The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Critical Bluetooth Vulnerability in Acrisure's KARR Security Systems Exposes Millions of Vehicles
In July 2026, researchers from the University of California, San Diego, identified a critical vulnerability in the KARR Security System, an aftermarket vehicle alarm installed in approximately 2.2 million vehicles across brands like Honda, Toyota, Mazda, Ford, and Jeep. The flaw stemmed from the use of a universal Bluetooth authentication key across all devices, allowing attackers within Bluetooth range to remotely unlock doors, control vehicle functions, and disable engine startup. This vulnerability affected vehicles sold since 2017, many of which had the system installed without owners' active knowledge or subscription. ([malwarebytes.com](https://www.malwarebytes.com/blog/bugs/2026/07/millions-of-cars-could-be-tracked-and-unlocked-by-a-hidden-security-flaw?utm_source=openai)) The incident underscores the growing risks associated with aftermarket automotive security systems, especially those installed by dealerships without stringent security protocols. As vehicles become increasingly connected, the potential attack surface expands, necessitating robust security measures and prompt vulnerability disclosures to protect consumers from unauthorized access and potential theft.
1 month ago
Kill Chain
Critical Bluetooth Vulnerability in KARR Security System Affects Millions of Vehicles
In July 2026, researchers at the University of California, San Diego, identified a critical Bluetooth vulnerability in the KARR Security System, an aftermarket car alarm installed in over 2.2 million vehicles across the United States. This flaw allows attackers within Bluetooth range to unlock doors, disable alarms, control vehicle lights and horns, and even prevent engine startup, all without the owner's knowledge. The vulnerability stems from the use of a universal authentication key stored in plain text within the system's mobile application, making all installed units susceptible to remote exploitation. This incident underscores the growing security risks associated with aftermarket automotive devices, especially those utilizing wireless communication protocols like Bluetooth. As vehicles become increasingly connected, the potential attack surface expands, highlighting the urgent need for robust security measures and regular vulnerability assessments in automotive systems to protect consumers from emerging cyber threats.
1 month ago
Kill Chain
Critical Vulnerability in Watchfire Controller Software: CVE-2026-5846
In July 2026, a critical vulnerability (CVE-2026-5846) was identified in Watchfire Controller Software versions BC550 12.30, BC750 11.33 and 12.35, BC760 12.38 and 13.00, and BC760DC 12.39. This flaw involved the use of hard-coded RSA private keys and corresponding X.509 certificates embedded in the firmware, which could allow malicious actors to deliver unauthorized firmware updates and gain full control over the affected controllers. The vulnerability was reported by James Tillson to CISA, leading to the issuance of security patches by Watchfire to mitigate the risk. The incident underscores the ongoing challenges in securing embedded systems within critical infrastructure sectors such as Commercial Facilities, Critical Manufacturing, Healthcare, and Financial Services. It highlights the necessity for organizations to regularly update and audit their systems to prevent exploitation of such vulnerabilities.
1 month ago
Kill Chain
Critical Vulnerability in NASA's cFS Health & Safety Application: CVE-2026-18064
In July 2026, a critical vulnerability (CVE-2026-18064) was identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application versions up to 7.0.1. This flaw, stemming from an incomplete fix for a previous issue (CVE-2026-15352), allows attackers to trigger a NULL pointer dereference, leading to application crashes and potential denial-of-service conditions. The vulnerability affects systems worldwide, given cFS's deployment across various space missions. ([vulners.com](https://vulners.com/ics/ICSA-26-197-03?utm_source=openai)) This incident underscores the challenges in fully remediating software vulnerabilities and highlights the importance of thorough testing and validation processes. Organizations relying on cFS should prioritize updating to the latest software versions and implement robust monitoring to detect and mitigate potential exploitation attempts.
1 month ago
Kill Chain
CISA's 'CI Fortify' Guidance: Isolating Vital Systems During Cyberattacks
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Australian Cyber Security Centre (ACSC) and other international partners, released the 'CI Fortify – Advice for isolating vital systems' guidance. This document provides critical infrastructure organizations with strategies to isolate essential operational technology (OT) systems from less secure networks during cyber incidents, ensuring the continuity of essential services. The guidance emphasizes proactive planning, including identifying vital systems, documenting network connections, and establishing isolation points to prevent lateral movement by threat actors. The release of this guidance underscores the increasing targeting of critical infrastructure by state-sponsored threat actors and cybercriminals. Recent incidents, such as the prolonged undetected presence of the Chinese Volt Typhoon group in U.S. critical infrastructure networks, highlight the urgent need for organizations to enhance their cyber resilience by preparing to isolate vital systems effectively.
1 month ago
Kill Chain
Enhancing Critical Infrastructure Resilience: CISA's 'CI Fortify' Guidance
On July 28, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with international partners, released the 'CI Fortify – Advice for Isolating Vital Systems' guidance. This document provides critical infrastructure organizations with practical steps to isolate essential operational technology (OT) and supporting systems from other networks during cyber incidents or periods of heightened threat. The guidance emphasizes identifying critical systems, mapping their connections, and implementing effective separation points to ensure continuity of essential services during disruptions. The release of this guidance underscores the increasing cyber threats targeting critical infrastructure sectors. State-sponsored actors and cybercriminals are increasingly focusing on these sectors to conduct espionage or prepare for disruptive cyber activities. Implementing the recommended isolation strategies is vital for organizations to enhance their resilience and maintain operational continuity in the face of evolving cyber threats.
1 month ago
Kill Chain
ShinyHunters Sextortion Email Scam Exploits Leaked Data in July 2026
In July 2026, threat actors exploited email addresses exposed in data breaches attributed to the ShinyHunters extortion group to launch a sextortion email campaign. These emails, falsely claiming to be from ShinyHunters, alleged that recipients' devices were compromised, and demanded $2,000 in Bitcoin to prevent the release of purportedly sensitive information. The campaign utilized data from breaches of companies such as Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. However, investigations revealed no evidence that the senders had actual access to recipients' devices or personal data. This incident underscores the persistent threat posed by cybercriminals repurposing leaked data for malicious activities. Organizations and individuals must remain vigilant against such social engineering tactics, as the misuse of exposed information continues to fuel sophisticated scams aimed at extorting victims.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in MZ Automation's libIEC61850 Library
In July 2026, multiple critical vulnerabilities were identified in MZ Automation's libIEC61850 library, widely used in industrial control systems. These vulnerabilities include stack-based and heap-based buffer overflows, as well as NULL pointer dereferences, which could allow unauthenticated attackers to execute arbitrary code or cause denial-of-service conditions. Affected versions range from v1.0.0 to v1.6.1. ([vuldb.com](https://vuldb.com/cve/CVE-2026-49035?utm_source=openai)) The discovery of these vulnerabilities underscores the ongoing risks in industrial control systems, emphasizing the need for regular security assessments and prompt patching to mitigate potential exploitation.
2 months ago
Kill Chain
Russian Cyberespionage Campaign Exploits Zimbra Vulnerability CVE-2025-66376
In July 2025, a Russian state-sponsored cyberespionage group, identified as CL-STA-1114 (also known as Void Blizzard and LAUNDRY BEAR), initiated a campaign targeting Zimbra webmail users across sectors such as government, defense, transportation, and finance in regions including NATO member states, Ukraine, CIS countries, and Africa. The attackers exploited a zero-click vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), allowing them to inject malicious JavaScript payloads via specially crafted HTML emails. This exploit enabled the exfiltration of sensitive data, including login credentials, email archives, and search histories, without any user interaction. The continued exploitation of CVE-2025-66376 underscores the critical need for organizations to promptly apply security patches and enhance their email security measures. The sophistication of this attack, particularly its zero-click nature, highlights the evolving tactics of nation-state actors and the importance of proactive defense strategies to protect sensitive information.
2 months ago
Kill Chain
Stadler Rail Rejects $12.3M Ransom After Cyberattack
In mid-July 2026, Swiss rail manufacturer Stadler Rail experienced a cyberattack when the Everest ransomware group accessed a data exchange platform shared with one of its suppliers. The attackers demanded a ransom of 10 million Swiss francs (approximately $12.3 million) after obtaining technical information. Stadler's internal IT systems and production operations remained unaffected, and the company refused to pay the ransom, filing a criminal complaint with the Thurgau cantonal police. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors to infiltrate larger organizations. The Everest group's focus on data theft and extortion, rather than traditional ransomware encryption, highlights the evolving tactics of threat actors in the cybersecurity landscape.
2 months ago
Kill Chain
Russian Hackers Exploit IP Cameras to Monitor NATO Military Logistics
In July 2026, Dutch intelligence agencies AIVD and MIVD disclosed that Russian state-backed hackers systematically compromised internet-connected IP cameras across Europe and Ukraine. By exploiting devices with default passwords and outdated firmware, these actors accessed video feeds to monitor military transport routes and weapons shipments bound for Kyiv. In Ukraine, the compromised cameras were used to identify the locations of Ukrainian military personnel, leading to targeted attacks on troops and equipment. This operation highlights the vulnerability of unsecured IoT devices and their potential exploitation for espionage and military purposes. The incident underscores the critical need for robust cybersecurity measures, especially for devices connected to the internet. Organizations are urged to secure IP cameras by updating firmware, changing default credentials, and restricting public internet access to prevent unauthorized surveillance and data breaches.
2 months ago
Kill Chain
HelloNet Campaign: A Sophisticated Supply Chain Attack on Russian Organizations
In July 2026, an advanced threat actor initiated a sophisticated cyber-espionage campaign, dubbed 'HelloNet,' targeting Russian organizations across government, energy, transport, education, and logistics sectors. The attackers exploited the update mechanism of ViPNet, a widely used Russian information-security product suite, by placing a malicious DLL file within the local ViPNet Update System directory. This file, named 'wtsapi32.dll' or 'HelloInjector,' was sideloaded at system startup via the legitimate 'itcsrvup64.exe' executable. Once executed, HelloInjector injected a payload into the 'svchost.exe' process, granting elevated privileges and persistence across reboots. Subsequent payloads, including 'HelloProxy' and 'HelloExecutor,' facilitated command execution, network reconnaissance, and data exfiltration. Kaspersky researchers tentatively attributed the campaign to an unidentified Chinese-speaking advanced persistent threat (APT) group, based on limited evidence such as an unused string referencing the Chinese website 'sina.com' and a malware download mirror hosted by the University of Science and Technology of China. However, this attribution remains low-confidence, with the possibility of a false flag operation not being ruled out. The campaign underscores the critical need for organizations to monitor systems running ViPNet software, particularly traffic on ports 5003, 5060, and 443, to detect and mitigate potential threats.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports