The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
CSRF Flaw in OpenPLC_V3 Sheds Light on ICS Software Security Risks
In December 2025, a significant cybersecurity vulnerability was disclosed in OpenPLC_V3, an open-source programmable logic controller widely deployed in critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. Researchers identified a Cross-Site Request Forgery (CSRF) flaw (CVE-2025-13970) that allowed remote, unauthenticated attackers to exploit absent CSRF protections, potentially tricking logged-in administrators into modifying PLC settings or uploading malicious code. This could have caused disruptive or destructive changes to industrial processes. A patch was promptly released via pull request #310, and no evidence of public exploitation has been reported to date. The incident underscores growing threats to industrial control system (ICS) environments, as attackers increasingly target device management interfaces. Regulatory and industry attention remains high, amplifying requirements for strong authentication, network segmentation, and timely vulnerability management for ICS software.
8 months ago
Kill Chain
GrayBravo's CastleLoader: 2025’s Multicluster MaaS Campaign Hits the Logistics Sector
In early to late 2025, the threat actor known as GrayBravo (formerly TAG-150) orchestrated multiple large-scale cyberattacks leveraging CastleLoader, a sophisticated malware loader distributed under a malware-as-a-service (MaaS) model. Four coordinated threat clusters exploited CastleLoader to compromise organizations—particularly in logistics—via phishing, malvertising, and credential harvesting. Attackers used fraudulent accounts on freight-matching platforms to enhance deception, delivering a range of information stealers and remote access trojans, including CastleRAT, RedLine Stealer, and NetSupport RAT. Multi-tiered infrastructure supported resilient operations and facilitated rapid malware deployment, leading to significant business and security disruption for targeted sectors. This incident illustrates an escalating threat trend: advanced MaaS tooling like CastleLoader rapidly proliferates across the cybercrime ecosystem, enabling both seasoned and novice criminals to launch complex, high-impact attacks. The campaign underscores attackers’ increasing industry expertise, adaptation to detection, and exploitation of legitimate business platforms to maximize credibility and impact.
8 months ago
Kill Chain
Broadside Mirai Variant Disrupts Maritime Logistics Sector in 2024
In early 2024, a novel Mirai variant dubbed 'Broadside' was discovered targeting maritime logistics organizations by exploiting a critical command injection flaw in exposed DVR systems. Attackers leveraged this vulnerability to gain persistent access, hijack the devices, and enable lateral movement across internal shipping infrastructure. Once compromised, infected endpoints became part of a botnet, amplifying the campaign’s impact and potentially threatening the operational continuity of global maritime logistics firms. The incident underscores growing risks faced by critical infrastructure sectors as IoT-targeting malware evolves. Mirai and its variants continue to adapt, now seeking less-conventional, specialized equipment in sectors previously overlooked, further complicating defense and regulatory compliance for logistics organizations worldwide.
8 months ago
Kill Chain
Johnson Controls iSTAR Certificate Expiry Flaw: 2025 ICS Vulnerability Explained
In December 2025, Johnson Controls disclosed a critical vulnerability (CVE-2025-61736) affecting its iSTAR series access control panels. The flaw, classified as improper validation of certificate expiration, could cause affected devices to lose communication with their C•CURE Server once the default certificate expires. This disruption, impacting multiple critical infrastructure sectors worldwide, stems from older panel versions utilizing TLS versions prior to 1.2, thereby exposing systems to operational risk and service interruptions. While no public exploitation has been reported, timely mitigation is necessary to prevent outages. This incident highlights the ongoing importance of robust certificate management and timely upgrades in the face of tightening compliance demands and evolving threat landscapes. With operational technology environments increasingly targeted, companies must address outdated encryption protocols to maintain business continuity and regulatory alignment.
8 months ago
Kill Chain
Zenitel TCIV-3+ 2025: Critical ICS Vulnerabilities Enable Remote Attacks
In November 2025, Zenitel disclosed multiple critical vulnerabilities affecting its TCIV-3+ intercom systems, widely deployed in communications-critical infrastructure worldwide. Security researchers from Claroty Team82 identified three separate OS command injection flaws (CVE-2025-64126, -64127, -64128), as well as a severe out-of-bounds write and a reflected cross-site scripting vulnerability. These issues allowed threat actors to remotely execute arbitrary code or cause denial-of-service conditions without authentication, putting operational technology environments at significant risk of disruption or compromise. The vulnerabilities require only low-complexity attacks and no user interaction, amplifying their business impact. This incident highlights the ongoing critical importance of securing industrial control system components exposed to remote exploitation. With threat actors increasingly targeting IoT and OT devices in critical communications infrastructure, these types of vulnerabilities are seeing a dramatic rise globally, and patching urgency is at an all-time high.
8 months ago
Kill Chain
Hacker Exposes 2.3TB in FS Italiane / Almaviva Supply Chain Breach (2024)
In June 2024, a hacker reportedly breached the systems of Almaviva, an Italian IT provider serving FS Italiane Group, the nation’s railway operator. The attacker claimed to have exfiltrated 2.3TB of sensitive corporate data—including documents, contracts, financial information, and communications—garnered by exploiting weaknesses in the supplier’s defenses. Although FS Italiane’s operational technology was not directly compromised, the breach of Almaviva’s infrastructure exposed highly confidential client and business data, raising concerns about third-party risks and data privacy for an array of Italian public sector organizations. This incident highlights a worrying trend of attackers targeting IT services providers as a conduit for large-scale data breaches against critical infrastructure operators. With supply chain vulnerabilities on the rise, organizations must urgently reassess their vendor risk management and network segmentation strategies to prevent similar cascading impacts.
8 months ago
Kill Chain
Scattered Spider Strikes: 2024 Transport for London Cyber Breach
In August 2024, Transport for London (TfL), the body responsible for the UK's capital city transit system, suffered a major cyber incident allegedly orchestrated by members of the Scattered Spider cybercriminal group. Attackers exploited weaknesses in TfL's digital infrastructure to gain unauthorized access, compromising sensitive customer data and disrupting critical services. The breach, which resulted in millions of pounds in damages and regulatory scrutiny, underscored the growing threat that organized cybercriminal gangs pose to public-sector organizations. Two British teenagers have since been arrested and charged, though they have pleaded not guilty in court. This incident highlights the increasing trend of skilled threat actors leveraging sophisticated tactics—such as social engineering and lateral movement—to target essential services. Heightened regulatory pressure and public concern reinforce the urgent need for robust cybersecurity measures across critical infrastructure sectors.
8 months ago
Kill Chain
Supply Chain Breach Hits Italian Rail Group via Almaviva: 2.3TB Data Stolen in 2024
In early June 2024, a threat actor claimed responsibility for breaching the Italian railway operator FS Italiane Group by targeting its IT services provider, Almaviva, resulting in the exfiltration of 2.3TB of sensitive data. The attackers reportedly gained initial access through compromised internal systems and leveraged this infiltration to move laterally, eventually accessing and downloading a vast trove of corporate documents, contracts, and possibly personal information related to employees and customers. The incident exposed Italy's transportation sector to significant risk of espionage, operational disruption, and data loss, igniting widespread concern among critical infrastructure operators. This breach highlights the mounting threat posed by attacks on trusted IT service providers, which serve as gateways to high-value targets. With the proliferation of supply chain and third-party compromise incidents globally, organizations in critical industries must reassess their lateral movement controls, segmentation, and third-party risk governance.
8 months ago
Kill Chain
Iran-Linked Hackers Fuse Cyber Espionage and Kinetic Strikes with Ship AIS Breach
In November 2025, state-sponsored hackers tied to Iran conducted a sophisticated cyber operation targeting maritime assets by mapping Automatic Identification System (AIS) data of commercial ships transiting a volatile region. Advanced reconnaissance and cyber infiltration enabled the attackers to gather real-time ship movement and metadata, informing a coordinated missile strike days later. The breach demonstrated tight integration between cyber-enabled intelligence collection and traditional kinetic attacks, raising alarm within global shipping, defense, and infrastructure sectors. The incident highlights a dangerous evolution in the use of cyber capabilities to directly amplify physical-world conflict and disruption. The rapid fusion of cyber warfare with real-world military operations signals a new era of threats that transcend digital boundaries. As geopolitical tensions escalate and critical infrastructure remains vulnerable, robust cyber and operational defenses are imperative for organizations at risk of becoming targets in hybrid war campaigns.
8 months ago
Kill Chain
How Phishing-as-a-Service Scams Exploited USPS and E-Z Pass: The Lighthouse Case
In 2025, Google filed a legal complaint against a China-based cybercriminal group alleged to have developed 'Lighthouse' Phishing-as-a-Service (PaaS) kits. These kits empower low-skilled actors to execute widespread smishing (SMS phishing) and e-commerce scams by providing templates, domain setup tools, and fake websites mimicking trusted brands such as USPS and E-Z Pass. Victims are lured via texts about overdue fees or package deliveries, redirecting them to realistic phishing sites that harvest credentials and financial information. The campaign leveraged legitimate ad platforms and payment methods, increasing its reach and credibility. The incident underscores the rising threat and sophistication of PaaS offerings, which lower the barrier for cybercrime and accelerate the proliferation of phishing campaigns. As threat actors streamline attack automation and mimic reputable organizations, enterprises must adapt with real-time detection, segmented network defenses, and stronger authentication measures.
8 months ago
Kill Chain
Critical Vulnerabilities in Railway Braking Systems Expose OT Security Gaps
In June 2024, security researchers discovered multiple vulnerabilities in the braking systems of modern trains, revealing that low-cost, readily available hardware could be used to exploit weaknesses in operational technology (OT) environments. Attackers demonstrated that by using items such as recycled cans and basic electronics sourced online, they could manipulate communication between the train conductor's controls and the braking systems. The lack of encrypted traffic and segmentation allowed malicious actors to reroute or interrupt braking commands, posing severe safety and operational risks to critical railway infrastructure. This incident underscores a broader trend of cyber-physical risk in OT systems, where traditional safety assumptions are being undermined by the exposure of legacy protocols and weak internal controls. As rail operators increasingly digitize and connect systems, adversaries have more opportunities to exploit gaps in lateral defenses and traffic security.
8 months ago
Kill Chain
Google Lawsuit Disrupts Lighthouse: Major Blow to Smishing Operations in 2024
In early 2024, Google initiated legal action against the operators behind Lighthouse, an SMS phishing (smishing) platform used to impersonate legitimate services and lure victims into fraudulent payment schemes, such as fake unpaid road tolls. The suspected operators, commonly referred to as the Smishing Triad and believed to be based in China, leveraged the Lighthouse kit and Telegram groups to execute widespread phishing campaigns. Following Google's lawsuit in the Southern District of New York, Lighthouse's infrastructure, Telegram channels, and several associated domains were taken offline, significantly disrupting the group's activities and signaling a major blow to organized SMS phishing at scale. This incident underscores the growing role of civil litigation and collaboration between technology giants and threat intelligence firms in disrupting cybercriminal ecosystems. As smishing attacks rise in sophistication and frequency worldwide, organizations must ensure layered defenses and readiness for increasingly advanced social engineering threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports