Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Transportation

Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.

195 threat reports
Page 2 of 17
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Transportation Threat Reports

Showing 13–24 / 195 reports
Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks
Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks

In October 2026, CISA disclosed critical vulnerabilities in Monta's electric vehicle charging platform affecting all versions of monta.app. The vulnerabilities include missing authentication for WebSocket endpoints (CVE-2026-95102), lack of rate limiting enabling brute-force attacks (CVE-2026-97363), insufficient session management (CVE-2026-97212), and publicly exposed charging station credentials (CVE-2026-93474). These flaws allow attackers to impersonate charging stations, gain unauthorized administrative control, disrupt charging services, and potentially compromise the entire EV charging network infrastructure. The vulnerabilities affect critical energy and transportation infrastructure deployed worldwide. This incident highlights the growing cybersecurity risks in smart city and critical infrastructure as IoT devices proliferate without adequate security controls. With electric vehicle adoption accelerating globally and charging networks becoming essential infrastructure, these vulnerabilities expose systemic weaknesses in industrial control systems that could enable nation-state actors or cybercriminals to disrupt transportation and energy systems at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerabilities in Armatura One Expose Global Industrial Control Systems
Critical Vulnerabilities in Armatura One Expose Global Industrial Control Systems
Government Administration1 month ago

Critical Vulnerabilities in Armatura One Expose Global Industrial Control Systems

CISA released advisory ICSA-26-274-01 on October 1, 2026, detailing five critical vulnerabilities in Armatura LLC's Armatura One industrial control system. The vulnerabilities include a critical deserialization flaw (CVE-2023-46604) enabling unauthenticated remote code execution, hardcoded cryptographic keys, default database passwords, and credential logging issues. These flaws affect versions prior to 4.7.2 globally and 4.6.1 in the USA, impacting critical infrastructure sectors including energy, manufacturing, and transportation systems worldwide. These vulnerabilities highlight the persistent security challenges in operational technology environments where legacy authentication models and poor credential management create attack vectors for ransomware groups and nation-state actors targeting critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Airlines/Aviation1 month ago

Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities

In September 2026, South Africa's Air Traffic and Navigation Services (ATNS) discovered ransomware-linked malware in operational technology networks supporting weather services for air traffic control systems managing 10% of global airspace. The attack affected facilities at Port Elizabeth Airport and potentially East London Airport, with preliminary investigations revealing data exfiltration to external IP addresses located in China. While internal teams implemented containment measures and malware removal, ATNS issued a request for comprehensive cyber-forensic investigation services to determine the full extent of compromise and remaining risks. This incident highlights the accelerating threat landscape targeting critical aviation infrastructure, with ransomware attacks on the aviation sector surging sixfold in 2025. The targeting of air traffic control systems represents a concerning escalation in attacks against operational technology environments that directly impact public safety and global transportation networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Infrastructure Under Siege: Lantronix G520 Gateway Vulnerabilities Expose Global Risk
Critical Infrastructure Under Siege: Lantronix G520 Gateway Vulnerabilities Expose Global Risk
Utilities1 month ago

Critical Infrastructure Under Siege: Lantronix G520 Gateway Vulnerabilities Expose Global Risk

In September 2026, CISA disclosed critical vulnerabilities (CVE-2026-84409 and CVE-2026-91191) affecting Lantronix G520 Series Cellular Gateways used in critical infrastructure worldwide. CVE-2026-84409 involves cross-site scripting through unencrypted update metadata retrieval, while CVE-2026-91191 stems from improper cryptographic signature verification where the production private key was exposed in the SDK. These vulnerabilities allow attackers to execute arbitrary code with root privileges, compromising devices deployed across transportation, energy, and water systems globally. These vulnerabilities highlight the growing threat to industrial control systems as cellular gateways become prime targets for nation-state actors and ransomware groups seeking to disrupt critical infrastructure operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Vulnerabilities in Toptech TMS7 and TopHAT Threaten Global Critical Infrastructure
Critical Vulnerabilities in Toptech TMS7 and TopHAT Threaten Global Critical Infrastructure
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerabilities in Toptech TMS7 and TopHAT Threaten Global Critical Infrastructure

CISA disclosed critical vulnerabilities in Toptech Systems' TMS7 and TopHAT industrial control systems affecting version 7.6.3, with the most severe vulnerability (CVE-2026-71379) scoring a perfect CVSS 10.0. The vulnerabilities include unauthenticated database access, unrestricted file uploads, multiple SQL injection flaws, session fixation, eval injection, and cross-site scripting. These systems are deployed worldwide across critical infrastructure sectors including energy, chemical, and transportation. Successful exploitation could allow attackers to access critical data, execute arbitrary code, and compromise entire industrial networks. This disclosure highlights the growing cybersecurity risks facing industrial control systems as critical infrastructure becomes increasingly digitized and interconnected, making them attractive targets for nation-state actors and cybercriminals seeking to disrupt essential services.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
Transportation1 month ago

Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis

In September 2026, CISA disclosed critical vulnerabilities in Viidure's Dashcam Android Application affecting versions up to 3.3.1.260403. Two severe flaws were identified: CVE-2026-94204, a cloud storage misconfiguration with public-read permissions exposing all user data and system files globally, and CVE-2026-96587, hardcoded credentials embedded in the application code providing full platform access. The vulnerabilities achieved CVSS scores of 7.5 and 10.0 respectively, with potential for complete platform compromise including unauthorized access to live dashcam footage, user records, firmware files, and critical system operations. Viidure failed to respond to CISA's coordination attempts, leaving users without vendor-provided remediation. This incident highlights the growing threat of cloud misconfigurations in IoT ecosystems, particularly as connected vehicle technologies proliferate across transportation infrastructure. The combination of exposed cloud storage and embedded credentials represents a concerning pattern in mobile application security that threatens critical infrastructure sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Public Safety1 month ago

Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover

A critical command injection vulnerability (CVE-2026-22755) with a CVSS score of 10.0 has been discovered in VIVOTEK camera firmware affecting 38+ camera models across V Series, C Series, S Series, Dome, Panoramic, and Bullet product lines. The vulnerability allows remote attackers to achieve command execution with root privileges on affected devices without authentication, leading to complete system compromise. CISA published this advisory after discovering a public proof of concept exploit, indicating the vulnerability is actively exploitable in the wild. VIVOTEK has released firmware updates to address the issue and recommends immediate patching of all affected camera systems. This vulnerability affects critical infrastructure sectors including government facilities, transportation systems, energy, and financial services deployed worldwide, with VIVOTEK being a Taiwan-based manufacturer of network surveillance equipment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks
Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks
Telecommunications1 month ago

Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks

A critical vulnerability (CVE-2026-96274) was discovered in Baicells Nova 430H eNodeB equipment that allows unauthenticated attackers within radio range to cause denial-of-service conditions. The flaw stems from improper validation of uplink messages during connection setup, where malformed NAS payloads can trigger shutdowns of signaling associations between the eNodeB and core network. This results in temporary service disruptions affecting cellular connectivity until systems re-establish their connections. Baicells has not responded to CISA's mitigation requests, leaving users without vendor support for this high-severity issue. This vulnerability highlights the growing security risks in critical communications infrastructure, particularly as 5G networks expand globally and nation-state actors increasingly target telecommunications equipment for disruption and espionage campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege
Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege
Automotive1 month ago

Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege

Times Car, Japan's major vehicle rental and mobility service, confirmed a cyberattack in September 2026 that compromised 6.6 million user accounts. The breach, discovered on September 25, exposed personal information including names, addresses, driver's license data, and identity verification documents of current and former members. While passwords were stored in encrypted form and credit card information remained unaffected, the incident represents one of Japan's largest automotive sector data breaches. Times Car blocked unauthorized access on September 26 and initiated forensic investigation with external experts while maintaining normal service operations. This incident highlights the escalating threat to mobility and automotive platforms as digital transformation accelerates across transportation sectors, with attackers increasingly targeting customer databases containing sensitive identity verification documents and location data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities
Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities
Transportation1 month ago

Keio Corporation Ransomware Attack Exposes Critical Infrastructure Vulnerabilities

In September 2026, Keio Corporation, a major Japanese railway operator with $2.6 billion annual revenue, suffered a ransomware attack that disrupted its business systems over the weekend. The attack primarily impacted the company's hospitality division including 25 hotels, affecting payment systems and customer-facing services, while railway operations remained unaffected. Keio immediately shut down its network to prevent further damage and engaged law enforcement and external security experts for investigation. The incident occurred alongside a separate breach at Tokyo Metro, raising concerns about coordinated attacks on Japanese transportation infrastructure. This incident highlights the growing threat to critical transportation infrastructure and the potential for ransomware groups to target hospitality and payment systems within larger organizations, demonstrating the need for segmented security architectures.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
2025 Industrial Automation Breach Exposes Critical Infrastructure Through Supply Chain Attack
2025 Industrial Automation Breach Exposes Critical Infrastructure Through Supply Chain Attack
Utilities1 month ago

2025 Industrial Automation Breach Exposes Critical Infrastructure Through Supply Chain Attack

Between March and April 2025, foreign cyber actors infiltrated a U.S. industrial automation solutions company providing SCADA programming and system integration services to critical infrastructure entities including power utilities and transportation systems. The attackers conducted reconnaissance using search terms like 'customers' and 'SCADA,' subsequently creating nine ZIP files containing approximately 800 exfiltrated files including customer SCADA information, ICS device specifications, and operational schematics. This supply chain compromise exposed sensitive infrastructure data that could enable future disruptive attacks against operational technology environments. This incident highlights the growing threat to critical infrastructure through third-party integrator compromises, occurring amid increased focus on ICS security following recent nation-state campaigns targeting operational technology systems and growing regulatory emphasis on supply chain risk management in critical sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover
Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover
Transportation1 month ago

Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover

CISA published advisory ICSA-26-267-01 detailing 13 critical vulnerabilities in Botslab G980H dashcams affecting two firmware versions worldwide. The vulnerabilities include authentication bypass, session hijacking, predictable session identifiers, hard-coded credentials, unencrypted communications, and path traversal flaws with CVSS scores up to 8.8. Attackers with adjacent network access can gain unauthorized device control, access sensitive recordings and location data, intercept WiFi credentials, and potentially install malicious firmware. Botslab has not responded to CISA's coordination efforts, leaving users without official patches or remediation guidance. This incident highlights the growing security risks in IoT devices within transportation infrastructure, as dashcams increasingly capture sensitive location data and connect to corporate networks through fleet management systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports