The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Pwn2Own Automotive 2026: Hackers Expose Record 76 Zero-Days in Cars, Chargers & Tesla
Between January 21–23, 2026, the Pwn2Own Automotive competition in Tokyo saw security researchers demonstrate a record-breaking 76 zero-day vulnerabilities across in-vehicle infotainment systems (IVIs), electric vehicle chargers, and automotive operating systems, including high-profile exploits against Tesla, Alpitronic, Autel, Kenwood, and other leading manufacturers. Teams leveraged physical and remote attack vectors, with notable attacks including USB-based chaining to breach Tesla’s infotainment system. The event awarded $1,047,000 in prizes, underscoring significant risks within connected automotive infrastructure. Vendors now have 90 days to issue security patches before public disclosure. This incident highlights a concerning rise in exploitable vulnerabilities within rapidly digitalizing automotive ecosystems. As vehicles integrate more software-driven services and connected devices, adversaries and researchers alike are increasingly shifting focus toward automotive cyberattacks—driving new urgency for robust segmentation, secure update mechanisms, and continuous monitoring.
8 months ago
Kill Chain
Pwn2Own Automotive 2026: 29 Zero-Days Unmasked in Next-Gen Vehicle Tech
At Pwn2Own Automotive 2026 in Tokyo, security researchers exploited 29 zero-day vulnerabilities on the second day alone, targeting fully patched electric vehicle (EV) chargers, in-vehicle infotainment systems (IVI), and automotive operating systems. Over $439,000 in prizes was awarded for these findings, impacting vendors like Phoenix Contact, ChargePoint, Grizzl-E, Kenwood, Alpine, and Alpitronic HYC50. Notably, researcher teams used advanced exploit chains to achieve root access, demonstrating how attackers could potentially compromise critical automotive technology with little or no prior warning. The event underscores the growing attack surface in connected vehicles and the persistent risk posed by unreported vulnerabilities. This incident highlights a significant surge in automotive cybersecurity threats, especially as EV and smart vehicle adoption accelerates. The frequency and sophistication of these exploits illustrate the urgency for automakers and suppliers to prioritize vulnerability management, rapid patch deployment, and layered defense strategies to protect both consumer safety and data integrity.
8 months ago
Kill Chain
Siemens 2026 Vulnerability Disclosure: New Multi-CVE Risks in RUGGEDCOM APE1808 Devices
In January 2026, Siemens disclosed multiple security vulnerabilities (including four CVEs: CVE-2025-40891, CVE-2025-40892, CVE-2025-40893, and CVE-2025-40898) affecting its RUGGEDCOM APE1808 devices used in critical manufacturing environments globally. The vulnerabilities include two types of stored cross-site scripting (XSS) and a path traversal flaw, exposing risks such as client-side code execution, privilege escalation, and manipulation of sensitive device configuration. Successful exploitation could enable unauthenticated or authenticated attackers to inject malicious code, alter reports, or compromise system availability, although Siemens’ additional input validation and content security policies restrict some impact scope. The company is working on fix versions and urges customers to apply recommended mitigations and patches promptly. The exposure of critical infrastructure devices to these vulnerabilities highlights the urgent need for robust patch management and network segmentation, especially given the industrial sector’s growing attractiveness to cyberattackers. The incident underscores the rising prevalence of complex, multi-vector attacks targeting operational technology (OT) environments and the increased regulatory pressures demanding enhanced security vigilance and rapid incident reporting.
8 months ago
Kill Chain
Siemens RUGGEDCOM ROS 2025: TLS Input Validation Vulnerability Disrupts Industrial Devices
In December 2025, Siemens disclosed a vulnerability (CVE-2025-40935) affecting multiple RUGGEDCOM ROS devices widely used in industrial control environments. The flaw resides in improper input validation during the TLS certificate upload process, which could allow an authenticated remote attacker to crash and automatically reboot the affected device, causing a temporary denial of service. Siemens promptly released security updates (V5.10.1 or later), and CISA amplified the advisory to increase awareness across critical infrastructure sectors globally. The vulnerability mainly impacts operational continuity, as no data compromise or persistent system access was observed. This incident underscores growing concerns about device-level vulnerabilities in operational technology environments, particularly as attackers increasingly target the industrial sector. The urgency around patching and secure configuration reflects an industry-wide shift toward defense-in-depth strategies and proactive risk mitigation for critical infrastructure.
8 months ago
Kill Chain
Siemens 2026 TeleControl Server Basic Vulnerability: What Critical Sectors Must Know
In January 2026, Siemens disclosed a critical local privilege escalation vulnerability (CVE-2025-40942) affecting versions of its TeleControl Server Basic deployed widely across sectors such as energy, water, and transportation. The bug, identified as CWE-250 (execution with unnecessary privileges), enables local attackers to escalate privileges and potentially execute arbitrary code with elevated permissions. Siemens attributed the discovery to its ProductCERT and an external researcher, and promptly issued a security update (v3.1.2.4) to remediate impacted installations globally. The vulnerability poses particular risk to critical infrastructure given the prevalence and deployment reach of the affected software. This incident underscores a broader industry concern about securing operational technology (OT) environments, especially as threat actors increasingly focus on exploiting privilege escalation flaws in industrial control systems. The swift vendor response, coupled with government advisories, reflects rising urgency and regulatory pressure to safeguard vital sectors from potentially disruptive attacks.
8 months ago
Kill Chain
Remote Hacking of WHILL Wheelchairs: Unsecured Bluetooth Puts Patient Safety at Risk
In January 2026, cybersecurity researchers revealed significant security flaws in WHILL's electric wheelchairs, which allowed attackers within Bluetooth range to remotely pair with the device due to the absence of authentication controls. This flaw enabled malicious actors to take control of the wheelchair, manipulating its movement, speed settings, and configuration profiles without requiring any credentials or user interaction. CISA subsequently issued an advisory highlighting the risk, underscoring that such vulnerabilities could result in dangerous, unauthorized maneuvers or override critical safety restrictions, potentially jeopardizing user safety and privacy. This incident exemplifies the escalating risk represented by insecure IoT medical devices, especially those operating in public or semi-public settings. With threat actors increasingly targeting Bluetooth-enabled endpoints and the medical IoT landscape expanding rapidly, similar vulnerabilities are likely to be discovered in other transportation and assistive devices, putting regulatory and patient pressures on device manufacturers and healthcare providers.
8 months ago
Kill Chain
How Insider Threats and Malware Breached Rotterdam and Antwerp Ports
Between September 2020 and April 2021, a Dutch national infiltrated IT systems across major European ports, including Rotterdam and Antwerp, by leveraging insider access at a logistics firm. Employees inserted USB sticks laden with malware, providing the hacker with persistent access to sensitive server infrastructure. Through remote access tools, the attacker intercepted data in transit, exfiltrated critical databases, and enabled large-scale smuggling operations—including the undetected import of 210 kg of cocaine—while also attempting extortion and resale of malware. This incident highlights the evolving intersection of cybercrime with organized crime, particularly how threat actors exploit insider vectors to orchestrate large-scale physical and digital breaches. The case underscores urgent regulatory and cyber defense challenges facing port operators and logistics networks globally.
8 months ago
Kill Chain
How a Latvian Insider Hacked an Italian Ferry's IoT Systems in 2025
In December 2025, an Italian ferry operator experienced a significant cybersecurity breach when a Latvian national was arrested for installing malware directly onto the vessel's onboard systems. Unlike a remote attack, the malware was physically introduced, potentially via a compromised insider or unauthorized access point. This compromised the ferry's IoT devices, impacting operational systems and potentially exposing sensitive data in transit. The incident raised immediate safety and privacy concerns and temporarily disrupted critical ferry services, drawing attention to the security of maritime transportation and IoT infrastructure. This event illustrates the mounting risks associated with connected operational technology in critical transportation sectors. As attackers increasingly target IoT and cyber-physical systems — particularly with the rise of insider-enabled methods — organizations must prioritize endpoint hardening, east-west traffic monitoring, and full-stack threat detection to safeguard vital infrastructure.
8 months ago
Kill Chain
Latvian Crew Arrested After Malware Attack on Italian Ferry: 2024 Maritime Cybersecurity Wake-Up Call
In June 2024, French law enforcement arrested two Latvian crew members aboard an Italian passenger ferry, the 'Cruise Bonaria,' after discovering they had installed malware on the ship’s critical systems. The suspects, employed as technicians, reportedly leveraged their privileged access to compromise the vessel’s automation and navigation controls. Investigators believe the malware was capable of allowing remote control over ship operations, raising concerns about the safety of passengers and the secure operation of maritime infrastructure. The incident temporarily disrupted the ferry's operations as authorities worked to contain the threat, analyze the infected systems, and restore normalcy while ensuring no lingering backdoors remained. This incident is a stark reminder of growing cyber risks targeting OT (operational technology) environments in critical transport sectors. The arrest coincides with heightened industry and regulatory attention on supply chain integrity, insider threats, and the urgent need for advanced monitoring and segmentation to protect safety-critical infrastructure.
8 months ago
Kill Chain
Kimsuky Leverages QR Phishing to Spread Android Malware in Fake Delivery App Campaign (2025)
In June 2025, the North Korean threat group Kimsuky launched a sophisticated phishing campaign using QR codes that directed victims to malicious websites impersonating South Korean logistics giant CJ Logistics. Unsuspecting users who scanned the QR codes and interacted with fake prompts were tricked into downloading and executing the DocSwap Android malware. The malware enabled unauthorized access to sensitive device data and communications, potentially allowing attackers to conduct surveillance and lateral movement within enterprise environments. The incident highlights the versatility of Kimsuky’s tactics and the growing risk to mobile users targeted via supply-chain or delivery-themed phishing. Kimsuky's campaign reflects a broader industry-wide uptick in mobile phishing and social engineering attacks that leverage QR codes and trusted brands. This case demonstrates how advanced persistent threat actors are pivoting to circumvent traditional detection, pushing organizations to adopt holistic mobile and endpoint security strategies.
8 months ago
Kill Chain
Unisoc Vehicle Modem Breach Exposes Automotive Risks in 2024
In 2024, security researchers uncovered a critical hardware and firmware vulnerability (CVE-2024-39432, CVE-2024-39431) affecting Unisoc UIS7862A modems widely used in modern vehicle head units. Attackers exploited a stack-based buffer overflow in the 3G RLC protocol to achieve unauthenticated remote code execution on the modem, bypassing standard mobile network security. Through this initial access, researchers leveraged hardware vulnerabilities to pivot laterally within the SoC, ultimately gaining privileged control over the Android Application Processor and demonstrating full system compromise—including running arbitrary code on the vehicle's infotainment system. This exposure places vehicle safety, user data privacy, and potentially road safety at significant risk. The incident highlights the urgent and real-world impact of modem and embedded system vulnerabilities as vehicles become increasingly connected. With the proliferation of IoT in critical and mobile environments, attackers are targeting lower-level protocols and hardware integration points, complicating detection and remediation while amplifying the severity of breaches.
8 months ago
Kill Chain
CISA Flags Exploited Vulnerability in Sierra Wireless AirLink ALEOS (CVE-2018-4063)
On December 12, 2025, CISA added CVE-2018-4063, a vulnerability impacting Sierra Wireless AirLink ALEOS, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. This vulnerability allows unrestricted upload of potentially malicious files, granting attackers the ability to gain remote control over affected network devices. Such vulnerabilities in network infrastructure expose organizations—including federal agencies—to heightened risks of unauthorized access, lateral movement, and disruption of operations. Federal Civilian Executive Branch agencies are mandated to remediate this issue promptly under Binding Operational Directive 22-01, and CISA encourages all enterprises to act urgently in their own environments. This incident highlights the persistent targeting of edge network infrastructure by threat actors, a trend accelerated by increased reliance on remote and distributed operations. The rapid inclusion of this vulnerability in CISA’s KEV Catalog underscores the growing regulatory and operational pressure on organizations to adopt proactive vulnerability and network segmentation controls.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports