Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Utilities

Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.

536 threat reports
Page 43 of 45
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Utilities Threat Reports

Showing 505–516 / 536 reports
CISA Discloses 2025 ICS Vulnerabilities Impacting Critical Infrastructure
Oil/Energy/Solar/Greentech10 months ago

CISA Discloses 2025 ICS Vulnerabilities Impacting Critical Infrastructure

In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) disclosed 10 advisories detailing significant vulnerabilities found in a range of Industrial Control Systems (ICS) from leading manufacturers including Rockwell Automation, Siemens, Schneider Electric, and others. These advisories highlighted security flaws impacting critical operational technology components—such as PLCs, network devices, and cloud-enabled devices—potentially exposing vital infrastructure to remote code execution, unauthorized access, and disruption risks. Attackers leveraging these weaknesses could impact sectors like energy, manufacturing, and healthcare, posing threats to operational continuity and safety. This incident underscores the escalating threat landscape for operational technology and ICS environments as attackers increasingly target critical infrastructure using both opportunistic exploits and sophisticated attack vectors. The wave of advisories reflects mounting urgency for organizations to prioritize OT security, driven by evolving regulatory requirements and the proliferation of targeted attacks on essential industrial sectors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 2025 Raisecomm Authentication Bypass: Root Access Risk to ICS Networks
Telecommunications10 months ago

Critical 2025 Raisecomm Authentication Bypass: Root Access Risk to ICS Networks

In October 2025, a critical remote authentication bypass vulnerability (CVE-2025-11534) was publicly disclosed in Raisecomm RAX701-GC series network equipment, allowing unauthenticated attackers to establish SSH sessions and gain root shell access without providing valid credentials. Discovered and reported by security researchers from runZero, this exploit poses an elevated risk to infrastructure sectors relying on these devices globally, as affected firmware versions remain susceptible with exploits achievable at low complexity and no prior privileges. Business and operational impacts include full remote compromise, lateral movement potential, and the ability for attackers to implant persistent threats or disrupt essential communications and IT operations. The incident is especially pressing now, indicating a rising trend in targeting embedded and edge devices in critical environments via misconfigurations or software flaws. As attackers expand their focus to accessible infrastructure, organizations face increasing pressure to implement robust access controls, proactive segmentation, and defense-in-depth strategies to safeguard operational networks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Unveils 2025 ICS Vulnerabilities: Critical Risks to Energy & Healthcare
Oil/Energy/Solar/Greentech10 months ago

CISA Unveils 2025 ICS Vulnerabilities: Critical Risks to Energy & Healthcare

In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released eight advisories highlighting multiple critical vulnerabilities in a range of Industrial Control Systems (ICS) products, including solutions from AutomationDirect, ASKI Energy, Veeder-Root, Delta Electronics, NIHON KOHDEN, Schneider Electric, and Hitachi Energy. These vulnerabilities could allow threat actors, including both cybercriminals and nation-state adversaries, to execute remote code, escalate privileges, disrupt control functionality, or access sensitive operational data. Although no confirmed exploits were publicly detailed at the time of disclosure, the affected systems are widely deployed in energy, healthcare, and manufacturing, raising concerns about both operational integrity and national infrastructure risk. The incident underscores an urgent trend of continuous vulnerability discovery within ICS and operational technology environments as attackers increasingly target these sectors. This rising cadence of disclosures highlights both the complexity of securing interconnected systems and the need for ongoing vigilance and layered defense measures in critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Veeder-Root TLS4B Vulnerabilities Expose Energy Sector to Remote Attacks in 2025
Oil/Energy/Solar/Greentech10 months ago

Veeder-Root TLS4B Vulnerabilities Expose Energy Sector to Remote Attacks in 2025

In October 2025, critical vulnerabilities were disclosed in the Veeder-Root TLS4B Automatic Tank Gauge System, widely deployed across the global energy sector. Security researcher Pedro Umbelino reported a severe command injection flaw (CVE-2025-58428) in the SOAP-based web service, enabling attackers with valid credentials to execute system-level commands, gain shell access, and potentially move laterally within targeted networks. A second vulnerability (CVE-2025-55067) affects time handling, potentially enabling attackers to cause authentication failures and denial of service by exploiting the Unix epoch rollover issue. Both vulnerabilities are remotely exploitable and threaten operational continuity, device functionality, and network integrity. This incident highlights the growing exposure of industrial control systems to sophisticated, remotely exploitable vulnerabilities. With the energy sector’s increasing reliance on interconnected OT devices, attackers are targeting control interfaces and authentication flaws to achieve deeper network access, reinforcing the urgent need for proactive risk assessments and robust segmentation strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ASKI Energy ALS-mini IP Controllers: 2025 ICS Vulnerability Exposes Critical Infrastructure
Oil/Energy/Solar/Greentech10 months ago

ASKI Energy ALS-mini IP Controllers: 2025 ICS Vulnerability Exposes Critical Infrastructure

In October 2025, a critical authentication vulnerability (CVE-2025-9574) was disclosed in ASKI Energy ALS-mini-S8 and ALS-mini-S4 IP controllers. Devices manufactured between serial numbers 2000 and 5166 were found to lack authentication on their embedded web servers, enabling attackers to remotely read and modify configuration parameters without restriction. Discovered by security researcher Souvik Kandar and reported to CISA, this flaw impacts devices predominantly used across the European energy and critical manufacturing sectors. With a CVSS v4 score of 9.9, exploitation could have allowed adversaries to take full administrative control of exposed devices. Though exploitation reports are absent as of publication, the lack of vendor support due to product end-of-life heightens risk; similar legacy device exposures have increasingly fueled supply chain and operational technology (OT) attacks. The incident underscores the importance of aggressive network segmentation, timely asset retirement, and compensating controls in managing outdated ICS infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025
Industrial Automation10 months ago

Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025

In October 2025, AutomationDirect disclosed multiple critical vulnerabilities affecting its Productivity Suite and a range of Productivity 1000, 2000, and 3000 PLC models, widely deployed in the manufacturing sector. Discovered by Nozomi Networks, the flaws—such as remote code execution, weak password recovery, and unrestricted file system access—could allow unauthenticated attackers to gain full control of affected devices, compromise sensitive project files, and disrupt industrial processes. The vulnerabilities could be exploited remotely with low attack complexity and no user interaction. This incident highlights rising risks posed by legacy and poorly segmented OT networks, as threat actors increasingly target industrial control systems. The sharp jump in the number and severity of disclosed PLC software vulnerabilities underscores the urgent need for enhanced segmentation, access controls, and monitoring in critical infrastructure environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations
Critical Manufacturing10 months ago

Schneider Electric OPC UA DoS Flaw Threatens Global OT Operations

In October 2025, Schneider Electric disclosed a critical vulnerability (CVE-2024-10085) affecting its EcoStruxure OPC UA Server Expert and Modicon Communication Server. The flaw, identified as improper allocation of resources without limits or throttling, allows a remote attacker to overwhelm the targeted server with excessive OPC UA requests, resulting in a denial-of-service (DoS) and loss of real-time process data. The vulnerability, scored at CVSS v4 8.2, threatens industrial operations worldwide, particularly in critical sectors like energy and manufacturing, if not promptly mitigated. This incident underscores the increasing risk to industrial control systems (ICS) from remote, low-complexity attacks exploiting resource exhaustion bugs. It highlights ongoing attacker interest in operational technology environments and the urgent need for robust ICS security best practices and timely patch management.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
Utilities10 months ago

CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)

In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
Oil/Energy/Solar/Greentech10 months ago

Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)

In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
Automotive10 months ago

ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025

In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
Utilities10 months ago

Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024

In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025
Utilities10 months ago

Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025

In early 2025, multiple organizations experienced cyberattacks stemming from the exploitation of a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). Threat actors leveraged this flaw to gain unauthorized access, deploy covert tools, and move laterally within victim environments. Notably, high-profile companies such as Schneider Electric may have been impacted, highlighting the sophistication and stealthiness of the attackers, who exploited encrypted and east-west traffic blind spots. The compromise of sensitive business data and disruption of enterprise resource planning systems underscore the far-reaching operational and financial consequences of this campaign. This incident sheds light on the escalating trend of supply chain attacks targeting widely used enterprise software through previously unknown vulnerabilities. The breadth of the campaign and the use of zero-day exploits signal a need for continuous vigilance, rapid patching, and advanced detection controls to defend critical systems against emerging threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports