ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “ICS operators”

8 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 13Exploit / PoC 5Research 3Industry 3Malware 2Policy & legal 2Vulnerability 2
SeverityAllcritical 1high 13medium 8low 1info 7

ICS Operators Warned of AI-Driven Attacks on Siemens PLCs

A US government advisory warns attackers are using AI-generated exploitation scripts against internet-exposed Siemens S7 Series PLCs.

A US government advisory warns ICS operators that attackers are targeting exposed Siemens S7 Series PLCs using AI-generated exploitation scripts. The use of AI to automate exploit development and delivery marks an escalation in threats to industrial control systems. Operators of exposed PLCs are warned to harden their environments as AI-assisted tooling lowers the barrier for adversaries.

Infosecurity Magazine · 27d agoExploit / PoC in the wild

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42 · 28d agoMalware in the wild

Multiple Vulnerabilities Discovered in a SCADA System

Unit 42 details five vulnerabilities (CVSS 7.0-7.8) in ICONICS Suite SCADA software enabling privilege escalation and DoS.

Unit 42 discovered five vulnerabilities (CVE-2024-1182, CVE-2024-7587, CVE-2024-8299, CVE-2024-8300, CVE-2024-9852) in ICONICS Suite versions 10.97.2 and earlier for Windows during a 2024 security assessment. The flaws, rated CVSS 7.0-7.8, allow DLL hijacking, privilege escalation, information disclosure, denial-of-service and potentially full system compromise. ICONICS Suite is a SCADA solution with hundreds of thousands of installations in over 100 countries, widely used in critical infrastructure, and several dozen servers are internet-exposed per Unit 42 telemetry. ICONICS released patches and advisories with workarounds in 2024.

Palo Alto Unit 42 · 28d agoVulnerabilityCVE-2024-1182CVE-2024-7587CVE-2024-8299+2 CVEs1

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA Advisories · 1d agoAdvisoryCVE-2026-81861

Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories

AMD, Arm, and Nvidia issued Patch Tuesday advisories fixing a Linux GPU driver DoS flaw, nine Mali GPU vulnerabilities, and two high-severity Triton defects.

AMD fixed CVE-2026-43603, a NULL pointer dereference in its Linux GPU kernel driver that can crash systems and cause denial-of-service, credited to SecMate researchers, with patches for EPYC, Ryzen, Radeon, and Instinct shipped in July and embedded variants due in October. Arm published an advisory covering nine Mali GPU vulnerabilities allowing use-after-free access, kernel information leaks, or DoS, releasing fixes for Valhall and 5th Gen GPU Architecture drivers, with Bifrost also affected. Nvidia updated Triton Inference Server for Linux to resolve two high-severity flaws, one causing DoS and one enabling information disclosure, data tampering, and DoS. Intel had issued no new advisories since the previous Patch Tuesday.

SecurityWeek · 7d agoAdvisoryCVE-2026-43603

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories · 1d agoAdvisoryCVE-2026-58113

Tycon Systems TPDIN-Monitor-WEB3

CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.

CISA published ICSA-26-246-08 for Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, covering CVE-2026-77847 (use of hard-coded credentials, CWE-798), CVE-2026-82712 (CSRF, CWE-352), and CVE-2026-82684 (missing authorization, CWE-862). Exploitation could enable man-in-the-middle attacks, factory resets, credential wiping, or extraction of system credentials, configurations, and flash contents; the CSRF issue scores CVSS 8.8. No public exploitation has been reported; CISA recommends isolating devices from business networks.

CISA Advisories · 13d agoAdvisory 2 sourcesCVE-2026-77847CVE-2026-82712CVE-2026-82684

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.

CISA Advisories · 6d agoAdvisoryCVE-2026-81821CVE-2026-81822CVE-2026-81823+1 CVEs