✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Critical Vulnerabilities in Hitachi Energy RTU500 Series Require Immediate Attention
In February 2026, Hitachi Energy disclosed multiple vulnerabilities affecting its RTU500 series products, including CVE-2026-1772, CVE-2026-1773, CVE-2024-8176, and CVE-2025-59375. These vulnerabilities, if exploited, could lead to unauthorized access to user management information and potential device outages. The affected firmware versions range from 12.7.1 to 13.8.1. Hitachi Energy has released firmware updates to address these issues and recommends users implement the provided mitigations to secure their systems. This incident underscores the critical importance of timely vulnerability management in industrial control systems, especially within the energy sector. Organizations are urged to stay vigilant and apply security patches promptly to mitigate potential risks associated with such vulnerabilities.
4 months ago
Kill Chain
Pro-Iranian Cyberattacks 2026: Unveiling the Threat to Critical Infrastructure
In early 2026, amid escalating geopolitical tensions, pro-Iranian cyber actors launched a series of coordinated cyberattacks targeting critical infrastructure in the United States and allied nations. These attacks aimed to disrupt essential services, including utilities and transportation systems, and were characterized by sophisticated techniques such as ransomware deployment and data exfiltration. The cyber offensive resulted in significant operational disruptions and financial losses, highlighting the evolving threat landscape posed by nation-state-sponsored cyber activities. This incident underscores the persistent and adaptive nature of cyber threats from nation-state actors, particularly in the context of geopolitical conflicts. Organizations are urged to enhance their cybersecurity posture by implementing robust defense mechanisms, conducting regular threat assessments, and fostering information-sharing partnerships to mitigate the risks associated with such sophisticated cyberattacks.
4 months ago
Kill Chain
Critical WebSocket Vulnerabilities in SWITCH EV's Platform Threaten EV Infrastructure Security
In February 2026, multiple critical vulnerabilities were identified in SWITCH EV's swtchenergy.com platform, affecting all versions. These vulnerabilities include missing authentication for critical functions (CVE-2026-27767), improper restriction of excessive authentication attempts (CVE-2026-25113), insufficient session expiration (CVE-2026-25778), and insufficiently protected credentials (CVE-2026-27773). Exploitation of these flaws could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic, and manipulate data sent to the backend, potentially leading to large-scale denial of service and unauthorized control over charging infrastructure. ([cvedetails.com](https://www.cvedetails.com/cve/CVE-2026-27767/?utm_source=openai)) The increasing reliance on electric vehicle (EV) infrastructure underscores the critical need for robust cybersecurity measures. These vulnerabilities highlight the potential risks associated with inadequate authentication and session management in critical infrastructure systems, emphasizing the importance of implementing comprehensive security protocols to safeguard against such threats.
5 months ago
Kill Chain
EV2GO 2026 Authentication Vulnerabilities: A Wake-Up Call for Critical Infrastructure Security
In February 2026, multiple critical vulnerabilities were identified in EV2GO's ev2go.io charging management platform, affecting all versions. These flaws include missing authentication for critical functions (CVE-2026-24731), improper restriction of excessive authentication attempts (CVE-2026-25945), insufficient session expiration (CVE-2026-20895), and insufficiently protected credentials (CVE-2026-22890). Exploitation could allow attackers to impersonate charging stations, hijack sessions, misroute traffic causing large-scale denial of service, and manipulate backend data. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/02/26/trj-cybersecurity-ev2go-charging-platform-exposed-authentication-failures-create-high-risk-entry-points-across-global-ev-infrastructure/?utm_source=openai)) The absence of vendor response and lack of available patches heighten the urgency for organizations to implement immediate defensive measures. This incident underscores the critical need for robust authentication mechanisms and proactive vulnerability management in infrastructure systems to prevent potential exploitation and operational disruptions.
5 months ago
Kill Chain
EV Energy's 2026 Security Flaws: A Wake-Up Call for EV Infrastructure
In February 2026, multiple critical vulnerabilities were identified in EV Energy's ev.energy platform, a UK-based provider of electric vehicle charging software. These vulnerabilities include missing authentication for critical functions (CVE-2026-27772), improper restriction of excessive authentication attempts (CVE-2026-24445), insufficient session expiration (CVE-2026-26290), and insufficiently protected credentials (CVE-2026-25774). Exploitation of these flaws could allow attackers to gain unauthorized control over charging stations, disrupt services, and compromise data integrity. ([beyondmachines.net](https://beyondmachines.net/event_details/critical-vulnerabilities-in-ev-energy-charging-platform-allow-remote-hijacking-b-x-t-d-l?utm_source=openai)) The increasing integration of electric vehicle infrastructure with the power grid underscores the urgency of addressing these security gaps. As cyberattacks on EV charging stations rise, ensuring robust authentication and session management mechanisms is critical to prevent potential disruptions and maintain trust in the EV ecosystem. ([yahoo.com](https://www.yahoo.com/news/cyberattacks-ev-charging-stations-rise-120000365.html?utm_source=openai))
5 months ago
Kill Chain
Critical Vulnerabilities in CloudCharge's Platform Threaten Global EV Charging Networks
In February 2026, multiple critical vulnerabilities were identified in CloudCharge's cloudcharge.se platform, which manages electric vehicle (EV) charging infrastructure globally. These vulnerabilities include missing authentication for critical functions (CVE-2026-20781), improper restriction of excessive authentication attempts (CVE-2026-25114), insufficient session expiration (CVE-2026-27652), and insufficiently protected credentials (CVE-2026-20733). Exploitation of these flaws could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic, and manipulate data sent to the backend, potentially leading to large-scale denial of service and unauthorized control over charging infrastructure. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/02/26/trj-cybersecurity-cloudcharge-platform-vulnerabilities-open-global-ev-charging-networks-to-session-hijack-and-impersonation-risk/?utm_source=openai)) The discovery of these vulnerabilities underscores the urgent need for robust authentication and session management mechanisms in critical infrastructure systems. As the adoption of EVs continues to rise, ensuring the security of charging networks is paramount to prevent potential disruptions and maintain public trust in these technologies.
5 months ago
Kill Chain
Critical Security Flaws in Mobility46's EV Charging Platform Expose Infrastructure to Unauthorized Access
In February 2026, multiple critical vulnerabilities were identified in Mobility46's charging station management platform, mobility46.se. These vulnerabilities include missing authentication for critical functions (CVE-2026-27028), improper restriction of excessive authentication attempts (CVE-2026-26305), insufficient session expiration (CVE-2026-27647), and insufficiently protected credentials (CVE-2026-22878). Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-27028?utm_source=openai)) The increasing reliance on electric vehicle (EV) infrastructure underscores the importance of securing such platforms. These vulnerabilities highlight the need for robust authentication mechanisms and session management to prevent unauthorized access and ensure the integrity of critical infrastructure services.
5 months ago
Kill Chain
Critical Vulnerabilities in Yokogawa CENTUM VP Vnet/IP Interface Package
In February 2026, multiple vulnerabilities were identified in Yokogawa Electric Corporation's Vnet/IP Interface Package, affecting CENTUM VP R6 and R7 systems. These vulnerabilities, including CVE-2025-1924, CVE-2025-48019, CVE-2025-48020, CVE-2025-48021, CVE-2025-48022, and CVE-2025-48023, could allow attackers on adjacent networks to send maliciously crafted packets, leading to denial-of-service conditions or arbitrary code execution. The affected versions are Vnet/IP Interface Package R1.07.00 and earlier. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48020?utm_source=openai)) The discovery of these vulnerabilities underscores the critical need for robust security measures in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely patching, network segmentation, and continuous monitoring to mitigate potential risks.
5 months ago
Kill Chain
Critical Security Flaws in Chargemap's EV Charging Platform Uncovered
In February 2026, multiple critical vulnerabilities were identified in Chargemap's platform, a widely used electric vehicle charging service. These flaws include missing authentication for critical functions (CVE-2026-25851), improper restriction of excessive authentication attempts (CVE-2026-20792), insufficient session expiration (CVE-2026-25711), and insufficiently protected credentials (CVE-2026-20791). Exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai)) The absence of vendor patches and Chargemap's lack of response to coordination requests from CISA highlight the urgency for organizations to implement immediate mitigations. This incident underscores the critical need for robust security measures in EV charging infrastructure, especially as the adoption of electric vehicles continues to rise globally. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai))
5 months ago
Kill Chain
Critical Unauthenticated RCE Vulnerability in Juniper Networks PTX Series Routers
In February 2026, Juniper Networks disclosed a critical vulnerability (CVE-2026-21902) in its Junos OS Evolved operating system running on PTX Series routers. This flaw, stemming from incorrect permission assignments in the On-Box Anomaly Detection framework, allows unauthenticated, network-based attackers to execute code with root privileges. The vulnerability affects Junos OS Evolved versions prior to 25.4R1-S1-EVO and 25.4R2-EVO, potentially leading to full device compromise. The exposure of such a critical service over externally accessible ports underscores the importance of rigorous access controls and timely patch management. Organizations relying on PTX Series routers should prioritize applying the provided patches or implementing recommended mitigations to prevent potential exploitation.
5 months ago
Kill Chain
Cisco 2026 Zero-Day Exploitation by UAT-8616
In February 2026, authorities disclosed that since 2023, attackers have been exploiting two zero-day vulnerabilities in Cisco's network edge software. The threat actor, identified as UAT-8616, utilized CVE-2026-20127 to bypass authentication and subsequently downgraded the software to exploit CVE-2022-20775, achieving root access. This sophisticated campaign targeted critical infrastructure sectors, establishing persistent footholds without detection. This incident underscores a growing trend of targeting network edge devices to gain long-term access to high-value organizations. The prolonged undetected exploitation highlights the need for enhanced monitoring and rapid response mechanisms to address emerging threats.
5 months ago
Kill Chain
Sophisticated Phishing Attacks Target Japanese Companies in 2026
In February 2026, a series of sophisticated phishing campaigns targeted Japanese-speaking individuals by impersonating reputable companies such as ANA, DHL, and myTOKYOGAS. These emails, originating from domains with a .cn top-level domain, utilized the Foxmail email client and directed recipients to counterfeit login pages designed to harvest sensitive credentials. The consistent use of the Foxmail client and .cn domains suggests coordination by a single threat actor. This incident underscores the evolving tactics of cybercriminals in crafting culturally and linguistically tailored phishing schemes to deceive users and compromise personal information. The prevalence of such targeted attacks highlights the necessity for enhanced vigilance and robust email filtering mechanisms to protect against credential theft and potential financial loss.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports