The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
CISA Issues 2025 Industrial Control Systems Vulnerability Alerts: What You Need to Know
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released four Industrial Control Systems (ICS) security advisories highlighting critical and high-severity vulnerabilities in products from Advantech (DeviceOn iEdge), Ubia (Ubox), ABB (FLXeon Controllers), and Hitachi Energy (Asset Suite). These advisories revealed weaknesses that allow threat actors to exploit unencrypted communications, weak authentication, and inadequate segmentation, which could enable remote attackers to gain unauthorized access, move laterally within ICS environments, or disrupt operations. The announcement underscores the ongoing risk posed to critical infrastructure from both targeted and opportunistic threats leveraging these flaws. This incident exemplifies a growing trend where attackers target ICS components and operational technology, exploiting security gaps often found in legacy or poorly maintained systems. As regulatory expectations rise and the threat landscape becomes more sophisticated, organizations must urgently prioritize ICS security, bolster monitoring, and implement zero trust architectures to defend critical infrastructure.
8 months ago
Kill Chain
F5’s 2023 Supply Chain Breach: When Nation-State Attacks Undermine U.S. Cyber Readiness
In October 2023, a significant nation-state supply chain attack targeted F5, a leading provider of network and application security solutions. Threat actors believed to be linked to China successfully gained unauthorized access to F5's source code and undisclosed vulnerabilities, providing them with intimate knowledge required to craft advanced exploits capable of bypassing traditional security defenses. BIG-IP, F5's flagship product, is widely deployed by major enterprises, federal agencies, healthcare institutions, and utilities, making the impact of this breach exceptionally far-reaching. In response, CISA issued an emergency directive urging federal agencies to promptly patch vulnerable systems, citing the potential for cascading impacts across critical infrastructure. This incident is particularly relevant as it underscores the growing sophistication of supply chain attacks, where adversaries target foundational software providers instead of individual end-users. The breach comes amidst rising threats from nation-state actors and highlights the urgent need for proactive security controls, rapid patching, and improved cross-sector collaboration to strengthen cyber resilience.
8 months ago
Kill Chain
Delta Electronics 2025 ICS Vulnerability: Buffer Overflow in CNCSoft-G2 Threatens Industrial Operations
In November 2025, Delta Electronics publicly disclosed a critical vulnerability in its CNCSoft-G2 software (version 2.1.0.27 and prior), used widely across critical manufacturing and energy sectors. The stack-based buffer overflow vulnerability (CVE-2025-58317) could be exploited by attackers using a malicious file to achieve arbitrary code execution with the privileges of the target process. Although no public exploitation has been reported yet and remote exploitation is not possible, the flaw poses significant risks to organizations controlling industrial networks, potentially undermining operational continuity and safety systems. Mitigations and patches have been released, with recommendations for further defense-in-depth and updated secure remote access. This case highlights the ongoing challenges in securing industrial control software as threat actors frequently target poorly validated file handling and legacy code. The need for robust patch management and segmentation is paramount—especially as ransomware groups and nation-state actors increasingly pursue industrial targets for disruption or extortion.
8 months ago
Kill Chain
CISA Discloses 2025 ICS Vulnerabilities Affecting Critical Infrastructure
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released five Industrial Control Systems (ICS) Advisories highlighting significant vulnerabilities impacting multiple vendors: Fuji Electric, Survision, Delta Electronics, Radiometrics, and IDIS. These advisories detail newly identified security issues, including unencrypted communication, improper authentication, and exploitable flaws exposing critical industrial and manufacturing systems to potential attack vectors. While no active exploitation has been publicly reported yet, the disclosed vulnerabilities could allow remote attackers to gain unauthorized access, disrupt operations, or compromise sensitive operational technology environments if left unaddressed. This incident underscores the ongoing and urgent need for proactive vulnerability management and timely patching within ICS environments. With an uptick in vulnerability disclosures and the rising convergence of IT and operational technology, threat actors continue to target unpatched systems in critical infrastructure, amplifying regulatory and business risk for operators in energy, manufacturing, and transportation sectors.
8 months ago
Kill Chain
Claroty Authentication Bypass Threatens OT Security in 2025
In early 2025, a critical vulnerability tracked as CVE-2025-54603 was discovered in Claroty’s industrial cybersecurity products, exposing operational technology (OT) networks and critical infrastructure to potential attacks and data theft. The flaw allowed threat actors to bypass authentication mechanisms, granting unauthorized access to sensitive network segments. Attackers leveraging this security gap could disrupt essential services, compromise confidential process data, and pose significant operational and safety risks. Claroty responded by issuing urgent patches to contain the exposure and mitigate ongoing threats. This incident highlights the increasing risk of authentication bypass exploits in OT environments, as threat actors target weak points in security architectures to gain privileged access. The event underscores an urgent need for robust, zero trust security frameworks and rapid vulnerability management in critical infrastructure sectors.
8 months ago
Kill Chain
CISA 2025 ICS Advisories Expose Widespread Industrial Control System Risks
In October 2025, CISA released thirteen industrial control systems (ICS) advisories highlighting critical security vulnerabilities across various products from leading vendors such as Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The disclosed vulnerabilities affected solutions commonly used in industrial environments, including HMIs, SCADA software, network management systems, and control processors. These weaknesses, if left unaddressed, could be leveraged by malicious actors for unauthorized access, lateral movement, or disruption of industrial processes, posing significant operational and safety risks to organizations dependent on ICS infrastructure. This mass vulnerability disclosure arrives amid an intensifying regulatory focus on the security of ICS and OT environments, paralleling a broader trend of increased adversary attention to unpatched operational technologies. Organizations must prioritize timely patching and hardened network segmentation to mitigate rapidly evolving threats and prevent cascading impacts across critical infrastructure.
8 months ago
Kill Chain
Siemens 2025: Missing Authentication Flaw in TeleControl Server Threatens Industrial Security
In October 2025, Siemens disclosed a critical authentication vulnerability (CVE-2025-40765) affecting TeleControl Server Basic V3.1 (versions before V3.1.2.3). The flaw, rated CVSS 9.3/10, allows remote, unauthenticated attackers to obtain user password hashes and perform authenticated actions on the database service. The vulnerability exposes critical manufacturing infrastructure worldwide, potentially enabling attackers to manipulate or disrupt automated industrial processes by escalating privileges. Siemens and CISA provided immediate mitigations, including patching and network access controls. This incident highlights the persistent risks from missing authentication controls in OT/ICS applications, at a time when remote exploitation targeting critical infrastructure is rapidly rising. The disclosure underscores the importance of timely patch management and network segmentation for industrial environments facing evolving cyber threats.
8 months ago
Kill Chain
Siemens 2025 ICS Vulnerabilities Expose Critical Manufacturing to Remote Disruption
In October 2025, Siemens disclosed high-severity vulnerabilities in its SIMATIC S7-1200 CPU V1/V2 Devices, a critical component used in manufacturing automation worldwide. Security researchers found that improper input validation and authentication bypass by capture-replay allowed unauthenticated remote attackers to either cause a denial-of-service state or remotely execute recorded engineering commands on exposed controllers, regardless of security passwords. The vulnerabilities, affecting devices shipped globally, could let on-path attackers disrupt operations or halt production lines if exploited. Siemens and CISA issued urgent advisories and released patches to mitigate risks. This incident highlights the ongoing vulnerability of industrial control systems (ICS) to remote exploits and session replay attacks. As critical infrastructure faces increasing threats from both sophisticated threat actors and opportunistic attacks, organizations operating legacy or unpatched automation hardware must rapidly recalibrate their cyber defenses in light of persistent risks and global attack surface expansion.
8 months ago
Kill Chain
Critical Siemens RUGGEDCOM ROS Vulnerabilities Expose Industrial Control Systems in 2025
In October 2025, Siemens disclosed several critical vulnerabilities in its RUGGEDCOM ROS industrial control system devices used globally in critical manufacturing sectors. The flaws include the use of weak cryptographic algorithms, improper handling of exceptional conditions, and protection mechanism failures, making affected devices susceptible to man-in-the-middle attacks, denial-of-service, and potential unauthorized access until device reboot. Exploitation is possible remotely with low complexity, allowing attackers to compromise encrypted communications or persist on non-management interfaces. This incident is especially relevant as supply chains and critical infrastructure increasingly adopt ICS/OT devices that, if not properly secured, expose entire operations to disruption. The persistence of cryptographic weaknesses and the growing sophistication of adversaries underscore the urgent need for robust, up-to-date security controls across the ICS ecosystem.
8 months ago
Kill Chain
Critical DoS Vulnerability in Rockwell Compact GuardLogix 5370 Exposes Manufacturing Operations
In October 2025, Rockwell Automation disclosed a critical remotely exploitable vulnerability (CVE-2025-9124) affecting Compact GuardLogix 5370 industrial controllers, stemming from an uncaught exception flaw. Attackers could trigger a denial-of-service by sending crafted CIP unconnected explicit messages, resulting in a major, non-recoverable device fault. The vulnerability, reported by Rockwell itself, exposes impacted controllers to significant operational disruptions, particularly concerning for organizations within critical manufacturing sectors worldwide. Immediate device upgrades and network segmentation were recommended to mitigate risk. This vulnerability highlights persistent gaps in OT security as attackers increase their focus on industrial control systems. The incident underscores the urgency surrounding real-time vulnerability management and emphasizes the rising threat surface presented by remotely accessible critical infrastructure.
8 months ago
Kill Chain
Critical Vulnerabilities in Rockwell Automation 1783-NATR Threaten Global Industrial Operations
In October 2025, Rockwell Automation disclosed three critical vulnerabilities in its 1783-NATR network address translation devices, primarily affecting industrial environments worldwide. The flaws included missing authentication checks on critical functions, a stored cross-site scripting (XSS) vulnerability, and a cross-site request forgery (CSRF) flaw. Remote attackers could exploit these to compromise administrative accounts, alter device configurations, and disrupt network traffic flow, potentially causing denial-of-service or the exposure of sensitive data vital to manufacturing operations. The vulnerabilities impacted all devices running firmware version 1.006 and earlier, with no public exploitation reported at the time of disclosure. This incident highlights the persistent security risks in operational technology (OT) and industrial control systems, particularly as threat actors increasingly target publicly exposed or poorly segmented infrastructure. The disclosure underscores the need for continuous patch management, robust network segmentation, and diligent monitoring to prevent widespread operational disruptions stemming from remote exploitation of critical vulnerabilities.
8 months ago
Kill Chain
CISA Discloses 2025 ICS Vulnerabilities Impacting Critical Infrastructure
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) disclosed 10 advisories detailing significant vulnerabilities found in a range of Industrial Control Systems (ICS) from leading manufacturers including Rockwell Automation, Siemens, Schneider Electric, and others. These advisories highlighted security flaws impacting critical operational technology components—such as PLCs, network devices, and cloud-enabled devices—potentially exposing vital infrastructure to remote code execution, unauthorized access, and disruption risks. Attackers leveraging these weaknesses could impact sectors like energy, manufacturing, and healthcare, posing threats to operational continuity and safety. This incident underscores the escalating threat landscape for operational technology and ICS environments as attackers increasingly target critical infrastructure using both opportunistic exploits and sophisticated attack vectors. The wave of advisories reflects mounting urgency for organizations to prioritize OT security, driven by evolving regulatory requirements and the proliferation of targeted attacks on essential industrial sectors.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports