The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
EU Sanctions Chinese and Iranian Firms for Cyberattacks in 2026
In March 2026, the European Union imposed sanctions on three companies—two Chinese and one Iranian—and two individuals for their involvement in cyberattacks targeting devices and critical infrastructure across multiple EU member states. Integrity Technology Group, a Beijing-based firm, provided technical support that led to the compromise of over 65,000 devices between 2022 and 2023. Anxun Information Technology, also from China, offered hacking services aimed at critical infrastructure. The Iranian company, Emennet Pasargad, was implicated in influence campaigns and the compromise of an SMS service in Sweden. The two sanctioned individuals are co-founders of Anxun Information Technology, believed to have played significant roles in these cyberattacks. This action underscores the EU's commitment to addressing state-sponsored cyber threats and protecting its member states' critical infrastructure. The sanctions include asset freezes and travel bans, reflecting the severity of the offenses and the EU's resolve to deter future cyberattacks.
6 months ago
Kill Chain
Aurora Generator Test 2007: A Cybersecurity Wake-Up Call for Critical Infrastructure
In March 2007, the Aurora Generator Test conducted by the Idaho National Laboratory demonstrated the potential for cyberattacks to physically destroy critical infrastructure. By exploiting vulnerabilities in industrial control systems, researchers remotely manipulated a diesel generator's circuit breakers, causing it to operate out of phase and ultimately leading to its destruction. This experiment highlighted the susceptibility of power grids to cyber threats, especially due to the use of legacy communication protocols lacking security measures. The Aurora Generator Test remains relevant today as it underscores the ongoing risks associated with outdated industrial control systems. Despite advancements in cybersecurity, many critical infrastructures still rely on legacy systems, making them vulnerable to similar attacks. This incident serves as a cautionary tale, emphasizing the need for continuous assessment and upgrading of security protocols in industrial environments.
6 months ago
Kill Chain
Poland's Nuclear Research Center Successfully Defends Against Cyberattack
In March 2026, Poland's National Centre for Nuclear Research (NCBJ) successfully thwarted a cyberattack targeting its IT infrastructure. The institute's security systems and internal procedures detected the intrusion early, preventing any compromise to their systems. Notably, the MARIA reactor, Poland's sole nuclear reactor used for scientific research and medical isotope production, remained unaffected and continued to operate safely at full capacity. While the NCBJ did not attribute the attack to any specific entity, reports suggest potential involvement of Iranian actors, though investigators caution that these indicators may be deceptive. This incident underscores the escalating cyber threats faced by critical infrastructure globally, particularly in the nuclear sector. Organizations must remain vigilant, continuously enhancing their cybersecurity measures to detect and respond to such sophisticated attacks promptly.
6 months ago
Kill Chain
Critical Vulnerability in Inductive Automation's Ignition Software: CVE-2025-13911
In December 2025, a vulnerability (CVE-2025-13911) was identified in Inductive Automation's Ignition SCADA software versions 8.1.x and 8.3.x. This flaw allows authenticated administrators to upload malicious project files containing Python scripts, which execute with SYSTEM-level privileges on Windows systems. The vulnerability arises from insufficient restrictions on Python library imports within the scripting environment, combined with the Ignition service account possessing excessive system permissions. Exploitation could lead to full system compromise, enabling attackers to manipulate automation processes, disrupt operations, exfiltrate sensitive data, or deploy ransomware. ([support.inductiveautomation.com](https://support.inductiveautomation.com/hc/en-us/articles/41992057776397-Script-Resource-Import-Vulnerability-for-Windows-CVE-2025-13911?utm_source=openai)) This incident underscores the critical importance of implementing the principle of least privilege and enforcing strict validation of imported project files in industrial control systems. Organizations must prioritize mitigating such vulnerabilities to safeguard against potential operational disruptions and security breaches.
6 months ago
Kill Chain
Critical Vulnerabilities in Siemens RUGGEDCOM APE1808 Devices: What You Need to Know
In March 2026, Siemens disclosed multiple vulnerabilities in its RUGGEDCOM APE1808 devices, which integrate Fortinet's FortiOS. These vulnerabilities include HTTP request smuggling (CVE-2025-55018), improper verification of communication channels (CVE-2025-62439), use of externally-controlled format strings (CVE-2025-64157), and authentication bypass via alternate paths (CVE-2026-24858). Exploitation could allow unauthenticated attackers to execute arbitrary code, bypass authentication mechanisms, or cause denial-of-service conditions. Siemens has released updates to address these issues and recommends users update to the latest firmware versions. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-698820.html?utm_source=openai)) The disclosure underscores the critical need for organizations to promptly apply security patches, especially in industrial control systems. The vulnerabilities highlight the importance of securing supply chain components and ensuring that third-party integrations do not introduce security risks.
6 months ago
Kill Chain
Mirai Botnet 2016: A Wake-Up Call for IoT Security
In October 2016, the Mirai botnet exploited default credentials on IoT devices to orchestrate one of the largest Distributed Denial-of-Service (DDoS) attacks in history. By scanning the internet for devices with open Telnet ports and using a list of common default usernames and passwords, Mirai infected hundreds of thousands of devices, including routers and IP cameras. These compromised devices were then used to launch massive DDoS attacks, notably targeting DNS provider Dyn, which resulted in widespread internet outages affecting major websites like Twitter, Netflix, and Amazon. The incident underscored the critical security risk posed by default credentials in IoT devices and highlighted the need for manufacturers and users to implement stronger security practices. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Mirai_%28malware%29?utm_source=openai)) The Mirai attack remains relevant today as IoT device proliferation continues, with many devices still shipping with default credentials. Recent studies indicate that a significant percentage of IoT devices retain factory-default passwords, making them susceptible to similar exploitation. This ongoing vulnerability emphasizes the importance of changing default credentials and implementing robust security measures to protect against potential large-scale cyberattacks. ([vulnsy.com](https://www.vulnsy.com/vulnerabilities/default-and-weak-iot-credentials?utm_source=openai))
6 months ago
Kill Chain
Critical Vulnerabilities in Lantronix EDS3000PS and EDS5000 Devices Threaten Infrastructure Security
In March 2026, multiple critical vulnerabilities were identified in Lantronix EDS3000PS and EDS5000 devices, including OS command injection and authentication bypass issues. Exploitation of these vulnerabilities could allow attackers to execute code with root-level privileges, potentially compromising critical infrastructure sectors such as Communications, Information Technology, and Critical Manufacturing. ([cisa.gov](https://www.cisa.gov/news-events/bulletins/sb22-108?utm_source=openai)) This incident underscores the ongoing risks associated with unpatched vulnerabilities in network devices, highlighting the necessity for organizations to implement robust vulnerability management and regular system updates to mitigate potential threats.
6 months ago
Kill Chain
Critical Vulnerability in Ceragon and Siklu's EtherHaul and MultiHaul Devices (CVE-2025-57176)
In September 2025, a critical vulnerability (CVE-2025-57176) was identified in Ceragon Networks and Siklu Communication's EtherHaul and MultiHaul series devices. The 'rfpiped' service on TCP port 555 allowed unauthenticated file uploads to any writable location on the device. This flaw, present in firmware versions 7.4.0 through 10.7.3, utilized weak encryption for metadata and transmitted file contents in cleartext, lacking authentication and path validation. Exploitation could lead to unauthorized access and control over affected devices. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-57176?utm_source=openai)) This incident underscores the persistent risks associated with inadequate authentication mechanisms in network devices. Organizations must prioritize regular firmware updates and implement robust access controls to mitigate such vulnerabilities.
6 months ago
Kill Chain
Iran's Integration of Cyber and Kinetic Warfare in 2026
In early 2026, Iranian threat actors intensified cyber operations targeting internet-connected surveillance cameras across the Middle East, including Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus. These attacks, which began on February 28, coincided with missile strikes in the region, suggesting a coordinated effort to use compromised cameras for operational planning and battle damage assessment. The targeted devices, primarily from manufacturers Hikvision and Dahua, were exploited using known vulnerabilities, aligning with Iran's established military doctrine of integrating cyber and kinetic warfare. This incident underscores the evolving nature of cyber threats, where digital intrusions are increasingly used to support and enhance physical military operations. Organizations must recognize the strategic use of cyber capabilities in modern conflicts and bolster their defenses accordingly.
6 months ago
Kill Chain
Critical Vulnerabilities in Everon's OCPP Backends Threaten EV Charging Security
In March 2026, multiple critical vulnerabilities were identified in Everon's OCPP Backends, affecting all versions of the platform. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([incibe.es](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-ocpp-backends-de-everon?utm_source=openai)) The discovery of these vulnerabilities underscores the growing cybersecurity risks within the electric vehicle (EV) charging infrastructure. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential operational disruptions and safeguard user data.
6 months ago
Kill Chain
Critical Vulnerabilities in Hitachi Energy's Relion REB500: Immediate Action Required
In February 2026, Hitachi Energy disclosed two significant vulnerabilities in its Relion REB500 product, identified as CVE-2026-2459 and CVE-2026-2460. These flaws allow authenticated users with specific roles to access and modify unauthorized directories, potentially compromising system integrity. The vulnerabilities affect versions up to and including 8.3.3.0. Hitachi Energy has released version 8.3.3.1 to address these issues and recommends users update promptly. ([cve.qwiksec.com](https://cve.qwiksec.com/cve/CVE-2026-2460?utm_source=openai)) This incident underscores the critical importance of stringent access controls and timely software updates in industrial control systems, especially within the energy sector. Organizations must remain vigilant against privilege escalation vulnerabilities to safeguard operational technology environments.
6 months ago
Kill Chain
Critical Vulnerabilities in Mitsubishi Electric's MELSEC iQ-F Series Expose Industrial Systems to Denial-of-Service Attacks
In March 2026, Mitsubishi Electric disclosed multiple vulnerabilities in their MELSEC iQ-F Series EtherNet/IP and Ethernet modules, specifically FX5-ENET/IP and FX5-EIP models. These flaws, identified as CVE-2026-1874, CVE-2026-1875, and CVE-2026-1876, allow remote attackers to induce denial-of-service conditions by continuously sending UDP packets, rendering the devices unresponsive until a system reset is performed. The vulnerabilities affect FX5-ENET/IP versions up to 1.106 and all versions of FX5-EIP. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1874?utm_source=openai)) This incident underscores the critical need for robust network security measures in industrial control systems, as such vulnerabilities can disrupt essential operations in critical manufacturing sectors worldwide. Organizations are advised to implement recommended mitigations, including updating firmware where available and employing network defenses to prevent unauthorized access. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-mitsubishi-electric-security-advisory-av26-191?utm_source=openai))
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports