Threats tagged 'ics'

Exploitation activity targeting CVE-2026-58115, an unauthenticated Node-RED admin API vulnerability, was detected on October 30, 2026. Attackers used Node-RED's inject and exec nodes to execute commands without authentication, deploying malicious flows that download and execute Linux bots. The payloads included staged shell scripts and persistent webshells, with binaries saved in RAM-backed storage to evade disk forensics. This vulnerability affects Node-RED embedded in critical infrastructure products such as Siemens SIMATIC IoT2050 devices, posing a risk to industrial control systems environments. The exploitation appears opportunistic and involves mass scanning across multiple CVEs rather than targeted attacks.

This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.

MITRE ATT&CK version 20 introduces new techniques and detection strategies addressing AI abuse, multi-factor authentication (MFA) bypass, and attacks on water utilities. The update includes 15 new detection strategies for Enterprise and ICS environments, supported by 38 analytics. Notable additions cover prompt injection attacks on large language models, theft of application-specific passwords to bypass MFA, CAPTCHA bypass methods, and attacks on internet-exposed programmable logic controllers (PLCs) at water utilities. The update also documents threat actor activities, including espionage groups and ransomware operators. These enhancements reflect recent adversary tactics and tradecraft without confirming active exploitation or specific vulnerabilities.

This report summarizes multiple cybersecurity developments including the ICS-Sniper proof-of-concept attack targeting industrial control systems using cloud-hosted SCADA, an unauthenticated remote code execution vulnerability in XWorm RAT's C2 panel allowing takeover, a critical Langflow vulnerability exploited before public disclosure, and an AI-assisted Chrome exploit chain that earned a $250,000 bounty. Additional topics include Bank of America's large-scale patching effort, KGB RAT malware with harassment features, and a data breach affecting Burger King Japan's app. The ICS-Sniper attack manipulates VPN-encrypted traffic to disrupt industrial operations. The XWorm flaw allows attackers to run code on the command-and-control server without operator interaction. The Langflow flaw permits authenticated users to execute arbitrary code on the server and has been actively exploited. The Chrome exploit combined three bugs now fixed by Google. These incidents highlight ongoing threats to industrial, enterprise, and consumer environments.

Siemens, Schneider Electric, and Rockwell Automation released multiple security advisories addressing vulnerabilities in industrial control systems (ICS) products. Siemens issued 17 advisories covering critical to medium-severity flaws in various products including Simatic S7-1500 CPUs and Ruggedcom devices. Schneider Electric disclosed two high-severity vulnerabilities affecting Pro-face and Sage RTUs. Rockwell Automation fixed two vulnerabilities in 1732E ArmorBlock, including a critical flaw allowing unauthenticated password changes leading to admin takeover. ABB reported possible probing activity against a dynovaPRO credential reset vulnerability but no confirmed exploitation. Additional advisories from CISA and CERT@VDE cover other ICS products. Patches and mitigations are available for many of these issues.

CISA has issued an urgent warning to patch a critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure (ICS) appliances. This flaw has been actively exploited in zero-day attacks since at least October 1, 2026, allowing unauthenticated remote attackers to execute arbitrary commands. Ivanti has released multiple patched versions addressing this issue and urges immediate updates. The vulnerability has been used in complex exploit chains leading to root-level code execution and credential theft. CISA mandates federal agencies to patch and recommends all organizations to check for compromise and remediate accordingly.

Ivanti Connect Secure (ICS) remote access gateway is affected by a high-severity zero-day vulnerability (CVE-2026-104935) that allows authentication bypass and remote code execution without user interaction. The vulnerability affects ICS versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Threat actors have exploited this flaw in the wild since at least October 1, 2026, chaining it with other vulnerabilities to achieve unauthenticated root-level code execution. Ivanti has released patches for some related flaws and is working on addressing a privilege escalation vulnerability used in the attack chain. Customers are urged to immediately apply available patches and use the Integrity Checker Tool to detect tampering.

Critical infrastructure organizations face increasing cyber risks from nation-state groups, particularly those affiliated with Iran, and AI-driven attacks. These adversaries have shifted from espionage to destructive attacks targeting essential services like water, energy, and government facilities. Challenges include asset visibility gaps, especially in older operational technology (OT) systems that are difficult to inventory and patch. Attackers leverage AI to rapidly map IT/OT networks and exploit legacy systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) advises critical infrastructure operators to strengthen cyber hygiene by reducing vulnerabilities, replacing unsupported legacy devices, and preparing rapid recovery plans. CISA emphasizes foundational cybersecurity practices such as employee education, strong authentication, timely patching, monitoring, data backup, and incident response planning. This guidance aims to help organizations mitigate risks from sophisticated nation-state and AI-enhanced cyber threats.

This analysis discusses the challenges and preparations organizations should undertake for post-quantum authentication, focusing on the impact of new cryptographic algorithms on certificate ecosystems. It highlights that post-quantum authentication affects not only cryptographic correctness but also operational processes, interoperability, and infrastructure readiness across diverse environments. Microsoft has initiated a Post-Quantum Cryptography (PQC) TLS Pilot Program to help certificate authorities test interoperability and operational readiness in controlled environments. Organizations are advised to inventory certificate dependencies, assess vendor roadmaps, and create test environments to identify compatibility and process gaps before large-scale deployment. The transition to post-quantum authentication is a multi-year effort requiring early and continuous testing to address performance, compatibility, and operational challenges.

The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.

NIST has released a draft update to its Operational Technology (OT) Security Guide (Special Publication 800-82 Revision 4) for public comment, expanding coverage to additional sectors and aligning with the NIST Cybersecurity Framework 2.0. Concurrently, CISA and the FBI issued guidance warning critical infrastructure operators about risks associated with third-party ICS integrators, emphasizing the principle of least privilege and recommending contractual cybersecurity requirements. The agencies highlighted a 2025 intrusion where foreign actors accessed an industrial automation company's network, potentially enabling disruptive downstream attacks. The guidance advises monitoring remote access, minimizing exposure, and incorporating cybersecurity controls in service agreements.

AI advancements are accelerating the discovery of vulnerabilities, leaving many operational technology (OT) systems unpatchable and at risk. These OT systems often run on legacy or bespoke software that cannot be easily updated or patched. Ignoring these vulnerabilities is not a viable defense. Instead, network-based protections such as micro-segmentation, next-generation firewalls (NGFW), and intrusion prevention systems (IPS) can provide compensatory controls by filtering and blocking exploit attempts. The concept of air-gapping is often ineffective in practice due to operational shortcuts. While patching remains the best defense, these layered network protections help mitigate risks where patching is impossible.

The Australian Signals Directorate (ASD) is transitioning from the Essential Eight cybersecurity framework to a new outcomes-based Essentials series starting mid-2027, with full retirement of the Essential Eight expected around mid-2028. This shift moves organizations away from periodic, checklist-style compliance assessments toward continuous validation of security posture across enterprise IT, cloud, operational technology (OT), and potentially agentic AI environments. The new framework emphasizes demonstrating ongoing achievement of security outcomes rather than merely implementing specific controls. Compliance with the Essential Eight remains mandatory only for certain Commonwealth entities, while private-sector adoption is voluntary but often expected by insurers and government contractors. The Essentials series introduces chapters tailored to different environments, reflecting their unique security challenges and dynamic nature. Exposure management tools are highlighted as a means to continuously identify and prioritize security exposures and provide real-time evidence of security posture.

Multiple critical and high-severity vulnerabilities affecting industrial control system (ICS) products from Schneider Electric, Siemens, Aveva, and Rockwell Automation were disclosed and patched in the September 2026 Patch Tuesday cycle. Notably, Schneider Electric fixed a critical authentication vulnerability in Modicon M580 controllers (CVE-2026-3869, CVSS 9.2), and Siemens addressed critical flaws in several products including Reyrolle 7SR5 and Industrial Edge Management. Aveva and Rockwell Automation also released patches for high-severity issues in their ICS components. These vulnerabilities could impact the security of critical industrial infrastructure if left unpatched.

Tenable is integrating Anthropic's Claude Mythos 5 AI model into its Tenable One Exposure Management Platform. This integration, starting with the new Adversary View feature, aims to enhance security teams' ability to identify complex vulnerability chains by reasoning across scattered low-signal data that traditional rules engines miss. Adversary View uses advanced adversarial reasoning to analyze raw scan data and prioritize defensive actions that disrupt attacker progression. This approach helps defenders see their environments from an attacker's perspective and focus remediation efforts more effectively. The offering is positioned as an AI-powered enhancement to exposure management rather than a vulnerability or exploit.

The ICS Cybersecurity Conference will feature a hands-on Cyber Attack Methods (CAM) training course focused on cyber-physical systems. This course places participants in a virtual environment to simulate adversary tactics against industrial control systems, helping defenders and engineers understand attack processes and improve system resilience. The training is designed for a broad audience including engineers and developers, not just security professionals. It aims to enhance practical knowledge of how cyber-physical attacks unfold and how to mitigate them. The course is US citizen-only and requires an Intel-based laptop to run the virtual machine environment.

Multiple U.S. government agencies have issued a joint advisory warning of active threat actors targeting Siemens S7 Series programmable logic controllers (PLCs) exposed to the internet or insufficiently segmented. These actors use AI-generated exploitation scripts disguised as legitimate OT monitoring tools to conduct reconnaissance and build capabilities for potential future disruptive attacks. The threat affects all CPU variants of the S7-200, S7-300, S7-400, S7-1200, and S7-1500 series. There is no single patch because the threat exploits multiple known weaknesses and exposure issues. Mitigation focuses on removing direct internet exposure, segmenting OT from IT networks, and hardening access controls. The advisory emphasizes that all PLC operators, regardless of vendor, should apply relevant mitigations. The threat is distinct from a prior Iranian-linked campaign and is unattributed to any specific group.

In late 2025, a small combined heat-and-power (CHP) plant in Poland was breached by attackers using a private APN to access its operational technology (OT) network. The attackers exploited a misconfiguration that allowed devices within the private APN network to communicate freely, enabling lateral movement. They compromised a FortiGate VPN/firewall and a Teltonika cellular router to tunnel into the private APN, then accessed a WAGO PFC200 PLC with default credentials. The attackers subsequently disabled key systems including a steam turbine and water treatment system by switching PLCs to STOP mode and activating password protection. The outage was short-lived and did not impact the population. This incident is notable as the first known real-world cyberattack leveraging lateral movement through a private APN to reach OT networks. The Polish CERT recommends treating private APNs as untrusted external networks and implementing client isolation and traffic allowlists.

Hackers linked to Iran targeted industrial control systems (ICS) at water facilities in at least a dozen US states. The post New Jersey, Alabama Join States Targeted in Water Cyberattacks appeared first on SecurityWeek .

Canada’s new Critical Cyber Systems Protection Act (Bill C-8) introduces a strict 72-hour cyber incident reporting mandate. Find out how Tenable is helping critical national infrastructure operators bridge the IT/OT divide to ensure full compliance. Key takeaways: Bill C-8 introduces stringent new cyber incident reporting requirements and heavy financial penalties for critical infrastructure operators. Eliminating network blind spots with a hybrid IT/OT discovery approach, including Safe Active Querying for isolated, hard-to-reach process-control systems, enables operators to establish a required security baseline. Predictive Vulnerability Priority Rating (VPR) scoring helps you prioritize and focus limited resources on the critical flaws that actually threaten physical safety and uptime. Advanced multi-detection engines and seamless IT workflow integrations accelerate mean-time-to-respond (MTTR) to help both security teams and operators align with a strict 72-hour reporting requirement. With the enactment of Canada’s Critical Cyber Systems Protection Act (CCSPA), commonly known as Bill C-8, the Canadian federal government is laying down a clear framework to protect the cyber-physical systems that are vital to national critical infrastructure security. For designated operators in telecommunications, energy, transportation, and banking, the mandate is clear: Establish formalized cybersecurity programs, mitigate supply chain risks, and — most critically — report cyber incidents to authorities within 72 hours. Failure to comply carries heavy consequences, including penalties that can reach up to $15 million Canadian dollars (CAD). But beyond the threat of fines, Bill C-8 highlights a fundamental operational challenge that many industrial organizations are still struggling to solve: How can you detect, investigate, and report a breach in 72 hours when you lack unified visibility across your converged IT and OT environments? Requirements for meeting Bill C-8's 72-hour incident reporting mandate In modern industrial operations and critical infrastructure, the line between IT and OT continues to blur. The introduction of connectivity (e.g., IoT-connected cameras and building management systems) has optimized processes and service delivery, but it has also introduced new cyber exposures. Today, threat actors do not honor traditional network silos; they frequently compromise a web-facing IT asset or IoT device and move laterally into the operational technology (OT) environment to disrupt physical processes. Meeting a 72-hour incident reporting window is nearly impossible if your security team is relying on fragmented point solutions. Solutions that focus exclusively on passive OT network monitoring often leave massive blind spots — especially considering that IT and IoT devices can constitute up to 50% of an industrial environment. When an incident occurs, teams waste precious hours manually correlating alerts across disconnected tools rather than actively investigating the root cause. To comply with CCSPA and protect uptime, critical national infrastructure (CNI) operators must bridge the IT/OT security divide. Establish your CCSPA cybersecurity baseline The CCSPA requires operators to implement formalized cybersecurity programs. The foundation of any mature security program is a comprehensive asset inventory — you cannot secure what you cannot see. The Tenable One Exposure Management Platform helps organizations eliminate security blind spots by building a complete, unified inventory of all OT, IoT, and IT assets. Tenable goes beyond passive-only network monitoring with our proprietary Safe Active Query technology. This hybrid approach safely communicates with industrial devices in their native protocols to uncover significantly more assets than passive monitoring alone — including dormant process control systems, shadow IT, and unmanaged IoT — without disrupting process integrity or impacting equipment uptime. Prioritize what matter…

Vulnerability#local#webCanada