#Critical Infrastructure
All CosmicBytez Labs articles tagged #Critical Infrastructure, across news, security advisories, how-to guides, and projects.
- News
BAE Systems Cyberattack Disrupts US Federal Court Operations
A cyberattack on contractor BAE Systems has knocked the Bankruptcy Noticing Center offline since Oct. 9, halting notices for every US bankruptcy court.
- News
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Hundreds of EU grocery stores lost tens of millions of euros after attackers exploited outdated, vendor-managed Danfoss refrigeration firmware.
- News
Ukraine Says Elon Musk's Starshield Service Partially Restored After Restrictions Disrupted Drone Missions
Ukraine's Defense Ministry says Starshield connectivity for moving terminals is restored, days after unannounced speed cap disrupted frontline drone missions.
- News
Cyberattack Hijacks Danfoss Controllers, Shuts Down Refrigerators at French Supermarkets
Attackers hijacked legacy Danfoss refrigeration controllers, forcing nonstop defrost cycles that pushed hundreds of French supermarket freezers to 50°C.
- News
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
CyberXero combined Claude Code, PentAGI, and Cobalt Strike to steal 628,000+ Ukrainian records and probe national energy infrastructure.
- News
FBI Seizes Seven Domains, Disrupts Flax Typhoon's MicroScan and FishHub Hacking Tools
FBI and DOJ seized seven domains used by China's Flax Typhoon to run MicroScan and FishHub, tools tied to critical infrastructure intrusions worldwide.
- News
Yandex Confirms Service Outage as Drone Strikes Disable Three Data Centers
Drone strikes on three Yandex data centers cut Russian cloud connectivity to roughly 30%, knocking out storage, payments, and dozens of services.
- News
FBI Seizes Seven Domains Behind Flax Typhoon's MicroScan and FishHub Hacking Tools
The FBI seized seven domains used by China-linked Flax Typhoon to run MicroScan and FishHub, tools tied to breaches of global critical infrastructure.
- News
FBI, Allies Expose China-Linked Flax Typhoon Portal Selling Stolen Email Access
FBI and 6 allied nations say China's Integrity Tech ran a portal selling access to emails stolen from Southeast Asian governments and healthcare systems.
- News
Ransomware Attack Disrupts Japan's IDCF Cloud Used by Government Clients
A ransomware attack on SoftBank-owned IDC Frontier's IDCF Cloud knocked out Japan's East Japan Region 1, disrupting 495 companies and government clients.
- News
Trump Names DNI Jay Clayton to Lead New Federal "Super Intelligence Force" on AI
President Trump named DNI Jay Clayton to lead a new "Super Intelligence Force," with 120 days to report on AI risk and oversight.
- News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs, letting attackers steal storage admin credentials and gain root on Kubernetes nodes.
- News
'Warlock' Ransomware Hits Critical Infrastructure in Portuguese- and Spanish-Speaking Countries
A China-nexus threat actor is exploiting Microsoft SharePoint flaws, including ToolShell, to deploy Warlock ransomware against critical infrastructure.
- News
Mississippi Mayor Says Ransomware Incident Led City to Shut Down Systems
A ransomware attack forced Vicksburg, Mississippi to shut down city computer systems; Mayor Willis Thompson says the FBI and DHS are investigating.
- News
Osavul Raises $10M to Spot Hostile Intent Across Cyber and Physical Domains
Hybrid risk intelligence firm Osavul closed a $10M Series A led by 33N Ventures to expand AI-driven threat detection for critical infrastructure.
- News
Warlock Ransomware Breaches Water Utility, Telecom via SharePoint Flaws
New forensic detail reveals a 9-day Warlock ransomware intrusion chain that hit a water utility, telecom operator, government body, and university.
- News
CISA Warns of Critical Pre-Auth RCE Flaw in MikroTik RouterOS
CISA warns of CVE-2026-84411, a critical CVSS 9.8 pre-auth flaw in MikroTik RouterOS letting unauthenticated attackers gain root RCE or crash the device.
- News
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
ATNS found ransomware-linked malware on an operational network tied to weather data, and is probing possible exfiltration to China-based IPs.
- Security
CVE-2026-63713: Time-Based Blind SQL Injection in Toptech TMS7 and TopHAT Audit Logs
Critical CVSS 9.0 time-based blind SQL injection in Toptech TMS7/TopHAT audit log search hits fuel terminal ICS/OT systems worldwide; patched in 7.8.
- Security
CVE-2026-68068: Toptech TMS7 and TopHAT Critical SQL Injection in Transaction Queue Viewer
Critical CVSS 9.0 time-based blind SQL injection in Toptech TMS7/TopHAT terminal management software's transaction queue viewer; patched in v7.8.
- News
Japan's Keio Confirms Ransomware Attack Disrupted Business Systems
Keio Group confirmed a ransomware attack hit servers on September 26, disrupting hotel, retail, and bus payment systems; trains stayed unaffected.
- News
How Tax Policy Could Help Stop Threat Actors From Breaching US Water Systems
An op-ed argues Congress should clarify existing tax incentives, not new grant programs, to fund cybersecurity at cash-strapped water utilities now.
- News
Kiteworks Urges Customers to Shut Down Servers Over Possible Imminent Zero-Day Attack
Kiteworks told 1,500+ customers to shut down servers for a multi-hour window after credible threat intel warned of a possible imminent zero-day attack.
- News
How Tax Incentives Could Shield US Water Utilities From Cyberattacks
A new op-ed argues federal tax incentives under the One Big Beautiful Bill could fund water utility cybersecurity faster than new federal programs.
- News
Deception by Design: CISA's Guide to Tricking Cybercriminals
CISA's new deception guide helps resource-strapped orgs deploy honeypots and honeytokens to catch attackers using stolen credentials.
- News
After Water Attacks, Congress Pitches Its Own AI Cyber Defense Pilot
Gottheimer's $100M CISA bill would give water utilities free AI tools, rivaling the White House's Texas pilot.
- News
CenterPoint Energy Confirms Data Theft as Hacker Leaks Files, Threatens Grid Attack
CenterPoint moves from 'investigating' to confirmed data theft as the alleged attacker publishes a 2.5GB archive and threatens infrastructure attacks.
- News
CenterPoint Energy Warns Customers of Data Breach After Dark Web Post
CenterPoint Energy confirms unauthorized access to customer data after a threat actor's dark web post claiming 7.49M stolen records.
- News
CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate
CISA, FBI, and Five Eyes partners publish joint crisis-comms guidance urging providers to drop PR spin and disclose outage root causes transparently.
- Security
CVE-2023-49105: CISA Adds ownCloud Auth Bypass to KEV After Nuclear Data Theft
CISA added ownCloud's critical pre-signed URL auth-bypass flaw (CVSS 9.8) to its KEV catalog after it was used to steal Philippine nuclear data.
- News
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
Operation Economic Outcast sanctions ~60 Iran-linked entities including MOIS-affiliated hackers who hit energy, defense, healthcare, and US government.
- News
CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs
FBI and CISA warn that Medusa ransomware has breached 500+ US critical infrastructure organizations since 2021, demanding ransoms up to $15 million.
- News
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
A CISA/FBI joint advisory warns that Gunra ransomware — a Conti-derived RaaS — has claimed 51+ victims by exploiting critical Fortinet FortiOS...
- News
Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
Attackers penetrated the operational technology network of a Polish combined heat and power plant through the grid operator's private cellular network,...
- Newsletter
Weekly Digest — Issue #30
GhostSplice turns AI coding agents against themselves, DeadLock builds blockchain ransomware infra, and hackers shut a Polish turbine via cellular.
- News
Critical Flaws Discovered in Belgian eID Software Used by 2 Million People
Security researchers uncovered critical vulnerabilities in Belgium's eID middleware software, affecting eight of the country's ten largest banks and over...
- News
FBI, South Korea Warn of Gunra Ransomware Gang Targeting Critical Infrastructure
The FBI and South Korea's government have jointly warned that the Gunra ransomware gang is breaching critical infrastructure through vulnerabilities in...
- News
Russian Hackers Breached Polish Energy Plant via Private APN in World-First DER Cyberattack
ELECTRUM/Sandworm compromised a Polish heat-and-power plant serving 50,000 residents through a private cellular APN, marking the first recorded...
- News
Senate Democrats Introduce Water Cyber Shield Act to Fund $300M Annual Water System Cybersecurity
Senators Schiff and Klobuchar introduce legislation directing $300 million per year to secure U.S. water and wastewater infrastructure following...
- News
Coast Guard Says It Is Monitoring Cyberattack That Disrupted North Carolina's Ports
A cyberattack on August 4, 2026 forced all three North Carolina Ports Authority facilities — Wilmington, Morehead City, and Charlotte Inland Port — to...
- News
Analog Devices Discloses Data Breach, Says Operations Unaffected
American semiconductor giant Analog Devices has disclosed that an unauthorized party accessed some of its systems and exfiltrated certain files, though...
- News
Origin Energy Data Breach Exposes Millions of Australian Customers
Australia's largest energy retailer has confirmed a data breach affecting up to 2 million customers, with exposed data including full names, contact...
- News
Swiss Rail Giant Stadler Rejects $12.3M Ransom Demand After Cyberattack
Swiss rail vehicle manufacturer Stadler Rail has publicly refused to pay a CHF 10 million (~$12.3M USD) ransom demanded by the Everest ransomware group...
- News
Hackers Abuse ViPNet Software to Target Russian Government Agencies
An advanced threat actor is exploiting the ViPNet private networking suite's update mechanism via DLL sideloading to compromise Russian government,...
- News
Fairlife Suspends U.S. Production After Cyber Incident Hits Coca-Cola Subsidiary
Fairlife, the premium dairy brand owned by Coca-Cola, has suspended production at its U.S. facilities following a cyber incident. Plants in Michigan, New...
- News
Coca-Cola Fairlife Ransomware Attack Halts All US Dairy Production
The Coca-Cola Company filed an SEC 8-K disclosure after a ransomware attack on its Fairlife dairy subsidiary temporarily suspended all US production of...
- News
Latvian State Forests Still Restoring Systems Weeks After Ransomware Attack
Latvia's state-owned forest management company LVM remains in recovery mode weeks after a ransomware attack that went undetected for nearly two weeks,...
- News
Armored Likho APT Targeting Government and Electric Power Entities
Kaspersky researchers have detailed a new campaign by Armored Likho — a threat actor overlapping with Eagle Werewolf — deploying modular RATs and the...
- Newsletter
June 30 Digest: BlueHammer Zero-Day, Ransomware Goes Corporate, AI Supply Chain Risks & Nation-State ICS Threats
A Microsoft Defender zero-day fuels ransomware before any patch exists; researchers dissect how syndicate groups run HR departments and tiered pricing;...
- News
Iran, Russia, and China Target Water Systems for Sabotage
Nation-state attackers from Iran, Russia, and China are breaching water utility systems through weak passwords, exposed PLCs, and poor network...
- News
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
- News
Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack
California Water Service has confirmed that Iranian hacker group Handala's cyberattack was limited to IT systems, with Mandiant's investigation finding no...
- News
Accenture to Acquire Majority Stake in Dragos, runZero, and NetRise in $4.1 Billion OT Cybersecurity Push
Accenture's $4.1 billion acquisition of Dragos (valued at $3.25B), runZero, and NetRise marks the largest consolidation in operational technology...
- News
Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023
Google's Threat Intelligence Group has unmasked UNC6508, a China-linked espionage actor that silently maintained access to critical infrastructure and...
- News
Australian Sugar Producer Works to Restore Operations After Ransomware Attack
Mackay Sugar, one of Australia's largest sugar producers, is working urgently to restore harvesting and milling operations after The Gentlemen ransomware...
- News
Hostile States Behind Three-Quarters of Attacks on Britain's Critical Infrastructure, Cyber Chief Warns
UK NCSC CEO Richard Horne delivered a stark warning at the RUSI Annual Security Lecture: nation-state adversaries are pre-positioning inside British...
- News
Cyberattack on Russian Tech Firm Astral Disrupts Business and Government Services for a Week
A sustained cyberattack against Russian enterprise software provider Astral has disrupted business and government services across Russia for over a week,...
- Security
CVE-2026-12183: Critical Auth Bypass in Gas Station Automation System
A CVSS 9.8 authentication bypass in Nefteprodukttekhnika's BUK TS-G Gas Station Automation System allows any unauthenticated attacker to gain full...
- News
Cisco Customers Encounter Another SD-WAN Zero-Day Under Attack
A seventh actively exploited zero-day in Cisco SD-WAN products this year — CVE-2026-20245 — is under attack with no patch yet available from Cisco.
- News
Over 900 US Gas Station Tank Gauge Systems Exposed to Attacks
Over 900 US automatic tank gauge systems are exposed online with no authentication, actively targeted by attackers seeking to disrupt fuel infrastructure.
- News
Exposed Fuel Tank Gauges Under Attack in the US
Threat actors are actively targeting Internet-exposed Automatic Tank Gauges (ATGs) at US gas stations, exploiting decades-old unprotected interfaces to…
- News
Russian Spies Aggressively Targeting Western Technology as Sanctions Bite
Western intelligence officials warn that Moscow's espionage apparatus is deploying cyber spies, hackers, and recruited middlemen to steal dual-use...
- Security
CVE-2026-34311 — Oracle Hospitality OPERA 5 Unauthenticated RCE
A CVSS 9.8 critical vulnerability in Oracle Hospitality OPERA 5 Property Services allows unauthenticated network attackers to fully compromise hotel...
- Security
CVE-2026-20182: Cisco Catalyst SD-WAN Controller
A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager allows an unauthenticated remote attacker to bypass...
- News
UK Fines Water Supplier $1.3M for Exposing Data of 664K
The UK's Information Commissioner's Office has fined South Staffordshire Water Plc and its parent company £963,900 ($1.3 million) after a cyberattack...
- News
West Pharmaceutical Services Hit by Disruptive Ransomware
West Pharmaceutical Services, a global manufacturer of drug delivery systems and packaging, has taken systems offline worldwide after hackers exfiltrated...
- Security
Dell ECS and ObjectScale: Hard-Coded Credentials
A critical CVSS 9.8 hard-coded credentials vulnerability in Dell ECS and ObjectScale allows unauthenticated local attackers to gain full filesystem access...
- News
UK Water Utility Fined £963,900 After Cl0p Lurked
The UK's Information Commissioner's Office fined South Staffordshire Water nearly £1 million after the Cl0p ransomware group maintained undetected access...
- Security
CVE-2026-8153: Universal Robots PolyScope OS Command
A critical OS command injection flaw in Universal Robots PolyScope Dashboard Server (CVSS 9.8) allows unauthenticated attackers to execute arbitrary...
- Security
CVE-2024-46636: NASA EOSDIS MODAPS v8.1 SQL Injection
A critical SQL injection vulnerability in NASA's Earth Observing System Data and Information System MODAPS v8.1 allows unauthenticated attackers to...
- News
American Utility Firm Itron Discloses Breach of Internal IT
Itron, Inc. has disclosed a cybersecurity incident via SEC Form 8-K in which an unauthorized third party accessed certain internal systems at the utility...
- News
Researchers Detect ZionSiphon Malware Targeting Israeli
Cybersecurity researchers at Darktrace have identified ZionSiphon, a new malware specifically designed to target Israeli water treatment and desalination...
- Security
CVE-2026-6284: PLC Brute Force Password Bypass (CVSS 9.1)
A critical vulnerability in a programmable logic controller allows unauthenticated network attackers to brute force weak passwords and gain full...
- News
Ransomware Attack Still Disrupting London Healthcare Nearly
More than 18 months after a ransomware attack crippled hospitals in South East London, at least one NHS trust is still operating without fully restored...
- News
Medusa Ransomware Is Fast to Exploit Fresh Vulnerabilities
SecurityWeek reports that the Medusa ransomware group has developed a dangerous capability: rapidly weaponizing newly disclosed vulnerabilities —...
- News
Medusa Ransomware Exploits Zero-Days to Deploy Ransomware
Microsoft has raised the alarm over Medusa ransomware's unprecedented operational speed, with the group now exploiting zero-day vulnerabilities before...
- News
Claude Source Code Leak Highlights Big Supply Chain Missteps
The accidental exposure of Anthropic's Claude Code source code via an npm packaging error is the latest reminder that software supply chains need...
- News
In Other News: ChatGPT Data Leak, Android Rootkit, Water
This week's security stories you may have missed: a ChatGPT conversation data leak, a new Android rootkit on Google Play, a municipal water facility taken...
- Security
CVE-2026-1579: MAVLink Protocol Unauthenticated Shell Access
A critical CVSS 9.8 vulnerability in the MAVLink drone communication protocol allows unauthenticated attackers to send arbitrary SERIAL_CONTROL commands —...
- News
State Department Reissues $10 Million Reward for Info on Iranian Hackers
Hours after the FBI confirmed that Iranian hackers gained access to Director Kash Patel's personal email account, the U.S. State Department reissued a $10...
- Security
Critical Stack-Based Buffer Overflow in Delta Electronics
A critical CVSS 9.8 stack-based buffer overflow in Delta Electronics COMMGR2 allows unauthenticated remote code execution, posing severe risk to...
- Security
CISA Issues Emergency Directive as Cisco SD-WAN Zero-Day
A maximum-severity authentication bypass in Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) has been actively exploited by threat actor UAT-8616 since...
- Security
CVE-2026-28775: Unauthenticated Root RCE in IDC SFX
A critical unauthenticated RCE vulnerability in International Datacasting Corporation's SFX Series satellite receivers allows attackers to execute...
- News
Google Disrupts Massive Chinese Espionage Campaign
Google's Threat Intelligence Group dismantles UNC2814, a China-linked operation that deployed a novel backdoor called GRIDTIDE abusing Google Sheets API...
- News
Iran Plunged Into Digital Darkness: Internet Drops to 4% in Cyberattack
During Operation 'Roar of the Lion,' a coordinated cyber offensive knocked Iran's internet connectivity down to just 4% of normal traffic, blacking out...
- News
Leaked Documents Reveal China's 'Expedition Cloud' Cyber
Technical documents leaked from a malware-infected developer device expose a Chinese military-linked training platform that replicates the critical...
- Security
Cisco SD-WAN Zero-Day CVE-2026-20127 Triggers Five Eyes
A CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN has been exploited since at least 2023. CISA issues Emergency Directive ED 26-03 as all Five...
- News
Ransomware Forces University of Mississippi Medical Center
A ransomware attack detected February 19 has taken down UMMC's EPIC EMR system and forced all 35 health clinics across Mississippi to close, canceling...
- News
Japanese Semiconductor Giant Advantest Hit by Ransomware
Advantest Corporation, the world's leading manufacturer of semiconductor test equipment supplying companies like TSMC, Intel, and Samsung, disclosed a...
- News
CISA Loses 62% of Workforce as DHS Shutdown Guts America's
A partial DHS shutdown since February 14 has furloughed 1,453 of CISA's 2,341 employees, halting vulnerability scanning, threat advisories, and critical...
- News
Romania's Oil Pipeline Operator Conpet Hit by Qilin Ransomware
The Qilin ransomware group has compromised Romania's national oil pipeline operator Conpet, exfiltrating over 1 TB of data including passports, internal...
- News
Shadow Campaigns: State-Backed Espionage Group Breaches 70+
Palo Alto Unit 42 reveals a state-aligned group designated TGR-STA-1030 compromised government and critical infrastructure targets in 37 countries using...
- News
Cyberattacks on Critical Infrastructure Double in Q1 2026
Dragos and Mandiant report a 112% increase in cyberattacks targeting energy, water, and transportation systems in the first quarter of 2026, with...
- News
DKnife: China-Linked AitM Framework Hijacks Router Traffic
Cisco Talos uncovers a seven-component Linux framework called DKnife that compromises routers to intercept credentials, replace downloads with trojans,...
- News
Healthcare Sector Faces Unprecedented Ransomware Surge in 2026
Ransomware attacks against healthcare organizations have increased 67% in the first month of 2026, with multiple hospital systems reporting service disruptions.
- News
Ivanti Connect Secure Under Active Attack - CISA Issues
CISA has issued an emergency directive requiring federal agencies to mitigate Ivanti Connect Secure vulnerabilities within 48 hours as active exploitation...