Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Utilities

Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.

536 threat reports
Page 1 of 45
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Utilities Threat Reports

Showing 1–12 / 536 reports
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
Oil/Energy/Solar/Greentech2 days ago

CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks

In November 2026, CISA published ICS Advisory ICSA-26-307-01 disclosing two critical vulnerabilities (CVE-2026-63017 and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center, an industrial control system platform widely deployed in critical manufacturing and energy sectors worldwide. CVE-2026-63017, rated CVSS 9.4, allows a low-privileged authenticated user to access administrator-restricted resources via incorrect authorization (CWE-863). CVE-2026-63774, also rated CVSS 9.4, enables authenticated users to execute unauthorized SQL commands through the report designer due to insufficient input validation (CWE-89). Both vulnerabilities require adjacent network access and affect versions spanning the 2020, 2024, and 2026 product lines. Successful exploitation could expose sensitive operational data, manipulate ICS database records, and disrupt energy grid management functions. These vulnerabilities are significant because they target ICS/OT environments in energy and critical manufacturing—sectors already under elevated threat from nation-state and ransomware actors. The combination of privilege escalation and SQL injection within a single OT platform dramatically lowers the bar for insider threats and lateral movement, reflecting a broader trend of attackers targeting operational technology management layers rather than field devices alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
Industrial Automation5 days ago

CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes

In late October 2026, active exploitation of CVE-2026-58115 (CVSS 10.0) was confirmed against Siemens SIMATIC IoT2050 Advanced devices running Node-RED. Unauthenticated remote attackers delivered multi-stage payloads via malicious Node-RED flows, using wget and curl to pull Linux botnet binaries from attacker-controlled servers at 85.215.73[.]250 and 45.194.90[.]57. Implants were disguised as kernel worker threads and stored in memory-backed paths to evade detection. A persistent HTTP backdoor endpoint was also installed, enabling arbitrary command execution even after reboots wiped in-memory implants, compromising operational technology environments at maximum privilege. This incident underscores an accelerating threat to OT and industrial IoT infrastructure, where legacy authentication gaps and internet-exposed management interfaces continue to be weaponized. As critical infrastructure sectors face increasing regulatory scrutiny under frameworks such as NIST CSF 2.0 and IEC 62443, the exploitation of unauthenticated remote code execution vulnerabilities in industrial devices signals a dangerous convergence of IT and OT attack surfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices

In October 2026, CISA republished a Hitachi Energy PSIRT advisory disclosing two high-severity vulnerabilities in the TRO600 series of industrial communication products deployed globally across energy-sector critical infrastructure. CVE-2026-10756 (CVSS 3.1: 7.5) allows an authenticated attacker to abuse port-forwarding to bypass network access restrictions and reach localhost-bound services, enabling unauthorized access to sensitive functionality and confidential data. CVE-2026-106087 (CVSS 4.0: 8.7) is an unauthenticated arbitrary file read flaw that exposes configuration files and credential data without any prior authentication, creating a direct path to credential harvesting and follow-on compromise. Hitachi Energy recommends immediate upgrade to version 9.2.2.1. These vulnerabilities are significant because TRO600 devices sit at the operational technology edge of energy grids and substations worldwide. The combination of an unauthenticated file-read and an authenticated lateral-access bypass mirrors the attack chain patterns observed in recent state-sponsored campaigns targeting energy infrastructure, reinforcing the urgency of ICS/OT network segmentation and encrypted-traffic enforcement.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure

In October 2026, CISA published ICS Advisory ICSA-26-302-03 disclosing two high-severity vulnerabilities in Hitachi Energy's CoreTec4 and CoreTec5 industrial cybersecurity appliances, which are widely deployed in global energy infrastructure. CVE-2026-13162 (CVSS 7.5) is an OS command injection flaw in the configuration daemon's timezone handler that allows an authenticated low-privileged user to execute arbitrary system commands with full device control. CVE-2026-43284 (CVSS 8.8) is a Linux kernel IPsec ESP subsystem write-what-where flaw enabling local privilege escalation to root by crafting malicious ESP packets that overwrite privileged OS binaries in memory. Both vulnerabilities affect CoreTec versions 3.4.0 and prior, with remediation requiring upgrade to CoreTec5 version 5.0.0. These disclosures arrive as threat actors, including nation-state groups, intensify targeting of operational technology environments in the energy sector. The combination of an authenticated remote command injection and a kernel-level privilege escalation in a single OT security appliance creates a chained exploitation path that could grant adversaries persistent root access to devices governing critical energy systems, elevating risk across the entire OT kill chain.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure
Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure
Telecommunications1 week ago

Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure

Chinese state-sponsored threat actor Volt Typhoon has been operating a covert relay infrastructure called 'Silent Train' for at least three years, exploiting at least four zero-day vulnerabilities—including CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875/8876 in N-able N-central, and CVE-2024-39717 in Versa Director—to target telecommunications firms, government agencies, defense contractors, utilities, and critical infrastructure providers primarily across California, Texas, and Hawaii. The framework chains compromised SOHO routers and IoT devices as ephemeral relays, with operators erasing all tooling within eight hours of session completion to evade forensic detection while maintaining persistent access to high-value enterprise systems for one to three months. Silent Train represents a significant evolution beyond Volt Typhoon's disrupted KV-Botnet infrastructure, demonstrating the group's adaptive capacity and sustained intent to pre-position within U.S. critical infrastructure ahead of potential geopolitical conflict. The campaign's hybrid use of disposable relays and retained enterprise footholds signals a maturing operational playbook that poses escalating risk to any organization managing edge networking, SD-WAN, or centralized IT management platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook
When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook
Utilities1 week ago

When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook

Between July and October 2025, the China-linked threat actor Storm-2603 deployed Warlock ransomware against at least four organizations—including a water utility, a telecom provider, a regional government body, and a university—across Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America. The attackers exploited unpatched on-premises Microsoft SharePoint vulnerabilities, including flaws disclosed and patched in July 2025, to plant web shells and spend nine days establishing persistence, mapping the domain, creating rogue service accounts, and staging lateral movement. In the final phase, a purpose-built tool disabled endpoint security software across roughly 40 hosts within two hours, after which Warlock ransomware was deployed via SYSVOL replication to at least 33 domain-joined hosts. This incident exposes a systemic assumption embedded in most security budgets: that detection and response tools will be operational when an attack arrives. Storm-2603's deliberate kill-before-encrypt playbook invalidates that assumption, demanding a shift toward network-layer and memory-resident controls that act before an adversary accumulates the privileges needed to silence sensors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now
SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now
Government Administration2 weeks ago

SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now

Since August 2024, the SafePay ransomware group has breached more than 600 critical infrastructure organizations across North America, South America, Europe, and Australia. Operating as a private, affiliate-free group, SafePay gains initial access through credential exposure, brute-force attacks, and exploitation of VPN edge devices—particularly leveraging Mullvad VPN IP addresses and phished account profiles. Once inside, actors perform double-extortion: exfiltrating sensitive data before encrypting systems, then threatening public release if ransoms go unpaid. Recovery is further undermined by deliberate deletion of shadow copies and wiping of network-attached storage backups. A joint advisory from CISA, FBI, USSS, and international partners was published October 21, 2026. SafePay has rapidly filled the vacuum left by dismantled ransomware operations such as BlackCat (ALPHV) and LockBit, emerging as one of the most active ransomware threats globally. With valid credentials bypassing prevention controls in 63% of post-access scenarios, the incident underscores escalating risks tied to identity abuse, VPN exploitation, and insufficient lateral movement controls across hybrid and cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching
Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching
Government Administration2 weeks ago

Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching

In October 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, including four chained flaws in Plex Media Server collectively dubbed Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Security researchers confirmed that threat actors are actively weaponizing these vulnerabilities to achieve unauthenticated remote code execution, deploying cryptocurrency miners and proxy malware. Additionally, a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) is being exploited via ClickFix campaigns, and a command injection bug in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) has been confirmed exploited. FCEB agencies face mandatory patch deadlines of October 23 and November 3, 2026. The Plex2Shell campaign exemplifies an accelerating trend of attackers chaining medium-severity vulnerabilities to achieve high-impact outcomes such as cryptojacking and proxy deployment. The breadth of affected vendors—media servers, industrial software, and web application firewalls—underscores that no technology category is immune, and that delayed patching in hybrid cloud environments creates critical exposure windows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AI Breached an OT Network and Moved a Robotic Arm in 16 Minutes—Here's What That Means for Critical Infrastructure
AI Breached an OT Network and Moved a Robotic Arm in 16 Minutes—Here's What That Means for Critical Infrastructure
Industrial Automation2 weeks ago

AI Breached an OT Network and Moved a Robotic Arm in 16 Minutes—Here's What That Means for Critical Infrastructure

In October 2026, Booz Allen Hamilton published findings from controlled laboratory testing in which frontier commercial AI models successfully compromised a mock OT/ICS environment in as little as 16 minutes. Starting at the perimeter firewall, the AI agent traversed IT network layers, identified misconfigured OT devices, penetrated a SCADA system, and ultimately actuated a robotic arm—achieving all eight predefined attack objectives. The speed of compromise was the critical finding: security-through-obscurity assumptions that have long protected OT environments were rendered ineffective by AI's ability to rapidly map unfamiliar industrial networks and chain exploits autonomously. This research signals a structural shift in OT/ICS threat modeling. AI-augmented attacks democratize adversarial capability, eliminating the need for deep OT domain expertise. With 70% of industrial operators already integrating AI into operations, the attack surface is expanding simultaneously from within and without, compressing defender response windows to sub-human timescales.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
Oil/Energy/Solar/Greentech2 weeks ago

When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform

In October 2026, CISA published ICS Advisory ICSA-26-280-01 disclosing seven vulnerabilities in CISA Malcolm, the agency's own open-source network traffic analysis and ICS security monitoring platform. Reported by Seth Grover of Idaho National Laboratory, the flaws span authentication bypass via nginx regex spoofing (CVE-2026-107336), hardcoded credentials enabling direct Arkime backend access (CVE-2026-107361), SSRF through an unmodified FilePond PHP component (CVE-2026-107362), RBAC bypass via URL path normalization inconsistency (CVE-2026-107333), cross-site request forgery enabling forensic log destruction (CVE-2026-107337), percent-encoding authorization bypass (CVE-2026-107334), and a gzip-bomb denial-of-service (CVE-2026-107335). Collectively these vulnerabilities expose critical-infrastructure operators—in Energy, IT, and Water sectors worldwide—to unauthenticated access, privilege escalation, lateral movement, and destruction of forensic evidence. The compromise of a security-monitoring tool itself represents an acute supply-chain and defense-evasion risk. As ICS/OT environments deepen their dependence on network-visibility platforms, adversaries now actively target the monitoring layer—blinding defenders while moving laterally through operational technology networks, a tactic increasingly observed in critical-infrastructure threat campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
Oil/Energy/Solar/Greentech2 weeks ago

Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now

In October 2026, CISA published ICS Advisory ICSA-26-288-01 disclosing six critical-to-high severity vulnerabilities in Eclipse Foundation Eclipse Milo, the widely deployed open-source OPC UA SDK used across chemical, energy, critical manufacturing, and water sectors worldwide. Flaws span incorrect authorization (CVE-2026-62927), missing authorization on diagnostics nodes (CVE-2026-63248, CVE-2026-58080), a padding-oracle attack enabling credential recovery (CVE-2026-60007), and two resource-exhaustion denial-of-service bugs (CVE-2026-63252, CVE-2026-61387). Unauthenticated remote attackers can delete protected OT data, impersonate legitimate users, or crash OPC UA servers entirely. The Eclipse Foundation has released version 1.1.5 as the remediation. These vulnerabilities underscore a systemic risk in ICS/OT environments: open-source protocol libraries embedded deep in industrial control stacks often escape rigorous security review cycles. As OPC UA adoption accelerates for Industry 4.0 connectivity, authorization bypasses and cryptographic weaknesses in foundational SDKs present nation-state and ransomware actors with high-value, low-friction entry points into operational technology networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical SCADA Alert: Hitachi Energy MicroSCADA X SYS600 Exposes Energy Infrastructure to Auth Bypass and Privilege Escalation
Critical SCADA Alert: Hitachi Energy MicroSCADA X SYS600 Exposes Energy Infrastructure to Auth Bypass and Privilege Escalation
Oil/Energy/Solar/Greentech2 weeks ago

Critical SCADA Alert: Hitachi Energy MicroSCADA X SYS600 Exposes Energy Infrastructure to Auth Bypass and Privilege Escalation

CISA published advisory ICSA-26-293-04 in October 2026 disclosing three vulnerabilities in Hitachi Energy MicroSCADA X SYS600, a supervisory control and data acquisition platform widely deployed in global energy infrastructure. CVE-2026-9852 is a CSV injection flaw (CVSS 3.1: 5.0) enabling data manipulation and potential code execution via malicious log entries. CVE-2026-9853 (CVSS 3.1: 7.8) allows any OS-authenticated user to read and modify SCADA application objects without SYS600 credentials, bypassing application-layer access controls entirely. CVE-2026-9854 (CVSS 3.1: 7.8) exposes a broken role-based access control mechanism that permits engineering-tool users to escalate privileges to Windows administrator, seizing full host control. All three affect versions 10.7 and prior; version 10.8 partially remediates the issues. These vulnerabilities arrive as threat actors—including nation-state groups targeting operational technology—intensify focus on energy-sector ICS platforms. The combination of authentication bypass and privilege escalation in a single SCADA product creates a chained attack path from low-privilege OS access to full operational disruption, mirroring TTPs observed in recent grid-targeting campaigns and underscoring the urgency of ICS-specific zero-trust segmentation.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports