscores the critical importance of securing industrial control systems against local threats. As cyberattacks targeting infrastructure components become more sophisticated, organizations must prioritize timely vulnerability management and implement robust security measures to protect against potential exploits.
1 month ago
Kill Chain
Critical Vulnerability in NAVTOR NavBox Exposes Maritime Operational Data
In March 2026, a critical vulnerability (CVE-2026-2754) was identified in NAVTOR's NavBox version 4.12.0.3, a maritime connectivity device widely used for managing navigation data and ship-shore communications. The flaw allowed unauthenticated remote attackers to access sensitive configuration and operational data through exposed HTTP API endpoints on TCP port 8080. Exploitation of this vulnerability could lead to unauthorized retrieval of internal network parameters, including ECDIS and OT information, device identifiers, and service status logs, posing significant risks to vessel operations and security. This incident underscores the growing cybersecurity challenges in the maritime industry, especially as operational technology systems become increasingly interconnected. The exposure of critical navigation and operational data highlights the urgent need for robust security measures and regular vulnerability assessments to protect against potential cyber threats targeting maritime infrastructure.
1 month ago
Kill Chain
CISA Issues Warning on Cyberattacks Targeting Fuel Tank Monitoring Systems
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, NSA, and Department of Energy, issued a warning about cyberattacks targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across critical infrastructure sectors. Attackers exploited vulnerabilities such as authentication bypasses, hardcoded credentials, and command-execution flaws to gain unauthorized access, allowing them to alter network settings, tank volumes, and pump controls. This manipulation could disable alerts and hinder operators from accurately monitoring tank levels, increasing the risk of leaks or equipment failures. This incident underscores the growing threat to operational technology (OT) systems within critical infrastructure. The exploitation of ATG systems highlights the need for enhanced cybersecurity measures, including restricting internet exposure, implementing strong authentication protocols, and applying timely security updates to prevent unauthorized access and potential operational disruptions.
1 month ago
Kill Chain
Urgent Advisory: Securing Automatic Tank Gauge Systems Against Cyber Threats
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with multiple federal partners, issued an urgent advisory regarding active cyberattacks targeting Automatic Tank Gauge (ATG) systems across the United States. These systems, integral to monitoring fuel storage tanks in sectors such as Energy, Chemical, Food and Agriculture, and Transportation, were found to be vulnerable due to internet exposure and weak authentication mechanisms. Threat actors exploited these weaknesses to gain unauthorized access, potentially allowing them to manipulate tank levels, disable alarms, and disrupt operations. While no physical damage was reported, the incidents underscored significant cybersecurity gaps in critical infrastructure. ([infoodandfuel.org](https://www.infoodandfuel.org/news/cybersecurity-alert-automatic-tank-gauge-systems-targeted?utm_source=openai)) This advisory highlights the escalating threat landscape for operational technology (OT) systems, emphasizing the need for immediate action to secure ATG systems. The incidents serve as a stark reminder of the vulnerabilities present in internet-exposed OT devices and the potential for malicious actors to exploit these weaknesses to disrupt essential services.
1 month ago
Kill Chain
MacGregor VDR G4e Vulnerabilities Highlight Maritime Cybersecurity Challenges
In May 2026, multiple critical vulnerabilities were identified in the MacGregor Voyage Data Recorder (VDR) G4e, a maritime device essential for recording navigational and operational data. These vulnerabilities, including the use of default and hard-coded credentials, insufficiently protected passwords, and improper access controls, could allow unauthorized attackers to gain administrator access to the device. Such exploitation poses significant risks, including unauthorized data access, manipulation, or deletion, potentially compromising maritime safety and incident investigations. This incident underscores the pressing need for enhanced cybersecurity measures in maritime systems. As vessels increasingly integrate networked technologies, the attack surface expands, making it imperative to address security flaws promptly. The vulnerabilities in the VDR G4e highlight the broader challenge of securing critical infrastructure against evolving cyber threats.
1 month ago
Kill Chain
Critical Security Flaws Discovered in XCharge C6 EV Chargers
In May 2026, multiple critical vulnerabilities were identified in XCharge's C6 electric vehicle charging controllers, including CVE-2026-9037, CVE-2026-9038, and CVE-2026-9039. These flaws could allow attackers to gain administrative rights or execute unauthorized code on affected devices. The vulnerabilities encompass issues such as unverified firmware updates, stack-based buffer overflows, and insecure default configurations. Exploitation of these vulnerabilities could lead to significant control over critical infrastructure in transportation systems worldwide. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-xcharge-c6-ev-chargers-have-3-critical-flaws-cvss-9-8.420545/?utm_source=openai)) The increasing integration of IoT devices in critical infrastructure highlights the urgency of addressing such vulnerabilities. Ensuring robust security measures and timely updates is essential to prevent potential disruptions and maintain the integrity of essential services.
1 month ago
Kill Chain
Critical Vulnerability in ABB Terra AC Wallbox Chargers: CVE-2025-5517
In October 2025, ABB disclosed a heap-based buffer overflow vulnerability (CVE-2025-5517) affecting multiple models of its Terra AC wallbox electric vehicle chargers. This flaw could allow attackers to execute arbitrary code, cause denial-of-service conditions, or gain unauthorized access. Exploitation requires either a man-in-the-middle position with unencrypted communication or a compromised Charging Station Management System (CSMS). ABB has released firmware updates to address this issue and recommends users update their devices promptly. This incident underscores the critical importance of securing industrial control systems, especially as electric vehicle infrastructure becomes more widespread. Organizations should ensure encrypted communications and regularly update firmware to mitigate such vulnerabilities.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports