SCADA, industrial control, water and pipelines — where intrusions stop being an IT problem.
Deterministic keyword + taxonomy matches over the live threat graph — a daily sweep, not analyst attribution. Zero LLM. Last rebuilt 2026-10-16.
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Graph links |
|---|---|---|
| Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 478 |
| APT28 | [APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub… | 280 |
| VOID MANTICORE | [VOID MANTICORE](https://attack.mitre.org/groups/G1055) is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).(Citation: Check Point VOID MANTICORE Handala Hack March 2026) Active since at le… | 203 |
| Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territor… | 187 |
| Play | [Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructur… | 172 |
| Ember Bear | [Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training … | 161 |
| BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Rans… | 153 |
| Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: DOJ Russia Targeting Critical Infrastructure March 2022)(Citation: UK GOV… | 148 |
| Mofang | [Mofang](https://attack.mitre.org/groups/G0103) is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focus… | 123 |
| Windshift | [Windshift](https://attack.mitre.org/groups/G0112) is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Cit… | 110 |
| NIMBUS MANTICORE | [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/g… | 84 |
| RedEcho | [RedEcho](https://attack.mitre.org/groups/G1042) is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. [RedEcho](https://attack.mitre.org/groups/G1042) overl… | 83 |
| TEMP.Veles | [TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework desig… | 69 |
| Dragonfly 2.0 | [Dragonfly 2.0](https://attack.mitre.org/groups/G0074) is a suspected Russian group that has targeted government entities and multiple U.S. critical infrastructure sectors since at least December 2015. (Citation: US-CERT TA18-074A) (Citatio… | 1 |
| Sharpshooter | Operation [Sharpshooter](https://attack.mitre.org/groups/G0104) is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [La… | 1 |
Campaigns and intel pulses mentioning this sector, most recent first.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Night Dragon | [Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The … | — | — |
| Indian Critical Infrastructure Intrusions | [Indian Critical Infrastructure Intrusions](https://attack.mitre.org/campaigns/C0043) is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| ArcaneDoor | [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDo… | — | — |
| Operation Sharpshooter | [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, … | — | — |
| 2022 Ukraine Electric Power Attack | The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org… | Sandworm Team | — |
| Operation Dust Storm | [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| KV Botnet Activity | [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https… | Volt Typhoon | — |
| AI-Assisted Breach of Mexico's Government Infrastructure | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation… | — | — |
| Aoki: Infostealer Targets AI Coding Assistant Credentials | The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. This capability represents a recent addition, as earlier versions did not target AI-related files… | — | 2026-10-15 |
| Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware | This investigation reveals the first public confirmation of zero-click mercenary spyware delivered via targeted advertisements, termed AdFection. Devices at Al Jazeera were infected with Candiru spyware through malicious ads purchased by Is… | — | 2026-10-15 |
| US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide | The FBI seized seven web domains linked to Integrity Technology Group, a Chinese security firm allegedly providing hacking tools to Beijing-backed operatives. These tools enabled attacks on critical infrastructure, including a South Carolin… | — | 2026-10-09 |
| The state of AI-analysis evasion in malware | Malware authors are developing techniques to obstruct automated AI analysis by embedding natural-language instructions within their code. This 'AI-analysis evasion' targets the pipeline that extracts text from samples and submits it to lang… | — | 2026-10-08 |
| Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical Infrastructure | An Iranian state-aligned threat actor designated as CL-STA-1178 has been impersonating the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The Blinder Tunnel campaign, active since November 2025 w… | — | 2026-10-07 |
| Warlock Ransomware Attackers Hit Water and Telecom Operators | The China-nexus threat group Longlegs continues to deploy Warlock ransomware by exploiting Microsoft SharePoint vulnerabilities, particularly the ToolShell exploit chain. Over the past two months, the group targeted at least four organizati… | — | 2026-10-02 |
| Breaking the Seal: Static Deobfuscation of JSCeal's Compiled V8 Bytecode | Check Point Research developed a fully static deobfuscation pipeline to analyze JSCeal, a sophisticated cryptocurrency-focused stealer delivered as compiled V8 bytecode. The malware uses javascript-obfuscator with multiple protection layers… | — | 2026-09-30 |
Techniques used by the actors above — what to detect for, ranked by how many of them use it.
| Technique | ATT&CK | Used by | Actors |
|---|---|---|---|
| Ingress Tool Transfer | T1105 | Dragonfly, Play, APT28 | 9 |
| PowerShell | T1059.001 | Dragonfly, Play, Ember Bear | 9 |
| Exploit Public-Facing Application | T1190 | Dragonfly, Play, Ember Bear | 8 |
| File Deletion | T1070.004 | Dragonfly, Play, Ember Bear | 8 |
| External Remote Services | T1133 | Dragonfly, Play, Ember Bear | 7 |
| Malicious File | T1204.002 | Dragonfly, APT28, Kimsuky | 7 |
| Registry Run Keys / Startup Folder | T1547.001 | Dragonfly, APT28, Kimsuky | 7 |
| Tool | T1588.002 | Dragonfly, Play, APT28 | 7 |
| Data from Local System | T1005 | Dragonfly, Ember Bear, APT28 | 6 |
| Domains | T1583.001 | Dragonfly, APT28, Kimsuky | 6 |
| LSASS Memory | T1003.001 | Play, Ember Bear, APT28 | 6 |
| Match Legitimate Resource Name or Location | T1036.005 | Ember Bear, APT28, Volt Typhoon | 6 |
| Process Discovery | T1057 | Play, APT28, Volt Typhoon | 6 |
| Remote Desktop Protocol | T1021.001 | Dragonfly, Volt Typhoon, Kimsuky | 6 |
| Spearphishing Attachment | T1566.001 | Dragonfly, APT28, Kimsuky | 6 |
CISA KEV entries whose vendor, product or description matches this sector — 3 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2021-26828 | OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability | OpenPLC · ScadaBR | 2025-12-03 |
| CVE-2021-26829 | OpenPLC ScadaBR Cross-site Scripting Vulnerability | OpenPLC · ScadaBR | 2025-11-28 |
| CVE-2016-4523 | Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability | Trihedral · VTScada (formerly VTS) | 2022-04-15 |
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| GHSA-wpqr-6v78-jr5g | 10.0 | # Summary Gemini CLI (`@google/gemini-cli`) and the `run-gemini-cli` GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions… | |
| CVE-2026-34938 | 10.0 | ### Summary `execute_code()` in `praisonai-agents` runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a `str` subclass with an overridden `startswith()` method to the `_sa… | |
| CVE-2026-33663 | 10.0 | ## Impact An authenticated user with the `global:member` role could exploit chained authorization flaws in n8n's credential pipeline to steal plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderA… | |
| CVE-2026-54745 | 10.0 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability th… | |
| CVE-2026-72733 | 9.9 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backup… | |
| CVE-2026-54680 | 9.9 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings su… | |
| CVE-2026-0933 | 9.9 | **Summary** A command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without… | |
| CVE-2026-45262 | 9.9 | ## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A scoped `ApiKey` with `fullaccess=0` and an `ApiAccess` row granting `allowget=1` on the `clientes` resource only… | |
| CVE-2026-19656 | 9.9 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system comma… | |
| CVE-2026-49252 | 9.9 | ### Impact Prototype pollution in deepstream server v <=10.0.4. Potential privilege escalation from any authenticated user with write permission to any record. ### Patches Yes, upgrade to v10.0.5 ### Workarounds Filter… | |
| CVE-2026-33322 | 9.8 | ### Impact _What kind of vulnerability is it? Who is impacted?_ A JWT algorithm confusion vulnerability in MinIO's OpenID Connect authentication allows an attacker who knows the OIDC `ClientSecret` to forge arbitrary id… | |
| CVE-2026-25895 | 9.8 | ### Summary **Description** A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.… | |
| CVE-2025-34274 | 9.8 | Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash p… | |
| CVE-2026-25894 | 9.8 | ### Description An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when au… | |
| CVE-2026-25893 | 9.8 | ### Note GitHub incorrectly stated this vulnerability is identical to CVE-2025-69970, which describes the fact that authentication is disabled by default. This advisory describes an exploit chain that enables authenticat… |
Named leak-site victims classified into this sector (ransomware.live taxonomy), most recent first.
No ransomware victims currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
Get a daily email when something new touches critical infrastructure — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.