The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Utilities
Breach intelligence, attack campaigns, and threat reports targeting the Utilities sector.
Explore Other Sectors
Utilities Threat Reports
Critical Xiiaozet LK100W Vulnerabilities Expose Industrial Control Systems to Remote Takeover
CISA disclosed three critical vulnerabilities in the Xiiaozet LK100W industrial control device, with CVSS scores up to 9.8. The flaws include OS command injection (CVE-2026-78037), missing authentication for critical functions (CVE-2026-78239), and authentication bypass (CVE-2026-76943). These vulnerabilities allow remote attackers to execute arbitrary commands with elevated privileges, enable unauthorized administrative services, and completely compromise affected devices running firmware versions below 2.1.240. The vulnerabilities were reported by Byron Guernsey of Okachobi, LLC and affect devices deployed worldwide across critical infrastructure sectors. This incident highlights the persistent security challenges in industrial IoT devices and the expanding attack surface of critical infrastructure. With nation-state actors increasingly targeting industrial control systems and the growing convergence of IT and OT networks, these authentication and command injection flaws represent the type of fundamental security weaknesses that enable sophisticated supply chain and infrastructure attacks.
3 weeks ago
Kill Chain
Industrial Automation Under Siege: Q2 2026 Threat Landscape Analysis
In Q2 2026, Kaspersky's industrial threat landscape report revealed a significant shift in cybersecurity threats targeting industrial control systems (ICS), with malicious objects blocked on 19.15% of ICS computers—the lowest level since 2022. The report identified 10,904 different malware families affecting industrial automation systems, with malicious scripts and phishing pages leading threat categories at 5.42% globally. Notable regional variations emerged, with Africa showing the highest attack rates at 27.9% while Northern Europe recorded the lowest at 8.1%. The biometrics sector faced the most severe threats at 26.44%, experiencing increases across multiple threat vectors including ransomware, spyware, and malicious documents. This trend reflects the evolving sophistication of threat actors targeting critical infrastructure, coinciding with increased adoption of cloud-native industrial systems and the expansion of attack surfaces through IoT integration. The data highlights growing concerns around industrial cybersecurity as nation-state actors and cybercriminal groups increasingly focus on operational technology environments.
4 weeks ago
Kill Chain
296K Device IoT Botnet Orchestrates Coordinated Attack on Water Infrastructure and Enterprise Systems
A coordinated multi-vector campaign emerged in August 2026 targeting critical infrastructure through three primary attack vectors: a massive 296,000-device IoT botnet compromising consumer and industrial devices, targeted attacks against over 100 water treatment facilities exploiting SCADA vulnerabilities, and active exploitation of a SharePoint remote code execution chain affecting enterprise environments. The campaign demonstrates sophisticated threat actors leveraging AI-enhanced automation to orchestrate simultaneous attacks across different infrastructure sectors, resulting in operational disruptions to water services and potential data exfiltration from corporate networks. This incident highlights the accelerating convergence of OT/IT attacks and AI-powered threat automation, representing a significant escalation in multi-domain campaign sophistication that requires immediate attention from infrastructure operators and enterprise security teams.
4 weeks ago
Kill Chain
How QTFY's 8-Year Espionage Campaign Exposed Critical Gaps in Federal Network Security
Federal authorities disrupted a sophisticated Chinese state-sponsored espionage operation conducted by the QTFY threat group, which had been targeting U.S. critical infrastructure since 2018. The group, operating through Nanjing Xinjiuwei Network Technology Company, successfully compromised multiple federal agencies including the Departments of Energy, Justice, Health and Human Services, Federal Reserve, NASA, and NIH. Using comprehensive toolsets including QScan vulnerability scanner with over 200 exploits and QTRouter traffic concealment platform, QTFY exploited zero-day vulnerabilities in major vendors like Ivanti, Pulse Secure, and Fortinet to maintain persistent access across government and private sector networks. This incident highlights the escalating sophistication of Chinese APT groups and their focus on long-term strategic intelligence collection from U.S. government agencies and critical infrastructure providers, demonstrating the urgent need for enhanced zero trust security architectures.
4 weeks ago
Kill Chain
Critical Vulnerabilities in Ebyte Industrial IoT Gateways Expose Manufacturing and Energy Infrastructure
The Ebyte NE2-D11 industrial IoT gateway contains 12 critical and high-severity vulnerabilities (ICSA-26-237-06) that enable complete device compromise through multiple attack vectors. These flaws include missing authentication for critical functions, cleartext transmission of sensitive data, client-side authentication bypass, CSRF attacks, and insufficient credential protection. The vulnerabilities affect firmware version FW-9167-0-11 deployed worldwide in critical manufacturing and energy sectors, allowing remote attackers to gain administrative access, intercept communications, modify configurations, and disrupt operations without authentication. This advisory highlights the persistent security challenges in industrial IoT devices as critical infrastructure increasingly relies on connected systems. With Ebyte's limited response to coordination efforts and no confirmed patch timeline, organizations face immediate risks from devices that lack basic security controls essential for industrial environments.
4 weeks ago
Kill Chain
CISA Red Team Reveals Shocking Security Gap: Two Critical Infrastructure Orgs, Vastly Different Outcomes
In August 2026, CISA published results from simultaneous red team assessments against two critical infrastructure organizations in the Government Services and Water/Wastewater sectors. Both organizations were fully compromised at the domain level using similar attack techniques including web application exploitation with default credentials, Active Directory Certificate Services misconfigurations, and privilege escalation through cleartext stored credentials. Organization A detected nothing despite thousands of security alerts, while Organization B's SOC detected and isolated affected workstations within 2-20 minutes, demonstrating the critical importance of security operations maturity over tool sophistication. This assessment highlights the growing focus on defensive capabilities amid increasing nation-state threats against critical infrastructure, particularly following recent campaigns like Salt Typhoon that exposed fundamental gaps in network security and detection capabilities across sectors.
4 weeks ago
Kill Chain
CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector
In 2024, CISA conducted red team exercises against two organizations - one government and one water sector entity - with dramatically different outcomes. Both organizations were successfully breached through phishing campaigns, but while the government organization failed to detect or respond to the simulated attack, allowing red teamers to gain elevated privileges and move laterally across systems undetected, the water sector organization quickly identified the intrusion and quarantined affected systems within 2-20 minutes. The exercise revealed critical gaps in detection capabilities, cloud security controls, and incident response procedures across both sectors. This incident highlights the urgent need for improved cybersecurity defenses in critical infrastructure sectors, particularly as nation-state actors increasingly target water facilities and government systems. The stark contrast in detection and response capabilities demonstrates the growing maturity gap in cybersecurity readiness across different sectors.
4 weeks ago
Kill Chain
Iranian Mabna Institute Hackers Sanctioned for Critical Infrastructure Breaches
In August 2026, the U.S. Treasury sanctioned five Iranian cyber actors affiliated with the Tehran-based Mabna Institute and Iran's Ministry of Intelligence and Security (MOIS) for conducting extensive compromises of U.S. critical infrastructure entities since late 2023. The threat actors successfully breached and exfiltrated data from energy companies, defense contractors, healthcare institutions, IT companies, and financial institutions, while also targeting local, state, and federal government offices in summer 2024. The group demonstrated dual motivations of state espionage and personal financial gain, with blockchain analysis revealing $16.8 million in cryptocurrency transactions across 30 wallets. This incident highlights the escalating cyber warfare between Iran and the U.S. following military strikes in February 2026, with Iranian threat actors increasingly targeting critical infrastructure as a form of asymmetric warfare. The emergence of coordinated hacktivist ecosystems and the blending of state-sponsored espionage with financially motivated cybercrime represents a significant evolution in nation-state threat actor behavior.
1 month ago
Kill Chain
CISA Red Team Assessment Exposes Critical Gap Between Strong and Weak SOC Operations
CISA conducted simultaneous red team assessments at two organizations in August 2026, revealing stark differences in defensive capabilities. Both organizations suffered full domain compromise and sensitive business system access, but Organization A failed to detect any malicious activity while Organization B rapidly identified and contained threats within 2-20 minutes. The assessments exposed critical gaps in cloud security, Active Directory configurations, and incident response processes across both critical infrastructure entities. This incident highlights the growing sophistication of identity-based attacks and the urgent need for organizations to mature their cloud security postures as threat actors increasingly target hybrid environments and exploit authentication mechanisms like Entra ID and AWS IAM.
1 month ago
Kill Chain
Critical Calix Router Flaw Exposes Millions of Home Networks to Internet Attackers
A critical unpatched vulnerability (CVE-2026-75501) in Calix GS7 XGS residential routers allows remote unauthenticated attackers to bypass NAT and firewall protections by creating arbitrary port-forwarding rules. The flaw affects EXOS/6.6.47 firmware and exposes the MiniUPnPd control endpoint on the WAN interface without authentication, enabling attackers to expose internal devices like cameras, NAS systems, and IoT appliances to the public internet with a single SOAP request. Major U.S. broadband providers including Cox Communications, Brightspeed, and ALLO deploy these vulnerable routers to residential customers. This vulnerability highlights the growing risk of perimeter-based security failures in an era where remote work and IoT adoption have expanded attack surfaces. With no vendor patch available and limited workarounds, this incident underscores the urgent need for zero-trust network architectures that don't rely solely on NAT and traditional firewall protections.
1 month ago
Kill Chain
AI-Powered Cyber Attacks Target Critical Infrastructure PLCs
In August 2026, U.S. government agencies warned of active threat actors using AI to generate exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors including water, energy, and manufacturing. Attackers leverage legitimate scanning services like Censys and ZoomEye to identify vulnerable PLCs, then deploy AI-generated scripts masquerading as monitoring tools to find exploits. The threat actors are systematically testing exploitation techniques against specific PLC models and using read access to understand target environments in preparation for future write operations that could cause operational disruption, safety incidents, equipment damage, and compliance violations. This incident marks a significant escalation in AI-enabled cyber threats against operational technology, demonstrating how artificial intelligence is lowering the barrier for sophisticated industrial control system attacks and compressing the timeline from vulnerability discovery to weaponization.
1 month ago
Kill Chain
Critical TSN Protocol Flaws Expose Industrial Control Systems to Manipulation
In August 2026, cybersecurity researchers from Nozomi Networks disclosed critical vulnerabilities in Time-Sensitive Networking (TSN) protocols, specifically targeting Mitsubishi Electric's CC-Link IE TSN implementation. The research demonstrated how attackers could exploit Layer 2 security weaknesses and TSN switch management interface flaws to inject malicious traffic into industrial control systems. Successful exploitation allows complete manipulation of operational technology processes, including starting and stopping robotic arms, tampering with synchronization clocks, and disrupting safety-critical communications in manufacturing environments. This research highlights the growing security challenges as industrial automation increasingly adopts TSN protocols for deterministic communication. With nation-state actors targeting critical infrastructure and the convergence of IT and OT networks accelerating, these vulnerabilities expose fundamental weaknesses in emerging industrial protocols that prioritize availability over security.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports