✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
ASKI Energy ALS-mini IP Controllers: 2025 ICS Vulnerability Exposes Critical Infrastructure
In October 2025, a critical authentication vulnerability (CVE-2025-9574) was disclosed in ASKI Energy ALS-mini-S8 and ALS-mini-S4 IP controllers. Devices manufactured between serial numbers 2000 and 5166 were found to lack authentication on their embedded web servers, enabling attackers to remotely read and modify configuration parameters without restriction. Discovered by security researcher Souvik Kandar and reported to CISA, this flaw impacts devices predominantly used across the European energy and critical manufacturing sectors. With a CVSS v4 score of 9.9, exploitation could have allowed adversaries to take full administrative control of exposed devices. Though exploitation reports are absent as of publication, the lack of vendor support due to product end-of-life heightens risk; similar legacy device exposures have increasingly fueled supply chain and operational technology (OT) attacks. The incident underscores the importance of aggressive network segmentation, timely asset retirement, and compensating controls in managing outdated ICS infrastructure.
6 months ago
Kill Chain
Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025
In October 2025, AutomationDirect disclosed multiple critical vulnerabilities affecting its Productivity Suite and a range of Productivity 1000, 2000, and 3000 PLC models, widely deployed in the manufacturing sector. Discovered by Nozomi Networks, the flaws—such as remote code execution, weak password recovery, and unrestricted file system access—could allow unauthenticated attackers to gain full control of affected devices, compromise sensitive project files, and disrupt industrial processes. The vulnerabilities could be exploited remotely with low attack complexity and no user interaction. This incident highlights rising risks posed by legacy and poorly segmented OT networks, as threat actors increasingly target industrial control systems. The sharp jump in the number and severity of disclosed PLC software vulnerabilities underscores the urgent need for enhanced segmentation, access controls, and monitoring in critical infrastructure environments.
6 months ago
Kill Chain
Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations
In October 2025, Schneider Electric disclosed a critical vulnerability (CVE-2024-10085) affecting its EcoStruxure OPC UA Server Expert and Modicon Communication Server. The flaw, identified as improper allocation of resources without limits or throttling, allows a remote attacker to overwhelm the targeted server with excessive OPC UA requests, resulting in a denial-of-service (DoS) and loss of real-time process data. The vulnerability, scored at CVSS v4 8.2, threatens industrial operations worldwide, particularly in critical sectors like energy and manufacturing, if not promptly mitigated. This incident underscores the increasing risk to industrial control systems (ICS) from remote, low-complexity attacks exploiting resource exhaustion bugs. It highlights ongoing attacker interest in operational technology environments and the urgent need for robust ICS security best practices and timely patch management.
6 months ago
Kill Chain
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.
6 months ago
Kill Chain
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.
6 months ago
Kill Chain
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.
6 months ago
Kill Chain
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.
6 months ago
Kill Chain
Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025
In early 2025, multiple organizations experienced cyberattacks stemming from the exploitation of a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). Threat actors leveraged this flaw to gain unauthorized access, deploy covert tools, and move laterally within victim environments. Notably, high-profile companies such as Schneider Electric may have been impacted, highlighting the sophistication and stealthiness of the attackers, who exploited encrypted and east-west traffic blind spots. The compromise of sensitive business data and disruption of enterprise resource planning systems underscore the far-reaching operational and financial consequences of this campaign. This incident sheds light on the escalating trend of supply chain attacks targeting widely used enterprise software through previously unknown vulnerabilities. The breadth of the campaign and the use of zero-day exploits signal a need for continuous vigilance, rapid patching, and advanced detection controls to defend critical systems against emerging threats.
6 months ago
Kill Chain
Volt Typhoon Breach Exposes Critical Infrastructure Vulnerabilities via Back-Office Data
In early 2024, multiple US critical infrastructure operators discovered that nation-state actors, most notably Volt Typhoon, exploited unsecured and unmonitored 'back-office' systems to gain persistence within operational technology (OT) and industrial control system (ICS) networks. The attackers bypassed perimeter defenses by identifying unencrypted data in transit, lateral east-west traffic vulnerabilities, and data sprawl in business support systems. Their operations evaded detection for months, leveraging encrypted channels and exploiting gaps in policy enforcement, leading to sensitive OT-adjacent data exfiltration and operational risk. This breach highlights a wider trend: sophisticated APTs are moving beyond headline-grabbing OT entry points, targeting unmonitored business data and hybrid network blind spots. Regulators, including CISA and NIST, emphasize organizations must urgently address visibility gaps and strengthen zero trust controls as attackers grow bolder and more evasive.
6 months ago
Kill Chain
Flax Typhoon Turns ArcGIS Geo-Mapping Server into APT Backdoor
In early 2024, Chinese state-sponsored threat group Flax Typhoon compromised an organization’s ArcGIS geospatial mapping server, turning the platform into a covert backdoor for persistent access. The attackers exploited vulnerabilities and weak segmentation, modifying core ArcGIS components to avoid detection while establishing reliable remote control and lateral movement capabilities. This stealthy intrusion allowed for unauthorized data access without typical alert triggers, posing significant operational and reputational risks for the victim, and demonstrated advanced tactics utilized by APT groups targeting critical infrastructure software. This incident highlights a growing trend where APTs compromise auxiliary business applications—like geo-mapping and analytics platforms—to evade detection and spread across internal networks. Organizations must reassess east-west security, encrypted traffic visibility, and zero trust segmentation to keep pace with evolving attacker tradecraft.
6 months ago
Kill Chain
Blue Angel Suite Faces 2024 Webctrl.cgi OS Command Injection Attempts
In October 2024, threat actors attempted to exploit an OS command injection vulnerability targeting the Blue Angel Software Suite's web interface on embedded Linux devices. Attackers issued crafted POST requests to the '/cgi-bin/webctrl.cgi' endpoint, aiming to inject arbitrary shell commands via the 'ipaddress' parameter. These attacks, detected by honeypots, mirror previous vulnerabilities such as CVE-2025-34033, which allows authenticated attackers to execute code as root by manipulating input passed to system commands like 'ping'. The incidents highlight persistent risks across IoT and broadband equipment, potentially providing attackers with full system control. This incident underscores a growing trend in targeting network appliances and IoT infrastructure for initial access and lateral movement. As regulatory attention increases and attackers shift toward exploiting device misconfigurations and weak input validation, robust segmentation and up-to-date patch management are even more critical.
6 months ago
Kill Chain
How Flax Typhoon Used ArcGIS Server as a Backdoor: 2025 Breach Breakdown
In mid-2025, threat intelligence researchers uncovered a year-long, state-sponsored attack committed by Chinese APT group Flax Typhoon (also known as Ethereal Panda/RedJuliett). The group exploited unpatched ArcGIS servers to establish persistent unauthorized access and covertly operated a backdoor for over twelve months. Using sophisticated techniques to evade detection and maintain long-term access, the attackers leveraged lateral movement and encrypted communication within targeted networks. The breach compromised sensitive data and potentially exposed critical infrastructure, highlighting a significant risk to affected organizations. This incident exemplifies a growing threat from well-resourced nation-state actors targeting enterprise geospatial systems, exploiting overlooked or under-patched software for initial entry. Attacks on infrastructure platforms are increasingly sophisticated, raising urgency for IT and security leaders to enhance detection, zero trust segmentation, and patch management programs in response to evolving APT campaigns.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports