The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Critical Vulnerabilities in Hardy Barth Salia EV Charge Controllers Expose Infrastructure Risks
In April 2026, CISA disclosed two critical vulnerabilities in Hardy Barth's Salia EV Charge Controller firmware versions up to 2.3.81. Identified as CVE-2025-5873 and CVE-2025-10371, these flaws allow remote attackers to upload malicious files via the web interface, potentially leading to remote code execution. Despite public proof-of-concept exploits being available, Hardy Barth has not responded to coordination requests, leaving systems at risk. This incident underscores the growing cybersecurity challenges in the EV infrastructure sector. The lack of vendor response highlights the need for proactive security measures and vigilant monitoring to protect critical energy and transportation systems from emerging threats.
5 months ago
Kill Chain
Critical Vulnerabilities Discovered in SenseLive X3050 Devices
In April 2026, multiple critical vulnerabilities were identified in the SenseLive X3050 device, version V1.523. These vulnerabilities include authentication bypass, insufficient session expiration, use of hard-coded credentials, and cleartext transmission of sensitive information. Exploitation of these flaws could allow attackers to gain complete control over the device, leading to unauthorized access and potential disruption of operations. The affected devices are widely deployed across critical infrastructure sectors such as manufacturing, water and wastewater, and energy. ([cyberpings.com](https://cyberpings.com/article/senselive-x3050-vulnerabilities-explained-mo8x?utm_source=openai)) The urgency of addressing these vulnerabilities is heightened by the lack of response from SenseLive to coordinate remediation efforts. Organizations utilizing the X3050 are advised to contact SenseLive directly for guidance and to implement immediate defensive measures to mitigate potential exploitation. ([cyberpings.com](https://cyberpings.com/article/senselive-x3050-vulnerabilities-explained-mo8x?utm_source=openai))
5 months ago
Kill Chain
Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack
In late 2025 and early 2026, a previously undocumented malware known as Lotus Wiper targeted Venezuela's energy and utilities sector. The attack began with batch scripts that disabled system defenses and disrupted operations, paving the way for the wiper to erase recovery mechanisms, overwrite physical drives, and systematically delete files, rendering systems inoperable. ([securelist.com](https://securelist.com/tr/lotus-wiper/119472/?utm_source=openai)) This incident underscores the escalating threat of destructive malware against critical infrastructure. The absence of ransom demands suggests a focus on disruption rather than financial gain, highlighting the need for robust cybersecurity measures in essential services. ([securityweek.com](https://www.securityweek.com/new-wiper-malware-targeted-venezuelan-energy-sector-prior-to-us-intervention/?utm_source=openai))
5 months ago
Kill Chain
Siemens TPM 2.0 Vulnerability (CVE-2025-2884) Disclosure
In April 2026, Siemens disclosed a vulnerability (CVE-2025-2884) in its TPM 2.0 implementation, affecting multiple products including SIMATIC and SIPLUS IPC series. The flaw, an out-of-bounds read in the CryptHmacSign function, could allow local attackers to access sensitive information or cause a denial of service. Siemens has released updates for several affected products and is preparing further fixes, recommending users to update to the latest versions. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-628843.html?utm_source=openai)) This incident underscores the critical importance of timely firmware updates and robust access controls, especially as TPM vulnerabilities can compromise foundational security features like encryption and secure boot processes.
5 months ago
Kill Chain
Critical Vulnerability in Siemens RUGGEDCOM SAM-P: Immediate Action Required
In April 2026, a critical privilege escalation vulnerability (CVE-2026-27668) was identified in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8. This flaw allows authenticated User Administrators to modify their own group memberships, potentially granting themselves elevated access across device groups. Siemens has addressed this issue by releasing version V5.8 and recommends immediate updates to mitigate the risk. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-741509.html?utm_source=openai)) This incident underscores the importance of stringent access controls and regular software updates in industrial control systems. Organizations should review their administrative privileges and ensure that all systems are updated to prevent unauthorized access and maintain operational integrity.
5 months ago
Kill Chain
Lotus Wiper Malware Disrupts Venezuelan Energy Sector in 2025
In mid-December 2025, a previously undocumented data-wiping malware named 'Lotus' was deployed in targeted attacks against energy and utility organizations in Venezuela. The attackers initiated the campaign by executing batch scripts that disabled system defenses and disrupted normal operations. Subsequently, the Lotus wiper was deployed to overwrite physical drives and systematically delete files, rendering the systems unrecoverable. This attack coincided with heightened geopolitical tensions in the region, including the capture of Venezuela's then-president, Nicolás Maduro, on January 3, 2026. The incident underscores the increasing use of destructive malware in cyberattacks against critical infrastructure, highlighting the need for robust cybersecurity measures and regular offline backups to mitigate such threats.
5 months ago
Kill Chain
Critical Vulnerabilities Discovered in Serial-to-IP Converters: A Wake-Up Call for OT Security
In April 2026, Forescout Technologies identified 22 new vulnerabilities in serial-to-IP converters from Lantronix and Silex, devices integral to connecting legacy industrial equipment to modern networks. These vulnerabilities, including remote code execution and authentication bypass, could allow attackers to disrupt operations, move laterally across networks, and tamper with sensitive data. Notably, tens of thousands of these devices are exposed online, increasing the risk to critical infrastructure sectors such as utilities, manufacturing, and healthcare. This discovery underscores the persistent security challenges in operational technology environments, particularly concerning devices that bridge legacy systems with modern networks. The prevalence of outdated components and inadequate security measures in these converters highlights the urgent need for organizations to assess and fortify their OT security postures to prevent potential exploitation.
5 months ago
Kill Chain
BRIDGE:BREAK Vulnerabilities Threaten Critical Infrastructure Security
In April 2026, Forescout Technologies identified 22 vulnerabilities in serial-to-IP converters from Lantronix and Silex, devices integral to connecting legacy industrial equipment to modern networks. These vulnerabilities, collectively named BRIDGE:BREAK, could allow attackers to disrupt operations, move laterally across networks, tamper with sensitive data, or take control of affected devices. The flaws include remote code execution, authentication bypass, firmware manipulation, denial of service, and exposure of confidential information. Notably, tens of thousands of these devices are accessible over the internet, significantly broadening the attack surface for potential cyberattacks. This discovery underscores the persistent security challenges in operational technology environments, especially concerning devices that bridge legacy systems with modern infrastructure. The prevalence of these vulnerabilities highlights the need for organizations to reassess their security postures, particularly in sectors like utilities, manufacturing, and healthcare, where such devices are commonly deployed.
5 months ago
Kill Chain
ZionSiphon Malware: A New Threat to Israeli Water Infrastructure
In April 2026, cybersecurity researchers identified a new malware strain named ZionSiphon, specifically engineered to target Israeli water treatment and desalination systems. The malware exhibits capabilities such as establishing persistence, modifying local configuration files, and scanning for operational technology (OT) services within local networks. Notably, ZionSiphon is designed to operate exclusively within Israeli IP address ranges and targets processes associated with water treatment operations, including chlorine dosing and pressure control systems. While the current version contains a flaw that prevents full execution, its architecture indicates a significant advancement in OT-targeted cyber threats. ([thehackernews.com](https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html?utm_source=openai)) This discovery underscores a growing trend of politically motivated cyberattacks aimed at critical infrastructure. The emergence of ZionSiphon highlights the increasing sophistication of threats targeting OT environments, emphasizing the need for enhanced security measures to protect essential services from potential sabotage.
5 months ago
Kill Chain
Critical Authorization Flaw in AVEVA Pipeline Simulation: CVE-2026-5387
In April 2026, a critical vulnerability (CVE-2026-5387) was identified in AVEVA Pipeline Simulation software, affecting versions up to 2025 SP1 build 7.1.9497.6351. This flaw allows unauthenticated attackers to perform operations reserved for high-privilege roles, such as modifying simulation parameters and training records, leading to potential privilege escalation. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-5387?utm_source=openai)) The incident underscores the importance of robust authorization mechanisms in industrial control systems. Organizations are urged to upgrade to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher and implement network access restrictions to mitigate this risk. ([aveva.com](https://www.aveva.com/en/support-and-success/cyber-security-updates/?utm_source=openai))
5 months ago
Kill Chain
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. The model discovered thousands of zero-day vulnerabilities, including a 27-year-old flaw in OpenBSD and a 16-year-old bug in FFmpeg. Due to its potent capabilities, Anthropic restricted access to select organizations under Project Glasswing to prevent potential misuse. This initiative involves collaboration with major tech companies to responsibly address and patch these vulnerabilities. The emergence of such powerful AI tools underscores the need for enhanced cybersecurity measures and collaborative efforts to safeguard critical infrastructure. The rapid advancement of AI in cybersecurity presents both opportunities and challenges, necessitating a reevaluation of existing security protocols and the development of new strategies to mitigate potential risks.
5 months ago
Kill Chain
ZionSiphon Malware: A New Threat to Water Treatment Facilities
In April 2026, cybersecurity researchers identified 'ZionSiphon,' a malware specifically designed to target operational technology within water treatment and desalination facilities in Israel. The malware aims to manipulate industrial control systems by increasing chlorine levels and adjusting hydraulic pressures to hazardous levels. Although the current version contains a flawed encryption logic that renders it non-functional, future iterations could rectify this issue, posing significant risks to critical infrastructure. This incident underscores the escalating threat landscape facing critical infrastructure sectors, particularly water treatment facilities. The emergence of specialized malware like ZionSiphon highlights the need for enhanced cybersecurity measures and vigilance to protect essential services from potential sabotage and disruption.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports