Transportation threat landscape
Airlines, shipping, rail and logistics — operational disruption is the extortion lever, cargo data the prize.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 11
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 147
- Ransomware victims, since 2026-06
- 193
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| FIN7 | FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, fin… | 366 |
| Leviathan | Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citat… | 236 |
| HEXANE | HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been locat… | 215 |
| APT33 | APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and… | 182 |
| Dragonfly | Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.(Citation: UK GOV… | 161 |
| menuPass | menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Mi… | 153 |
| LazyScripter | LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.… | 147 |
| Chimera | Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Ch… | 121 |
| TA2541 | TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1… | 120 |
| NIMBUS MANTICORE | NIMBUS MANTICORE is a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/g… | 94 |
| Tropic Trooper | Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focus… | 89 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 51.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Wocao | Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| C0010 | C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts op… | — | — |
| APT41 DUST | APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campa… | APT41 | — |
| Indian Critical Infrastructure Intrusions | Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| Operation Dust Storm | Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia | Infrastructure analysis reveals a cluster of SpiceRAT command and control servers active from late 2025 through August 2026, linked through shared TLS certificates, domain registrations, and a cloned RTX Corporation webpage. The infrastruct… | — | 2026-10-16 |
| MATCHBOIL: New tricks, same old evil intentions | ESET researchers documented the evolution of MATCHBOIL, a custom C# downloader used by Russia-aligned APT group UAC-0099. The malware downloads payloads from command-and-control servers, installs them, and establishes persistence on victim… | — | 2026-10-09 |
| Behind the Connect Button: The Fake AI Ads Campaign | Security researchers uncovered a sophisticated human-operated phishing platform disguising itself as AI advertising products for major platforms including Muse, Gemini, Claude, ChatGPT, and Perplexity. The campaign uses a Browser-in-the-Bro… | — | 2026-10-07 |
| Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical Infrastructure | An Iranian state-aligned threat actor designated as CL-STA-1178 has been impersonating the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. The Blinder Tunnel campaign, active since November 2025 w… | — | 2026-10-07 |
| Caught in 4K: The Gentlemen Files | A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent lea… | — | 2026-10-05 |
| Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America | Two distinct multi-stage network intrusion campaigns are actively targeting Latin American organizations, with attackers leveraging artificial intelligence tools to enhance their capabilities. The Mexican transportation campaign (CL-CRI-113… | — | 2026-10-03 |
| Counterfeit installers to system compromise: Tracking a deceptive software download campaign | A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users… | — | 2026-10-02 |
| ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | UNC6240, also known as ShinyHunters, has resumed mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft systems globally across multiple sectors including education, technology, healthcare, agriculture, transportation, and governme… | — | 2026-09-28 |
| PhantomCore and PhantomGraph backdoors delivered via an unpatched TrueConf server | The Head Mare APT group exploited a chain of vulnerabilities in TrueConf video conferencing servers to deploy PhantomCore and PhantomGraph backdoors. Attackers connected to unpatched TrueConf servers via port 4307/TCP without authorization,… | — | 2026-09-10 |
| Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set | Mirage Kitten, an APT group historically focused on the Middle East and Africa, has deployed two previously undocumented cross-platform remote access trojans: NodeRabbit (Node.js-based) and PollCat (JavaScript-based). Both malware families… | — | 2026-09-03 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 213.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| GHSA-xhj4-g6w8-2xjw | 9.8 | ### Impact When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by … | |
| CVE-2026-60583 | 8.8 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacke… | |
| CVE-2026-87780 | 8.8 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to … | |
| CVE-2026-38056 | 8.8 | A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastr… | |
| CVE-2026-87781 | 8.6 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.… | |
| CVE-2026-61005 | 8.1 | Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability … | |
| CVE-2026-61009 | 8.0 | Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerabilit… | |
| CVE-2026-60584 | 7.6 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged … | |
| CVE-2026-70791 | 7.6 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows … | |
| CVE-2026-14952 | 7.5 | An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. Th… | |
| CVE-2026-61006 | 7.2 | Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability … | |
| CVE-2026-61299 | 7.1 | Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability … | |
| CVE-2026-60957 | 5.4 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows … | |
| CVE-2026-107160 | 5.3 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links … | |
| CVE-2026-107158 | 5.3 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LT… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Transportation / Transportation/Logistics), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Toyota Canarias | qilin | 2026-10-19 |
| SkyWorld Air Cargo | qilin | 2026-10-19 |
| Baltimore Tank Lines | Storm | 2026-10-19 |
| Patriot Maritime | Storm | 2026-10-19 |
| BRUTRA Logistek | qilin | 2026-10-18 |
| monroeroadways.com | settra | 2026-10-18 |
| PART2 Global AirFreight International | Eclipse | 2026-10-17 |
| Brenner Base Tunnel | everest | 2026-10-17 |
| Adams Warehouse & Delivery, Inc. | aurora | 2026-10-16 |
| Axle Logistics | thegentlemen | 2026-10-16 |
| Keio Corporation | qilin | 2026-10-15 |
| E-Z Pack Trucks | Wallstreet | 2026-10-14 |
| Excess Baggage | ransomhouse | 2026-10-13 |
| ConAuto | qilin | 2026-10-12 |
| GlobalNet LCL (port agency operations) | N0n | 2026-10-12 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches transportation — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.