Critical Infrastructure threat landscape
SCADA, industrial control, water and pipelines — where intrusions stop being an IT problem.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 15
- Actively-attacked vulnerabilities (CISA KEV)
- 4
- Ransomware victims, last 90 days
- 94
- Ransomware victims, since 2026-06
- 128
Shared bucket: ransomware.live groups Energy into “Energy, Energy & Utilities” — the ransomware figures on this page are the same victims shown on the Energy page, not additional ones.
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| Kimsuky | Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 485 |
| APT28 | APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub… | 283 |
| VOID MANTICORE | VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at le… | 212 |
| Volt Typhoon | Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territor… | 194 |
| Play | Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructur… | 182 |
| Ember Bear | Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training… | 164 |
| BlackByte | BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled [BlackByte Rans… | 163 |
| Dragonfly | Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: UK GOV… | 161 |
| Mofang | Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focus… | 123 |
| Windshift | Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Cit… | 115 |
| NIMBUS MANTICORE | NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/g… | 94 |
| RedEcho | RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overl… | 85 |
| TEMP.Veles | TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework desig… | 72 |
| Dragonfly 2.0 | Dragonfly 2.0 is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. (Citatio… | 1 |
| Sharpshooter | Operation Sharpshooter is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [La… | 1 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 41.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| 2022 Ukraine Electric Power Attack | The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org… | Sandworm Team | — |
| Night Dragon | Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The… | — | — |
| KV Botnet Activity | KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https… | Volt Typhoon | — |
| ArcaneDoor | ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDo… | — | — |
| Operation Dust Storm | Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| Operation Sharpshooter | Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom,… | — | — |
| Indian Critical Infrastructure Intrusions | Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| AI-Assisted Breach of Mexico's Government Infrastructure | The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation… | — | — |
| US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide | The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolin… | — | 2026-10-09 |
| Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical Infrastructure | An Iranian state-aligned threat actor designated as CL-STA-1178 has been impersonating the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The Blinder Tunnel campaign, active since November 2025 w… | — | 2026-10-07 |
| Warlock Ransomware Attackers Hit Water and Telecom Operators | The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizati… | — | 2026-10-02 |
| Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities | A suspected Chinese-speaking threat actor conducted targeted intrusions against Philippine nuclear research and defense organizations. On August 13, 2026, an open directory on a VPS exposed custom Python scripts exploiting CVE-2023-49105 in… | — | 2026-09-25 |
| AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution | This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized mal… | — | 2026-09-22 |
| PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure | A previously undocumented custom backdoor called PATCHCORD has been identified targeting Afghan telecom providers and South Asian critical infrastructure organizations. The C/C++ implant is delivered through sector-specific lures including… | — | 2026-09-12 |
| Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure | A massive cybercrime campaign tracked as CL-CRI-1171 has operated undetected for at least two years, utilizing a pay-per-install marketplace to distribute multiple malware families. The operation targeted primarily young gamers through YouT… | — | 2026-09-09 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 292.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 4 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2023-6448 | Unitronics Vision PLC and HMI Insecure Default Password Vulnerability | Unitronics · Vision PLC and HMI | 2023-12-11 |
| CVE-2021-38406 | Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability | Delta Electronics · DOPSoft 2 | 2022-08-25 |
| CVE-2018-7841 | Schneider Electric U.motion Builder SQL Injection Vulnerability | Schneider Electric · U.motion Builder | 2022-04-15 |
| CVE-2016-8562 | Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability | Siemens · SIMATIC CP | 2022-03-03 |
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-19188 | 10.0 | A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socke… | |
| CVE-2026-25938 | 9.8 | ### Summary **Description** An authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This affects FUXA versio… | |
| CVE-2026-25895 | 9.8 | ### Summary **Description** A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.… | |
| CVE-2023-6448 | 9.8 | Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.… | KEV |
| CVE-2026-25894 | 9.8 | ### Description An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when au… | |
| CVE-2026-25893 | 9.8 | ### Note GitHub incorrectly stated this vulnerability is identical to CVE-2025-69970, which describes the fact that authentication is disabled by default. This advisory describes an exploit chain that enables authenticat… | |
| CVE-2026-63353 | 9.6 | Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the func… | |
| CVE-2026-63354 | 9.6 | Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user… | |
| CVE-2026-63350 | 9.6 | Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into i… | |
| CVE-2026-25939 | 9.1 | ### Summary An authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This vul… | |
| CVE-2026-25752 | 9.1 | ### Summary **Description** An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. This affects FUXA through version 1.2.9. This issue has been patc… | |
| CVE-2026-34184 | 9.1 | AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts … | |
| CVE-2025-41669 | 8.8 | The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capabi… | |
| CVE-2025-14849 | 8.8 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.… | |
| CVE-2026-34185 | 8.8 | AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control ov… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Energy & Utilities / Energy), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Pengurusan Aset Air Berhad | qilin | 2026-10-18 |
| Luzco Ilumination | emperador | 2026-10-18 |
| ECO USA | N0n | 2026-10-18 |
| ONEOK, Inc. | Redact | 2026-10-16 |
| Petroleum Telcom Communications | thegentlemen | 2026-10-16 |
| Hocon Gas | qilin | 2026-10-15 |
| Colorado Texas | nightspire | 2026-10-14 |
| IGPL | HYFLOCK | 2026-10-13 |
| Comisión Municipal de Agua Potable y Alcantarillado de Victoria | qilin | 2026-10-13 |
| Greentech Environmental | interlock | 2026-10-12 |
| Prodiel | qilin | 2026-10-12 |
| Eversource Energy | Redact | 2026-10-12 |
| Confipetrol | qilin | 2026-10-11 |
| CALICHE | Majinahanashi | 2026-10-10 |
| Supreme Energy | Panzer | 2026-10-09 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches critical infrastructure — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.