The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
AI-Powered Cyber Campaigns Expose New Threat Landscape in Latin America
Two sophisticated AI-enhanced cyber campaigns targeted organizations across Latin America in 2026, demonstrating how threat actors are integrating artificial intelligence into their attack workflows. The first campaign (CL-CRI-1131) targeted Mexican transportation companies and government entities using living-off-the-land techniques and self-hosted NextChat instances for AI assistance. The second campaign (CL-CRI-1163) focused on Brazilian financial institutions, employing custom remote access trojans and Go-based SOCKS5 proxies with AI-generated naming conventions. Both campaigns utilized commercial large language models like ChatGPT and Claude to overcome technical obstacles, generate exploit scripts, and streamline post-exploitation activities. Despite enhanced technical capabilities through AI integration, the attackers exposed their operations through poor operational security, including unsecured staging directories and publicly accessible NextChat interfaces. This represents a significant evolution in regional threat landscapes where diverse threat groups are independently adopting AI to accelerate their attack capabilities while maintaining fundamental security weaknesses that defenders can exploit.
3 weeks ago
Kill Chain
AI Weaponizes PLC Exploits: How Claude Ported Critical Infrastructure Attacks
In September 2026, Forescout's Vedere Labs demonstrated how Anthropic's Claude AI successfully ported a pre-authentication remote code execution exploit targeting CVE-2021-31886 from one WAGO programmable logic controller model to another. The research consumed $535.74 in API costs over 8.5 hours to adapt an existing 750-852 exploit for the 750-831 controller, exploiting a stack-based buffer overflow in the Nucleus FTP server with a CVSS score of 9.8. The AI-assisted exploit development achieved code execution by sending network packets, though a subsequent attempt to create a command-and-control implant permanently bricked the target PLC by writing to flash memory. This research highlights the evolving threat landscape where AI tools are lowering the technical barriers for developing industrial control system exploits, coinciding with recent warnings from NSA, CISA, and FBI about AI-generated scripts targeting Siemens PLCs and ongoing attacks against water utility infrastructure.
3 weeks ago
Kill Chain
Critical Privilege Escalation Flaw Exposes Industrial Control Systems to Complete Compromise
A critical privilege escalation vulnerability (CVE-2026-16675) was discovered in Rockwell Automation's FactoryTalk Activation Manager V5.02 and below, affecting industrial control systems worldwide. The vulnerability allows authenticated attackers to hijack console windows during installation or repair operations, escalating from standard user privileges to SYSTEM-level access with complete control over affected systems. This poses significant risks to critical manufacturing infrastructure, as attackers can access all files, processes, and system resources once exploited. This vulnerability highlights the ongoing security challenges facing industrial control systems as manufacturing environments become increasingly digitized and interconnected, making them attractive targets for cybercriminals and nation-state actors seeking to disrupt critical infrastructure operations.
3 weeks ago
Kill Chain
Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers
Rockwell Automation disclosed CVE-2021-42260, a high-severity denial of service vulnerability affecting ControlLogix, CompactLogix, GuardLogix, and Compact GuardLogix controllers. The vulnerability, with a CVSS score of 7.5, allows attackers to trigger an infinite loop condition through corrupt crafted data, causing major nonrecoverable faults (MNRF) in safety controllers and requiring program downloads for recovery. The flaw impacts multiple firmware versions across the 34.x, 35.x, 36.x, and 37.x series, affecting critical manufacturing infrastructure deployed worldwide. This vulnerability highlights the ongoing risks to operational technology environments where denial of service attacks can cause significant operational disruption. As industrial control systems become increasingly connected and targeted by threat actors, vulnerabilities like CVE-2021-42260 demonstrate the critical need for robust OT security measures and timely patch management in manufacturing environments.
3 weeks ago
Kill Chain
Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems
Four critical denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) were discovered in Rockwell Automation's RSLinx Classic versions 4.50 and earlier. These vulnerabilities allow attackers to crash the RSLinx Classic service by sending specially crafted CIP packets, exploiting integer overflow, integer underflow, and buffer overflow conditions. The vulnerabilities affect critical manufacturing infrastructure worldwide and require service restarts to recover, potentially disrupting industrial operations and production systems. These vulnerabilities highlight the growing threat landscape facing industrial control systems as cybercriminals increasingly target critical infrastructure. With the rise of nation-state actors and ransomware groups focusing on OT environments, securing industrial communication protocols like CIP has become paramount for operational resilience.
3 weeks ago
Kill Chain
Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks
In September 2026, CISA disclosed critical vulnerabilities in Rockwell Automation's FactoryTalk Historian Machine Edition affecting Series B 5.202 and Series C 7.101. CVE-2025-12768, with a CVSS score of 8.0, enables remote code execution through an out-of-bounds write condition exploitable by attackers with low-level authentication. CVE-2026-12661 allows denial-of-service attacks via stack-based buffer overflows when crafted requests are sent to the web interface, potentially crashing industrial systems. These vulnerabilities impact critical infrastructure sectors including chemical manufacturing, healthcare, and water systems worldwide. The disclosure emphasizes the growing threat landscape targeting industrial control systems and operational technology environments. Similar buffer overflow vulnerabilities in ICS components have been increasingly exploited by nation-state actors and ransomware groups to disrupt critical infrastructure operations.
3 weeks ago
Kill Chain
Iran-Linked Nation-State Actors Launch Coordinated Attacks on US Water Infrastructure
In August 2026, Iran-linked threat actors conducted a sophisticated campaign targeting critical water and wastewater systems across at least 12 US states, utilizing advanced persistent threat techniques to infiltrate industrial control systems. The attackers successfully compromised SCADA networks and human-machine interfaces, demonstrating their ability to manipulate critical infrastructure operations. In a parallel attack, the same threat group shut down a UK power plant for four days in July 2026, highlighting the global reach and severity of their capabilities. The incidents caused significant operational disruptions, water service outages affecting hundreds of thousands of residents, and forced emergency response protocols across multiple states. These attacks represent a dangerous escalation in nation-state targeting of critical infrastructure, coinciding with increased geopolitical tensions and sophisticated adversaries developing specialized capabilities for industrial control system compromise. The incidents underscore the urgent need for enhanced OT security measures and zero-trust architectures protecting critical national infrastructure.
3 weeks ago
Kill Chain
DoD Refrigeration Systems Under Cyber Attack: When Supply Chains Become Attack Vectors
In August 2026, multiple U.S. Department of Defense military base commissaries experienced simultaneous refrigeration system failures across at least seven installations, including Fort Irwin, F.E. Warren Air Force Base, Fort Huachuca, Naval Station Newport, Columbus Air Force Base, Travis Air Force Base, and Naval Air Station Lemoore. The coordinated nature and timing of these outages strongly suggests a sophisticated cyber attack targeting critical infrastructure systems within the military supply chain. The Pentagon acknowledged awareness of the disruptions but declined to provide details about the scope or attribution of the incidents. This incident highlights the growing threat to operational technology and IoT devices within critical infrastructure environments. As nation-state actors increasingly target supply chain vulnerabilities and connected systems, the simultaneous failure of refrigeration systems across geographically dispersed military installations demonstrates how cyber threats can disrupt essential services and potentially compromise food safety and operational readiness.
3 weeks ago
Kill Chain
Fire Ant Hackers Transform Cisco Routers Into Covert Espionage Platforms
Chinese Fire Ant hackers, linked to the UNC3886 espionage group, evolved their tactics in August 2026 by compromising Cisco IOS XR routers to establish covert surveillance platforms. The threat actors deployed custom malware creating hidden GRE tunnels, suppressed system logs, and transformed network infrastructure into collection points for traffic monitoring and reconnaissance. They captured network traffic via PCAP files uploaded to external FTP servers, exposing internal topology, authentication flows, and communications across trusted network paths to enable lateral movement into high-value connected environments. This incident highlights the growing trend of nation-state actors targeting critical network infrastructure as initial access points, moving beyond traditional endpoint compromises to leverage trusted network devices for persistent espionage operations and supply chain infiltration.
3 weeks ago
Kill Chain
Fire Ant APT Turns Cisco Routers Into Credential Harvesting Platforms
In 2026, the China-linked Fire Ant threat group expanded their espionage operations beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts across high-value networks. The attackers transformed compromised routers into collection platforms, capturing network traffic, harvesting administrator credentials, and suppressing security logs to blind defenders. Fire Ant deployed custom malware including TacTap for credential theft, BridgeAgent backdoor, and router-specific implants that modified system libraries to hide their presence from network administrators. This incident demonstrates the evolving sophistication of nation-state actors targeting critical network infrastructure, particularly as organizations increasingly rely on hybrid cloud architectures. The attackers' ability to compromise trusted network devices highlights the growing threat to supply chain security and the need for enhanced monitoring of network edge devices that traditional security controls often overlook.
3 weeks ago
Kill Chain
Critical ASE2000 Vulnerabilities Expose Industrial Control Systems to XXE and TLS Bypass Attacks
Applied Systems Engineering's ASE2000 V2 Communications Test Set, used in critical infrastructure sectors including energy and manufacturing, contains two critical vulnerabilities affecting versions 2.25 through 2.37. CVE-2018-1285 involves XML External Entity (XXE) attacks through vulnerable Apache log4net configurations, while CVE-2026-18717 enables TLS certificate validation bypass. These vulnerabilities could allow attackers to read or write arbitrary files, intercept encrypted communications, and potentially compromise industrial control systems used worldwide. These vulnerabilities highlight the persistent challenge of securing industrial control systems, particularly as critical infrastructure faces increasing cyber threats and nation-state targeting, making immediate patching and network segmentation essential for operational security.
3 weeks ago
Kill Chain
Critical Flaws in Ebyte Industrial Gateways Expose Global Infrastructure to Remote Attacks
In August 2026, CISA disclosed thirteen critical vulnerabilities in the Ebyte NA111-M industrial control system device, a Chinese-manufactured gateway used worldwide in critical infrastructure. The vulnerabilities include missing authentication, cleartext transmission of sensitive data, client-side authentication bypass, and weak cryptographic implementations. With CVSS scores up to 9.8, these flaws allow complete device compromise through remote exploitation, enabling attackers to access sensitive configurations, modify device settings, intercept MQTT credentials, and disrupt industrial operations. This disclosure highlights the persistent challenge of securing legacy industrial control systems that lack fundamental security controls, as nation-state actors and cybercriminals increasingly target critical infrastructure through vulnerable ICS devices for espionage and operational disruption.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports