✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Two CVSS 10.0 Flaws in Red Lion RTUs Expose Industrial Control Environments
In October 2025, two critical vulnerabilities (CVE-2023-40151 and CVE-2023-42770) were publicly disclosed in Red Lion Sixnet RTU devices, which are widely used for industrial automation and critical infrastructure. Both flaws received a CVSS 10.0 rating, underscoring their exploitability and impact. Attackers exploiting these vulnerabilities could achieve remote code execution with the highest privileges, granting them full control over affected devices. These RTUs are often deployed in energy, utilities, and manufacturing, raising concerns about the potential for business disruption, safety risks, and further attacks via compromised operational technology networks. This incident is particularly relevant as it highlights how legacy and specialized industrial control systems remain a prime target for threat actors leveraging zero-day vulnerabilities. The convergence of IT and OT, combined with growing regulatory scrutiny and an uptick in supply chain exposures, means that organizations must refocus on asset visibility and patch management for embedded and hard-to-update devices.
6 months ago
Kill Chain
NSA-Linked Cyberattack Highlights Risks to China’s National Time Service Center (2023–2024)
Between March 2022 and June 2024, China’s National Time Service Center reportedly fell victim to a sophisticated cyber-espionage campaign allegedly orchestrated by the U.S. National Security Agency (NSA). Attackers initially compromised employee mobile devices via a text-messaging service vulnerability, leading to credential theft and enabling unauthorized access to the Center’s internal systems by April 2023. From August 2023 onward, the NSA purportedly leveraged a suite of 42 advanced cyber tools to target sensitive infrastructure, using VPNs and forged certificates to evade detection and bypass defenses. The attack put critical services at risk, with potential consequences including network disruption, financial system instability, and interruptions to vital communications and national defense functions. This incident underscores escalating nation-state cyber competition, especially over foundational infrastructure. The methods used—mobile device exploitation, lateral movement, and evasion through encrypted channels—reflect trending Tactics, Techniques, and Procedures (TTPs) in state-sponsored attacks, raising concerns for governments and critical sectors worldwide about supply chain and timing-related risks.
6 months ago
Kill Chain
Satellite Communications Exposed: 2025’s Unencrypted Data Crisis
In mid-2025, a landmark study revealed that a vast portion of global geostationary satellite communications—including critical infrastructure, government, corporate, and consumer data—are transmitted unencrypted. Security researchers, using inexpensive commercially available satellite equipment, intercepted highly sensitive transmissions such as internal communications, private calls and SMS, and in-flight internet traffic. Because thousands of geostationary transponders broadcast across enormous geographic areas, these unprotected signals can be passively accessed by unauthorized parties from virtually anywhere within satellite coverage zones, putting confidential data at significant risk of interception and exploitation. This incident underscores a persistent and growing concern regarding the lack of robust encryption in satellite communications, even as regulations and cyber threats evolve rapidly. Increasing satellite connectivity for aviation, maritime, and remote access drives urgency around encryption, as adversaries and data brokers exploit these vulnerabilities on a global scale.
6 months ago
Kill Chain
Nation-State Breach of F5 Sparks CISA Emergency Directive for Federal Agencies
In mid-2024, F5 Networks disclosed that a sophisticated nation-state attacker gained prolonged, unauthorized access to its internal systems, compromising BIG-IP source code and undisclosed vulnerability details. The breach, detected in August, prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive compelling federal agencies to immediately identify, patch, or disconnect thousands of F5 products in their environments. While no direct federal compromises have been reported yet, the theft of sensitive product and security information could facilitate widespread exploitation across both federal agencies and private organizations relying on F5 systems. This incident underscores heightened risks to supply chain integrity and critical infrastructure posed by persistent nation-state campaigns. With attackers targeting widely deployed technology vendors, government and industry face urgent pressure to enhance monitoring, rapid patching, and zero trust defenses to mitigate risks from downstream exploitation of software supply chains.
6 months ago
Kill Chain
Chinese APT Exploits ArcGIS Tool for Stealthy Persistence and Credential Theft
In 2025, a Chinese state-sponsored Advanced Persistent Threat (APT) group, attributed to Flax Typhoon, maintained over a year of undetected access to an organization's network by exploiting a public-facing ArcGIS geo-mapping server. The attackers leveraged stolen administrator credentials to upload a malicious Java Server Object Extension (SOE) acting as a covert web shell, allowing them to execute commands via a REST API and escalate privileges internally. Persistence was further established by deploying SoftEther VPN Bridge, enabling encrypted outbound connectivity and facilitating lateral movement, data exfiltration, and credential harvesting within the victim's environment. This incident underscores the increasing sophistication of APTs exploiting legitimate third-party software and obscure admin features for stealthy, long-term persistence. The method's novelty, combined with highly targeted credential theft and the use of living-off-the-land techniques, highlights urgent gaps in detection, segmentation, and secure configuration, especially in public-facing or critical GIS applications.
6 months ago
Kill Chain
TwoNet Hacktivists Target Decoy Water Plant in Bold Critical Infrastructure Attack
In September 2025, the pro-Russian hacktivist group TwoNet targeted what they believed to be a vulnerable water treatment plant, unaware it was a decoy system (honeypot) operated by cybersecurity researchers. The attackers gained access using default credentials, escalated attacks through SQL enumeration, and exploited a known XSS vulnerability (CVE-2021-26829). Within 26 hours, they created new user accounts, manipulated PLC setpoints, disabled real-time updates, and attempted to disrupt both logs and alarms via the Human Machine Interface (HMI). Their tactics included data exfiltration and process disruption, signaling a shift toward operational technology (OT) attacks targeting critical infrastructure. This incident highlights a growing trend of hacktivist groups evolving from DDoS and defacement attacks to more sophisticated operations against OT and ICS targets. The rapid escalation and attempted sabotage observed in this breach emphasize the urgent need for robust segmentation, authentication, and real-time anomaly detection within critical infrastructure environments.
6 months ago
Kill Chain
CISA Confirms Active Exploitation of Meteobridge CVE-2025-4008 Command Injection Flaw
On October 24, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged an actively exploited command injection vulnerability (CVE-2025-4008) within Smartbedded Meteobridge's web interface. This critical flaw, assigned a CVSS score of 8.7, permits remote attackers to execute arbitrary code by exploiting improper input handling. Threat actors are leveraging this vulnerability in the wild, potentially compromising sensitive data and gaining unauthorized access to affected networks. The exposure primarily impacts organizations deploying Meteobridge for environmental monitoring or network-connected IoT operations, raising significant concerns about operational integrity and data confidentiality. This incident highlights a persistent trend in adversaries targeting device management interfaces and exploiting command injection vulnerabilities for lateral movement or further compromise. With regulatory scrutiny increasing and attackers rapidly capitalizing on newly discovered flaws, swift patching and enhanced network segmentation are more crucial than ever.
6 months ago
Kill Chain
Attackers Exploit Milesight Routers to Launch European SMS Phishing Wave
In early 2025, unidentified threat actors exploited vulnerabilities in Milesight industrial cellular routers to launch a large-scale smishing campaign across Europe. By abusing the routers’ publicly exposed APIs, attackers sent malicious SMS messages containing phishing URLs directly to mobile users in countries including Sweden and Italy. This campaign has been ongoing since at least February 2022, with attackers leveraging compromised infrastructure to bypass traditional security filters, resulting in widespread delivery of credential-theft links and potential downstream attacks. This incident highlights the increasing trend of attackers targeting edge infrastructure and IoT devices to amplify their phishing and malware operations. As threat actors shift tactics toward abusing legitimate network equipment, organizations face new regulatory and operational risks, with urgent need to secure device APIs, implement segmentation, and strengthen monitoring to counter evolving smishing threats.
6 months ago
Kill Chain
ICS Malware Attacks Spike in Q2 2025: Key Lessons for Industrial Automation Security
In Q2 2025, industrial automation systems worldwide experienced significant and persistent threats, with 20.5% of ICS (Industrial Control Systems) computers encountering malicious objects, despite a slight quarterly decrease. Attackers leveraged a multi-stage campaign, beginning with phishing emails and malicious documents to gain access, and subsequently deploying next-stage malware such as spyware, ransomware, and cryptominers. Regions like Africa and sectors such as biometrics were among the most targeted, while common initial infection sources included malicious internet resources, infected emails, and removable media devices. Multiple sophisticated malware families (over 10,000 variants) exploited ICS security gaps to enable lateral movement, persistent access, and data exfiltration, impacting operational resilience and increasing risk of service disruption for critical industries. This incident underscores the continued evolution of ICS-targeting malware and the increasing sophistication of attack vectors in the operational technology sector. The upward trend in email-based infiltration and malicious cloud links, coupled with persistent use of multi-stage payloads, highlights the urgent need for robust, layered security, Zero Trust policies, and compliance alignment to protect critical infrastructure environments against both commodity and targeted threats.
6 months ago
Kill Chain
Russian APTs Gamaredon and Turla Join Forces: Kazuar Backdoor Attack on Ukraine (2025)
In February 2025, cybersecurity researchers observed a coordinated attack on Ukrainian organizations involving collaboration between Russian APT groups Gamaredon and Turla. Utilizing tools such as PteroGraphin and PteroOdd, Gamaredon gained initial access and facilitated the deployment of Turla’s advanced Kazuar backdoor onto a compromised Ukrainian endpoint. This multi-stage intrusion enabled persistent remote access and potential data exfiltration, underscoring a notable escalation in Russian state-sponsored cyber tactics, as adversaries actively combined resources and malware capabilities to maximize operational impact. The attack targeted sensitive Ukrainian infrastructure, heightening concerns over the defense of critical systems. This incident exemplifies the increasing integration and sophistication among nation-state threat actors, specifically through sharing or chaining malware tools for greater effect. The cooperative tactics and advanced persistence mechanisms highlight the evolving threat landscape and emphasize the urgency for enhanced east-west traffic security, zero trust segmentation, and anomaly detection across critical sectors.
6 months ago
Kill Chain
HybridPetya Ransomware: UEFI Secure Boot Under Attack in 2024
In June 2024, ESET researchers discovered a ransomware variant dubbed HybridPetya, modeled after the infamous Petya/NotPetya malware, with a significant escalation in its capabilities. HybridPetya leverages the CVE-2024-7344 vulnerability to compromise UEFI-based systems, effectively bypassing Secure Boot protections on outdated hardware. Although not known to be active in broad campaigns, this bootkit joins a small group of malware capable of undermining the fundamental trust mechanisms securing modern machines, representing a sophisticated evolution in ransomware delivery and persistence techniques. HybridPetya’s emergence highlights the rapid adaptation of cybercriminals to harden malware against defensive controls. UEFI bootkit methods—once advanced nation-state territory—are now appearing in ransomware. Organizations must urgently review endpoint protections, hardware patching, and secure boot configurations to lower exposure to these new attack paths.
6 months ago
Kill Chain
HybridPetya Ransomware: UEFI Secure Boot Bypass Proof-of-Concept Shakes Firmware Security
In July 2025, ESET Research uncovered HybridPetya, a proof-of-concept ransomware closely mimicking the destructive Petya and NotPetya malware. HybridPetya features a novel UEFI bootkit component, capable of targeting both legacy and modern UEFI-based systems by exploiting CVE-2024-7344 to bypass Secure Boot protections. The malware operates by encrypting the Master File Table on NTFS partitions, leveraging advanced techniques such as malicious EFI application deployment and fake CHKDSK screens to evade detection. To date, ESET’s telemetry has found no evidence of HybridPetya in active attacks, and its development suggests an evolving threat landscape for ransomware targeting core system components. HybridPetya’s public discovery underscores an alarming trend: sophisticated ransomware is expanding its reach to firmware and boot processes, previously considered resilient to commodity malware. The rise of UEFI-targeting threats and Secure Boot bypass exploits highlights the urgent need for rigorous patch management and endpoint visibility, especially as new vulnerabilities (like CVE-2024-7344) become weaponized.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports