FlagThis - Latest Cybersecurity News

A three-month forensic investigation by CERT Polska and IOActive into the December 2025 cyberattack on the Polish energy sector has confirmed a multi-target campaign impacting at least two Combined Heat and Power (CHP) plants. The investigation identified a novel exploitation of private Access Point Names (APNs) used for cellular-based industrial connectivity. By leveraging these cellular-to-OT bridges, threat actors successfully bypassed traditional network perimeter defenses to access critical ICS/OT control systems. The incident involved the deployment of specialized ICS/OT malware, highlighting a sophisticated pivot from mobile telecommunications infrastructure directly into critical national infrastructure environments.

A coordinated cyberattack targeted over 30 Minnesota water and wastewater utilities, leveraging internet-exposed industrial control systems (ICS) via cellular modems. The campaign utilized critical vulnerabilities in Rockwell Automation controllers (CVE-2021-22681, CVE-2023-3595, CVE-2024-6242) and targeted Schneider Electric and Siemens PLCs. Threat actors, attributed to the Iranian-linked CyberAv3ngers (IRGC-CEC), progressed to "Phase 4" capabilities, employing legitimate vendor engineering software to exfiltrate PLC project files and manipulate Add-On Instructions (AOIs) to disable safety protocols. This resulted in operational shutdowns in Braham and transitions to manual operations across multiple municipalities, though no water quality contamination was reported.

The IRGC-linked threat actor CyberAv3ngers is executing a targeted campaign against critical infrastructure, specifically exploiting internet-facing Unitronics Vision PLCs, Federal Signal, and Genmark siren controllers. By leveraging weak or default credentials and unauthorized access to Human-Machine Interfaces (HMIs), the group manipulates emergency alert protocols and public warning systems. This shift from technical sabotage to "cyber-psychological warfare" aims to trigger mass public panic and erode societal trust in civil safety mechanisms. The campaign serves as a non-kinetic extension of regional geopolitical tensions, requiring urgent hardening of OT network segmentation and credential management to prevent mass societal destabilization.

CVE-2025-67038 is a critical OS command injection vulnerability affecting Lantronix EDS5000 series serial-to-Ethernet device servers. An unauthenticated remote attacker can achieve root-level system compromise by injecting arbitrary shell commands via the username parameter. With a CVSS score of 9.8 and confirmed active exploitation in the wild, the flaw enables full device takeover and potential lateral movement into sensitive industrial or management networks. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal remediation by June 26, 2026.

Iranian state-sponsored group MuddyWater, affiliated with the Ministry of Intelligence and Security, is actively targeting U.S. critical infrastructure by exploiting internet-exposed Rockwell Automation Programmable Logic Controllers (PLCs). The attackers leverage these exposed OT interfaces to deploy SSH backdoors for persistent access. Once established, they manipulate SCADA display data to deceive industrial operators, masking the actual state of physical processes within the water, energy, and government sectors. This activity, detailed in CISA/FBI Joint Advisory AA26-097A, represents a direct effort to facilitate operational disruptions through the manipulation of Industrial Control Systems (ICS).

A coordinated campaign is targeting Automatic Tank Gauge (ATG) systems across the U.S. energy sector, exploiting vulnerabilities in Modbus and proprietary serial-to-IP communication protocols. Attackers are leveraging insecure remote access gateways, such as cellular modems and VPNs, and exploiting hardcoded credentials or unauthenticated interfaces to gain unauthorized access. By injecting commands or spoofing telemetry data, actors can manipulate liquid level and pressure readings, potentially masking containment leaks or triggering false-positive emergency shutdowns. The lack of network segmentation between IT corporate environments and OT tank consoles facilitates lateral movement, creating significant risks of environmental contamination and fuel supply chain instability.

The National Cyber Security Centre (NCSC) has identified a strategic shift by state-sponsored actors targeting UK Critical National Infrastructure (CNI), transitioning from opportunistic espionage to "prepositioning" for future kinetic sabotage. Adversaries are utilizing Living-off-the-Land (LotL) techniques and targeting OT/ICS environments to maintain stealthy, long-term persistence. The attack surface has expanded to include the Defense Industrial Base (DIB) via compromised third-party Managed Service Providers (MSPs) and software update mechanisms. With 75% of CNI attacks attributed to nation-states, these operations aim to establish dormant access for physical disruption during geopolitical conflict, with AI-driven automated exploitation expected to scale these capabilities by 2028.

Around June 10, 2026, a cybersecurity incident targeted Mackay Sugar, Australia's second-largest raw sugar producer, causing the immediate shutdown of the Farleigh and Racecourse milling facilities in Queensland. The attack disrupted critical operational technology (OT) and logistics systems, forcing the isolation of industrial control systems and the suspension of cane haulage and harvesting activities. This interruption occurred at the onset of the annual crushing season, impacting approximately 1,300 supplying farms and threatening regional agricultural output and supply chain stability.

Between May 18 and May 24, 2026, CISA and the CCCS released a massive series of ICS/OT security advisories detailing critical vulnerabilities in industrial automation, energy, and building management systems. The research identifies significant flaws, including Remote Code Execution (RCE), Authentication Bypass, Buffer Overflows, and Denial of Service (DoS), affecting hardware from ABB, Siemens, Hitachi Energy, ZKTeco, and Kieback & Peter. Exploitation vectors include network-level access to industrial protocols and firmware, posing risks of unauthorized physical surveillance via ZKTeco, safety compromises in Kieback & Peter controllers, and kinetic impacts in ABB B&R automation environments. Immediate remediation via vendor-provided patches and firmware updates is essential to prevent widespread OT downtime.

Integration of Operational Technology (OT) into data center environments has introduced critical vulnerabilities within Vertiv and Trane UPS and HVAC systems. Attackers can exploit weaknesses in industrial protocols such as Modbus, BACnet, and SNMP, alongside insecure remote management interfaces and flawed firmware integrity checks. Successful exploitation enables unauthorized privilege escalation and manipulation of environmental controls or power distribution. This creates a high risk of thermal runaway, physical hardware destruction, and total facility outages, potentially cascading into municipal energy grid instability and significant SLA breaches for cloud and enterprise service providers.

The US House Homeland Security Subcommittee is investigating the escalation of AI-driven cyber-physical threats targeting critical infrastructure. Adversaries are deploying agentic AI to automate vulnerability discovery and execute autonomous attack chains, drastically reducing the time-to-exploit for ICS/OT environments to under 24 hours. Technical vectors include AI-generated polymorphic malware that bypasses signature-based EDR and deepfake-driven authentication bypass targeting critical personnel. These capabilities enable the transition from data exfiltration to kinetic disruption of power grids and water systems. Legislative efforts, specifically the "Great American AI Act" (Obernolte-Trahan), seek to establish federal guardrails and a new Center for AI Standards and Innovation (CAISI) to counter these rapid-cycle exploitation threats.