The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation
In June 2024, U.S. federal agencies were ordered by CISA to immediately patch a critical vulnerability in GeoServer, an open-source geospatial server widely deployed across government networks. Threat actors were observed actively exploiting an XML External Entity (XXE) injection flaw that allows attackers to access sensitive files, exfiltrate data, and potentially pivot within federal environments. The exploitation, which was discovered in the wild, underscores how quickly attackers can weaponize unpatched vulnerabilities to compromise mission-critical public sector infrastructure, putting sensitive government information at risk. This incident highlights a recent spike in the exploitation of internet-facing open-source software by both cybercriminal and nation-state groups. With regulatory pressure mounting around software supply chain risks and zero-day response times, such vulnerabilities remain a primary vehicle for initial access in sophisticated cyberattacks.
8 months ago
Kill Chain
CISA Flags Critical GeoServer XXE Vulnerability Exploited in the Wild
In December 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical XML External Entity (XXE) vulnerability, CVE-2025-58360, affecting OSGeo GeoServer to its Known Exploited Vulnerabilities catalog. This flaw impacts versions up to 2.25.5 and select subsequent releases, enabling unauthenticated attackers to exploit the /geoserver/wms GetMap endpoint. Successful exploitation may lead to unauthorized file access, Server-Side Request Forgery (SSRF), or denial-of-service attacks. The discovery, reported by vulnerability platform XBOW, has prompted warnings from both CISA and the Canadian Centre for Cyber Security, emphasizing risks to organizations using GeoServer in production environments. This incident underscores the persistent targeting of widely-used open-source tools by threat actors, particularly through unauthenticated exploit paths. Amid increased regulatory focus and real-world exploitation evidence, organizations face mounting pressure to patch vulnerable infrastructure and strengthen detective controls to mitigate post-exploitation impacts.
8 months ago
Kill Chain
How Zigbee Protocol Flaws Exposed Industrial IoT Networks in 2024
In early 2024, security researchers uncovered critical vulnerabilities affecting Zigbee-based industrial IoT and automation environments. By assessing real-world installations, attackers demonstrated how both spoofed packet injection and coordinator impersonation attacks could exploit application-layer protocol weaknesses and misconfigurations. Notably, exposed or hard-coded keys, absence of end-to-end encryption, and insecure default settings enabled adversaries to hijack communications, control relay devices, and ultimately compromise entire sensor networks. The attack techniques bypassed traditional network segmentation and leveraged custom wireless tools to overcome timing and profile mismatches. This incident highlights urgent gaps in IoT and industrial security — especially the risks posed by legacy or proprietary protocol deployments lagging on best-practice cryptographic implementation. With industrial sectors increasingly reliant on automated sensor networks, attackers are expanding TTPs to target low-power wireless protocols like Zigbee, making advanced monitoring and zero trust approaches more critical than ever.
8 months ago
Kill Chain
CISA Flags Exploited Vulnerability in Sierra Wireless AirLink ALEOS (CVE-2018-4063)
On December 12, 2025, CISA added CVE-2018-4063, a vulnerability impacting Sierra Wireless AirLink ALEOS, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. This vulnerability allows unrestricted upload of potentially malicious files, granting attackers the ability to gain remote control over affected network devices. Such vulnerabilities in network infrastructure expose organizations—including federal agencies—to heightened risks of unauthorized access, lateral movement, and disruption of operations. Federal Civilian Executive Branch agencies are mandated to remediate this issue promptly under Binding Operational Directive 22-01, and CISA encourages all enterprises to act urgently in their own environments. This incident highlights the persistent targeting of edge network infrastructure by threat actors, a trend accelerated by increased reliance on remote and distributed operations. The rapid inclusion of this vulnerability in CISA’s KEV Catalog underscores the growing regulatory and operational pressure on organizations to adopt proactive vulnerability and network segmentation controls.
8 months ago
Kill Chain
AzeoTech DAQFactory 2025: Critical ICS Memory Flaws Open Path to Code Execution
In December 2025, critical memory corruption vulnerabilities were disclosed in AzeoTech DAQFactory, an industrial control system platform widely used in critical manufacturing. Attackers leveraging these flaws—such as out-of-bounds write, use-after-free, heap and stack buffer overflows, and type confusion—could upload malicious .ctl files, leading to potential arbitrary code execution or data disclosure. No remote exploitation was reported, but the flaws affect DAQFactory versions 20.7 (Build 2555) and earlier, impacting deployments worldwide. The incident underscores the persistent risk that memory-based vulnerabilities pose to ICS platforms, amplifying concerns about supply chain and file-based attacks in operational environments. Given ICS’s expanding attack surface and recent regulatory scrutiny, addressing patch management and limiting untrusted file handling remain crucial for minimizing operational risk.
8 months ago
Kill Chain
CSRF Flaw in OpenPLC_V3 Sheds Light on ICS Software Security Risks
In December 2025, a significant cybersecurity vulnerability was disclosed in OpenPLC_V3, an open-source programmable logic controller widely deployed in critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. Researchers identified a Cross-Site Request Forgery (CSRF) flaw (CVE-2025-13970) that allowed remote, unauthenticated attackers to exploit absent CSRF protections, potentially tricking logged-in administrators into modifying PLC settings or uploading malicious code. This could have caused disruptive or destructive changes to industrial processes. A patch was promptly released via pull request #310, and no evidence of public exploitation has been reported to date. The incident underscores growing threats to industrial control system (ICS) environments, as attackers increasingly target device management interfaces. Regulatory and industry attention remains high, amplifying requirements for strong authentication, network segmentation, and timely vulnerability management for ICS software.
8 months ago
Kill Chain
Critical Vulnerabilities in Siemens SINEMA Remote Connect Server Expose Manufacturing Networks
In December 2025, Siemens disclosed two vulnerabilities impacting SINEMA Remote Connect Server versions prior to V3.2 SP4, designated as CVE-2025-40818 and CVE-2025-40819. The flaws involved incorrect permission assignments for SSL/TLS private keys and improper authorization controls over license management within the server's database. An authenticated attacker could exploit these weaknesses to impersonate trusted servers, decrypt or intercept sensitive communications, and bypass licensing restrictions, exposing critical manufacturing environments worldwide to unauthorized access and operational risk. This incident underscores the persistent importance of robust permission management and encryption key protection in industrial control systems. With increased targeting of operational technology environments, organizations must prioritize patching, secure configurations, and risk assessments to maintain both compliance and resilience against escalating threats.
8 months ago
Kill Chain
CISA’s 2025 ICS Advisories Expose Critical OT Vulnerabilities
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) published 12 critical advisories detailing multiple vulnerabilities affecting industrial control systems (ICS) from major vendors including Johnson Controls, Siemens, and Varex Imaging. These advisories highlight flaws exposed by threat assessments in device firmware, authentication mechanisms, remote access features, and legacy software within widely deployed ICS/OT products. An exploitation of these vulnerabilities could give adversaries access to critical operations, enable lateral movement within secure networks, or disrupt essential physical processes that underpin energy, healthcare, and manufacturing sectors. The occurrence underscores the ongoing risks posed by legacy and unpatched OT technology in critical infrastructure. A surge in targeted attacks against ICS environments, evolving regulatory requirements, and new threat intelligence guidance are elevating urgency for rapid remediation, modern zero trust approaches, and the adoption of robust segmentation and visibility controls.
8 months ago
Kill Chain
Siemens Discloses Physical Access Flaw in 2025 G5DFR Devices
In December 2025, Siemens Energy Services disclosed a critical vulnerability in all G5DFR versions of its Elspec G5 devices, affecting industrial control systems worldwide. Attackers with physical access could reset the Admin password by inserting a USB drive containing a public reset string, effectively bypassing authentication (CVE-2025-59392, CVSS 7.0). While exploitation required direct device access, successful attacks would allow unauthorized changes to critical system configurations, risking operational integrity within the energy sector. Siemens and CISA advised urgent firmware updates and robust network isolation to mitigate the risk. This incident highlights the persistent risk of physical-layer threats in critical infrastructure environments, even as digital attack surfaces expand. The availability of public reset procedures underscores the urgency in securing endpoints and the importance of layered, defense-in-depth strategies, especially given the evolving regulatory landscape and increased scrutiny on energy sector cybersecurity.
8 months ago
Kill Chain
Authentication Bypass Exposes Siemens Gridscale X Prepay ICS: 2025 Breach Analysis
In December 2025, Siemens disclosed critical vulnerabilities impacting its Gridscale X Prepay solution, widely used in energy infrastructure. The flaws—an observable response discrepancy (CVE-2025-40806) and authentication bypass via capture-replay (CVE-2025-40807)—could allow remote attackers to enumerate valid user names and circumvent lockouts, compromising operational security. Discovered by Kira of The Raven Security and coordinated via Siemens ProductCERT and CISA, these issues placed globally deployed ICS systems at risk of unauthorized access by leveraging predictable system responses and token replay, potentially impacting sensitive control environments. This incident highlights an ongoing trend of attackers exploiting authentication weaknesses in industrial control systems, underscoring the need for strict access management and timely vulnerability mitigation. With ICS assets increasingly targeted and regulatory scrutiny rising, implementing robust segmentation and monitoring is more crucial than ever.
8 months ago
Kill Chain
Ukrainian Hacker Charged: Russian Hacktivist Attacks Underscore U.S. Critical Infrastructure Risks
In 2024, U.S. authorities charged a Ukrainian national for collaborating with Russian state-sponsored hacktivist groups in a series of high-profile cyberattacks against critical infrastructure. The targeted sectors included U.S. water systems, election infrastructure, and nuclear facilities. Leveraging advanced intrusion tools and lateral movement tactics, the attacker contributed to sophisticated campaigns aimed at espionage, disruption, and potential sabotage. These efforts underscore the persistent threat posed by coordinated state-aligned cyber actors and the increasing risk to essential public services worldwide. This case highlights how modern threat actors are expanding their focus from traditional targets to critical infrastructure with geo-political motives. The intersection of hacktivism, nation-state support, and escalating global tensions demands greater cyber defense readiness and robust compliance from both private and public sectors.
8 months ago
Kill Chain
Russian State-Backed Cyberattack Hits US Critical Infrastructure: Lessons from 2024
In 2024, U.S. authorities charged Ukrainian national Victoria Dubranova for her alleged involvement in Russian state-sponsored cyberattacks targeting critical infrastructure across the U.S. and allied nations. Dubranova is accused of collaborating with CyberArmyofRussia_Reborn (CARR) and NoName057(16), groups funded by Russian entities, to launch coordinated distributed denial of service (DDoS) and destructive intrusions. The attacks compromised water systems, food processing facilities, government bodies, and nuclear regulatory sites, resulting in water system sabotage, meat contamination, and emergency evacuations. Investigations revealed evolving tactics and recruitment methods, including custom malware (DDoSia) and incentivized hacktivist participation. This case underscores the escalating threat from state-backed cybercriminals targeting operational technology and essential services. As hacktivists innovate with new tools and social engineering, the risk to public utilities remains severe, prompting a regulatory and industry emphasis on network segmentation, reduced internet exposure, and proactive cyber defense.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports