The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Critical Siemens LOGO! 8 Vulnerabilities Put Global ICS at Risk
In November 2025, Siemens disclosed multiple critical vulnerabilities affecting its LOGO! 8 BM Devices, widely deployed in global commercial facilities and transportation systems. Security researchers from Thales Cybersecurity Services Australia identified flaws enabling unauthenticated remote attackers to exploit classic buffer overflow and missing authentication vulnerabilities. These flaws could allow malicious actors to execute arbitrary code, disrupt device operations via denial-of-service, or modify critical device parameters such as IP address and time settings, potentially impacting industrial operations. The incident underscores growing concerns about the security posture of industrial control systems (ICS), as attackers increasingly target remote management features lacking modern authentication. With regulatory scrutiny intensifying and attackers exploiting similar flaws in operational technology, organizations must prioritize ICS security and proactive patch management to reduce exposure.
8 months ago
Kill Chain
How Google Disrupted the Lighthouse Phishing-as-a-Service Operation in 2024
In early 2024, Google’s Threat Analysis Group identified and disrupted the 'Lighthouse' Phishing-as-a-Service (PhaaS) platform, operated by the Smishing Triad criminal group. Lighthouse enabled large-scale, automated phishing campaigns, leveraging SMS-based lures such as unpaid toll notifications and fraudulent package delivery alerts. Attackers used this kit to collect personal and financial data, facilitating credentials theft across multiple geographies. Google’s intervention included technical disruption, reporting malicious domains, and restricting infrastructure linked to the group, limiting subsequent campaign reach and effectiveness. The Lighthouse case highlights a surge in professionally run phishing platforms offered as a service, making sophisticated cybercrime accessible to less-skilled actors. Organizations face heightened risk from increasingly tailored, high-volume phishing attacks exploiting mobile and digital payment ecosystems, warranting ongoing vigilance and stronger controls.
8 months ago
Kill Chain
Google Sues to Dismantle Chinese 'Lighthouse' Phishing Platform Orchestrating US Toll Scams
In June 2024, Google filed a lawsuit to dismantle the 'Lighthouse' phishing-as-a-service (PhaaS) platform operated out of China. Lighthouse enabled global cybercriminals to launch large-scale SMS phishing campaigns, targeting U.S. residents by impersonating the U.S. Postal Service and E-ZPass toll systems. Attackers used automated infrastructure to send convincing text messages, directing victims to fraudulent sites designed to steal credit card and personal information. The campaign resulted in substantial financial losses for consumers and posed major operational risks to U.S. businesses and government agencies. This incident underscores the growing sophistication and accessibility of phishing-as-a-service offerings. With such turnkey solutions readily available on the dark web, attackers are able to scale campaigns with minimal technical skill, escalating both the frequency and severity of credential theft and fraud worldwide.
8 months ago
Kill Chain
CISA Discloses 2025 ICS Vulnerabilities Affecting Critical Infrastructure
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five Industrial Control Systems (ICS) Advisories highlighting significant vulnerabilities impacting multiple vendors: Fuji Electric, Survision, Delta Electronics, Radiometrics, and IDIS. These advisories detail newly identified security issues, including unencrypted communication, improper authentication, and exploitable flaws exposing critical industrial and manufacturing systems to potential attack vectors. While no active exploitation has been publicly reported yet, the disclosed vulnerabilities could allow remote attackers to gain unauthorized access, disrupt operations, or compromise sensitive operational technology environments if left unaddressed. This incident underscores the ongoing and urgent need for proactive vulnerability management and timely patching within ICS environments. With an uptick in vulnerability disclosures and the rising convergence of IT and operational technology, threat actors continue to target unpatched systems in critical infrastructure, amplifying regulatory and business risk for operators in energy, manufacturing, and transportation sectors.
8 months ago
Kill Chain
Survision LPR Cameras: Unauthenticated Access Vulnerability (CVE-2025-12108)
In November 2025, a critical vulnerability (CVE-2025-12108) was disclosed in Survision License Plate Recognition (LPR) cameras, affecting all product versions globally. The flaw stems from missing authentication safeguards, allowing threat actors to remotely access device configuration wizards without credentials. This enables full system compromise—enabling attackers to alter settings, exfiltrate data, or use compromised cameras as entry points for broader attacks on commercial infrastructure. Researchers at Microsec identified the issue and notified stakeholders, prompting immediate remediation efforts and a firmware update (v3.5) from Survision. No confirmed active exploitation has been reported so far. With physical security increasingly integrated with digital management systems, unauthenticated access to surveillance infrastructure exposes environments to cyber-physical risks. The urgency of this disclosure reflects a broader industry trend: attackers actively seek exposed IoT and operational tech lacking basic authentication, prompting rising regulatory scrutiny and heightened compliance mandates.
8 months ago
Kill Chain
Global Airports at Risk: Radiometrics VizAir 2025 Unauthenticated Access Exposes Critical Infrastructure
In November 2025, critical vulnerabilities were publicly disclosed in Radiometrics VizAir, a system widely deployed in global airport transportation infrastructure. The flaws (CVE-2025-61945, CVE-2025-54863, CVE-2025-61956) permit unauthenticated remote attackers to manipulate weather parameters, runway settings, and extract sensitive meteorological data via missing authentication controls and exposed credentials. Exploitation could disrupt airport operations, mislead air traffic control and pilots, and create hazardous flight conditions by disabling vital alerts or injecting false data. The vulnerabilities were reported by a security researcher and were assigned the highest CVSS score of 10.0, reflecting severe risk to operational safety. This incident highlights the escalating risk facing critical infrastructure as attackers increasingly target operational technology systems with low-complexity, high-impact exploits. Given the global reliance on secure flight operations, the breach underscores the urgency for robust authentication, segmentation, and credential management controls across transportation-critical systems.
8 months ago
Kill Chain
Hackers Weaponize Remote Access: Cargo Freight Hijacking Hits Supply Chain
In early 2024, cybercriminals orchestrated a sophisticated supply-chain attack targeting the logistics sector by weaponizing remote monitoring and management (RMM) tools to seize control over freight operations. Exploiting weak access controls and leveraging legitimate remote-access software, attackers infiltrated trucking company systems and issued unauthorized commands, redirecting and physically stealing cargo from moving supply chains. This intrusion resulted in significant operational disruption, untraceable cargo losses, and highlighted severe gaps in network segmentation and east-west traffic security. This attack marks a rise in real-world impacts from IT compromise, illustrating how digital breaches are now driving tangible disruptions across critical infrastructure. The incident underscores escalating regulatory scrutiny and the urgency of advanced security controls to mitigate supply-chain and identity-driven threats.
8 months ago
Kill Chain
Freight Brokers Targeted: Hackers Use RMM Tools in Supply Chain Heist (2024)
In 2024, cybercriminals executed a targeted supply chain attack against freight brokerages and trucking carriers by exploiting phishing emails and malicious links. Attackers used remote monitoring and management (RMM) tools to infiltrate corporate systems, taking control of freight scheduling and logistics platforms. This allowed the threat actors to manipulate cargo shipments, redirect valuable freight, and orchestrate the theft of physical goods. The attack revealed significant gaps in internal segmentation, endpoint security, and east-west visibility, resulting in financial loss, disrupted operations, and reputational impact across the logistics sector. This incident highlights an emerging trend in the weaponization of legitimate IT tools like RMMs for high-value supply chain attacks. As threat actors innovate with living-off-the-land techniques, organizations with critical logistics functions face heightened scrutiny from regulators and renewed urgency to close visibility and segmentation gaps.
8 months ago
Kill Chain
Cybercriminals Infiltrate Logistics & Freight Networks with Malicious Remote Monitoring Tools
In June 2025, cybercriminals aligned with organized crime groups targeted logistics and freight organizations using malicious Remote Monitoring and Management (RMM) tools to infiltrate operational networks. Attackers gained entry via phishing campaigns that tricked employees into deploying unauthorized RMM software, providing persistent remote access for data exfiltration and, in some cases, facilitating theft of high-value cargo. The breach’s impact manifested in compromised shipment scheduling, disrupted fleet operations, and direct financial loss due to fraudulent transactions and stolen cargo. This incident underscores the growing trend of attackers exploiting legitimate IT tools for financial crime, particularly across critical supply chain infrastructure. The prevalence of infostealer malware and stealthy remote-access attacks highlights the urgency for logistics companies to strengthen segmentation, adopt zero trust models, and improve anomaly detection.
8 months ago
Kill Chain
Siemens 2025: Missing Authentication Flaw in TeleControl Server Threatens Industrial Security
In October 2025, Siemens disclosed a critical authentication vulnerability (CVE-2025-40765) affecting TeleControl Server Basic V3.1 (versions before V3.1.2.3). The flaw, rated CVSS 9.3/10, allows remote, unauthenticated attackers to obtain user password hashes and perform authenticated actions on the database service. The vulnerability exposes critical manufacturing infrastructure worldwide, potentially enabling attackers to manipulate or disrupt automated industrial processes by escalating privileges. Siemens and CISA provided immediate mitigations, including patching and network access controls. This incident highlights the persistent risks from missing authentication controls in OT/ICS applications, at a time when remote exploitation targeting critical infrastructure is rapidly rising. The disclosure underscores the importance of timely patch management and network segmentation for industrial environments facing evolving cyber threats.
8 months ago
Kill Chain
Critical Siemens RUGGEDCOM ROS Vulnerabilities Expose Industrial Control Systems in 2025
In October 2025, Siemens disclosed several critical vulnerabilities in its RUGGEDCOM ROS industrial control system devices used globally in critical manufacturing sectors. The flaws include the use of weak cryptographic algorithms, improper handling of exceptional conditions, and protection mechanism failures, making affected devices susceptible to man-in-the-middle attacks, denial-of-service, and potential unauthorized access until device reboot. Exploitation is possible remotely with low complexity, allowing attackers to compromise encrypted communications or persist on non-management interfaces. This incident is especially relevant as supply chains and critical infrastructure increasingly adopt ICS/OT devices that, if not properly secured, expose entire operations to disruption. The persistence of cryptographic weaknesses and the growing sophistication of adversaries underscore the urgent need for robust, up-to-date security controls across the ICS ecosystem.
8 months ago
Kill Chain
Veeder-Root TLS4B Vulnerabilities Expose Energy Sector to Remote Attacks in 2025
In October 2025, critical vulnerabilities were disclosed in the Veeder-Root TLS4B Automatic Tank Gauge System, widely deployed across the global energy sector. Security researcher Pedro Umbelino reported a severe command injection flaw (CVE-2025-58428) in the SOAP-based web service, enabling attackers with valid credentials to execute system-level commands, gain shell access, and potentially move laterally within targeted networks. A second vulnerability (CVE-2025-55067) affects time handling, potentially enabling attackers to cause authentication failures and denial of service by exploiting the Unix epoch rollover issue. Both vulnerabilities are remotely exploitable and threaten operational continuity, device functionality, and network integrity. This incident highlights the growing exposure of industrial control systems to sophisticated, remotely exploitable vulnerabilities. With the energy sector’s increasing reliance on interconnected OT devices, attackers are targeting control interfaces and authentication flaws to achieve deeper network access, reinforcing the urgent need for proactive risk assessments and robust segmentation strategies.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports