Exploitation activity targeting CVE-2026-58115, an unauthenticated Node-RED admin API vulnerability, was detected on October 30, 2026. Attackers used Node-RED's inject and exec nodes to execute commands without authentication, deploying malicious flows that download and execute Linux bots. The payloads included staged shell scripts and persistent webshells, with binaries saved in RAM-backed storage to evade disk forensics. This vulnerability affects Node-RED embedded in critical infrastructure products such as Siemens SIMATIC IoT2050 devices, posing a risk to industrial control systems environments. The exploitation appears opportunistic and involves mass scanning across multiple CVEs rather than targeted attacks.
The article provides a detailed analysis of the Shell data breach attributed to the Cl0p ransomware syndicate, highlighting the exfiltration of 89GB of sensitive engineering data through a pure extortion attack. It explains Cl0p's shift from traditional ransomware encryption to data theft and extortion, the risks posed to the global energy supply chain, and offers concrete defensive recommendations for critical infrastructure operators.
Multiple U.S. federal agencies have issued a joint advisory about active exploitation campaigns targeting programmable logic controllers (PLCs) in critical infrastructure sectors such as government facilities, water systems, and energy. Attackers scan for internet-exposed industrial control systems and use legitimate engineering software with valid credentials to appear as authorized technicians. They manipulate controller logic and operator displays to conceal their activities. This campaign affects equipment from Rockwell Automation, Schneider Electric, and Siemens. Unlike a prior 2023 campaign, this ongoing activity has caused confirmed operational disruptions and financial losses. The exploitation leverages architectural weaknesses rather than software vulnerabilities and accesses systems through specific network ports.
This article provides a detailed analysis of the recent cyber attack involving the Kudankulam Nuclear Power Plant, focusing on a data breach via a third-party contractor's server. It outlines the scope of leaked files, the ransomware group responsible, and NPCIL's official response emphasizing that critical nuclear safety systems were not compromised. The report highlights supply chain risks and ongoing investigations by CERT-In.
Cyber threats targeting the global aviation and aerospace sector are rapidly evolving, with ransomware, identity-based intrusions, and platform-level disruptions becoming dominant attack vectors. The interconnected nature of this ecosystem, combined with time-sensitive operations and complex third-party dependencies, makes it highly attractive to threat actors. Shared airport IT platforms represent critical single points of failure, as demonstrated by the September 2025 ransomware attack on Collins Aerospace MUSE system that disrupted major European airports including Heathrow, Brussels, Berlin, and Dublin. Major ransomware groups like LockBit and Cl0p maintain heavy focus on aviation suppliers, while advanced persistent threat groups including Refined Kitten, Wicked Panda, and Fancy Bear conduct strategic espionage targeting intellectual property, aircraft design data, and military aviation intelligence. Emerging threats include vulnerabilities in regional airports, aviation SaaS platforms, and satellite ...
A highly targeted destructive wiper campaign dubbed 'Lotus Wiper' was discovered targeting the energy and utilities sector in Venezuela during late 2025 and early 2026. The attack begins with batch scripts coordinating execution across networks using domain shares as trigger mechanisms. These scripts disable security services, lock out users, and prepare the environment for the final payload. The Lotus Wiper systematically destroys data by wiping physical drives with zeros, deleting restore points, clearing USN journals, and recursively deleting files. Unlike ransomware, this wiper has no financial motivation or ransom demands, designed purely for data destruction. Evidence suggests attackers maintained long-term domain access prior to the attack, with the wiper compiled months before deployment. The malware targets older Windows systems and uses legitimate system tools like diskpart, robocopy, and fsutil.
Hydra Saiga, a suspected Kazakhstani state-sponsored threat actor, has been actively targeting government, energy, and critical infrastructure in Central Asia, Europe, and the Middle East since 2021. The group is known for using Telegram Bot API for C2 communication and employing a mix of custom implants and 'Living off the Land' techniques. Their activities align closely with Kazakhstan's geopolitical interests, particularly in water and energy sectors. The group has compromised at least 34 organizations across 8 countries, with reconnaissance extending to over 200 additional targets globally. Hydra Saiga's operations demonstrate a clear focus on water infrastructure linked to major regional rivers and gas distribution systems, reflecting strategic intelligence collection efforts.
A significant joint offensive by the US and Israel has triggered a multi-vector retaliatory campaign from Iran, leading to an escalation in cyberattacks. Iran's limited internet connectivity is likely hindering state-aligned threat actors' ability to coordinate sophisticated attacks. Hacktivist groups are targeting perceived adversaries, while other nation-state actors may exploit the situation. Observed activities include phishing campaigns, DDoS attacks, data exfiltration, and wiper attacks. Multiple Iranian state-aligned personas and collectives have claimed responsibility for various disruptive operations. Pro-Russian hacktivist groups have also been active, targeting Israeli systems and infrastructure. The situation remains fluid, and organizations are advised to implement multi-layered defenses and focus on foundational security hygiene.
A new hacking group called Punishing Owl has emerged, targeting Russian critical infrastructure. Their first attack on December 12, 2025, compromised a Russian state security agency, leaking internal documents. The group used DNS manipulation, created fake subdomains, and sent phishing emails to the victim's partners. They employed a PowerShell stealer called ZipWhisper to exfiltrate browser data. Punishing Owl's attacks are politically motivated and focus exclusively on Russian targets, including government agencies, scientific institutions, and IT organizations. The group has established a presence on cybercriminal forums and social media, likely operating from Kazakhstan. Experts predict this group will continue to be a persistent threat in the Russian cyberspace.
In late 2025, Poland's energy system was targeted by a major cyberattack, now attributed to the Russia-aligned APT group Sandworm by ESET Research. The attack involved data-wiping malware named DynoWiper, detected as Win32/KillFiles.NMO. While the full impact is still under investigation, researchers noted the attack's timing coincided with the 10th anniversary of Sandworm's 2015 attack on Ukraine's power grid. Sandworm continues to target critical infrastructure, particularly in Ukraine, with regular wiper attacks. The group's history of disruptive cyberattacks and the similarities in tactics, techniques, and procedures led to a medium-confidence attribution of this latest incident to Sandworm.
The Knownsec leak exposes a state-aligned Chinese cyber contractor deeply integrated with national security and intelligence operations. Internal documents reveal Knownsec's role in developing offensive cyber capabilities, large-scale reconnaissance systems, and data fusion platforms for public security bureaus and military clients. Key products include ZoomEye for global IP scanning, GhostX for exploitation, and Passive Radar for covert network mapping. The leak provides unprecedented insight into Knownsec's organizational structure, personnel, and strategic targeting of foreign critical infrastructure, particularly in Taiwan and other Asian countries. It demonstrates how commercial entities like Knownsec function as core components of China's cyber-espionage ecosystem, blending state objectives with industrial-scale development of intrusion and surveillance technologies.
MuddyWater, an Iran-aligned cyberespionage group, has been targeting critical infrastructure in Israel and Egypt with custom malware and improved tactics. The campaign uses previously undocumented tools like the Fooder loader and MuddyViper backdoor to enhance defense evasion and persistence. Fooder masquerades as a Snake game and uses game-inspired techniques to hinder analysis. MuddyViper enables system information collection, file manipulation, and credential theft. The group also employs browser-data stealers and reverse tunneling tools. This campaign demonstrates MuddyWater's evolution towards more sophisticated and refined approaches, though traces of operational immaturity remain. The group continues to pose a significant threat, particularly to government, military, telecommunications, and critical infrastructure sectors in the Middle East.
ESET researchers have identified a new cyberespionage campaign by the Iran-aligned MuddyWater group targeting organizations in Israel and Egypt. The group uses custom malware tools, including a Fooder loader and the MuddyViper backdoor, employing advanced techniques such as CNG cryptography and reflective loading. The campaign focuses on critical infrastructure sectors and uses spearphishing emails with links to remote monitoring and management software to deliver its payloads. MuddyWater's toolset includes browser data stealers, credential stealers, and reverse tunneling tools, indicating enhanced stealth and credential harvesting capabilities.
Conti, a notorious ransomware operation identified in 2019, quickly gained infamy for its advanced encryption, rapid lateral movement, and double extortion tactics. Operated by the Russia-based Wizard Spider group, Conti evolved from Ryuk ransomware and maintained suspected ties to Russian state interests. Between 2019 and 2022, Conti targeted healthcare providers, governments, educational institutions, critical infrastructure, and private businesses, earning an estimated $180 million in 2021. Their aggressive tactics highlighted the urgent need for strong cybersecurity defenses. In 2022, internal divisions arose following leaked private chats. Conti's operations mimicked legitimate businesses, showcasing the industrialization of cybercrime and its devastating impact on critical sectors.
This intelligence report emphasizes the importance of understanding one's own environment and personal weaknesses in cybersecurity. It stresses the need for repeatable processes to maintain knowledge of one's environment and advocates for continuous learning to fill skill gaps. The report also highlights recent vulnerability disclosures by Cisco Talos across various software, including catdoc, Parallel, NVIDIA, and High-Logic FontCreator. It underscores the significance of promptly applying patches and remaining vigilant against potential exploits. Additionally, the report touches on recent cyber incidents affecting the NHS, United Natural Foods, and vulnerabilities in Google accounts and SinoTrack GPS devices.
