The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Opportunistic Pro-Russia Hacktivist Attacks on Critical Infrastructure (2025)
In May and December 2025, joint advisories from CISA, FBI, NSA, Department of Energy, and international partners highlighted a surge in opportunistic attacks on US and global critical infrastructure mounted by pro-Russia hacktivist groups such as Cyber Army of Russia Reborn, Z-Pentest, NoName057(16), and Sector16. These actors leveraged poorly secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate operational technology (OT) systems, targeting assets ranging from water treatment plants to energy and pipeline operators. The attacks, while generally less sophisticated than those carried out by advanced persistent threat (APT) groups, resulted in varying degrees of impact including service disruptions and, in some cases, physical damage to critical assets. This campaign reflects a growing trend of hacktivist groups exploiting low-hanging vulnerabilities in OT environments, often amplifying their impact through sensationalist or exaggerated public claims. The continued prevalence of exposed VNC devices and basic authentication weaknesses underscores the importance for asset owners and operators to harden access, enforce strong authentication, and monitor for anomalous activities to combat evolving hacktivist TTPs.
8 months ago
Kill Chain
U-Boot Bootloader Flaw Threatens Global Manufacturing and Critical Infrastructure
In December 2025, a critical vulnerability (CVE-2025-24857) was disclosed in U-Boot, a widely-used bootloader for embedded systems, impacting all versions prior to 2017.11 and several Qualcomm chipsets. The flaw—improper access control for volatile memory containing boot code—allowed an attacker with local access to execute arbitrary code at boot, posing significant risk to devices across essential sectors including energy, communications, manufacturing, healthcare, and more. No active exploitation has been reported, but the vulnerability could undermine device integrity and operational security in globally deployed critical infrastructure systems. Mitigations include upgrading to the latest U-Boot version and implementing strict physical and network isolation measures. This incident underlines the persistent risk posed by supply chain and firmware vulnerabilities in critical infrastructure. With IoT and embedded device ubiquity rising, attackers are increasingly targeting low-level firmware to achieve persistence or bypass security, heightening regulatory scrutiny and emphasizing the need for proactive vulnerability management and secure device lifecycle practices.
8 months ago
Kill Chain
CISA Warns of Multiple ICS Vulnerabilities in U-Boot, Festo LX, and CCTV Devices (2025)
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released advisories on three newly discovered vulnerabilities affecting critical components in industrial environments: Universal Boot Loader (U-Boot), Festo LX Appliances, and multiple India-based CCTV cameras. These advisories highlight exploitable weaknesses that could allow threat actors to compromise device integrity, execute unauthorized commands, or pivot deeper into industrial networks, potentially disrupting operations or stealing sensitive data. The vulnerabilities impact a broad range of operational technology (OT) deployments and may require urgent patching or mitigation to prevent exploitation. This incident underscores the increasing volume and diversity of attacks targeting industrial control systems and OT environments. As digital transformation deepens, threat actors continue to capitalize on unpatched systems and weak security controls in critical infrastructure, raising the risks for sectors reliant on ICS technology.
8 months ago
Kill Chain
Sunbird DCIM Vulnerabilities Expose Critical Infrastructure: 2025 Authentication Bypass & Credential Risks
In December 2025, security vulnerabilities were disclosed in Sunbird DCIM's dcTrack and Power IQ products, affecting all versions up to v9.2.0. Two significant flaws—an Authentication Bypass Using an Alternate Path or Channel (CVE-2025-66238) and the Use of Hard-coded Credentials (CVE-2025-66237)—could allow attackers to gain unauthorized access or escalate privileges within critical infrastructure environments. Threat actors abusing these vulnerabilities could redirect network traffic, access restricted services, or take control of host machines, exposing organizations to severe operational and reputational risks. This incident highlights the ongoing challenges organizations face in securing infrastructure management tools. Authentication and credential weaknesses remain a leading vector for cyberattacks amid increasing regulatory oversight and the proliferation of critical systems connected globally. Prompt patching and improved credential handling are now essential across industries facing similar risks.
8 months ago
Kill Chain
CISA 2025 Advisories Expose Widespread ICS Vulnerabilities in Critical Infrastructure
On December 4, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued nine Industrial Control Systems (ICS) advisories after identifying multiple vulnerabilities across key ICS products from major vendors such as Mitsubishi Electric, Johnson Controls, Sunbird, SolisCloud, Advantech, and others. While no active exploitation was confirmed at the time of disclosure, these vulnerabilities—ranging from insufficient access controls and weak encryption to improper input validation—expose critical industrial environments to potential risks including remote code execution, credential compromise, and unauthorized access. The advisories underscore the wide attack surface present in operational technology (OT) and outline mitigation steps for affected organizations. The coordinated disclosure highlights the urgent need for ICS operators to address cybersecurity weaknesses as attackers increasingly target industrial networks. With OT/IT convergence, a sharp rise in ransomware, and persistent geopolitical tensions, these advisories reinforce the imperative for proactive patch management, microsegmentation, encrypted traffic, and continuous OT monitoring to prevent disruptive and costly breaches.
8 months ago
Kill Chain
Advantech iView 2025 SQL Injection Flaw: Immediate Risks for OT Environments
In December 2025, Advantech disclosed a critical SQL injection vulnerability (CVE-2025-13373) affecting its iView network management product (version 5.7.05.7057 and earlier). Security researchers found that attackers could send specially-crafted SNMP v1 trap requests that were not properly sanitized, enabling remote exploitation without authentication. If exploited, the flaw could allow threat actors to access, modify, or delete sensitive information, posing significant operational and business risks to industrial control systems globally. Although no known public exploitation has been reported, the vulnerability exposes organizations across critical manufacturing and information technology sectors to serious threats. This incident underscores the persistent risk of unpatched input validation flaws in widely-deployed operational technology (OT) products. The increasing convergence of IT and OT systems—as well as the expanding attack surfaces in critical infrastructure—make immediate patching, network isolation, and robust segmentation essential in mitigating future high-impact vulnerabilities.
8 months ago
Kill Chain
Authorization Bypass in SolisCloud API Exposes Global Energy Data
In December 2025, the SolisCloud Monitoring Platform, widely used across the global energy sector, was found to have a critical API vulnerability that allowed authorization bypass via a user-controlled key. This flaw, tracked as CVE-2025-13932, permitted any authenticated user to manipulate API requests and access detailed plant data belonging to other customers by altering the plant_id parameter. The vulnerability, present in both API v1 and v2, exposed sensitive operational information and highlighted a significant risk of data leakage in cloud-hosted critical infrastructure platforms. No mitigation had been released by SolisCloud at the time of public disclosure. This incident underscores the heightened threat of insecure APIs in industrial control systems, coinciding with a broader increase in supply chain risks and attacks targeting energy infrastructure. Regulatory bodies are likely to intensify scrutiny, given the global deployment and criticality of such platforms in the energy sector.
8 months ago
Kill Chain
Freedom Mobile Data Breach 2024: Customer Information Compromised via Account Platform
In June 2024, Freedom Mobile, Canada's fourth-largest wireless carrier, publicly disclosed a significant data breach after attackers compromised its customer account management platform. Unauthorized access allowed threat actors to steal sensitive customer data, including personal information such as names, contact details, and possibly financial information. The breach's scope is still being assessed, but the incident highlighted vulnerabilities in the exposed platform, prompting a swift operational and security review. Immediate remedial measures included engaging external cybersecurity experts, notifying impacted customers, and alerting regulatory authorities as required by Canadian privacy law. This incident underscores the continued risk posed by attacks targeting customer portals and account management systems—an increasingly common vector across the telecom sector. With regulatory scrutiny around privacy and data protection intensifying globally, this breach offers a stark reminder of the critical importance of securing customer data and internal administrative interfaces.
8 months ago
Kill Chain
CISA Flags OpenPLC ScadaBR Vulnerability Amid Active Exploitation in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-26828, an unrestricted file upload vulnerability impacting OpenPLC ScadaBR systems, to its Known Exploited Vulnerabilities (KEV) catalog after evidence emerged of active exploitation. This vulnerability allows attackers to upload malicious files to vulnerable systems, potentially enabling remote code execution or complete system takeover. Threat actors have exploited this flaw as an entry vector to target operational technology (OT) and industrial control system (ICS) environments, posing a significant risk for both federal agencies and the private sector reliant on automation and SCADA networks. The incident highlights the persistent threat to critical infrastructure from unpatched software and the growing focus of attackers on OT/ICS vulnerabilities. With regulatory directives like CISA’s BOD 22-01 mandating urgent remediation, organizations face increasing accountability for securing their environments against rapidly evolving exploits.
8 months ago
Kill Chain
Iranian APT Deploys MuddyViper Backdoor in Widespread Israeli Attacks (2025)
In late 2025, Iranian nation-state threat group MuddyWater launched a series of targeted cyberattacks against Israeli organizations spanning academia, engineering, local government, manufacturing, transportation, and utilities. Leveraging a newly identified malware backdoor dubbed MuddyViper, attackers infiltrated critical Israeli networks through spear-phishing and supply chain compromise, enabling persistent access and lateral movement across sensitive environments. The campaign was detected following unusual network activity and led to the exposure and disruption of operations, sparking concerns about the security of key national infrastructure. This incident highlights an ongoing evolution in APT tactics—particularly the development of custom malware for stealthy attacks on critical sectors tied to geopolitical tensions. The breach underscores the need for advanced detection, east-west traffic controls, and zero trust strategies to counter sophisticated nation-state actors.
8 months ago
Kill Chain
Iskra iHUB 2025: Missing Authentication Exposes Critical Energy Infrastructure
In December 2025, a critical vulnerability (CVE-2025-13510) was disclosed for Iskra iHUB and iHUB Lite smart metering gateways, extensively used in the global energy sector. The devices exposed a web management interface lacking authentication, allowing remote attackers to reconfigure settings, update firmware, or manipulate connected systems without needing valid credentials. Reported by researcher Souvik Kandar and publicized by CISA, the issue affected all versions of these products, placing energy utilities at heightened risk. Successful exploitation could compromise grid operations, disrupt data collection, and enable broader attacks on critical infrastructure. This incident underscores the persistent risk of weak or missing authentication in industrial control systems amid heightened regulatory scrutiny. As similar vulnerabilities drive attacks on critical infrastructure worldwide, energy sector organizations must urgently reevaluate their security postures against remotely exploitable threats and adopt robust access controls in alignment with zero trust principles.
8 months ago
Kill Chain
Critical RCE Flaw in Industrial Video & Control Longwatch Threatens Global OT Networks
In December 2025, a critical remote code execution vulnerability (CVE-2025-13658) was discovered in Industrial Video & Control’s Longwatch systems (versions 6.309 to 6.334). An unauthenticated attacker could exploit a lack of access controls and code signing via an exposed HTTP endpoint, gaining SYSTEM-level privileges across vulnerable energy and water infrastructure deployments worldwide. This exploitation method requires minimal technical expertise and impacts operational technology (OT) integrity in sectors fundamental to public safety. This vulnerability exemplifies persistent gaps in OT device security and comes amid heightened global concerns around the security of essential infrastructure. With regulatory scrutiny and sophistication of attacker tactics increasing, organizations must urgently address privilege escalation routes and remote code execution exposures within their ICS/SCADA environments.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports