[{"id":"anyproxy-5socks-2025","title":"Anyproxy and 5socks router botnet disruption","eventKind":"campaign","aliases":["Operation Moonlander","5socks botnet"],"startDate":"2010-01-01","endDate":"2025-07-23","disclosureDate":"2025-05-07","datePrecision":"pre-period; start-truncated-to-corpus-start; end-remediation-update-day","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["router","residential-proxy","end-of-life","law-enforcement","government-disruption"],"status":"disrupted","attributionActor":"Four people charged by the United States Department of Justice as alleged Anyproxy and 5socks administrators","attributionConfidence":"high","victim":"Owners of compromised end-of-life wireless routers and victims of proxied activity","sector":"Residential and small-business networks","country":"Multiple countries","initialAccess":"The indictment alleges that operators exploited known flaws in internet-exposed remote-management services on old wireless routers.","bridgePath":"Malware reconfigured the routers and sold their residential internet addresses as proxy exit nodes.","otOrIotMechanism":"The malware obtained root access, maintained persistence, opened proxy ports, and checked in with command servers.","observedEffect":"The service advertised more than 7,000 proxies. United States and foreign authorities seized the domains and disabled overseas infrastructure. In a July update, the Federal Bureau of Investigation reported remediation on 547 routers in the United States.","intendedEffect":"The indictment alleges that the charged administrators tried to profit from unauthorized proxy access to compromised routers.","impactType":"consumer-router-proxy","evolutionNote":"The case showed a long-lived commercial proxy service built on unsupported routers and a government operation that changed victim-router configurations to prevent renewed access.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cyber Criminal Services Target End-of-Life Routers to Launch Attacks and Hide Their Activities","url":"https://www.ic3.gov/CSA/2025/250507.pdf","publisher":"Federal Bureau of Investigation","publicationDate":"2025-05-07","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]},{"title":"Botnet Dismantled in International Operation, Russian and Kazakhstani Administrators Indicted","url":"https://www.justice.gov/usao-ndok/pr/botnet-dismantled-international-operation-russian-and-kazakhstani-administrators","publisher":"United States Department of Justice","publicationDate":"2025-05-09","accessedDate":"2026-11-02","supports":["dates","effect","attribution","outcome"]}],"evidenceNotes":"The campaign predates the timeline. The 2010 start is a corpus-boundary truncation, not evidence of first compromise on January 1, 2010; the service advertised operation since 2004. The four named people are charged and presumed innocent unless proved guilty. High confidence refers to the official Department of Justice allegation, not adjudicated guilt. The 7,000 figure describes advertised proxies, not all compromised routers. The Department of Justice page was published May 9 and updated July 23; the 547-router remediation result comes from that update.","summary":"Anyproxy and 5socks allegedly used malware on old wireless routers to sell residential proxy access. The service advertised more than 7,000 proxies. United States and foreign authorities seized its domains and disabled overseas infrastructure in May 2025. The Federal Bureau of Investigation later reported remediation on 547 routers in the United States. The named defendants remain presumed innocent unless proved guilty."},{"id":"stuxnet-natanz","title":"Stuxnet at Natanz","eventKind":"campaign","aliases":["Operation Olympic Games"],"startDate":"2010-01-01","endDate":"2010-06-17","disclosureDate":"2010-06-17","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["nuclear","plc","centrifuge"],"status":"successful","attributionActor":"No publicly confirmed actor","attributionConfidence":"unknown","victim":"Natanz Fuel Enrichment Plant","sector":"nuclear","country":"Iran","initialAccess":"Public evidence does not confirm the first access path. The malware used removable media and several Windows vulnerabilities to move.","bridgePath":"The malware moved from Windows computers to Siemens engineering software and programmable logic controllers.","otOrIotMechanism":"Stuxnet changed controller logic and hid the changes from operators. It changed centrifuge speed and valve states.","observedEffect":"The Institute for Science and International Security assessed that Stuxnet probably contributed to unusual centrifuge failures and removals. Public evidence does not prove the exact number of affected centrifuges or the effect on enrichment capacity.","intendedEffect":"The operation tried to delay uranium enrichment without an overt military attack.","impactType":"direct-ot-manipulation","evolutionNote":"Stuxnet showed that malware could use detailed process knowledge to cause physical damage and hide the change from operators.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"W32.Stuxnet Dossier","url":"https://nsarchive.gwu.edu/document/21440-document-44","publisher":"Symantec, archived by the National Security Archive","publicationDate":"2011-02-01","accessedDate":"2026-11-02","supports":["access","mechanism"]},{"title":"Stuxnet Malware and Natanz","url":"https://isis-online.org/isis-reports/stuxnet-malware-and-natanz-update-of-isis-december-22-2010-reportsupa-href1","publisher":"Institute for Science and International Security","publicationDate":"2011-02-16","accessedDate":"2026-11-02","supports":["effect","target"]}],"evidenceNotes":"The technical target and probable damage have strong support. No government has publicly accepted responsibility.","summary":"Stuxnet changed the control logic for centrifuges at Natanz. It hid the changes from operators. The Institute for Science and International Security assessed that Stuxnet probably contributed to centrifuge failures. Public evidence does not prove the exact damage or the effect on enrichment capacity. Stuxnet became a prominent early example of malware that could cause physical damage through industrial control logic."},{"id":"jssd-capstone-turbine-watering-hole-2010-2015","title":"JSSD turbine-manufacturer watering-hole campaign","eventKind":"campaign","aliases":["Jiangsu MSS turbofan espionage campaign"],"startDate":"2010-01-08","endDate":"2015-05-31","disclosureDate":"2018-10-30","datePrecision":"start-day; end-month","lane":"ot-bridge","bridgeRole":"proxy","secondaryTags":["turbine-manufacturer","watering-hole","aerospace","intellectual-property"],"status":"successful","attributionActor":"Officers of the Jiangsu Province Ministry of State Security and recruited hackers, as alleged by the United States Department of Justice","attributionConfidence":"medium","victim":"Capstone Turbine, aerospace manufacturers, component suppliers, and a San Diego technology company","sector":"industrial machinery, aerospace, and technology","country":"United States, France, and China","initialAccess":"The conspirators used spearphishing, several malware families, compromised websites, domain hijacking, and recruited company insiders.","bridgePath":"The actors compromised the website of a gas-turbine manufacturer and used it as a watering hole. They also used access across a turbofan supply chain to reach aerospace companies and steal engine technology.","otOrIotMechanism":"The campaign targeted industrial manufacturers and their websites. It did not manipulate turbines or aircraft controls. The industrial supplier and its trusted website became access infrastructure for attacks on other organizations.","observedEffect":"The campaign repeatedly compromised private companies and stole non-public commercial information. It used the Capstone Turbine compromise to support later intrusions. Malware remained in one Oregon aerospace supplier until May 2015.","intendedEffect":"The actors sought turbofan-engine intellectual property and other commercial information for the benefit of Chinese aerospace development.","impactType":"industrial-vendor-watering-hole-proxy","evolutionNote":"The campaign turned an industrial manufacturer into attack infrastructure. It used trust in a supplier website and supply-chain relationships to reach non-OT aerospace and technology targets.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Chinese Intelligence Officers and Their Recruited Hackers and Insiders Conspired to Steal Sensitive Commercial Aviation and Technological Data for Years","url":"https://www.justice.gov/usao-sdca/pr/chinese-intelligence-officers-and-their-recruited-hackers-and-insiders-conspired-steal","publisher":"United States Department of Justice","publicationDate":"2018-10-30","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","intent","attribution"]}],"evidenceNotes":"The cited source describes criminal charges, not convictions. It supports repeated intrusions, a Capstone watering hole, and theft objectives. It does not support any claim of turbine or aircraft-control manipulation.","summary":"Jiangsu intelligence officers and recruited hackers allegedly compromised a gas-turbine manufacturer and used its website as a watering hole. They also attacked companies across a turbofan supply chain. The industrial supplier relationship became a path to non-OT aerospace and technology targets."},{"id":"antwerp-port-container-system-2011-2013","title":"Antwerp port system abuse for drug smuggling","eventKind":"campaign","aliases":["Antwerp container-release-code hack"],"startDate":"2011-06-01","endDate":"2013-06-30","disclosureDate":"2013-06-17","datePrecision":"month","lane":"ot-bridge","bridgeRole":"direct-control","secondaryTags":["maritime","terminal-operations","organized-crime","container-release-codes"],"status":"disrupted","attributionActor":"A Netherlands-based organized crime group and hired hackers, identified by Belgian and Dutch law enforcement","attributionConfidence":"high","victim":"Shipping companies and container-terminal operators at the Port of Antwerp","sector":"maritime transport and logistics","country":"Belgium and the Netherlands","initialAccess":"The hackers sent malware in email to port workers. After defenders blocked remote access, the hackers also installed keyloggers on office computers.","bridgePath":"The hackers used access to port business and cargo-management systems to obtain or change container location, movement, and release information.","otOrIotMechanism":"The campaign did not manipulate crane or vessel controls. It manipulated the digital workflow that controlled when and where drivers could collect physical containers.","observedEffect":"The group removed drug-laden containers before legitimate hauliers arrived. Police dismantled the group in June 2013 and seized cocaine, heroin, cash, and weapons.","intendedEffect":"The group used port operational data to hide and recover illegal drug shipments.","impactType":"terminal-operations-to-physical-crime","evolutionNote":"This campaign used a logistics control system as a bridge from cyber access to physical organized crime. It did not need to damage equipment or stop port operations.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"The Internet Organised Crime Threat Assessment 2014","url":"https://www.europol.europa.eu/publications-events/main-reports/internet-organised-crime-threat-assessment-iocta-2014","publisher":"Europol","publicationDate":"2014-09-28","accessedDate":"2026-11-02","supports":["access","bridge","effect","attribution"]},{"title":"Proceedings of the Marine Safety and Security Council, Winter 2014-2015","url":"https://www.dco.uscg.mil/Portals/9/DCO%20Documents/Proceedings%20Magazine/Archive/2014/Vol71_No4_Wint2014-15.pdf?ver=2019-12-11-161907-677","publisher":"United States Coast Guard","publicationDate":"2014-12-01","accessedDate":"2026-11-02","supports":["access","bridge","effect"]}],"evidenceNotes":"Sources describe compromise of shipping and terminal information systems. They do not report compromise of industrial controllers. Europol linked the activity to a dismantled organized crime group.","summary":"An organized crime group hired hackers to compromise port and shipping systems in Antwerp. The group used container data and release information to collect drug shipments before legitimate hauliers arrived. The bridge joined a digital terminal workflow to physical smuggling."},{"id":"beresford-siemens-plc-2011","title":"Beresford Siemens PLC attack demonstrations","eventKind":"demonstration","aliases":["Siemens SIMATIC S7 research"],"startDate":"2011-06-10","endDate":"2011-06-10","disclosureDate":"2011-06-10","datePrecision":"advisory-publication-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","siemens","replay","denial-of-service"],"status":"successful","attributionActor":"Dillon Beresford of NSS Labs","attributionConfidence":"not-applicable","victim":"Laboratory Siemens SIMATIC S7-1200 CPU V1 and V2 controllers","sector":"multiple industrial sectors","country":"United States","initialAccess":"The tests required network access to the automation network.","bridgePath":"The researcher sent crafted traffic directly to Siemens controllers.","otOrIotMechanism":"The research demonstrated direct network control of S7-1200 PLCs. Siemens documents capture-replay of legitimate commands regardless of whether a controller password was configured, plus unauthenticated denial of service through malformed HTTP traffic.","observedEffect":"Siemens validated that recorded commands could be replayed and that affected controllers could be placed in a stopped or defective state.","intendedEffect":"The research tested the resistance of Siemens controllers to direct network attacks.","impactType":"laboratory-direct-ot-control","evolutionNote":"The work demonstrated direct PLC control through protocol impersonation and controller-level vulnerabilities.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"SSA-625789: Multiple Vulnerabilities in SIMATIC S7-1200 CPU V1/V2 Devices","url":"https://cert-portal.siemens.com/productcert/html/ssa-625789.html","publisher":"Siemens ProductCERT","publicationDate":"2011-06-10","accessedDate":"2026-11-02","supports":["date","disclosure","mechanism","effect","scope","researcher"]}],"evidenceNotes":"These were controlled tests, not an intrusion at an operating plant. The chronology uses Siemens's explicitly printed original advisory publication date rather than unsupported first-report or later-advisory days. Siemens directly documents capture-replay and denial-of-service effects for S7-1200 CPU V1 and V2 devices. Broader claims about other S7 product families are omitted.","summary":"Dillon Beresford reported direct attack techniques against Siemens SIMATIC S7-1200 controllers. Siemens validated capture-replay and stop or defect conditions in S7-1200 CPU V1 and V2 devices. The work was controlled security research."},{"id":"insulin-pump-wireless-control-demo-2011","title":"Wireless insulin-pump control demonstration","aliases":["Hacking Medical Devices for Fun and Insulin"],"startDate":"2011-08-04","endDate":"2011-08-04","disclosureDate":"2011-08-04","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["medical-device","insulin-pump","wireless","patient-safety"],"status":"successful","attributionActor":"Jay Radcliffe","attributionConfidence":"not-applicable","victim":"The researcher's own insulin pump","sector":"Consumer medical devices","country":"United States","initialAccess":"The researcher reverse-engineered the wireless protocol for his own insulin pump and used the device serial number to send commands.","bridgePath":"A nearby radio transmitter sent commands through the pump's wireless interface to a device that controls insulin delivery.","otOrIotMechanism":"The pump accepted wireless commands without adequate encryption or access control.","observedEffect":"The researcher remotely disabled his own pump and showed that he could change its settings. The FDA told GAO that it knew of no actual malicious incident involving an insulin pump or implantable defibrillator.","intendedEffect":"Demonstrate that weak wireless controls could permit an unauthorized change to a medical device.","impactType":"consumer-medical-device-control","evolutionNote":"The demonstration made a direct link between consumer-device security and patient safety. It also contributed to early federal review of medical-device cybersecurity.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Medical Devices: FDA Should Expand Its Consideration of Information Security for Certain Types of Devices","url":"https://www.gao.gov/products/gao-12-816","publisher":"United States Government Accountability Office","publicationDate":"2012-08-31","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations","policy-response"]},{"title":"Comment of a Coalition of Medical Device Researchers in Support of Proposed Class 27: Software – Networked Medical Devices","url":"https://cdn.loc.gov/copyright/1201/2015/comments-020615/InitialComments_longform_Coalition_of_Medical_Device_Researchers_Class27.pdf","publisher":"Coalition of Medical Device Researchers, filed with the United States Copyright Office","publicationDate":"2015-02-06","accessedDate":"2026-11-02","supports":["researcher","effect","policy-response","limitations"]},{"title":"Black Hat USA 2011 Briefings: Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System","url":"https://blackhat.com/html/bh-us-11/bh-us-11-archives.html","publisher":"Black Hat","publicationDate":"2011-08-04","accessedDate":"2026-11-02","supports":["dates","researcher","mechanism","limitations"]}],"evidenceNotes":"Jay Radcliffe tested the insulin pump that he wore. This was not a hostile attack. The 2015 filing contains his January 28 statement as Appendix D, but the full filing date is February 6. GAO states that researchers demonstrated intentional threats, but the FDA knew of no related malicious incident.","summary":"A researcher sent wireless commands to his own insulin pump. He remotely disabled the pump and showed that he could change its settings. The work showed that weak wireless controls in a consumer medical device could create a patient-safety risk. No related malicious incident was known to the FDA."},{"id":"trendnet-camera-exposure-2012","title":"TRENDnet SecurView camera exposure","aliases":["TRENDnet camera-feed breach"],"startDate":"2012-01-01","endDate":"2012-12-31","disclosureDate":"2013-09-04","datePrecision":"incident-year; disclosure-day","eventKind":"incident","lane":"consumer-iot-bridge","bridgeRole":"attack-surface","secondaryTags":["camera","privacy","surveillance","software-flaw","ftc"],"status":"successful","attributionActor":"Unidentified hackers","attributionConfidence":"unknown","victim":"Owners of TRENDnet SecurView internet-connected cameras","sector":"Consumer physical security and smart homes","country":"Multiple countries","initialAccess":"A software flaw allowed a person with a camera's internet address to view its feed without effective authentication.","bridgePath":"The internet-connected camera exposed video and, for some models, audio from private homes directly to remote users.","otOrIotMechanism":"The camera software failed to enforce its password setting. TRENDnet also transmitted or stored some credentials as readable text.","observedEffect":"Hackers published links to live feeds from nearly 700 cameras. The feeds exposed children, adults, and private activity inside homes.","intendedEffect":"View and publish private consumer-camera feeds.","impactType":"consumer-camera-exposure","evolutionNote":"The case became the first United States Federal Trade Commission action against an everyday internet-connected product.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Marketer of Internet-Connected Home Security Video Cameras Settles FTC Charges It Failed to Protect Consumers' Privacy","url":"https://www.ftc.gov/news-events/news/press-releases/2013/09/marketer-internet-connected-home-security-video-cameras-settles-ftc-charges-it-failed-protect","publisher":"United States Federal Trade Commission","publicationDate":"2013-09-04","accessedDate":"2026-11-02","supports":["dates","access","mechanism","scale","effect","regulatory-response"]}],"evidenceNotes":"The FTC reports that a hacker disclosed the flaw in January 2012 and that hackers later published links to nearly 700 feeds. Public evidence does not identify the actors or exact exposure dates for each camera.","summary":"A software flaw exposed TRENDnet home-camera feeds without effective authentication. Hackers published links to nearly 700 live feeds. The feeds showed private activity inside homes. The case became the first United States federal enforcement action against an everyday internet-connected product."},{"id":"carna-internet-census-2012","title":"Carna Internet Census botnet","aliases":["Internet Census 2012"],"startDate":"2012-03-01","endDate":"2012-12-31","disclosureDate":"2013-03-17","datePrecision":"start-month; end-month; disclosure-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","embedded-device","default-credentials","internet-scanning"],"status":"successful","attributionActor":"Anonymous Carna operator","attributionConfidence":"unknown","victim":"Owners of insecure routers and other embedded devices","sector":"Consumer and small-network devices","country":"Multiple countries","initialAccess":"The operator logged in to embedded devices that used default credentials, weak credentials, or no credentials.","bridgePath":"Compromised routers and embedded devices supplied a distributed platform for internet-wide measurement and scanning.","otOrIotMechanism":"Small binaries ran in memory, measured networks, and reported results. Approximately 420,000 devices ran the binary. The census also observed approximately 1.2 million unprotected devices and 420 million ping-responsive IP addresses.","observedEffect":"The botnet performed large internet scans and produced a public census data set. Approximately 420,000 devices ran the binary without owner authorization.","intendedEffect":"Map the public IPv4 internet and show the scale of insecure embedded devices.","impactType":"unauthorized-iot-measurement-botnet","evolutionNote":"Carna showed before Mirai that weak consumer and small-network devices could supply hundreds of thousands of distributed nodes.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Internet Census 2012: Port scanning /0 using insecure embedded devices","url":"https://census2012.sourceforge.net/paper.html","publisher":"Anonymous Carna operator","publicationDate":"2013-03-17","accessedDate":"2026-11-02","supports":["dates","access","devices","scale","mechanism","effect","limitations"]},{"title":"An Internet Census Taken by an Illegal Botnet: A Qualitative Assessment of Published Measurements","url":"https://doi.org/10.1145/2656877.2656893","publisher":"ACM SIGCOMM Computer Communication Review, volume 44, number 3","publicationDate":"2014-07-01","accessedDate":"2026-11-02","supports":["dates","scale","effect","limitations","context"]}],"evidenceNotes":"The client distribution covers March through December 2012. Many measurements used a narrower June-through-October window. The report and data set were released on March 17, 2013. Approximately 420,000 devices ran the binary. This count is distinct from approximately 1.2 million observed unprotected devices and 420 million ping-responsive IP addresses. The ACM article is an editorial note and was not peer reviewed.","summary":"An anonymous operator entered insecure routers and embedded devices without authorization. Approximately 420,000 devices ran the census binary from March through December 2012. The botnet scanned and measured the public IPv4 internet. The project showed that consumer and small-network devices could supply large distributed scanning capacity."},{"id":"project-shine-exposure-2012-2014","title":"Project SHINE maps Internet-visible control systems","eventKind":"trend","aliases":["SHodan INtelligence Extraction"],"startDate":"2012-04-14","endDate":"2014-01-31","disclosureDate":"2014-10-01","datePrecision":"data-collection-window; report-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["internet-exposure","shodan","asset-discovery","scada"],"status":"successful","attributionActor":"Bob Radvanovsky and Jacob Brodsky of Infracritical","attributionConfidence":"not-applicable","victim":"Shodan records for Internet-visible control and control-related products","sector":"multiple industrial sectors","country":"Multiple countries","initialAccess":"The researchers used existing Shodan metadata. They did not scan or connect to the returned systems.","bridgePath":"Search terms for control vendors, products, and industrial protocols identified records in Shodan metadata.","otOrIotMechanism":"The project correlated service banners and protocol ports associated with PLCs, RTUs, HMIs, SCADA products, and control-related systems.","observedEffect":"The project's broad search terms produced 2,186,971 IP-address results. The count included broad control-related categories and classification limits. It was not a count of unique, vulnerable, or operational OT devices.","intendedEffect":"The project measured public exposure and helped owners identify unexpected Internet connections.","impactType":"ot-exposure-trend","evolutionNote":"Project SHINE made large-scale remote discovery of industrial assets a measurable security problem. It also showed that owners had to verify presumed isolation.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Project SHINE (SHodan INtelligence Extraction) Findings Report – 1 Oct 2014","url":"https://scadahacker.com/library/Documents/ICS_Vulnerabilities/Infracritical%20-%20Project%20SHINE%20Findings%20Report%20-%20Oct%202014.pdf","publisher":"Infracritical","publicationDate":"2014-10-01","accessedDate":"2026-11-02","supports":["method","effect","scope","limitations"]}],"evidenceNotes":"The count is a total of IP-address results from broad search terms. It includes control-related products and classification limits. It is not a verified count of unique devices, vulnerable plants, or successful intrusions. Project researchers did not scan or access the returned systems.","summary":"Project SHINE used Shodan metadata to research Internet-visible control and control-related products. Its broad search terms produced 2,186,971 IP-address results. The researchers did not scan or connect to the returned systems. The total does not represent unique, vulnerable, or operational OT devices."},{"id":"shamoon-aramco-business-operations-2012","title":"Shamoon disruption of Saudi Aramco business operations","eventKind":"incident","aliases":["Saudi Aramco cyberattack","Disttrack"],"startDate":"2012-08-15","endDate":"2012-08-26","disclosureDate":"2012-08-15","datePrecision":"start-day; end-main-internal-services-restoration-day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["wiper","oil-and-gas","business-systems","manual-operations"],"status":"successful","attributionActor":"Unknown actor; public claims and later assessments linked the operation to Iran, but the cited primary sources do not establish the operator","attributionConfidence":"unknown","victim":"Saudi Arabian Oil Company","sector":"oil and gas","country":"Saudi Arabia","initialAccess":"Public primary sources do not establish the initial access vector.","bridgePath":"Shamoon disabled enterprise systems that supported finance, payroll, human resources, procurement, communication, and other business functions. Staff used manual procedures to keep the oil company operating.","otOrIotMechanism":"The malware erased data on business-network computers. Production and research systems used separate networks. Saudi Aramco stated that core operations continued.","observedEffect":"Approximately 30,000 business-network workstations were affected. Office and support work moved to manual methods. Saudi Aramco restored its main internal network services by August 26. Oil and gas operations continued.","intendedEffect":"The operation tried to destroy data and disable company business operations.","impactType":"enterprise-wiper-operational-dependency","evolutionNote":"Shamoon showed that destructive IT malware could impose a severe operational burden on an industrial company even when production networks remained separate and production continued.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Saudi Aramco restarts all main electronic services affected by a malicious virus","url":"https://www.spa.gov.sa/1024794","publisher":"Saudi Press Agency","publicationDate":"2012-08-26","accessedDate":"2026-11-02","supports":["dates","effect","recovery","operational-continuity","limitations"]},{"title":"Current and Future Worldwide Threats to the National Security of the United States","url":"https://www.govinfo.gov/content/pkg/CHRG-113shrg89575/pdf/CHRG-113shrg89575.pdf","publisher":"United States Senate Committee on Armed Services","publicationDate":"2013-04-18","accessedDate":"2026-11-02","supports":["effect","scale","limitations"]},{"title":"Energy to the World, Volume 2","url":"https://www.aramco.com/-/media/publications/books/energy-to-the-world/saudi-aramco-energy-to-the-world---vol2.pdf","publisher":"Saudi Aramco","publicationDate":"2025-01-01","accessedDate":"2026-11-02","supports":["bridge","manual-operations","business-functions","effect","operational-continuity"]}],"evidenceNotes":"The Saudi Press Agency published Saudi Aramco's August 26 restoration statement. Saudi Aramco's corporate history identifies the disabled business functions and the switch to manual work. It also states that production and research systems were separate. The 2025 source date is normalized to the publication year shown by Aramco. The cited sources do not support a high-confidence actor attribution.","summary":"Shamoon affected approximately 30,000 Saudi Aramco business workstations. Staff used manual procedures for business functions. Production systems remained separate, and core operations continued. The bridge was the industrial operation's dependence on enterprise support systems."},{"id":"telvent-oasys-breach-2012","title":"Telvent OASyS project-file breach","eventKind":"incident","aliases":["Telvent SCADA vendor breach"],"startDate":"2012-09-10","endDate":"2012-09-26","disclosureDate":"2012-09-26","datePrecision":"start-discovery-day; end-disclosure-cutoff; intrusion-start-and-containment-undisclosed","lane":"ot-bridge","bridgeRole":"access","secondaryTags":["scada-vendor","remote-support","project-files","energy"],"status":"successful","attributionActor":"Unconfirmed; researchers linked the methods to a China-based espionage cluster","attributionConfidence":"low","victim":"Telvent and customers whose OASyS SCADA project files were affected","sector":"energy technology and pipeline operations","country":"Canada and multiple customer countries","initialAccess":"Attackers entered the Telvent corporate network and installed malware. Public reporting does not identify the first access vector or intrusion date.","bridgePath":"The attackers reached customer project files at a SCADA vendor. Telvent also had remote support links to customer systems. It stopped customer access while it contained the breach.","otOrIotMechanism":"The stolen files described OASyS SCADA deployments. Public evidence does not show that the attackers entered a customer control system or changed a physical process.","observedEffect":"Attackers stole customer project files. Telvent disconnected clients and affected parts of its internal network as a precaution. It changed remote-support procedures while it removed malware.","intendedEffect":"The confirmed objective was theft of vendor and customer information. A later operational attack was possible but not observed.","impactType":"scada-vendor-knowledge-and-access-bridge","evolutionNote":"The incident showed two risks in one supplier relationship. A vendor held detailed customer engineering files and also maintained remote support paths into customer environments.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Telvent Hit by Sophisticated Cyber-Attack, SCADA Admin Tool Compromised","url":"https://www.securityweek.com/telvent-hit-sophisticated-cyber-attack-scada-admin-tool-compromised/","publisher":"SecurityWeek","publicationDate":"2012-09-26","accessedDate":"2026-11-02","supports":["dates","access","bridge","effect","limitations","company-statement"]},{"title":"Hackers break into energy technology company","url":"https://www.washingtonpost.com/investigations/hackers-break-into-energy-technology-company/2012/09/27/99322e4c-08e6-11e2-a10c-fa5a255a9258_story.html","publisher":"The Washington Post","publicationDate":"2012-09-27","accessedDate":"2026-11-02","supports":["access","bridge","effect","limitations","reported-attribution"]}],"evidenceNotes":"Telvent discovered the breach on September 10, but public evidence does not establish the intrusion start. Telvent confirmed affected customer files. It said it had no reason to believe that attackers obtained information that enabled access to customer systems. The September 26 end date is a public-report cutoff, not containment. Attribution remained unconfirmed.","summary":"Attackers breached Telvent and stole OASyS SCADA customer project files. Telvent stopped remote customer access while it contained the incident. No public evidence shows access to customer control systems. The bridge was the vendor's custody of engineering data and its remote support connections."},{"id":"turbine-usb-service-infection-2012","title":"Third-party USB infection of a turbine control network","eventKind":"incident","aliases":[],"startDate":"2012-10-01","endDate":"2012-10-31","disclosureDate":"2013-01-01","datePrecision":"incident-month; end-month-boundary; restart-delay-about-three-weeks; disclosure-month","lane":"ot-bridge","bridgeRole":"access","secondaryTags":["removable-media","third-party-technician","turbine-control","maintenance"],"status":"successful","attributionActor":"No deliberate attacker identified; a third-party technician introduced crimeware without knowledge of the infection","attributionConfidence":"not-applicable","victim":"An unnamed power company","sector":"electric power generation","country":"Unspecified","initialAccess":"A third-party technician used an infected USB drive to install software updates during a scheduled equipment outage.","bridgePath":"The maintenance process carried malware from a service technician's removable media into the turbine control network.","otOrIotMechanism":"Crimeware infected approximately ten computers on the control-system network. The malware was not designed to control the turbine.","observedEffect":"The infection caused downtime for affected systems and delayed the plant restart by approximately three weeks.","intendedEffect":"No evidence shows an intent to disrupt the plant. The operational effect was accidental.","impactType":"third-party-maintenance-malware-cascade","evolutionNote":"The incident showed that a routine vendor maintenance task could cross an air gap and create a long operational delay without a purpose-built OT payload.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"ICS-CERT Monitor, October-November-December 2012","url":"https://www.cisa.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Oct-Dec2012.pdf","publisher":"Industrial Control Systems Cyber Emergency Response Team","publicationDate":"2013-01-01","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","limitations"]}],"evidenceNotes":"ICS-CERT placed the event in early October 2012 and reported a restart delay of approximately three weeks. The normalized dates cover that month and do not state exact incident days. The report became public in January 2013. ICS-CERT did not name a malware family, facility, country, or plant type. It reported crimeware, an accidental service-media path, no malicious intent, and no direct turbine manipulation.","summary":"A third-party technician used an infected USB drive during turbine maintenance. Crimeware infected approximately ten control-network computers. The incident delayed the plant restart by approximately three weeks. No evidence shows a deliberate OT attack."},{"id":"sabot-plc-payload-2012","title":"SABOT automatic PLC payload generation","eventKind":"demonstration","aliases":["Specification-based Attacks against Boolean Operations and Timers"],"startDate":"2012-10-16","endDate":"2012-10-18","disclosureDate":"2012-10-16","datePrecision":"conference-window","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","payload-generation","model-checking","control-logic"],"status":"successful","attributionActor":"Pennsylvania State University researchers","attributionConfidence":"not-applicable","victim":"Five laboratory control systems","sector":"multiple industrial sectors","country":"United States","initialAccess":"The demonstration assumed access that could download and replace PLC control logic.","bridgePath":"SABOT downloaded existing controller code, mapped PLC variables to physical devices, and built a tailored malicious payload.","otOrIotMechanism":"The tool used an attacker-supplied process description and model checking to recover device semantics from controller bytecode.","observedEffect":"SABOT generated correct payloads for all tested systems with a full process description. It succeeded on four of five systems in most tests with incomplete descriptions. Analyses completed in less than two minutes.","intendedEffect":"The research tested whether attackers could automate process-aware PLC payload development with limited plant knowledge.","impactType":"laboratory-ot-payload-generation","evolutionNote":"SABOT showed a path from hand-built, process-specific malware toward automatic generation of tailored PLC attacks.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"SABOT: Specification-based payload generation for Programmable Logic Controllers","url":"https://pure.psu.edu/en/publications/sabot-specification-based-payload-generation-for-programmable-log/","publisher":"Pennsylvania State University","publicationDate":"2012-10-16","accessedDate":"2026-11-02","supports":["mechanism","effect","scope"]},{"title":"SABOT: Specification-based Payload Generation for Programmable Logic Controllers","url":"https://doi.org/10.1145/2382196.2382244","publisher":"Association for Computing Machinery","publicationDate":"2012-10-16","accessedDate":"2026-11-02","supports":["mechanism","effect"]}],"evidenceNotes":"This was a laboratory research tool. It assumed controller access and an attacker description of plant behavior. No operating-plant deployment was reported.","summary":"SABOT downloaded PLC code and mapped internal variables to physical devices. It then generated a tailored malicious payload from a process description. The tool succeeded on all five tested systems when the description was complete. It also succeeded on four of five systems in most incomplete-description tests."},{"id":"havex-dragonfly-2013","title":"Havex industrial reconnaissance campaign","eventKind":"campaign","aliases":["Dragonfly","Energetic Bear","Crouching Yeti"],"startDate":"2013-01-01","endDate":"2014-12-31","disclosureDate":"2014-06-30","datePrecision":"year","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["energy","supply-chain","opc","reconnaissance"],"status":"successful","attributionActor":"Russian FSB Center 16, assessed by CISA, FBI, and DOE; three officers were alleged in a U.S. indictment","attributionConfidence":"high","victim":"Energy organizations and customers of compromised ICS and SCADA software vendors","sector":"energy","country":"Multiple countries","initialAccess":"The actors used spearphishing, watering holes, and malicious versions of legitimate software updates on ICS vendor websites.","bridgePath":"Havex created a backdoor on infected systems. Its OPC module then found and queried connected control-system resources.","otOrIotMechanism":"The malware enumerated OPC servers, tags, vendor data, running state, and other ICS configuration data. It sent the data to command-and-control servers.","observedEffect":"The campaign installed malware on more than 17,000 devices and exfiltrated enterprise and ICS data. Public sources do not report a deliberate physical process change.","intendedEffect":"The actors sought persistent access and detailed knowledge of energy control environments.","impactType":"ot-reconnaissance","evolutionNote":"Havex combined a software supply-chain attack with discovery of operational technology. It collected information about industrial environments before a possible destructive operation.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"TTPs of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector","url":"https://www.cisa.gov/sites/default/files/publications/AA22-083A_TTPs_of_Indicted_State-Sponsored_Russian_Cyber_Actors_Targeting_the_Energy_Sector.pdf","publisher":"CISA, FBI, and DOE","publicationDate":"2022-03-24","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution"]},{"title":"Four Russian Government Employees Charged in Historical Critical Infrastructure Campaigns","url":"https://www.justice.gov/usao-dc/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting","publisher":"United States Department of Justice","publicationDate":"2022-03-24","accessedDate":"2026-11-02","supports":["scale","effect","attribution"]}],"evidenceNotes":"ICS-CERT found no function that deliberately changed connected hardware. Public evidence does not confirm an operational denial of service. The criminal charges remain allegations.","summary":"Havex entered energy networks through phishing, compromised websites, and infected industrial software updates. It queried Open Platform Communications systems and collected control-system data. The campaign compromised more than 17,000 devices. Public evidence does not show a deliberate physical process change."},{"id":"white-rose-gps-spoof-demo-2013","title":"White Rose yacht GPS-spoofing demonstration","aliases":["White Rose of Drachs spoofing experiment"],"startDate":"2013-06-01","endDate":"2013-06-30","disclosureDate":"2013-07-29","datePrecision":"incident-month; disclosure-day","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"dependency","secondaryTags":["gps","navigation","maritime","autopilot","radio"],"status":"successful","attributionActor":"Authorized University of Texas at Austin researchers","attributionConfidence":"not-applicable","victim":"White Rose of Drachs yacht and participating crew","sector":"Consumer and commercial maritime navigation","country":"International waters near Italy","initialAccess":"Researchers broadcast counterfeit civil GPS signals toward the yacht's GPS antennas from its upper deck.","bridgePath":"False radio signals changed the position reported by the GPS receivers. The navigation display then caused the crew to make course corrections.","otOrIotMechanism":"The counterfeit signals slowly overpowered authentic GPS signals without triggering an alarm. The navigation system displayed a straight course while the vessel moved to a parallel track.","observedEffect":"The crew changed course in response to false navigation data. The yacht ended on a parallel track hundreds of meters from its intended route.","intendedEffect":"Measure whether false civil GPS signals could covertly influence a vessel and its crew.","impactType":"connected-navigation-spoofing","evolutionNote":"The experiment showed that an external radio input could influence a connected navigation system without direct access to the vessel network.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"UT Austin Researchers Successfully Spoof an $80 million Yacht at Sea","url":"https://news.utexas.edu/2013/07/29/ut-austin-researchers-successfully-spoof-an-80-million-yacht-at-sea/","publisher":"University of Texas at Austin","publicationDate":"2013-07-29","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","limitations"]},{"title":"Hostile Control of Ships via False GPS Signals: Demonstration and Detection","url":"https://www.ion.org/publications/abstract.cfm?articleID=102703","publisher":"The Institute of Navigation","publicationDate":"2017-03-01","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations"]}],"evidenceNotes":"The captain authorized the experiment. False GPS data influenced the crew, and the crew changed the course. The researchers did not directly operate the rudder or propulsion system. The paper appeared in NAVIGATION, volume 64, number 1, Spring 2017, pages 51–66. March 1 is a normalized Spring 2017 publication date.","summary":"Researchers broadcast false GPS signals to a yacht with the captain's approval. The false position data caused the crew to make course corrections. The yacht moved hundreds of meters from its intended route without a navigation alarm. The researchers did not directly control the rudder or propulsion."},{"id":"bowman-dam-intrusion-2013","title":"Bowman Avenue Dam intrusion","eventKind":"incident","aliases":["Rye dam intrusion"],"startDate":"2013-08-28","endDate":"2013-09-18","disclosureDate":"2016-03-24","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["dam","scada","water","remote-access"],"status":"failed","attributionActor":"Hamid Firoozi and an Islamic Revolutionary Guard Corps-sponsored entity, as alleged in a United States indictment","attributionConfidence":"high","victim":"Bowman Avenue Dam","sector":"water management","country":"United States","initialAccess":"Firoozi repeatedly obtained unauthorized remote access to the dam control system. Public evidence does not identify the access method.","bridgePath":"The actor reached the supervisory control and data acquisition system directly through remote access.","otOrIotMechanism":"The access exposed water-level data, temperature data, and the state of the sluice gate. The system normally permitted remote gate operation.","observedEffect":"The actor obtained dam status information. The actor could not operate the sluice gate because staff had disconnected it for maintenance.","intendedEffect":"Public evidence does not prove that the actor intended to move the gate. The unauthorized access created that capability under normal operating conditions.","impactType":"failed-direct-ot-access","evolutionNote":"The incident showed that a remote actor could reach a small municipal control system. A maintenance condition prevented physical control.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Manhattan U.S. Attorney Announces Charges Against Seven Iranians","url":"https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-charges-against-seven-iranians-conducting-coordinated","publisher":"United States Department of Justice","publicationDate":"2016-03-24","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","attribution"]}],"evidenceNotes":"The Department of Justice describes allegations, not a criminal judgment. The gate was unavailable because staff had disconnected it for maintenance. Public evidence does not prove an attempted gate movement.","summary":"An Iranian actor repeatedly accessed the control system for Bowman Avenue Dam. The access exposed operating data and normally permitted remote sluice-gate control. Staff had disconnected the gate for maintenance. This condition prevented physical operation."},{"id":"target-fazio-2013","title":"Target breach through an HVAC contractor","eventKind":"incident","aliases":["Target payment-card breach","Fazio Mechanical breach"],"startDate":"2013-11-27","endDate":"2013-12-15","disclosureDate":"2013-12-19","lane":"ot-bridge","bridgeRole":"access","secondaryTags":["third-party","hvac-contractor","payment-cards"],"status":"successful","attributionActor":"Unknown cybercriminal group","attributionConfidence":"unknown","victim":"Target Corporation and its customers","sector":"retail","country":"United States","initialAccess":"The attackers sent phishing email to Fazio Mechanical Services. They obtained credentials that the contractor used for Target systems.","bridgePath":"The attackers used contractor credentials to enter Target. They moved through the network and reached point-of-sale systems.","otOrIotMechanism":"The contractor serviced refrigeration and HVAC equipment. Public evidence does not show that an HVAC controller or building-control network was compromised.","observedEffect":"The attackers stole payment-card data for approximately 40 million customers and other personal data for as many as 70 million customers.","intendedEffect":"The attackers tried to steal payment data for financial crime.","impactType":"ot-vendor-ecosystem-bridge","evolutionNote":"This breach made third-party OT service relationships a major security concern. The access path was a contractor account, not the HVAC equipment itself.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"A Kill Chain Analysis of the 2013 Target Data Breach","url":"https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883","publisher":"United States Senate Committee on Commerce, Science, and Transportation","publicationDate":"2014-03-26","accessedDate":"2026-11-02","supports":["access","bridge","effect"]},{"title":"Cybersecurity: Bank and Other Depository Regulators Need Better Data Analytics","url":"https://www.gao.gov/assets/680/671612.pdf","publisher":"United States Government Accountability Office","publicationDate":"2015-07-02","accessedDate":"2026-11-02","supports":["effect"]}],"evidenceNotes":"Popular accounts often say that attackers entered through an HVAC system. The Senate report supports a contractor-credential path. Fazio stated that it did not remotely monitor or control Target HVAC systems.","summary":"Attackers first compromised an HVAC contractor. They used the contractor credentials to enter Target and then reached point-of-sale systems. They stole payment and personal data. Public evidence does not show that attackers compromised HVAC controllers. The bridge was the contractor relationship and its network access."},{"id":"german-steelworks-2014","title":"German steelworks attack","eventKind":"incident","aliases":["German blast furnace incident"],"startDate":"2014-01-01","endDate":"2014-12-17","disclosureDate":"2014-12-17","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["manufacturing","blast-furnace"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Unnamed German steelworks","sector":"manufacturing","country":"Germany","initialAccess":"The attackers used spear phishing and social engineering to enter the office network.","bridgePath":"The attackers moved from the office network into the production network and industrial control systems.","otOrIotMechanism":"The attackers caused failures in control components and production equipment.","observedEffect":"Operators could not shut down a blast furnace in a controlled manner. The plant had major physical damage.","intendedEffect":"Public evidence does not show the intended effect.","impactType":"direct-ot-disruption","evolutionNote":"This incident showed that an office-network compromise could cross into production and cause major equipment damage without special public malware.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Die Lage der IT-Sicherheit in Deutschland 2014","url":"https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2014.pdf?__blob=publicationFile","publisher":"German Federal Office for Information Security","publicationDate":"2014-12-17","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]},{"title":"IT threat situation for industrial control systems","url":"https://www.grs.de/sites/default/files/2021-09/GRS-647.pdf","publisher":"Gesellschaft für Anlagen- und Reaktorsicherheit","publicationDate":"2021-09-01","accessedDate":"2026-11-02","supports":["effect","context"]}],"evidenceNotes":"The victim, malware, exact date, and actor remain unknown. The German government report documents the access path and damage.","summary":"Attackers entered the office network of a German steelworks. They then moved into the production network. Failures in control equipment prevented a controlled furnace shutdown. The plant had major damage. The public report did not identify the victim or the actor."},{"id":"irongate-capability-2014-2016","title":"IRONGATE process-masking malware discovery","eventKind":"capability","aliases":["IRONGATE"],"startDate":"2014-09-01","endDate":"2016-06-02","disclosureDate":"2016-06-02","datePrecision":"compile-month; disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","process-masking","simulation","siemens"],"status":"unknown","attributionActor":"Unknown developer","attributionConfidence":"unknown","victim":"No identified victim; custom simulated Siemens control environment","sector":"industrial process simulation","country":"Unknown","initialAccess":"No infection path or public victim was identified. Researchers found samples on VirusTotal in the second half of 2015.","bridgePath":"The malware replaced a custom library between simulated PLC input and output data and operator software.","otOrIotMechanism":"IRONGATE recorded five seconds of normal reads and replayed them to the operator software. It discarded normal writes and injected fixed input values into a Siemens PLCSIM-based biogas simulation.","observedEffect":"In the matching simulation, IRONGATE could conceal simulated process changes with recorded normal data. Siemens confirmed that the recovered code would not work against a standard operational Siemens control system.","intendedEffect":"The developer's intent is unknown. Mandiant assessed that the code could be a test case, proof of concept, or research activity.","impactType":"pre-impact-ot-capability","evolutionNote":"IRONGATE demonstrated process-data replay as a reusable concealment concept outside Stuxnet, but only in a custom simulation.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"IRONGATE ICS Malware: Nothing to See Here...Masking Malicious Activity on SCADA Systems","url":"https://cloud.google.com/blog/topics/threat-intelligence/irongate-ics-malware/","publisher":"Mandiant","publicationDate":"2016-06-02","accessedDate":"2026-11-02","supports":["discovery","mechanism","effect","intent","limitations"]},{"title":"CCN-CERT AL 03/16 IRONGATE, un código dañino que afecta a Sistemas de Control Industrial","url":"https://www.ccn-cert.cni.es/en/updated-security/alertas-ccn-cert/3825-ccn-cert-al-03-16-irongate-un-codigo-danino-que-afecta-a-sistemas-de-control-industrial.html","publisher":"CCN-CERT","publicationDate":"2016-06-10","accessedDate":"2026-11-02","supports":["mechanism","effect","context"]}],"evidenceNotes":"The recovered malware targeted custom simulation code, not standard Siemens products. No field deployment, physical effect, infection path, victim, or actor was identified. The September 2014 date is the sample compile month, not an operation date.","summary":"Researchers found IRONGATE samples that targeted a custom Siemens process simulation. The malware replayed five seconds of normal reads, discarded normal writes, and injected fixed input values. It would not work in a standard Siemens control system. The developer, intent, victim, and field use remain unknown."},{"id":"jeep-cherokee-demonstration-2015","title":"Jeep Cherokee remote-control demonstration","aliases":["Uconnect remote vehicle hack"],"startDate":"2015-07-21","endDate":"2015-07-21","disclosureDate":"2015-07-21","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["connected-vehicle","cellular","can-bus","research"],"status":"successful","attributionActor":"Authorized researchers Charlie Miller and Chris Valasek","attributionConfidence":"not-applicable","victim":"A research vehicle; the work caused a recall of about 1.4 million vehicles","sector":"Automotive","country":"United States","initialAccess":"The researchers reached the Uconnect head unit through the cellular network and an exposed service.","bridgePath":"The connected head unit supplied a path from the cellular network to a vehicle controller and the controller area network.","otOrIotMechanism":"The researchers changed controller firmware and injected controller area network messages.","observedEffect":"The controlled demonstration stopped the engine and changed braking and steering functions. NHTSA recorded no related crash, injury, or fatality.","intendedEffect":"Demonstrate that a remote attacker could cross from an internet-connected entertainment system to safety-critical vehicle controls.","impactType":"connected-device-to-safety-control","evolutionNote":"The research showed that one consumer-connected component could provide remote access to safety-critical controls.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Remote Exploitation of an Unaltered Passenger Vehicle","url":"https://illmatics.com/Remote%20Car%20Hacking.pdf","publisher":"Charlie Miller and Chris Valasek","publicationDate":"2015-08-05","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect"]},{"title":"NHTSA Recall Query RQ15-004","url":"https://static.nhtsa.gov/odi/inv/2015/INOA-RQ15004-8729.PDF","publisher":"National Highway Traffic Safety Administration","publicationDate":"2015-07-24","accessedDate":"2026-11-02","supports":["effect","recall","limitations"]}],"evidenceNotes":"This was controlled security research, not hostile activity. The success label describes the demonstration. It does not describe an adversary campaign.","summary":"Researchers reached a Jeep Cherokee through its cellular-connected Uconnect system. They crossed from the head unit to safety-critical vehicle controls. The demonstration caused a recall of about 1.4 million vehicles. It was authorized research, not a hostile attack."},{"id":"hospira-symbiq-2015","title":"Hospira Symbiq remote-dose capability","eventKind":"demonstration","aliases":["Symbiq Infusion System vulnerabilities"],"startDate":"2015-07-21","endDate":"2015-07-31","disclosureDate":"2015-07-21","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["medical-device","infusion-pump","hospital-network","patient-safety"],"status":"unknown","attributionActor":"Not applicable to disclosed product vulnerabilities","attributionConfidence":"not-applicable","victim":"Health care facilities that used Hospira Symbiq infusion pumps","sector":"Health care","country":"United States","initialAccess":"An unauthorized user first needed network access to a health care facility that used a susceptible pump.","bridgePath":"The hospital network supplied a remote path to the connected infusion pump.","otOrIotMechanism":"The vulnerabilities could let an unauthorized user control the pump and change the delivered drug dose.","observedEffect":"Hospira and an independent researcher confirmed remote access through a hospital network. The Food and Drug Administration urged facilities to stop using the pumps. The agency knew of no unauthorized clinical access or patient harm.","intendedEffect":"The research and advisories tried to identify and reduce a patient-safety risk before hostile use.","impactType":"medical-device-remote-control-capability","evolutionNote":"The case moved connected-device security from data loss to remote control of a treatment dose and a direct patient-safety decision by a regulator.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Cybersecurity Vulnerabilities of Hospira Symbiq Infusion System","url":"https://wayback.archive-it.org/7993/20170722144742/https://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm456815.htm","publisher":"United States Food and Drug Administration","publicationDate":"2015-07-31","accessedDate":"2026-11-02","supports":["target","mechanism","effect","context"]},{"title":"ICS-CERT Monitor, July and August 2015","url":"https://www.cisa.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jul-Aug2015.pdf","publisher":"Industrial Control Systems Cyber Emergency Response Team","publicationDate":"2015-08-31","accessedDate":"2026-11-02","supports":["dates","context"]}],"evidenceNotes":"The confirmed result was remote access capability and a regulatory stop-use recommendation. The Food and Drug Administration reported no unauthorized clinical access, injury, or death.","summary":"Hospira and an independent researcher confirmed that an unauthorized user could reach Symbiq infusion pumps through a hospital network. The user could change the delivered drug dose. The Food and Drug Administration urged health care facilities to stop using the pumps. The agency knew of no hostile clinical access or patient harm."},{"id":"vtech-connected-toy-breach-2015","title":"VTech connected-toy data breach","aliases":["Learning Lodge breach","Kid Connect breach"],"startDate":"2015-11-12","endDate":"2015-11-29","disclosureDate":"2015-11-30","datePrecision":"incident-day; disclosure-day","eventKind":"incident","lane":"consumer-iot-bridge","bridgeRole":"attack-surface","secondaryTags":["connected-toy","children","privacy","cloud-service","data-breach"],"status":"successful","attributionActor":"Unidentified hacker","attributionConfidence":"unknown","victim":"Children and parents who used VTech Learning Lodge, Kid Connect, and Planet VTech","sector":"Connected toys and children's online services","country":"Multiple countries","initialAccess":"The attacker used SQL injection to enter a VTech environment on a third-party server. The attacker then used credentials and passwords from a test environment to move into production systems.","bridgePath":"Internet-connected toys and their companion services caused families to store children's and parents' data in VTech systems.","otOrIotMechanism":"The services lacked adequate safeguards, intrusion detection, and encryption for some stored personal information.","observedEffect":"A hacker accessed consumer information, including children's information. The incident led to the first United States children's privacy case that involved internet-connected toys.","intendedEffect":"Public evidence does not establish the attacker's objective beyond unauthorized access to consumer data.","impactType":"connected-toy-data-exposure","evolutionNote":"The case showed that a connected consumer product can expose users through its supporting cloud and account systems, even when the toy is not directly compromised.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Electronic Toy Maker VTech Settles FTC Allegations That it Violated Children's Privacy Law and the FTC Act","url":"https://www.ftc.gov/news-events/news/press-releases/2018/01/electronic-toy-maker-vtech-settles-ftc-allegations-it-violated-childrens-privacy-law-ftc-act","publisher":"United States Federal Trade Commission","publicationDate":"2018-01-08","accessedDate":"2026-11-02","supports":["dates","access","mechanism","scale","effect","regulatory-response"]},{"title":"Connected toy manufacturer improves safeguards to adequately protect children's information","url":"https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2018/pipeda-2018-001/","publisher":"Office of the Privacy Commissioner of Canada","publicationDate":"2018-01-08","accessedDate":"2026-11-02","supports":["mechanism","effect","scale","regulatory-response"]}],"evidenceNotes":"The FTC complaint states allegations that led to a stipulated settlement. Public records do not identify the hacker or the exact initial exploit.","summary":"A hacker entered VTech systems that supported connected toys and children's services. The hacker accessed information about parents and children. Regulators found inadequate security controls. The case showed that cloud services can be a major part of a connected product's attack surface."},{"id":"ukraine-grid-2015","title":"Ukraine power grid attack","eventKind":"campaign","aliases":["BlackEnergy 3 grid attack"],"startDate":"2015-12-23","endDate":"2015-12-23","disclosureDate":"2016-03-18","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","remote-access","blackenergy"],"status":"successful","attributionActor":"Russian GRU Unit 74455, also called Sandworm","attributionConfidence":"high","victim":"Three Ukrainian electricity distribution companies","sector":"electricity","country":"Ukraine","initialAccess":"The actors used spear phishing, credential theft, and lateral movement.","bridgePath":"The actors moved from business systems to distribution control systems and used authorized remote-control functions.","otOrIotMechanism":"Operators under attacker control opened substation breakers. The actors also damaged computers and blocked customer calls.","observedEffect":"The attack stopped electricity for more than 225,000 customers. Operators restored service with manual control.","intendedEffect":"The operation tried to disrupt electricity distribution and delay recovery.","impactType":"direct-ot-operation","evolutionNote":"The attack combined ordinary enterprise intrusion methods with manual use of valid grid-control functions and coordinated recovery barriers.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"United States v. Andrienko et al. indictment","url":"https://www.justice.gov/d9/press-releases/attachments/2020/10/19/2020_10_19_unsealed_indictment_0.pdf","publisher":"United States Department of Justice","publicationDate":"2020-10-15","accessedDate":"2026-11-02","supports":["effect","attribution"]},{"title":"2017 State of Reliability","url":"https://www.nerc.com/globalassets/programs/rapa/pa/sor_2017_master_20170613.pdf","publisher":"North American Electric Reliability Corporation","publicationDate":"2017-06-13","accessedDate":"2026-11-02","supports":["access","effect","recovery"]}],"evidenceNotes":"A United States indictment and a power-sector review support the effect. The indictment supplies the official actor attribution.","summary":"Russian GRU actors entered Ukrainian electricity companies through business networks. They used valid remote-control functions to open breakers. More than 225,000 customers lost electricity. The actors also damaged computers and blocked customer calls. Operators used manual control to restore service."},{"id":"vpnfilter-2018","title":"VPNFilter router botnet","aliases":["VPNFilter","APT28 VPNFilter botnet"],"startDate":"2016-01-01","endDate":"2018-05-23","disclosureDate":"2018-05-23","datePrecision":"start-year; end-disruption-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["soho-router","nas","proxy","credential-theft","modbus","device-destruction"],"status":"disrupted","attributionActor":"Russian GRU actors identified by United States authorities as APT28, Sofacy, and Sandworm","attributionConfidence":"high","victim":"Owners of at least 500,000 small-office and home-office routers and storage devices","sector":"Residential networks, small businesses, government, and critical infrastructure","country":"At least 54 countries","initialAccess":"The actors exploited known vulnerabilities in internet-connected routers and network-attached storage devices.","bridgePath":"Compromised devices supplied proxy access, traffic collection, and a position at the edge of victim networks.","otOrIotMechanism":"VPNFilter could collect credentials, inspect industrial Modbus traffic, manipulate network traffic, execute commands, and make an infected device unusable.","observedEffect":"VPNFilter infected at least 500,000 devices in 54 countries. The United States seized a command domain and redirected botnet traffic to disrupt actor control and support victim notification.","intendedEffect":"Collect intelligence, conceal actor traffic, support access to downstream networks, and retain an option to disable infected devices.","impactType":"consumer-edge-proxy-and-destructive-capability","evolutionNote":"VPNFilter combined router proxying, industrial-protocol monitoring, and device destruction in one state-operated botnet.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Justice Department Announces Actions to Disrupt Advanced Persistent Threat 28 Botnet of Infected Routers and Network Storage Devices","url":"https://www.justice.gov/archives/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected","publisher":"United States Department of Justice","publicationDate":"2018-05-23","accessedDate":"2026-11-02","supports":["dates","scale","devices","effect","attribution","outcome"]},{"title":"New VPNFilter malware targets at least 500K networking devices worldwide","url":"https://blog.talosintelligence.com/vpnfilter/","publisher":"Cisco Talos","publicationDate":"2018-05-23","accessedDate":"2026-11-02","supports":["access","mechanism","scale","effect","limitations"]}],"evidenceNotes":"The May 2018 operation disrupted command infrastructure. It did not remove every infection. Some devices remained vulnerable to reinfection. Modbus monitoring was a malware capability; public evidence does not establish a physical OT effect.","summary":"VPNFilter infected at least 500,000 routers and storage devices. The malware could collect credentials, inspect Modbus traffic, relay actor traffic, and disable devices. The United States seized a command domain and disrupted actor control. Public evidence does not show a physical OT effect."},{"id":"nissan-leaf-api-2016","title":"Nissan LEAF cloud API demonstration","eventKind":"demonstration","aliases":["NissanConnect EV API vulnerability"],"startDate":"2016-01-23","endDate":"2016-02-24","disclosureDate":"2016-02-24","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["vehicle","cloud-api","authorization","privacy","climate-control"],"status":"successful","attributionActor":"Not applicable to controlled security research","attributionConfidence":"not-applicable","victim":"Nissan LEAF owners who used the NissanConnect EV service","sector":"Automotive","country":"Multiple countries","initialAccess":"The cloud application programming interface accepted anonymous requests that contained a vehicle identification number.","bridgePath":"The Nissan cloud service relayed requests from the internet to connected vehicles.","otOrIotMechanism":"A user could enumerate vehicle identifiers, retrieve battery and travel information, and turn vehicle climate control on or off without an authorization token.","observedEffect":"Researchers used the cloud service to control climate functions on an authorized test vehicle from another country. They also confirmed that another vehicle returned status data. They did not change functions on the other vehicle.","intendedEffect":"The research tried to confirm and report missing authorization in a connected-vehicle cloud service.","impactType":"vehicle-cloud-direct-control","evolutionNote":"The demonstration showed that a cloud authorization failure could control vehicle functions without exploiting vehicle firmware or a local radio interface.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs","url":"https://www.troyhunt.com/controlling-vehicle-features-of-nissan/","publisher":"Troy Hunt","publicationDate":"2016-02-24","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect"]}],"evidenceNotes":"The researchers controlled an authorized vehicle and limited tests on an unrelated vehicle to a passive status request. The demonstrated functions did not include steering, braking, or propulsion.","summary":"The NissanConnect EV cloud interface accepted anonymous requests that contained only a vehicle identifier. Researchers controlled climate functions on an authorized Nissan LEAF from another country. They also confirmed that an unrelated vehicle returned status data. The work showed that a cloud authorization flaw could control a connected product without an exploit against the product firmware."},{"id":"russian-energy-third-party-pivot-2016-2018","title":"Russian energy-sector third-party pivot campaign","eventKind":"campaign","aliases":["TA18-074A","Dragonfly 2.0 third-party campaign"],"startDate":"2016-03-01","endDate":"2018-03-16","disclosureDate":"2018-03-16","datePrecision":"start-month; advisory-cutoff","lane":"ot-bridge","bridgeRole":"pivot","secondaryTags":["energy","third-party","remote-access","staging-targets","ics-reconnaissance"],"status":"successful","attributionActor":"Russian government cyber actors, as attributed by the United States Department of Homeland Security and Federal Bureau of Investigation","attributionConfidence":"high","victim":"United States and international energy organizations, plus vendors, integrators, suppliers, and small commercial facilities","sector":"energy and critical infrastructure","country":"United States and multiple other countries","initialAccess":"The actors compromised small commercial facilities and third-party suppliers. They used spearphishing, watering holes, malicious documents, and compromised websites to collect credentials.","bridgePath":"The actors used trusted third-party infrastructure, accounts, and remote access to enter energy enterprise networks. They then moved toward systems and data related to industrial control environments.","otOrIotMechanism":"The actors collected control-system architecture, vendor information, reference documents, and layout diagrams. The advisory also documented access to human-machine interface screenshots. It did not report a physical process change.","observedEffect":"The campaign gained remote access to energy-sector networks and exfiltrated enterprise and industrial-control information. It compromised third parties as staging points. Public reporting did not identify a service outage from this campaign phase.","intendedEffect":"The actors sought persistent access, credentials, and detailed knowledge of energy operations.","impactType":"trusted-third-party-to-energy-pivot","evolutionNote":"This campaign made suppliers and small facilities part of the attack path. The actors used trusted relationships to bypass direct defenses at larger energy targets.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors","url":"https://www.cisa.gov/news-events/alerts/2018/03/15/russian-government-cyber-activity-targeting-energy-and-other-critical-infrastructure-sectors","publisher":"United States Department of Homeland Security and Federal Bureau of Investigation","publicationDate":"2018-03-16","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","attribution","limitations"]}],"evidenceNotes":"The advisory attributes the activity to Russian government actors. It documents network access and industrial-control data collection. It does not show that this campaign phase changed a physical process or caused an outage. The disclosure date is the advisory revision date, not the campaign end.","summary":"Russian government actors first compromised suppliers, integrators, and small commercial facilities. They used those trusted systems and accounts to enter energy networks. They collected enterprise and industrial-control information. Public evidence does not show a physical effect from this campaign phase."},{"id":"kemuri-shared-it-ot-platform-2016","title":"Kemuri shared IT and OT platform compromise","eventKind":"incident","aliases":["Smoke on the Water","Kemuri Water Company breach"],"startDate":"2016-03-02","endDate":"2016-03-02","disclosureDate":"2016-03-02","datePrecision":"disclosure-only; activity-in-undisclosed-preceding-60-day-window","lane":"ot-bridge","bridgeRole":"pivot","secondaryTags":["water","as400","payment-application","shared-platform"],"status":"successful","attributionActor":"Unidentified actor; Verizon linked the source addresses to earlier hacktivist investigations","attributionConfidence":"low","victim":"An unnamed regional water utility identified by the pseudonym Kemuri Water Company","sector":"water and wastewater","country":"Unspecified","initialAccess":"The actor exploited an internet-facing payment application. The web server stored credentials for the utility's AS/400 system in a clear-text configuration file.","bridgePath":"One AS/400 platform held customer data, billing, financial functions, network routing, and the valve and flow-control application. Stolen web-server credentials opened both IT and OT functions.","otOrIotMechanism":"The actor used the shared platform to change settings for programmable logic controllers that managed water flow and treatment chemicals.","observedEffect":"The actor made four connections during an undisclosed 60-day period. The actor changed valve, flow, and chemical settings. The changes disrupted water distribution and increased the time needed to replenish supplies. Utility alerts helped staff reverse the changes. The same breach exposed data for 2.5 million customers.","intendedEffect":"Verizon found no clear motive. The actor appeared to have limited knowledge of the control process.","impactType":"shared-it-ot-platform-pivot","evolutionNote":"Kemuri joined payment, customer, financial, routing, and control functions on one legacy platform. A basic web compromise therefore reached both personal data and physical-process controls.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Data Breach Digest: Smoke on the Water","url":"https://files.cyberriskalliance.com/wp-content/uploads/2018/07/verizon_data_breach_digest_53373.pdf","publisher":"Verizon RISK Team","publicationDate":"2016-03-02","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","attribution","limitations"]},{"title":"Get a behind-the-scenes look at cyber investigations through the first-ever Verizon Data Breach Digest","url":"https://www.prnewswire.com/news-releases/get-a-behind-the-scenes-look-at-cyber-investigations-through-the-first-ever-verizon-data-breach-digest-300229255.html","publisher":"Verizon","publicationDate":"2016-03-02","accessedDate":"2026-11-02","supports":["publication-date","source-context","limitations"]}],"evidenceNotes":"Verizon used a pseudonym and did not identify the country or assessment date. The four connections occurred during an undisclosed 60-day period before its assessment. Therefore, the record uses the report release date only. Verizon linked the source addresses to earlier hacktivist investigations and classified the scenario as hacktivist, but it found no clear motive or identified actor. The report linked unauthorized sessions to process changes but did not report harm to customers.","summary":"An unidentified actor compromised a water utility's payment application and found credentials for a shared AS/400 platform. That platform held customer data and ran the valve and flow-control application. The actor exposed customer data and changed water-treatment settings. Staff reversed the changes after alerts."},{"id":"tesla-model-s-remote-control-demo-2016","title":"Tesla Model S remote-control demonstration","aliases":["Keen Security Lab Tesla remote attack"],"startDate":"2016-09-19","endDate":"2016-09-19","disclosureDate":"2016-09-19","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["connected-vehicle","can-bus","browser","wifi","research"],"status":"successful","attributionActor":"Authorized Tencent Keen Security Lab researchers","attributionConfidence":"not-applicable","victim":"Research Tesla Model S vehicles","sector":"Automotive","country":"China","initialAccess":"The researchers used a chain of vulnerabilities while a vehicle connected to a malicious Wi-Fi hotspot and loaded content through its browser.","bridgePath":"The browser and vehicle gateway supplied a path from wireless internet access to the controller area network.","otOrIotMechanism":"The exploit chain gained control of vehicle systems and sent commands that affected body and driving functions.","observedEffect":"The researchers demonstrated remote control in parked and driving modes on unmodified Model S vehicles. Tesla confirmed the vulnerabilities and issued an over-the-air update.","intendedEffect":"Demonstrate a remote path from a connected vehicle interface to controller area network functions.","impactType":"connected-device-to-safety-control","evolutionNote":"The work extended remote vehicle-control research to a software-defined vehicle that could also receive a security fix over the air.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Car Hacking Research: Remote Attack Tesla Motors","url":"https://keenlab.tencent.com/en/2016/09/19/Keen-Security-Lab-of-Tencent-Car-Hacking-Research-Remote-Attack-to-Tesla-Cars/","publisher":"Tencent Keen Security Lab","publicationDate":"2016-09-19","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","vendor-response"]},{"title":"Free-Fall: Hacking Tesla from Wireless to CAN Bus","url":"https://blackhat.com/docs/us-17/thursday/us-17-Nie-Free-Fall-Hacking-Tesla-From-Wireless-To-CAN-Bus-wp.pdf","publisher":"Tencent Keen Security Lab and Black Hat USA","publicationDate":"2017-07-27","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]}],"evidenceNotes":"This was controlled research, not hostile activity. The attack required the vehicle to connect to attacker-controlled Wi-Fi and use its browser. The researchers reported the flaws to Tesla before public disclosure.","summary":"Researchers used a vulnerability chain to cross from a Tesla Model S browser to its vehicle network. They demonstrated remote control in parked and driving modes. Tesla confirmed the flaws and delivered an over-the-air fix."},{"id":"hajime-p2p-iot-botnet-2016","title":"Hajime peer-to-peer IoT botnet","aliases":["Hajime worm"],"startDate":"2016-10-01","endDate":"2017-04-25","disclosureDate":"2016-10-16","datePrecision":"start-month; disclosure-day; end-observation-cutoff","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","camera","dvr","peer-to-peer","worm"],"status":"successful","attributionActor":"Unknown Hajime operator","attributionConfidence":"unknown","victim":"Owners of compromised routers, cameras, and digital video recorders","sector":"Consumer and small-network devices","country":"Multiple countries","initialAccess":"Hajime used default Telnet credentials and later added device exploits to enter internet-connected devices.","bridgePath":"Compromised consumer devices formed a decentralized peer-to-peer network that could distribute code and commands.","otOrIotMechanism":"The worm used a distributed hash table and BitTorrent-style communication instead of a fixed command server. It also blocked ports that competing malware used.","observedEffect":"Hajime compromised a large population of devices and displayed messages from its operator. Researchers did not observe a DDoS payload during the documented period.","intendedEffect":"The operator claimed to secure systems, but public evidence does not establish the operator's identity or future intent.","impactType":"decentralized-iot-botnet","evolutionNote":"Hajime showed that an IoT botnet could remove a central command-server dependency and retain the ability to distribute new modules.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Hajime: Analysis of a decentralized internet worm for IoT devices","url":"https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf","publisher":"Rapidity Networks","publicationDate":"2016-10-16","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect"]},{"title":"Hajime - Friend or Foe?","url":"https://www.radware.com/security/ddos-threats-attacks/hajime-iot-botnet/","publisher":"Radware Emergency Response Team","publicationDate":"2017-04-25","accessedDate":"2026-11-02","supports":["access","devices","scale","mechanism","effect","limitations"]}],"evidenceNotes":"Published estimates of botnet size differ. The record does not use a precise device count. The operator's messages suggested a vigilante purpose, but the modular botnet remained under unauthorized control.","summary":"Hajime entered routers, cameras, and recorders through weak credentials and exploits. It linked the devices through a peer-to-peer control system and could distribute new code. Researchers did not observe a DDoS payload during the documented period. The operator remained unknown."},{"id":"mirai-dyn-2016","title":"Mirai attack on Dyn","aliases":["Mirai Dyn DDoS"],"startDate":"2016-10-21","endDate":"2016-10-21","disclosureDate":"2016-10-21","eventKind":"incident","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["botnet","ddos","camera","dvr","router"],"status":"successful","attributionActor":"Paras Jha, Josiah White, and Dalton Norman developed Mirai; Daniel Kaye pleaded guilty to participating in the Dyn attack","attributionConfidence":"high","victim":"Dyn and users of services that depended on Dyn DNS","sector":"Internet infrastructure","country":"United States and global","initialAccess":"Mirai scanned for internet-connected devices that used known default credentials.","bridgePath":"Compromised cameras, digital video recorders, routers, and other devices supplied distributed traffic for attacks against internet services.","otOrIotMechanism":"The botnet enrolled consumer devices and instructed them to send large volumes of network traffic.","observedEffect":"The attack disrupted Dyn's domain name service and made major online services unavailable to users.","intendedEffect":"Disrupt Dyn and services that depended on its domain name infrastructure.","impactType":"iot-botnet-ddos","evolutionNote":"Mirai made insecure consumer devices a large and reusable source of attack capacity.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Individual Pleads Guilty for Participating in Internet of Things Cyberattack in 2016","url":"https://www.justice.gov/usao-nh/pr/individual-pleads-guilty-participating-internet-things-cyberattack-2016","publisher":"United States Department of Justice","publicationDate":"2020-02-13","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","attribution"]},{"title":"Justice Department Announces Charges and Guilty Pleas in Three Computer Crime Cases","url":"https://www.justice.gov/usao-ak/pr/justice-department-announces-charges-and-guilty-pleas-three-computer-crime-cases","publisher":"United States Department of Justice","publicationDate":"2017-12-13","accessedDate":"2026-11-02","supports":["access","devices","attribution","effect"]}],"evidenceNotes":"The Mirai developers and the person charged for the Dyn participation are separate attribution claims. The cited criminal cases support both statements separately.","summary":"Mirai used weak default credentials to infect consumer devices. The devices supplied traffic for a distributed denial-of-service attack against Dyn. The attack disrupted domain name service and made many online services unavailable."},{"id":"lappeenranta-heating-ddos-2016","title":"Lappeenranta building-heating disruption","eventKind":"incident","aliases":["Finnish building-automation denial-of-service incident"],"startDate":"2016-10-31","endDate":"2016-11-03","disclosureDate":"2016-11-08","datePrecision":"approximate-start; end-day; disclosure-day","lane":"iiot-bridge","bridgeRole":"attack-capacity","secondaryTags":["building-automation","heating","denial-of-service","smart-building"],"status":"successful","attributionActor":"Unknown criminal group, as assessed by the Finnish communications regulator","attributionConfidence":"low","victim":"Building-automation operators and residents in Lappeenranta","sector":"commercial and residential building management","country":"Finland","initialAccess":"Public evidence does not identify the first access method. The affected building-control systems were connected to the internet for remote management.","bridgePath":"Attack traffic passed through vulnerable building-automation systems toward another target. The overload also disrupted the local control computers.","otOrIotMechanism":"The traffic exhausted control-system capacity. Control computers restarted repeatedly or became unavailable for remote control.","observedEffect":"Heating services were disrupted at two buildings in Lappeenranta. Finnish officials also reported disruption of other heating and cooling systems. The local systems were probably not the final target.","intendedEffect":"The Finnish communications regulator assessed that criminals used vulnerable systems to strengthen an attack against another European target. It did not identify that target.","impactType":"building-automation-disruption","evolutionNote":"The incident showed that a connected building system can supply attack capacity and fail locally at the same time.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Communications watchdog: Criminals behind home automation system cyber attack","url":"https://yle.fi/a/3-9278770","publisher":"Yle, citing the Finnish Communications Regulatory Authority","publicationDate":"2016-11-08","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","actor-characterization","limitations"]}],"evidenceNotes":"The regulator assessed that the Finnish systems relayed traffic toward another target. Public reports differ on the precise technical path and duration. Do not attribute the incident to Mirai without stronger evidence.","summary":"Attack traffic passed through connected building-automation systems in Finland. The overload disrupted heating at two buildings. The Finnish communications regulator assessed that criminals used the systems to attack another target."},{"id":"philips-hue-zigbee-worm-demo-2016","title":"Philips Hue Zigbee worm demonstration","aliases":["IoT Goes Nuclear","IrradiateHue"],"startDate":"2016-11-03","endDate":"2016-11-03","disclosureDate":"2016-11-03","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["smart-light","zigbee","worm","firmware","mesh-network"],"status":"successful","attributionActor":"Authorized academic security researchers","attributionConfidence":"not-applicable","victim":"Philips Hue research lamps","sector":"Smart homes and connected lighting","country":"Israel and Canada","initialAccess":"The researchers exploited the Zigbee Light Link proximity check and recovered the key used to protect lamp firmware updates.","bridgePath":"One compromised lamp could send a malicious over-the-air firmware update directly to nearby lamps through Zigbee links.","otOrIotMechanism":"The research combined a Touchlink flaw, firmware-key recovery, and lamp-to-lamp radio propagation. A drone could trigger the demonstrated takeover from outside a building.","observedEffect":"The researchers demonstrated the required infection steps and changed lamp firmware. They did not assemble or release a self-spreading destructive worm. Philips issued a firmware fix for the long-range propagation flaw.","intendedEffect":"Show that dense smart-device networks could support malware propagation without using the internet or a central hub.","impactType":"smart-home-mesh-worm-capability","evolutionNote":"The work showed that physical proximity between consumer devices could become an independent malware path.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"IoT Goes Nuclear: Creating a ZigBee Chain Reaction","url":"https://eprint.iacr.org/2016/1047.pdf","publisher":"IACR Cryptology ePrint Archive","publicationDate":"2016-11-03","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"Philips Hue, AES-CCM, and more!","url":"https://colinoflynn.com/2016/11/philips-hue-aes-ccm-and-more/","publisher":"Colin O'Flynn","publicationDate":"2016-11-03","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations","vendor-response"]}],"evidenceNotes":"The researchers verified the components of the infection path but deliberately did not combine them into a self-spreading worm. Citywide effects were modeled, not observed.","summary":"Researchers changed Philips Hue lamp firmware through Zigbee. They showed the components needed for lamp-to-lamp malware spread without the internet or a hub. They did not release a self-spreading worm. Philips fixed the flaw that enabled long-range propagation."},{"id":"sfmta-ransomware-fare-dependency-2016","title":"SFMTA ransomware and fare-system precaution","eventKind":"incident","aliases":["Muni ransomware incident"],"startDate":"2016-11-25","endDate":"2016-11-30","disclosureDate":"2016-11-28","datePrecision":"start-day; fare-equipment-downtime-about-24-hours; recovery-expected-by-end-day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["transit","ransomware","fare-gates","office-it"],"status":"successful","attributionActor":"Unknown ransomware operator","attributionConfidence":"unknown","victim":"San Francisco Municipal Transportation Agency","sector":"public transit","country":"United States","initialAccess":"SFMTA stated that the malware did not enter through an external breach of its firewalls. It did not publish the exact infection vector.","bridgePath":"Ransomware encrypted office computers and affected access to internal systems. SFMTA and its payment partner turned off ticket machines and fare gates as a precaution.","otOrIotMechanism":"The malware did not affect train or bus control and did not affect transit safety. The operational bridge was the dependency between office IT, payment systems, and passenger service.","observedEffect":"Approximately 900 office computers were affected. Ticket machines and fare gates were offline for approximately 24 hours. Transit service continued, and safety systems were not affected. On November 28, SFMTA expected the remaining computers to work within one or two days. SFMTA later reported approximately 50,000 dollars in lost fare revenue.","intendedEffect":"The operator tried to extort a ransom by denying access to computer systems.","impactType":"transit-business-system-dependency","evolutionNote":"The incident separated safe vehicle operation from the digital systems around passenger service and revenue. A business-IT attack changed station operations without changing train control.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Update on SFMTA Ransomware Attack","url":"https://www.sfmta.com/blog/update-sfmta-ransomware-attack","publisher":"San Francisco Municipal Transportation Agency","publicationDate":"2016-11-28","accessedDate":"2026-11-02","supports":["dates","effect","bridge","recovery","operational-continuity","limitations"]},{"title":"San Francisco Municipal Transportation Agency Revenue Bonds","url":"https://www.sfmta.com/media/43630/download?inline=","publisher":"San Francisco Municipal Transportation Agency","publicationDate":"2021-03-01","accessedDate":"2026-11-02","supports":["effect","financial-effect","recovery"]}],"evidenceNotes":"SFMTA said that transit and safety operations were unaffected. It turned off fare equipment as a precaution. November 30 is an upper bound from SFMTA's November 28 expectation, not a confirmed full-restoration date. The record does not claim compromise of train-control systems.","summary":"Ransomware encrypted approximately 900 SFMTA office computers. The agency turned off ticket machines and fare gates for approximately 24 hours. Transit and safety operations continued. The event showed a dependency between enterprise IT, payment services, and passenger operations."},{"id":"telekom-router-outage-2016","title":"Deutsche Telekom router outage during Mirai-variant attack","eventKind":"incident","aliases":["Deutsche Telekom TR-064 router attack","Speedport router outage"],"startDate":"2016-11-27","endDate":"2016-11-28","disclosureDate":"2016-11-28","datePrecision":"day","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["routers","mirai-variant","telecommunications","device-outage","attack-capacity"],"status":"mixed","attributionActor":"Daniel Kaye","attributionConfidence":"high","victim":"Deutsche Telekom broadband customers","sector":"Consumer telecommunications","country":"Germany","initialAccess":"Kaye sent mass requests that targeted a known Zyxel TR-064 flaw. Deutsche Telekom routers did not have that flaw, so exploitation failed on those devices.","bridgePath":"The operator tried to recruit routers as denial-of-service capacity. Some Deutsche Telekom router models crashed while processing the mass requests.","otOrIotMechanism":"The routers were not infected. A separate then-unknown processing flaw caused repeated crashes under the request volume.","observedEffect":"BSI reported about 900,000 affected customer connections. Deutsche Telekom reported temporary failures in more than one million routers. Customers lost internet, voice-over-IP, and IPTV services until an update restored normal operation the next day.","intendedEffect":"Kaye tried to build a router botnet for denial-of-service attacks against a Liberian telecommunications company.","impactType":"consumer-router-service-outage","evolutionNote":"This incident showed that failed IoT exploitation can still cause mass device and service outages.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Judgment reached on the 2016 router attack","url":"https://www.telekom.com/en/newsroom/latest-updates/news/2017/7/judgment-reached-on-the-2016-router-attack","publisher":"Deutsche Telekom","publicationDate":"2017-07-27","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","intent","conviction"]},{"title":"The State of IT Security in Germany 2017","url":"https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2017.pdf?__blob=publicationFile&v=3","publisher":"German Federal Office for Information Security","publicationDate":"2017-10-12","accessedDate":"2026-11-02","supports":["mechanism","effect","scope"]},{"title":"Lonestar Communications Corporation LLC v Kaye & Ors [2023] EWHC 421 (Comm)","url":"https://www.bailii.org/ew/cases/EWHC/Comm/2023/421.html","publisher":"England and Wales High Court (Commercial Court)","publicationDate":"2023-02-28","accessedDate":"2026-11-02","supports":["attribution","conviction","intent"]}],"evidenceNotes":"The source counts describe different units: about 900,000 customer connections and more than one million routers. The targeted exploit did not work on Deutsche Telekom routers. The requests triggered a different crash flaw. The later court record identifies Kaye and records his guilty plea and confession.","summary":"Daniel Kaye sent mass exploit requests to recruit routers for a botnet. Deutsche Telekom routers resisted infection, but some models crashed under the requests. The outage affected about 900,000 customer connections and more than one million routers."},{"id":"industroyer-2016","title":"CRASHOVERRIDE at Kyiv","eventKind":"incident","aliases":["Industroyer","CRASHOVERRIDE"],"startDate":"2016-12-17","endDate":"2016-12-17","disclosureDate":"2017-06-12","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","iec-protocols","protection-relay"],"status":"successful","attributionActor":"Russian GRU Unit 74455, also called Sandworm","attributionConfidence":"high","victim":"Ukrenergo substation in Kyiv","sector":"electricity","country":"Ukraine","initialAccess":"Public evidence does not identify the first access path.","bridgePath":"The attackers installed malware in the substation control environment.","otOrIotMechanism":"The malware used native electricity protocols to operate switches and circuit breakers. It also tried to disable protection relays.","observedEffect":"Part of Kyiv lost electricity for approximately one hour. The protection-relay attack did not complete.","intendedEffect":"The operation tried to automate power disruption and make recovery more difficult.","impactType":"direct-ot-manipulation","evolutionNote":"Industroyer changed the model from remote manual operation to malware that directly used standard grid protocols.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Industroyer technical analysis","url":"https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/","publisher":"ESET Research","publicationDate":"2017-06-12","accessedDate":"2026-11-02","supports":["mechanism","effect"]},{"title":"United States v. Andrienko et al. indictment","url":"https://www.justice.gov/d9/press-releases/attachments/2020/10/19/2020_10_19_unsealed_indictment_0.pdf","publisher":"United States Department of Justice","publicationDate":"2020-10-15","accessedDate":"2026-11-02","supports":["effect","attribution"]}],"evidenceNotes":"ESET linked the malware to the outage with high probability. A later United States indictment attributed the operation to GRU officers.","summary":"Industroyer used standard electricity protocols to operate substation equipment. It stopped electricity in part of Kyiv for approximately one hour. The malware also tried to disable protection relays. This step could have damaged equipment during recovery, but it did not complete."},{"id":"ring-camera-takeovers-2017","title":"Ring camera account takeovers","aliases":["Ring credential-stuffing campaign"],"startDate":"2017-01-01","endDate":"2020-01-31","disclosureDate":"2023-05-31","datePrecision":"campaign-years; end-approximate","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["camera","credential-stuffing","privacy","surveillance","harassment"],"status":"successful","attributionActor":"Multiple unidentified attackers","attributionConfidence":"unknown","victim":"Approximately 55,000 Ring customers in the United States","sector":"Consumer physical security and smart homes","country":"United States","initialAccess":"Attackers used credential stuffing and password guessing against customer accounts. Ring did not require effective multifactor authentication during much of the period.","bridgePath":"Compromised accounts supplied remote access to stored video, live feeds, profiles, settings, and camera audio.","otOrIotMechanism":"The cloud service allowed account holders to view cameras, change settings, and speak through two-way audio.","observedEffect":"Attackers accessed accounts, videos, live streams, and device controls for approximately 55,000 customers. Some attackers used camera audio to threaten or harass occupants.","intendedEffect":"Access private video, surveil occupants, control cameras, and harass or extort users.","impactType":"consumer-camera-cloud-control","evolutionNote":"The incidents showed how reused credentials and weak cloud-account controls could expose physical spaces through consumer cameras.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users' Cameras","url":"https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users","publisher":"United States Federal Trade Commission","publicationDate":"2023-05-31","accessedDate":"2026-11-02","supports":["campaign-window","access","mechanism","scale","effect","limitations"]}],"evidenceNotes":"The FTC record combines several waves and many unidentified attackers. The approximately 55,000 figure applies to U.S. customer accounts described in the complaint. It does not identify one coordinated operator.","summary":"Attackers used stolen or guessed credentials to enter Ring accounts. They accessed video, live feeds, settings, and camera audio for approximately 55,000 customers. Some attackers used two-way audio to threaten or harass occupants. Public evidence does not identify one operator."},{"id":"harvey-plc-rootkit-2017","title":"HARVEY physics-aware PLC rootkit demonstration","eventKind":"demonstration","aliases":["HARVEY"],"startDate":"2017-02-26","endDate":"2017-03-01","disclosureDate":"2017-02-27","datePrecision":"conference-window; paper-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","rootkit","physics-aware","power-grid"],"status":"successful","attributionActor":"Luis A. Garcia, Ferdinand Brasser, Mehmet H. Cintuglu, Ahmad-Reza Sadeghi, Osama Mohammed, and Saman A. Zonouz","attributionConfidence":"not-applicable","victim":"An Allen-Bradley controller in a laboratory power-grid testbed","sector":"electricity","country":"United States","initialAccess":"The demonstration installed modified firmware through a JTAG hardware debugging interface. The paper also described possible network and removable-media paths.","bridgePath":"The rootkit ran below the normal controller logic and controlled the PLC input and output path.","otOrIotMechanism":"HARVEY replaced legitimate actuator commands with damaging commands. It used a physical power-system model to generate false sensor values that matched the expected operator view.","observedEffect":"The researchers implemented HARVEY on an Allen-Bradley PLC and evaluated it on a power-grid testbed. It changed physical outputs and concealed the changes from controller logic and operator monitoring.","intendedEffect":"The research tested whether model-aware firmware malware could maximize physical damage and keep operator data internally consistent.","impactType":"laboratory-stealthy-ot-manipulation","evolutionNote":"HARVEY moved process deception into controller firmware and used a live physical model to create plausible false measurements.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit","url":"https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/hey-my-malware-knows-physics-attacking-plcs-physical-model-aware-rootkit/","publisher":"Internet Society","publicationDate":"2017-02-27","accessedDate":"2026-11-02","supports":["mechanism","effect","scope","authors"]},{"title":"Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit","url":"https://www.ndss-symposium.org/wp-content/uploads/2017/09/ndss2017_08-1_Garcia_paper.pdf","publisher":"Internet Society","publicationDate":"2017-02-27","accessedDate":"2026-11-02","supports":["access","mechanism","effect","limitations","authors"]}],"evidenceNotes":"This was a laboratory testbed demonstration. It required firmware compromise and a target process model. No malicious field deployment was reported. The conference ran from 2017-02-26 through 2017-03-01, and the paper page is dated 2017-02-27.","summary":"HARVEY ran in PLC firmware on a power-grid testbed. It changed actuator commands and used a physical model to generate plausible false sensor values. The controller logic and operator view did not show the real manipulation. The work was a laboratory demonstration, not a reported attack."},{"id":"brickerbot-pdos-2017","title":"BrickerBot permanent-denial campaign","aliases":["BrickerBot PDoS","Internet Chemotherapy"],"startDate":"2017-04-01","endDate":"2017-04-21","disclosureDate":"2017-04-13","datePrecision":"start-month; disclosure-day; last-documented-activity-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["camera","dvr","router","destructive-malware","telnet"],"status":"unknown","attributionActor":"Self-described Janit0r; real identity unknown","attributionConfidence":"low","victim":"Owners of insecure BusyBox-based IoT devices","sector":"Consumer and small-network devices","country":"Multiple countries","initialAccess":"BrickerBot used exposed Telnet services and default credentials to enter BusyBox-based devices.","bridgePath":"Compromised devices launched destructive command sequences against other internet-connected cameras, recorders, and similar devices.","otOrIotMechanism":"The commands corrupted storage, removed files and network routes, and changed kernel settings.","observedEffect":"Radware recorded 1,895 attack attempts over four days. It later recorded BrickerBot.3 and BrickerBot.4 attempts on April 21. In a controlled test, the command sequence made one IP camera unresponsive after reboot, and a factory reset did not recover it. Radware could not confirm how many devices were disabled in the wild.","intendedEffect":"Permanently disable insecure IoT devices so that other botnets could not use them.","impactType":"destructive-consumer-iot-control","evolutionNote":"BrickerBot changed insecure IoT devices from attack resources into the direct target of destructive malware.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"BrickerBot: Back With A Vengeance","url":"https://www.radware.com/security/ddos-threats-attacks/brickerbot-pdos-back-with-vengeance/","publisher":"Radware Emergency Response Team","publicationDate":"2017-04-20","accessedDate":"2026-11-02","supports":["dates","access","mechanism","scale","effect","actor-claim","limitations"]},{"title":"BrickerBot – The Dark Knight of IoT","url":"https://blog.radware.com/security/2017/04/brickerbot-dark-knight-iot/","publisher":"Radware","publicationDate":"2017-04-13","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","limitations"]}],"evidenceNotes":"Radware verified permanent loss of function on one test camera. It could not measure or confirm the number of devices damaged in the wild. The unknown status applies to the principal destructive effect of the hostile campaign. Radware documented later BrickerBot.3 and BrickerBot.4 attempts on April 21. The Janit0r identity is a self-claim.","summary":"BrickerBot used exposed Telnet services and default credentials to enter consumer IoT devices. It sent commands that corrupted storage and network settings. Radware permanently disabled one test camera, but it could not confirm the number of devices disabled in the wild."},{"id":"dallas-warning-sirens-2017","title":"Dallas warning-siren activation","eventKind":"incident","aliases":["Dallas outdoor warning siren hack"],"startDate":"2017-04-07","endDate":"2017-04-08","disclosureDate":"2017-04-08","datePrecision":"day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["public-safety","warning-siren","municipal-iot","wireless-control"],"status":"successful","attributionActor":"Unknown local actor","attributionConfidence":"unknown","victim":"City of Dallas outdoor warning system","sector":"municipal public safety","country":"United States","initialAccess":"The City of Dallas did not disclose the technical access method. It assessed that the attack came from the Dallas area.","bridgePath":"The attacker reached the connected municipal warning system and issued unauthorized activation commands.","otOrIotMechanism":"The attack activated all outdoor warning sirens. Public evidence does not identify the exploited device, protocol, or vulnerability.","observedEffect":"All 156 Dallas warning sirens activated at 11:42 p.m. The city disabled the complete outdoor warning system at 1:17 a.m. while engineers investigated.","intendedEffect":"Public evidence does not establish the attacker's objective.","impactType":"municipal-warning-direct-control","evolutionNote":"The incident showed that unauthorized control of connected public-safety equipment can cause a city-wide physical alarm without custom destructive malware.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Update on Dallas sirens","url":"https://content.govdelivery.com/accounts/TXDALLAS/bulletins/193126a","publisher":"City of Dallas","publicationDate":"2017-04-08","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","attribution-limitations"]}],"evidenceNotes":"The city confirmed unauthorized activation but withheld technical details. The statement that the attack was local was an assessment, not an identification of the actor. Do not infer a radio protocol or vulnerability.","summary":"An unknown actor activated all 156 outdoor warning sirens in Dallas. The city disabled the complete warning system while engineers investigated. Public evidence does not identify the access method or attacker."},{"id":"persirai-camera-botnet-2017","title":"Persirai IP-camera botnet","eventKind":"campaign","aliases":["ELF_PERSIRAI.A"],"startDate":"2017-05-09","endDate":"2017-05-09","disclosureDate":"2017-05-09","datePrecision":"research-publication cutoff","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["ip-cameras","ddos","zero-day","upnp"],"status":"successful","attributionActor":"Unknown botnet operators","attributionConfidence":"unknown","victim":"Owners of vulnerable internet-connected IP cameras","sector":"Consumer and small-business video surveillance","country":"Multiple countries","initialAccess":"Universal Plug and Play exposed camera web interfaces through routers. Persirai used command injection and a publicly disclosed zero-day to obtain password files and execute code.","bridgePath":"Compromised cameras became scanning nodes and potential denial-of-service capacity against other internet systems.","otOrIotMechanism":"The memory-resident malware contacted command servers, spread to more cameras, and accepted UDP flood commands.","observedEffect":"Trend Micro observed compromised cameras automatically attacking other cameras. About 120,000 exposed cameras matched the vulnerable device population.","intendedEffect":"The campaign tried to expand a camera botnet and use enrolled devices for distributed denial-of-service attacks.","impactType":"iot-botnet-attack-capacity","evolutionNote":"Persirai showed how a shared camera-component flaw could create attack capacity without relying only on default Telnet passwords.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Persirai: New IoT Botnet Targets IP Cameras","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/persirai-new-internet-things-iot-botnet-targets-ip-cameras","publisher":"Trend Micro Research","publicationDate":"2017-05-09","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","scope","limitations"]},{"title":"Persirai Botnet","url":"https://digital.nhs.uk/cyber-alerts/2018/cc-2805","publisher":"NHS England Digital","publicationDate":"2018-11-22","accessedDate":"2026-11-02","supports":["mechanism","mitigation","archived-context"]}],"evidenceNotes":"The May 9 date is a research-publication cutoff, not a proven campaign start or end. The 120,000 figure is the vulnerable exposed population, not a verified infection count. The NHS page is archived and warns that its content can be outdated. Public sources do not quantify DDoS victim impact.","summary":"Persirai exploited exposed IP-camera interfaces. Compromised cameras scanned and attacked more cameras and accepted denial-of-service commands. About 120,000 exposed cameras matched the vulnerable population, not a verified infected-device count."},{"id":"wannacry-manufacturing-shutdowns-2017","title":"WannaCry manufacturing shutdowns","eventKind":"campaign","aliases":["WannaCry","WannaCrypt"],"startDate":"2017-05-12","endDate":"2017-05-15","disclosureDate":"2017-05-12","datePrecision":"day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","worm","automotive","manufacturing","windows"],"status":"successful","attributionActor":"North Korean actors, as assessed by the United Kingdom and partner governments","attributionConfidence":"high","victim":"Renault-Nissan manufacturing facilities and other organizations","sector":"Automotive manufacturing and multiple other sectors","country":"Multiple countries","initialAccess":"WannaCry exploited vulnerable Windows systems and spread automatically between reachable computers.","bridgePath":"The worm affected production-support systems. Renault-Nissan isolated facilities and stopped production to contain the incident.","otOrIotMechanism":"The malware did not use a custom industrial protocol. Manufacturing depended on Windows systems that supported plant operations.","observedEffect":"Five Renault-Nissan vehicle plants in France, Slovenia, Romania, and India stopped production.","intendedEffect":"The malware encrypted files and demanded payment. Public evidence does not show that its operators selected the vehicle plants for a specific physical effect.","impactType":"it-to-manufacturing-cascade","evolutionNote":"Self-propagating ransomware caused production shutdowns in several countries. It did not need custom OT malware.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"WannaCry Cyberattack Case Study","url":"https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_WannaCry.pdf","publisher":"Idaho National Laboratory","publicationDate":"2025-12-01","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]},{"title":"Foreign and Commonwealth Office Annual Report and Accounts 2017-18","url":"https://assets.publishing.service.gov.uk/media/5b3dff6eed915d39d8913e8e/FCO1119_FCO_Annual_Report_2018.pdf","publisher":"United Kingdom Foreign and Commonwealth Office","publicationDate":"2018-07-19","accessedDate":"2026-11-02","supports":["attribution"]}],"evidenceNotes":"The shutdowns were containment and recovery decisions after an IT-focused worm infection. Public evidence does not show direct manipulation of plant controllers.","summary":"WannaCry spread through vulnerable Windows systems. Renault-Nissan stopped five vehicle plants in four countries. The shutdowns contained an IT infection and protected production. The incident showed that commodity ransomware could interrupt manufacturing without industrial functions."},{"id":"notpetya-operational-cascade-2017","title":"NotPetya logistics and manufacturing cascade","eventKind":"campaign","aliases":["NotPetya","ExPetr","Nyetya"],"startDate":"2017-06-27","endDate":"2017-07-31","disclosureDate":"2017-06-27","datePrecision":"start-day; end-approximate-month","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["wiper","supply-chain","shipping","ports","pharmaceutical-manufacturing"],"status":"successful","attributionActor":"Russian GRU Unit 74455, as alleged in a United States indictment","attributionConfidence":"high","victim":"Organizations that included A.P. Moller-Maersk and Merck","sector":"Shipping, ports, manufacturing, pharmaceuticals, and other sectors","country":"Multiple countries","initialAccess":"The actors compromised updates for the Ukrainian M.E.Doc accounting software. NotPetya then spread through connected Windows networks.","bridgePath":"The destructive IT attack removed access to shared business and logistics systems. The loss of these systems interrupted ports, shipping, and pharmaceutical manufacturing.","otOrIotMechanism":"NotPetya did not require custom OT functions. Physical operations depended on scheduling, identity, communications, and production-support systems that the malware disabled.","observedEffect":"Maersk reported major interruptions across its container businesses and APM terminals. It estimated an effect of USD 200 million to USD 300 million. Merck reported worldwide manufacturing disruption, lost sales, and recovery expenses.","intendedEffect":"United States prosecutors alleged that the actors deployed destructive malware to damage systems and disrupt services.","impactType":"it-to-operations-cascade","evolutionNote":"One destructive IT campaign interrupted logistics and manufacturing in many countries. It showed that shared digital services can be critical dependencies for physical operations.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"United States v. Andrienko et al. indictment","url":"https://www.justice.gov/d9/press-releases/attachments/2020/10/19/2020_10_19_unsealed_indictment_0.pdf","publisher":"United States Department of Justice","publicationDate":"2020-10-15","accessedDate":"2026-11-02","supports":["access","mechanism","intent","attribution"]},{"title":"A.P. Moller-Maersk Interim Report Q2 2017","url":"https://investor.maersk.com/static-files/0ed2b2c8-518c-48ce-b009-c7b06308ad71","publisher":"A.P. Moller-Maersk","publicationDate":"2017-08-16","accessedDate":"2026-11-02","supports":["effect","scale","financial-effect"]},{"title":"Merck 2017 Form 10-K","url":"https://www.sec.gov/Archives/edgar/data/310158/000031015818000005/mrk1231201710k.htm","publisher":"United States Securities and Exchange Commission","publicationDate":"2018-02-27","accessedDate":"2026-11-02","supports":["effect","manufacturing-effect","financial-effect"]}],"evidenceNotes":"The record combines operational effects from one NotPetya campaign. It does not imply that Maersk and Merck shared networks or response decisions. The indictment supplies official attribution but remains an allegation.","summary":"NotPetya entered networks through compromised M.E.Doc updates. It destroyed access to shared IT services. Maersk reported major interruptions at shipping and port businesses. Merck reported worldwide manufacturing disruption. The campaign showed how one IT attack can interrupt many physical operations."},{"id":"casino-fish-tank-2017","title":"Reported casino fish-tank breach","aliases":["Casino aquarium thermometer breach"],"startDate":"2017-07-01","endDate":"2017-07-19","disclosureDate":"2017-07-19","eventKind":"incident","lane":"consumer-iot-bridge","bridgeRole":"access","secondaryTags":["aquarium","connected-sensor","data-exfiltration","reported"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Unnamed North American casino","sector":"Gaming and hospitality","country":"North America; exact country not public","initialAccess":"Darktrace reported that connected aquarium equipment was involved. Public evidence does not identify the exploit or credentials.","bridgePath":"Darktrace said the fish-tank system supplied access to other parts of the casino network and an outbound data path.","otOrIotMechanism":"The aquarium equipment connected to the casino network through an individual virtual private network.","observedEffect":"Darktrace reported an anomalous transfer of 10 gigabytes to an unusual destination in Finland.","intendedEffect":"Public evidence does not establish the stolen data type or the attacker's complete objective.","impactType":"reported-iot-data-path","evolutionNote":"The reported case showed why operators must separate small connected devices from sensitive networks.","significance":{"historicalImportance":2,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Hacked Smart Fish Tank Exfiltrated Data to Rare External Destination","url":"https://www.securityweek.com/hacked-smart-fish-tank-exfiltrated-data-rare-external-destination/","publisher":"SecurityWeek","publicationDate":"2017-07-20","accessedDate":"2026-11-02","supports":["bridge","effect","limitations"]},{"title":"How a fish tank helped hack a casino","url":"https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/","publisher":"The Washington Post","publicationDate":"2017-07-21","accessedDate":"2026-11-02","supports":["access","bridge","effect"]}],"evidenceNotes":"All public accounts trace to Darktrace. No named victim, forensic report, regulator record, device vulnerability, or independent confirmation is public. Do not state that high-roller records were stolen.","summary":"Darktrace reported that attackers used connected aquarium equipment at an unnamed casino to reach other network areas. Darktrace also observed 10 gigabytes of outbound traffic to Finland. Public evidence does not identify the victim, exploit, stolen data, or attacker."},{"id":"satori-successor-botnets-2017","title":"Satori and Mirai-successor botnets","aliases":["Satori","Okiru","Masuta","Tsunami","Fbot"],"startDate":"2017-08-01","endDate":"2018-08-31","disclosureDate":"2020-06-25","datePrecision":"start-month; end-arrest-month","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["mirai-successor","router","vulnerability-exploitation","ddos","botnet-rental"],"status":"successful","attributionActor":"Kenneth Currin Schuchman and associates; Schuchman pleaded guilty","attributionConfidence":"high","victim":"Owners of hundreds of thousands of compromised internet-connected devices and denial-of-service targets","sector":"Residential networks, small businesses, and online services","country":"Multiple countries","initialAccess":"The operators used default credentials and device vulnerabilities to compromise internet-connected equipment.","bridgePath":"Compromised devices supplied distributed attack capacity that the operators used and sold to customers.","otOrIotMechanism":"The botnets extended Mirai code with new device exploits, processor support, and command functions.","observedEffect":"The operators compromised hundreds of thousands of devices. They used the botnets for distributed denial-of-service attacks and sold botnet access to customers.","intendedEffect":"Conduct denial-of-service attacks and earn money by selling access to compromised-device capacity.","impactType":"commercial-iot-botnet","evolutionNote":"The successor botnets moved beyond default passwords and added device exploits. Their operators also sold attack capacity as a service.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Washington Man Sentenced for Role in Developing Mirai Successor Botnets","url":"https://www.justice.gov/usao-ak/pr/washington-man-sentenced-role-developing-mirai-successor-botnets","publisher":"United States Department of Justice","publicationDate":"2020-06-25","accessedDate":"2026-11-02","supports":["dates","access","mechanism","scale","effect","intent","attribution"]}],"evidenceNotes":"Schuchman pleaded guilty and was sentenced. The cited source says associates were charged. Do not describe every named associate as convicted. The campaign dates are approximate.","summary":"Schuchman and associates developed several Mirai-successor botnets. They added device exploits and compromised hundreds of thousands of devices. They used the botnets for denial-of-service attacks and sold access to customers. Schuchman pleaded guilty and received a prison sentence."},{"id":"trisis-2017","title":"TRISIS at a petrochemical plant","eventKind":"incident","aliases":["TRITON","HatMan"],"startDate":"2017-08-01","endDate":"2017-08-31","disclosureDate":"2017-12-14","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["safety-system","petrochemical","triconex"],"status":"failed","attributionActor":"TsNIIKhM, a Russian government research institute","attributionConfidence":"high","victim":"An unnamed Saudi petrochemical plant","sector":"oil and gas","country":"Saudi Arabia","initialAccess":"The actor entered the plant networks and reached an engineering workstation for the safety system.","bridgePath":"The actor used the engineering workstation to send code to Schneider Electric Triconex safety controllers.","otOrIotMechanism":"TRISIS tried to change controller memory and safety logic. A fault caused the safety system to stop the process.","observedEffect":"The plant shut down safely. The attempted controller change did not remain active.","intendedEffect":"The operation tried to impair a safety system that prevents dangerous industrial conditions.","impactType":"direct-safety-system-manipulation","evolutionNote":"TRISIS was the first publicly known campaign to target a safety instrumented system, not only the production-control system.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"HatMan safety system targeted malware","url":"https://www.cisa.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf","publisher":"CISA","publicationDate":"2019-04-10","accessedDate":"2026-11-02","supports":["mechanism","effect"]},{"title":"Four Russian Government Employees Charged in Historical Critical Infrastructure Campaigns","url":"https://www.justice.gov/usao-dc/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting","publisher":"United States Department of Justice","publicationDate":"2022-03-24","accessedDate":"2026-11-02","supports":["effect","attribution"]}],"evidenceNotes":"CISA documents the malware function. The United States indictment supplies the official attribution. The victim name remains confidential.","summary":"TRISIS targeted the plant safety system. The malware tried to change safety-controller memory and logic. A fault caused a safe process shutdown. The attempted change did not remain active. The operation showed that an attacker could target the system that prevents an industrial accident."},{"id":"st-jude-pacemaker-firmware-2017","title":"St. Jude pacemaker cybersecurity firmware update","eventKind":"capability","aliases":["Abbott pacemaker cybersecurity recall"],"startDate":"2017-08-29","endDate":"2020-07-08","disclosureDate":"2017-08-29","datePrecision":"firmware-update-disclosure-day; end-recall-termination-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["medical-device","pacemaker","radio-frequency","firmware","patient-safety"],"status":"unknown","attributionActor":"Not applicable to disclosed product vulnerabilities","attributionConfidence":"not-applicable","victim":"Patients and health care providers that used affected St. Jude Medical pacemakers","sector":"Health care","country":"Multiple countries","initialAccess":"The vulnerabilities concerned nearby unauthorized radio-frequency access to affected implanted pacemakers.","bridgePath":"Radio-frequency communications linked a Merlin Patient Care System programmer to an implanted pacemaker.","otOrIotMechanism":"Confirmed access-control weaknesses could permit unauthorized commands. Abbott released programmer software and pacemaker firmware updates to reduce the risk.","observedEffect":"The Food and Drug Administration confirmed the vulnerabilities and recorded a cybersecurity firmware recall across several pacemaker families and related programmer software. Abbott distributed the update through health care providers. Public evidence did not show a successful patient attack.","intendedEffect":"The corrective action tried to prevent unauthorized access to implanted pacemakers.","impactType":"implantable-device-remote-access-capability","evolutionNote":"The action showed that a connected implanted device could require a coordinated field firmware update for a confirmed cybersecurity risk.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Firmware Update to Address Cybersecurity Vulnerabilities Identified in Abbott's (formerly St. Jude Medical's) Implantable Cardiac Pacemakers: FDA Safety Communication","url":"https://wayback.archive-it.org/7993/20201222110125/https://www.fda.gov/medical-devices/safety-communications/firmware-update-address-cybersecurity-vulnerabilities-identified-abbotts-formerly-st-jude-medicals","publisher":"United States Food and Drug Administration","publicationDate":"2017-08-29","accessedDate":"2026-11-02","supports":["dates","target","mechanism","effect","context"]},{"title":"Medical Device Recalls","url":"https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm?event_id=78093&start_search=1","publisher":"United States Food and Drug Administration","publicationDate":"2018-06-12","accessedDate":"2026-11-02","supports":["target","mechanism","effect"]},{"title":"Class 2 Device Recall Accent family of pacemakers","url":"https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRes/res.cfm?ID=158779","publisher":"United States Food and Drug Administration","publicationDate":"2018-06-12","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","distribution"]}],"evidenceNotes":"This record starts with the August 29, 2017 pacemaker firmware communication, not the separate January 9 communication about implantable cardiac devices and Merlin@home. The end date is the recall termination date. The recall event covers several pacemaker families and related software; the Accent page supplies one family-specific recall record. The status remains unknown because this was mitigation of a capability, not disruption of a hostile operation. Public evidence does not show a successful patient attack.","summary":"The Food and Drug Administration confirmed cybersecurity vulnerabilities in several St. Jude Medical pacemaker families. Abbott released programmer software and pacemaker firmware updates to reduce unauthorized radio-frequency access risk. Health care providers applied the update during clinical care. Public evidence did not show a successful attack on a patient."},{"id":"iotroop-reaper-botnet-2017","title":"IoTroop vulnerability-scanning botnet campaign","aliases":["Reaper botnet","IoT Reaper"],"startDate":"2017-10-01","endDate":"2017-10-29","disclosureDate":"2017-10-19","datePrecision":"start-month; end-research-cutoff","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","camera","botnet","vulnerability-exploitation","modular-malware"],"status":"successful","attributionActor":"Unknown IoTroop operator; technical indicators suggested operation from China","attributionConfidence":"low","victim":"Owners of vulnerable routers, cameras, and network devices","sector":"Consumer and small-network devices","country":"Multiple countries","initialAccess":"IoTroop scanned for and exploited known vulnerabilities in cameras, routers, and embedded web servers.","bridgePath":"Compromised devices found more vulnerable systems and accepted modules or scripts from command infrastructure.","otOrIotMechanism":"The malware replaced Mirai's credential guessing with vulnerability scanning. Its controller could load Lua scripts and second-stage payloads.","observedEffect":"Researchers observed propagation infrastructure and infected devices. They did not observe a completed DDoS attack, and the core malware did not contain a built-in DDoS function.","intendedEffect":"Maintain flexible control of compromised IoT devices and deliver additional payloads. Public evidence does not prove a specific DDoS objective.","impactType":"modular-iot-botnet-capability","evolutionNote":"IoTroop moved mass IoT compromise from default-password guessing toward multi-vendor vulnerability exploitation and modular payloads.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"IoTroop Botnet: The Full Investigation","url":"https://research.checkpoint.com/2017/iotroop-botnet-full-investigation/","publisher":"Check Point Research","publicationDate":"2017-10-29","accessedDate":"2026-11-02","supports":["dates","access","devices","mechanism","effect","actor-indicators","limitations"]},{"title":"Reaper Botnet","url":"https://www.radware.com/getattachment/Security/Threat-Advisories-and-Attack-Reports/1786/ERT-Alert-ReaperBotnet.pdf.aspx?lang=en-US","publisher":"Radware Emergency Response Team","publicationDate":"2017-10-25","accessedDate":"2026-11-02","supports":["access","devices","mechanism","effect","limitations"]}],"evidenceNotes":"IoTroop, Reaper, and IoT Reaper name the same cluster. Researchers observed live infections and propagation infrastructure. Public reports made very different scale estimates, so this record omits a device count. Check Point found separate DDoS-capable modules and backend handling, but the core malware had no DDoS function and no actual DDoS attack was observed. Check Point stated that the China indicators could be forged and did not link the botnet to Black Vine.","summary":"IoTroop exploited known flaws in routers, cameras, and embedded web servers. Compromised devices scanned for more targets and accepted modular payloads. This was a live infection campaign. Researchers did not observe a completed DDoS attack."},{"id":"strava-heatmap-military-exposure-2018","title":"Strava heatmap military-location exposure","aliases":["Strava Global Heatmap exposure"],"startDate":"2017-11-01","endDate":"2018-08-03","disclosureDate":"2018-01-28","datePrecision":"start-month; disclosure-day; end-policy-response","eventKind":"trend","lane":"consumer-iot-bridge","bridgeRole":"dependency","secondaryTags":["fitness-tracker","smartwatch","geolocation","military","surveillance"],"status":"successful","attributionActor":"Not applicable; unintended exposure through user-contributed fitness data","attributionConfidence":"not-applicable","victim":"Military personnel and sensitive military facilities represented in public fitness data","sector":"Defense and consumer fitness services","country":"Multiple countries","initialAccess":"No intrusion was required. Personnel used fitness trackers, smartwatches, smartphones, and related applications that recorded location data.","bridgePath":"Consumer devices uploaded exercise routes to Strava. Strava aggregated shared activity into a public global heatmap.","otOrIotMechanism":"The density and shape of recorded routes exposed locations, routines, and approximate numbers of personnel in sparsely mapped operational areas.","observedEffect":"Public users identified sensitive military facilities and activity patterns in the heatmap. The United States Department of Defense later prohibited geolocation functions on government and personal devices in designated operational areas.","intendedEffect":"Strava intended to visualize user fitness activity. The exposure of military locations and routines was unintended.","impactType":"consumer-geolocation-operational-exposure","evolutionNote":"The analysis showed that aggregated consumer-device telemetry can expose sensitive operations without a cyber intrusion.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Building the Global Heatmap","url":"https://medium.com/strava-engineering/the-global-heatmap-now-6x-hotter-23fc01d301de","publisher":"Strava Engineering","publicationDate":"2017-11-01","accessedDate":"2026-11-02","supports":["dates","mechanism","context"]},{"title":"Fitness app Strava exposes the location of military bases","url":"https://techcrunch.com/2018/01/28/strava-exposes-military-bases/","publisher":"TechCrunch","publicationDate":"2018-01-28","accessedDate":"2026-11-02","supports":["dates","devices","mechanism","effect","limitations"]},{"title":"Use of Geolocation-Capable Devices, Applications, and Services","url":"https://media.defense.gov/2018/Aug/06/2001951064/-1/-1/1/GEOLOCATION-DEVICES-APPLICATIONS-SERVICES.PDF","publisher":"United States Department of Defense","publicationDate":"2018-08-03","accessedDate":"2026-11-02","supports":["devices","operational-risk","policy-response"]},{"title":"Management Advisory: The DoD’s Use of Mobile Applications (Report No. DODIG-2023-041)","url":"https://media.defense.gov/2023/Mar/30/2003190058/-1/-1/1/REVISED_DODIG-2023-041.PDF","publisher":"United States Department of Defense Office of Inspector General","publicationDate":"2023-02-09","accessedDate":"2026-11-02","supports":["context"]}],"evidenceNotes":"This was an unintended data exposure, not an intrusion or hostile campaign. Strava's engineering account supports the November 2017 heatmap release and its use of public activity data. Contemporaneous reporting supports the January 2018 disclosure, identification of military locations and activity patterns, and the use of phones and wearable devices. The August 2018 DoD memorandum supports device classes, operational risk, and the policy response. The 2023 DoD Inspector General advisory provides later mobile-application context only, not evidence of the original Strava incident.","summary":"Fitness devices and applications uploaded exercise routes to Strava. The public heatmap exposed sensitive military locations and activity patterns. No intrusion was required. The United States Department of Defense later restricted geolocation functions in operational areas."},{"id":"olympic-destroyer-service-provider-pivot-2018","title":"Olympic Destroyer service-provider pivot","eventKind":"campaign","aliases":["PyeongChang Olympic Destroyer attack"],"startDate":"2017-12-19","endDate":"2018-02-09","disclosureDate":"2018-02-09","datePrecision":"provider-compromise-by-day; destructive-event-day; disclosure-day","lane":"ot-bridge","bridgeRole":"pivot","secondaryTags":["event-infrastructure","it-provider","wiper","winter-olympics"],"status":"successful","attributionActor":"Russian GRU Main Centre for Special Technologies, Unit 74455","attributionConfidence":"high","victim":"Two information-technology providers for the Games and the PyeongChang Organizing Committee","sector":"sports event operations and information technology services","country":"South Korea","initialAccess":"By December 19, the actors had begun to compromise one information-technology provider for the Games. By December 21, they had begun to compromise a second provider. They searched provider networks for credentials and Olympic architecture information.","bridgePath":"The actors used provider credentials and trusted connections to enter the Olympic environment. They obtained domain administrator access and used a connection from the second provider.","otOrIotMechanism":"Olympic Destroyer wiped and rebooted computers that supported the event. The malware did not target industrial controllers. The provider relationships connected external service networks to event operations.","observedEffect":"Thousands of provider and organizing-committee computers were compromised. The wiper disabled provider servers and wiped 30 organizing-committee computers during the opening ceremony. Administrators isolated systems and replaced affected computers, which limited disruption.","intendedEffect":"The United Kingdom assessed that the intent was almost certainly sabotage of the Winter Olympic Games.","impactType":"service-provider-to-event-operations-pivot","evolutionNote":"Olympic Destroyer used trusted service providers as paths into a time-critical physical event. The campaign disrupted event support systems without an industrial-control payload.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"United States v. Andrienko et al. indictment","url":"https://www.justice.gov/d9/press-releases/attachments/2020/10/19/2020_10_19_unsealed_indictment_0.pdf","publisher":"United States Department of Justice","publicationDate":"2020-10-15","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","attribution"]},{"title":"UK exposes series of Russian cyber attacks against Olympic and Paralympic Games","url":"https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games","publisher":"United Kingdom Foreign, Commonwealth and Development Office","publicationDate":"2020-10-19","accessedDate":"2026-11-02","supports":["effect","intent","attribution","limitations"]}],"evidenceNotes":"The United States source is an indictment, so its allegations are not convictions. It states that compromise of IT Company 2 began by December 19 and compromise of IT Company 1 began by December 21. It supports thousands of compromised computers and 30 wiped organizing-committee computers. More than 16,000 queried machines were not 16,000 wiped machines. The United Kingdom later attributed the attack to GRU Unit 74455 with high confidence. Public evidence supports provider pivots and destructive IT effects, not industrial-controller manipulation.","summary":"GRU actors first compromised two IT providers for the Winter Olympics. They used provider credentials and connections to enter the Olympic environment. Olympic Destroyer wiped event-support computers during the opening ceremony. Administrators limited the disruption by isolating and replacing systems."},{"id":"hide-n-seek-p2p-botnet-2018","title":"Hide 'N Seek peer-to-peer IoT botnet","aliases":["HNS botnet","Hide'n'Seek"],"startDate":"2018-01-10","endDate":"2018-05-31","disclosureDate":"2018-01-24","datePrecision":"start-day; end-last-documented-update-month","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","camera","peer-to-peer","botnet","persistence"],"status":"successful","attributionActor":"Unknown Hide 'N Seek operator","attributionConfidence":"unknown","victim":"Owners of compromised routers, cameras, and other IoT devices","sector":"Consumer and small-network devices","country":"Multiple countries","initialAccess":"Hide 'N Seek used a Telnet credential attack and later added exploits for network and camera products.","bridgePath":"Compromised devices formed a peer-to-peer network that distributed commands, updates, and malware binaries without a central command server.","otOrIotMechanism":"Each peer could relay commands and files. Later versions added modules, device-data collection, code execution, and persistence on some devices.","observedEffect":"Bitdefender measured more than 32,000 compromised devices in January 2018. It documented another update in May that added persistence, more exploits, and a cryptocurrency miner. Public research did not identify a major external attack launched by the botnet.","intendedEffect":"Maintain a resilient IoT botnet that could receive new capabilities and use compromised devices for later operations.","impactType":"persistent-peer-to-peer-iot-botnet","evolutionNote":"Hide 'N Seek combined decentralized control, updateable exploit logic, and device persistence. These features made IoT botnets more resilient than early volatile botnets.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"New Hide 'N Seek IoT Botnet using custom-built Peer-to-Peer communication spotted in the wild","url":"https://www.bitdefender.com/en-us/blog/labs/new-hide-n-seek-iot-botnet-using-custom-built-peer-to-peer-communication-spotted-in-the-wild","publisher":"Bitdefender Labs","publicationDate":"2018-01-24","accessedDate":"2026-11-02","supports":["dates","access","devices","scale","mechanism","effect"]},{"title":"VB2018 paper: Hide’n’Seek: an adaptive peer-to-peer IoT botnet","url":"https://virusbulletin.com/virusbulletin/2018/12/vb2018-paper-hidenseek-adaptive-peer-peer-iot-botnet/","publisher":"Virus Bulletin","publicationDate":"2018-10-05","accessedDate":"2026-11-02","supports":["access","devices","mechanism","effect","limitations"]}],"evidenceNotes":"The botnet compromised tens of thousands of devices. Bitdefender documented a May 2018 update, which is the record end cutoff. Public reports document capabilities and growth, but not a major completed attack against an external victim. The Virus Bulletin page gives only copyright year 2018; the source date is normalized to the paper's official VB2018 presentation date, October 5, 2018.","summary":"Hide N Seek compromised routers, cameras, and other IoT devices. It used peer-to-peer control instead of a central command server. A May 2018 update added persistence, more exploits, and a cryptocurrency miner. Researchers measured more than 32,000 compromised devices but did not identify a major external attack."},{"id":"tsmc-fab-tool-virus-2018","title":"TSMC fab-tool virus incident","eventKind":"incident","aliases":["TSMC 2018 computer virus incident"],"startDate":"2018-08-03","endDate":"2018-08-06","disclosureDate":"2018-08-05","datePrecision":"day","lane":"ot-bridge","bridgeRole":"access","secondaryTags":["semiconductor","manufacturing-tool","malware","human-error"],"status":"successful","attributionActor":"No malicious actor established","attributionConfidence":"not-applicable","victim":"Taiwan Semiconductor Manufacturing Company","sector":"Semiconductor manufacturing","country":"Taiwan","initialAccess":"Staff installed software on a new manufacturing tool. The software contained malware. The malware spread when the tool connected to the company network.","bridgePath":"A manufacturing-tool installation carried ordinary malware into a highly automated production environment.","otOrIotMechanism":"The malware caused computer systems and fabrication tools to malfunction. TSMC stated that the event resulted from incorrect installation procedures.","observedEffect":"Affected equipment stopped wafer production. TSMC reported shipment delays and an estimated loss of approximately USD 85 million.","intendedEffect":"Public evidence does not establish a malicious actor or a deliberate attack on TSMC.","impactType":"manufacturing-tool-to-operations-cascade","evolutionNote":"The incident showed that a software-installation path can carry ordinary malware into automated manufacturing equipment.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"TSMC Details Impact of Computer Virus Incident","url":"https://pr.tsmc.com/english/news/1969","publisher":"Taiwan Semiconductor Manufacturing Company","publicationDate":"2018-08-05","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","limitations"]},{"title":"TSMC 2018 Annual Report","url":"https://investor.tsmc.com/static/annualReports/2018/english/pdf/2018_tsmc_ar_e_ch6.pdf","publisher":"Taiwan Semiconductor Manufacturing Company","publicationDate":"2019-02-19","accessedDate":"2026-11-02","supports":["effect","financial-effect","response"]}],"evidenceNotes":"TSMC described the incident as a virus infection caused by an installation error. Do not describe it as a confirmed hostile campaign. The success label refers to the documented operational effect.","summary":"Malware entered TSMC through software installed on a new manufacturing tool. It spread after the tool connected to the network. Fabrication equipment malfunctioned, and wafer production stopped. TSMC did not identify a malicious actor."},{"id":"port-san-diego-samsam-2018","title":"Port of San Diego SamSam disruption","eventKind":"incident","aliases":["Port of San Diego ransomware incident"],"startDate":"2018-09-25","endDate":"2018-10-04","disclosureDate":"2018-09-26","datePrecision":"start-first-reported-day; end-public-update-cutoff; recovery-completion-undisclosed","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["maritime","ransomware","public-safety","administrative-systems"],"status":"successful","attributionActor":"Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, as alleged by the United States Department of Justice","attributionConfidence":"medium","victim":"San Diego Unified Port District","sector":"maritime transport and public safety","country":"United States","initialAccess":"The Department of Justice alleged that the SamSam operators exploited security vulnerabilities at victim organizations. Public sources do not establish the exact Port of San Diego access vector.","bridgePath":"Ransomware disabled the shared information-technology environment that supported port administration and Harbor Police administrative work. Port staff used alternate procedures for public services and safety support.","otOrIotMechanism":"The event affected administrative and public-safety support systems. It did not stop vessel movements or cargo-terminal control.","observedEffect":"The ransomware disrupted port information-technology systems and limited park permits, public-records work, business services, and Harbor Police administrative systems. The Port handled seven cruise ships and ten cargo ships, processed payroll, and continued public-safety operations during the incident. Recovery was still in progress on October 4. Public evidence does not give a completion date.","intendedEffect":"The operators tried to deny access to data and extort a ransom payment.","impactType":"port-it-public-safety-dependency","evolutionNote":"The event showed that one port IT environment could support commercial administration and police functions. Manual and alternate procedures kept vessel and public-safety operations active.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, Municipalities, and Public Institutions","url":"https://www.justice.gov/usao-nj/pr/two-iranian-men-indicted-deploying-ransomware-extort-hospitals-municipalities-and-public","publisher":"United States Department of Justice","publicationDate":"2018-11-28","accessedDate":"2026-11-02","supports":["mechanism","effect","intent","attribution","limitations"]},{"title":"Cyberattack Fall 2018 crisis communications response","url":"https://www.capio.org/sites/main/files/file-attachments/portofsandiego_cyberattackfall2018_cri_byhhs2p.pdf","publisher":"Port of San Diego, archived by the California Association of Public Information Officials","publicationDate":"2019-02-14","accessedDate":"2026-11-02","supports":["dates","bridge","effect","operational-continuity","recovery-status","limitations"]}],"evidenceNotes":"The Department of Justice attribution is an allegation in a criminal case. The California Association of Public Information Officials archive preserves Port statements from September 26 through October 4. Those statements support the service effects and continued operations. They do not give a recovery-completion date. Public evidence supports disruption of supporting systems, not compromise of terminal-control equipment.","summary":"SamSam ransomware disabled Port of San Diego information-technology systems. Administrative and Harbor Police support systems lost functions, but vessel and public-safety operations continued. The event exposed a dependency between shared port IT and several operational support functions."},{"id":"mozi-iot-botnet-2019","title":"Mozi peer-to-peer IoT botnet","aliases":["Mozi botnet"],"startDate":"2019-01-01","endDate":"2023-09-27","disclosureDate":"2021-08-19","datePrecision":"first-observed-year; end-kill-switch-discovery-day; documented-disclosure-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","gateway","dvr","peer-to-peer","ddos","kill-switch"],"status":"disrupted","attributionActor":"Unknown Mozi operators; the kill-switch operator is also unknown","attributionConfidence":"unknown","victim":"Owners of vulnerable routers, gateways, and digital video recorders","sector":"Residential and small-business networks","country":"Multiple countries","initialAccess":"Mozi exploited weak Telnet passwords and known vulnerabilities in internet-connected devices.","bridgePath":"Compromised gateways supplied distributed attack capacity, command execution, and a position at the edge of downstream networks.","otOrIotMechanism":"Mozi used a peer-to-peer command system. It could perform distributed denial-of-service attacks, collect data, and run commands or payloads.","observedEffect":"Mozi infected large numbers of routers, gateways, and recorders. In August 2023, a signed kill switch removed most bot functionality. ESET found the kill switch in September.","intendedEffect":"Maintain a resilient botnet for distributed attacks, data collection, and remote command execution.","impactType":"peer-to-peer-iot-botnet","evolutionNote":"Mozi used peer-to-peer control to reduce dependence on central command servers. A valid signed message later disabled most bot functions.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"How to proactively defend against Mozi IoT botnet","url":"https://www.microsoft.com/en-us/security/blog/2021/08/19/how-to-proactively-defend-against-mozi-iot-botnet/","publisher":"Microsoft","publicationDate":"2021-08-19","accessedDate":"2026-11-02","supports":["access","devices","mechanism","effect","risk"]},{"title":"Who killed Mozi? Finally putting the IoT zombie botnet in its grave","url":"https://www.welivesecurity.com/en/eset-research/who-killed-mozi-finally-putting-iot-zombie-botnet-in-grave/","publisher":"ESET Research","publicationDate":"2023-11-01","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","outcome","limitations"]}],"evidenceNotes":"The public record does not identify the Mozi operators or the party that issued the valid kill-switch message. The disruption label describes the observed loss of bot functionality. The first source date is used as the documented disclosure date.","summary":"Mozi infected routers, gateways, and video recorders through weak passwords and known vulnerabilities. Its peer-to-peer design supported distributed attacks and remote commands. A valid signed message removed most bot functions in 2023. Public evidence does not identify who operated or disabled the botnet."},{"id":"western-us-grid-firewall-dos-2019","title":"Western U.S. grid firewall denial-of-service incident","eventKind":"incident","aliases":["NERC firewall firmware incident","March 2019 U.S. grid cyber event","sPower firewall denial-of-service incident"],"startDate":"2019-03-05","endDate":"2019-03-05","disclosureDate":"2019-09-05","datePrecision":"day","lane":"iiot-bridge","bridgeRole":"dependency","secondaryTags":["electricity","firewall","remote-generation","denial-of-service","communications"],"status":"successful","attributionActor":"Unknown external actor","attributionConfidence":"unknown","victim":"sPower control center and remote wind and solar generation sites in California, Utah, and Wyoming","sector":"electricity generation and grid operations","country":"United States","initialAccess":"An external actor exploited a known vulnerability in the web interface of internet-facing firewalls. A firmware update was available before the incident but was not installed.","bridgePath":"The firewalls controlled communications between a control center, remote generation sites, and field equipment at the sites. Repeated firewall reboots interrupted these communications.","otOrIotMechanism":"The exploit caused the perimeter firewalls to reboot. Each firewall was offline for less than five minutes. The reboots occurred during a ten-hour period.","observedEffect":"The incident caused brief communications outages at a low-impact control center and multiple remote generation sites. It did not affect electricity generation.","intendedEffect":"Public evidence does not show the actor's objective beyond the denial-of-service activity.","impactType":"industrial-edge-communications-loss","evolutionNote":"The incident showed that a vulnerable perimeter device can interrupt grid monitoring communications without changing an industrial process.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Risks Posed by Firewall Firmware Vulnerabilities","url":"https://www.nerc.com/pa/rrm/ea/Lessons%20Learned%20Document%20Library/20190901_Risks_Posed_by_Firewall_Firmware_Vulnerabilities.pdf","publisher":"North American Electric Reliability Corporation","publicationDate":"2019-09-05","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"OE-417 Electric Emergency Incident and Disturbance Report Final","url":"https://nsarchive.gwu.edu/document/19698-us-department-energy-oe-417-electric","publisher":"United States Department of Energy","publicationDate":"2019-03-09","accessedDate":"2026-11-02","supports":["dates","victim","geography","effect","limitations"]}],"evidenceNotes":"NERC anonymized the utility, firewall vendor, vulnerability, and actor. A Department of Energy OE-417 record released under FOIA identifies sPower and confirms the date and affected states. NERC confirms the exploit, repeated reboots, communications outages, and absence of a generation effect.","summary":"An external actor exploited internet-facing firewalls at sPower. Repeated firewall reboots interrupted communications between its control center and remote wind and solar sites. Electricity generation continued."},{"id":"norsk-hydro-lockergoga-2019","title":"Norsk Hydro LockerGoga shutdown","eventKind":"incident","aliases":["Hydro cyberattack","LockerGoga at Norsk Hydro"],"startDate":"2019-03-18","endDate":"2019-04-05","disclosureDate":"2019-03-19","datePrecision":"day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","aluminum","manufacturing","manual-operations"],"status":"successful","attributionActor":"LockerGoga operators; responsibility for the Hydro incident remains publicly unconfirmed","attributionConfidence":"unknown","victim":"Norsk Hydro","sector":"Aluminum and manufacturing","country":"Multiple countries","initialAccess":"Attackers entered Hydro's IT environment and deployed LockerGoga ransomware. Public evidence does not establish the complete first-access path.","bridgePath":"The ransomware removed access to production-support systems. Hydro isolated plants and changed some operations to manual control.","otOrIotMechanism":"The malware targeted IT systems. Loss of trusted production services forced operational changes and temporary shutdowns.","observedEffect":"Hydro changed several plants to manual operation. Some facilities reduced or temporarily stopped production. Recovery continued for several weeks.","intendedEffect":"The attackers tried to encrypt systems and extort the company. Public evidence does not establish a separate objective against industrial controllers.","impactType":"it-to-manufacturing-cascade","evolutionNote":"The incident showed how ransomware against IT can force a global industrial company to use manual production methods.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Update: Hydro Subject to Cyber Attack","url":"https://www.hydro.com/en/global/media/news/2019/update-hydro-subject-to-cyber-attack/","publisher":"Norsk Hydro","publicationDate":"2019-03-19","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","response"]},{"title":"What Is OT Malware?","url":"https://www.ncsc.gov.uk/blog-post/what-is-ot-malware","publisher":"United Kingdom National Cyber Security Centre","publicationDate":"2023-09-13","accessedDate":"2026-11-02","supports":["context","effect","limitations"]}],"evidenceNotes":"The ransomware affected IT and production-support systems. Public evidence does not show direct manipulation of industrial controllers. Individual responsibility for the Hydro intrusion remains unconfirmed.","summary":"LockerGoga ransomware affected Norsk Hydro's IT environment. Hydro isolated plants and changed several facilities to manual operation. Some production stopped temporarily. Public evidence does not show direct manipulation of industrial controllers."},{"id":"cyclops-blink-2019","title":"Cyclops Blink router botnet","aliases":["Cyclops Blink","Sandworm Cyclops Blink"],"startDate":"2019-06-01","endDate":"2022-04-06","disclosureDate":"2022-02-23","datePrecision":"start-month; end-disruption-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["soho-router","watchguard","asus","command-infrastructure","sandworm"],"status":"disrupted","attributionActor":"Russian GRU Unit 74455, also called Sandworm","attributionConfidence":"high","victim":"Owners of compromised WatchGuard and ASUS network devices","sector":"Residential, small-business, government, and enterprise networks","country":"Multiple countries","initialAccess":"The actors exploited vulnerable internet-connected network devices.","bridgePath":"Compromised perimeter devices formed a botnet and supplied distributed command infrastructure. They could also expose systems behind the devices.","otOrIotMechanism":"Cyclops Blink installed persistent modular malware on network devices and used selected devices as command servers.","observedEffect":"The malware infected thousands of devices. The FBI copied and removed malware from identified command devices and changed firewall rules to block remote actor access.","intendedEffect":"Maintain resilient command infrastructure and support future Russian GRU cyber operations through compromised edge devices.","impactType":"consumer-edge-command-infrastructure","evolutionNote":"Cyclops Blink replaced centralized VPNFilter infrastructure with a distributed network of compromised edge devices.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation's Main Intelligence Directorate","url":"https://www.justice.gov/archives/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation","publisher":"United States Department of Justice","publicationDate":"2022-04-06","accessedDate":"2026-11-02","supports":["dates","devices","mechanism","effect","attribution","outcome"]},{"title":"New Sandworm malware Cyclops Blink replaces VPNFilter","url":"https://www.ncsc.gov.uk/news/new-sandworm-malware-cyclops-blink-replaces-vpnfilter","publisher":"UK National Cyber Security Centre","publicationDate":"2022-02-23","accessedDate":"2026-11-02","supports":["campaign-window","access","mechanism","attribution"]}],"evidenceNotes":"The FBI operation changed identified command devices. It did not remove malware from every bot device. Public evidence does not show that Cyclops Blink caused a direct OT process effect.","summary":"Sandworm used Cyclops Blink to compromise network devices and build distributed command infrastructure. The malware infected thousands of devices. The FBI removed malware from identified command devices and blocked remote actor access. The operation did not clean every infected device."},{"id":"ipstorm-proxy-botnet-2019","title":"IPStorm proxy botnet","aliases":["InterPlanetary Storm","IPStorm"],"startDate":"2019-06-01","endDate":"2022-12-31","disclosureDate":"2023-11-14","datePrecision":"start-month; end-month; disclosure-disruption-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["android","linux","networked-device","proxy-service","cybercrime"],"status":"disrupted","attributionActor":"Sergei Makinin","attributionConfidence":"high","victim":"Owners of thousands of compromised computers and other internet-connected devices","sector":"Connected computing devices","country":"Multiple countries","initialAccess":"Makinin deployed malicious software to compromise internet-connected devices. Public court reporting does not specify each exploit or delivery method.","bridgePath":"Compromised devices became paid proxy nodes that concealed customer internet activity.","otOrIotMechanism":"The botnet infected computers and other electronic devices. Online reports cited by the Department of Justice state that it expanded from Windows systems to Linux, macOS, and Android devices. Makinin sold proxy access through proxx.io and proxx.net.","observedEffect":"Court documents support thousands of compromised devices. Makinin advertised more than 23,000 proxies and acknowledged at least 550,000 United States dollars in proceeds. He pleaded guilty on September 18, 2023. Law enforcement later disabled his infrastructure but did not act on device owners' computers.","intendedEffect":"Sell concealed internet access through devices that their owners did not authorize as proxies.","impactType":"connected-device-proxy","evolutionNote":"IPStorm extended a commercial proxy botnet across several operating systems and internet-connected device classes.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Russian and Moldovan National Pleads Guilty to Operating Illegal Botnet Proxy Service that Infected Tens of Thousands of Internet-Connected Devices Around the World","url":"https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service","publisher":"United States Department of Justice","publicationDate":"2023-11-14","accessedDate":"2026-11-02","supports":["dates","bridge","effect","intent","attribution","outcome","limitations"]}],"evidenceNotes":"Court documents place the operation from at least June 2019 through December 2022 and support thousands of compromised devices. The headline says tens of thousands. The count of more than 23,000 was an advertised proxy count, not an independently verified infection count. The operating-system details come from online reports cited by the Department of Justice. The September 2023 plea and November 2023 infrastructure dismantlement occurred after the supported campaign period.","summary":"Sergei Makinin used IPStorm to turn thousands of compromised internet-connected devices into paid proxies. He advertised more than 23,000 proxies and acknowledged at least 550,000 United States dollars in proceeds. He pleaded guilty, and law enforcement disabled his infrastructure."},{"id":"urgent11-vxworks-capability-2019","title":"URGENT/11 embedded-device takeover capability","eventKind":"demonstration","aliases":["URGENT/11","VxWorks IPnet vulnerabilities"],"startDate":"2019-07-29","endDate":"2019-07-29","disclosureDate":"2019-07-29","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"attack-surface","secondaryTags":["vxworks","embedded-rtos","industrial-controller","medical-device","firewall","remote-code-execution","lateral-movement-potential"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected VxWorks devices; no confirmed malicious victim","sector":"manufacturing, energy, health care, communications, transportation, and enterprise networks","country":"Multiple countries","initialAccess":"Six of the eleven disclosed flaws allowed remote code execution through crafted network packets. Some paths could reach devices through outbound connections, network address translation, or firewalls.","bridgePath":"The same vulnerable network stack appeared in industrial controllers, medical devices, and perimeter equipment. Compromise of a firewall or another embedded device could expose its protected network, but the research did not document an observed pivot.","otOrIotMechanism":"The flaws affected the IPnet TCP/IP stack in VxWorks. Researchers demonstrated remote device takeover without user interaction and described broadcast exploitation inside a network.","observedEffect":"Researchers demonstrated device-takeover paths and vendors issued patches. Public evidence does not show malicious exploitation, an industrial outage, or patient harm.","intendedEffect":"The research showed how attackers could control embedded devices, bypass perimeter defenses, and spread inside networks. It did not represent a hostile operation.","impactType":"embedded-device-attack-surface-capability","evolutionNote":"The disclosure showed that one embedded network stack created a shared attack surface across industrial controllers, medical devices, and enterprise perimeter equipment.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"URGENT/11","url":"https://www.armis.com/research/urgent-11","publisher":"Armis","publicationDate":"2019-07-29","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"FDA informs patients, providers and manufacturers about potential cybersecurity vulnerabilities for connected medical devices and health care networks that use certain communication software","url":"https://www.fda.gov/news-events/press-announcements/fda-informs-patients-providers-and-manufacturers-about-potential-cybersecurity-vulnerabilities","publisher":"United States Food and Drug Administration","publicationDate":"2019-10-01","accessedDate":"2026-11-02","supports":["affected-devices","effect","limitations","mitigation"]}],"evidenceNotes":"The device totals were estimates, not confirmed vulnerable deployments. The research showed takeover and lateral-movement potential. It did not document an observed pivot or hostile exploitation. The FDA reported no adverse events.","summary":"Researchers found eleven flaws in the VxWorks network stack. The flaws created a shared attack surface across industrial, medical, and perimeter devices. Public evidence does not show malicious exploitation or an operational effect."},{"id":"rogue7-siemens-plc-demonstration-2019","title":"Rogue7 Siemens PLC attack demonstration","eventKind":"demonstration","aliases":["Rogue7"],"startDate":"2019-08-08","endDate":"2019-08-08","disclosureDate":"2019-08-08","datePrecision":"presentation-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","siemens","engineering-workstation","logic-injection","stealth"],"status":"successful","attributionActor":"Authorized researchers from Technion and Tel Aviv University","attributionConfidence":"not-applicable","victim":"Siemens SIMATIC S7-1200 and S7-1500 test devices","sector":"cross-sector industrial automation","country":"Controlled research in Israel","initialAccess":"The researchers obtained network access to the PLC communication path and reverse engineered the Siemens engineering protocol.","bridgePath":"A rogue engineering station communicated directly with Siemens PLCs and impersonated the legitimate TIA engineering station.","otOrIotMechanism":"The rogue station could start or stop a PLC, download attacker-selected control logic, and separate the source code shown to an engineer from the bytecode that the PLC executed.","observedEffect":"In controlled tests, the researchers remotely changed running PLC logic while the engineering view showed different source code. They also demonstrated remote PLC start and stop commands.","intendedEffect":"Demonstrate that protected Siemens engineering communications did not prevent direct and concealed changes to PLC control logic.","impactType":"controlled-direct-ot-manipulation","evolutionNote":"Rogue7 extended Stuxnet-style code hiding to newer Siemens S7 controllers without malware on the legitimate engineering station.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs","url":"https://i.blackhat.com/USA-19/Thursday/us-19-Bitan-Rogue7-Rogue-Engineering-Station-Attacks-On-S7-Simatic-PLCs-wp.pdf","publisher":"Black Hat USA","publicationDate":"2019-08-08","accessedDate":"2026-11-02","supports":["researchers","target","access","mechanism","effect","limitations"]}],"evidenceNotes":"This was controlled research, not activity in a production plant. The paper documents working attacks on real Siemens controllers. The researchers disclosed the work to Siemens before publication.","summary":"Researchers built a rogue engineering station for Siemens S7 PLCs. It downloaded attacker-selected logic and made the source code shown to an engineer differ from the code that ran. Controlled tests also started and stopped PLCs remotely."},{"id":"ekans-ics-ransomware-2019-2020","title":"EKANS industrial-process ransomware capability","eventKind":"demonstration","aliases":["EKANS","SNAKE ransomware"],"startDate":"2019-12-01","endDate":"2020-01-06","disclosureDate":"2020-01-06","datePrecision":"emergence-month normalized to month start; initial-public-disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["ransomware","hmi","historian","process-termination","criminal"],"status":"successful","attributionActor":"Unidentified financially motivated ransomware operators","attributionConfidence":"medium","victim":"Industrial organizations and systems with named ICS software processes","sector":"manufacturing, energy, and other industrial sectors","country":"Multiple countries","initialAccess":"EKANS had no built-in propagation method. Operators had to deploy and execute it after gaining host or network access.","bridgePath":"The ransomware executed on Windows hosts that supported industrial operations, including HMI, historian, and licensing functions.","otOrIotMechanism":"Before file encryption, EKANS forcibly stopped a hard-coded list of processes. The list included GE Proficy, Honeywell HMIWeb, ThingWorx, and industrial licensing processes.","observedEffect":"Malware analysis and sandbox execution confirmed process termination and encryption. On a relevant industrial host, this could cause loss of view. Public evidence does not prove direct process manipulation or a physical effect.","intendedEffect":"Dragos assessed that process termination removed file locks and increased encryption impact. Available evidence supports criminal monetization, not state-directed physical sabotage.","impactType":"ot-specific-malware-process-disruption","evolutionNote":"EKANS and related MegaCortex samples were the first publicly identified criminal ransomware with hard-coded references to industrial processes. The capability was crude but moved OT-specific functionality beyond state operators.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"EKANS Ransomware and ICS Operations","url":"https://archive.orkl.eu/c94e126c9dd06e3397e06e5e10e15c325a9184c1.pdf","publisher":"Dragos","publicationDate":"2020-02-03","accessedDate":"2026-11-02","supports":["first-observed","chronology","mechanism","effect","target","limitations"]},{"title":"EKANS Ransomware Misconceptions and Misunderstandings","url":"https://www.dragos.com/blog/ekans-ransomware-misconceptions-and-misunderstandings","publisher":"Dragos","publicationDate":"2020-06-18","accessedDate":"2026-11-02","supports":["disclosure-date","effect","intent","attribution-assessment","limitations"]}],"evidenceNotes":"Dragos states that EKANS emerged in mid-December 2019. The start date uses month-level normalization. A sample entered a malware repository on December 26, 2019. The initial public disclosure occurred on January 6, 2020. The first Dragos report URL is an archived copy because the original URL no longer works. The effect is confirmed malware behavior, not a confirmed physical incident. Dragos later clarified that the process list overlaps MegaCortex and primarily supports encryption. EKANS cannot issue industrial protocol commands. This record covers the malware capability, not the separate Honda incident.","summary":"EKANS ransomware stopped named industrial software processes before it encrypted files. Confirmed targets included HMI, historian, and licensing software. The function could cause loss of view on a relevant host. It could not directly command a physical process."},{"id":"natural-gas-compression-ransomware-2020","title":"Natural-gas compression facility ransomware shutdown","eventKind":"incident","aliases":["CISA natural-gas compression facility incident","Pipeline ransomware incident"],"startDate":"2020-02-18","endDate":"2020-02-18","disclosureDate":"2020-02-18","datePrecision":"disclosure-only","lane":"ot-bridge","bridgeRole":"pivot","secondaryTags":["ransomware","natural-gas","pipeline","loss-of-view","controlled-shutdown"],"status":"successful","attributionActor":"Unknown ransomware operator","attributionConfidence":"unknown","victim":"An unnamed United States natural-gas compression facility","sector":"Natural gas and pipeline operations","country":"United States","initialAccess":"The attacker used a spearphishing link to enter the organization's IT network. The ransomware then moved into the OT network.","bridgePath":"Insufficient separation allowed commodity ransomware to move from IT into OT monitoring and control assets.","otOrIotMechanism":"The ransomware encrypted Windows systems in both networks. It caused a loss of availability and view. It did not manipulate programmable logic controllers.","observedEffect":"The operator implemented a controlled shutdown of pipeline operations. The facility remained shut down for approximately two days while staff restored systems.","intendedEffect":"The attacker deployed commodity ransomware. Public evidence does not show a specific plan to manipulate the physical process.","impactType":"it-to-ot-ransomware-pivot","evolutionNote":"Weak IT and OT separation allowed commodity ransomware to reach operational monitoring systems. Loss of view caused a controlled physical shutdown.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Ransomware Impacting Pipeline Operations","url":"https://nsarchive.gwu.edu/document/21227-07-20200218-ransomware-impacting-pipeline-operations-cisa","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2020-02-18","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]}],"evidenceNotes":"CISA did not identify the victim, malware family, or incident date. The timeline uses the advisory date. The ransomware caused loss of view and availability. CISA reported no programmable-logic-controller manipulation.","summary":"Commodity ransomware moved from an IT network into an OT network at a natural-gas compression facility. It encrypted monitoring systems and caused loss of view. The operator completed a controlled shutdown for approximately two days. The malware did not manipulate programmable logic controllers."},{"id":"israel-water-campaign-2020","title":"Israeli water-system attack campaign","eventKind":"campaign","aliases":["April 2020 Israeli water attacks"],"startDate":"2020-04-24","endDate":"2020-04-25","disclosureDate":"2020-05-07","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["water","pumping","command-and-control","state-activity"],"status":"disrupted","attributionActor":"Iranian-sponsored actors, as assessed by government and public reporting","attributionConfidence":"medium","victim":"Israeli water and wastewater facilities","sector":"water and wastewater","country":"Israel","initialAccess":"Public sources do not identify the first access method.","bridgePath":"The actors reached command-and-control or operational systems at water facilities.","otOrIotMechanism":"The activity targeted systems that controlled pumps and water treatment. Public sources do not disclose the complete technical method.","observedEffect":"Operators detected the activity and prevented significant damage or interruption of water service. Reports described abnormal pump operation and changes to operational data at some sites.","intendedEffect":"The campaign could have stopped pumps or changed water-treatment conditions. Public evidence does not establish the exact intended physical result.","impactType":"disrupted-direct-ot-attack","evolutionNote":"The campaign showed direct state-linked interest in municipal water controls. Detection and operational safeguards prevented a significant service effect.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cyber Threat Bulletin: The Cyber Threat to Operational Technology","url":"https://www.cyber.gc.ca/en/guidance/cyber-threat-bulletin-cyber-threat-operational-technology","publisher":"Canadian Centre for Cyber Security","publicationDate":"2021-12-16","accessedDate":"2026-11-02","supports":["target","effect","attribution","intent"]},{"title":"Report Confirms Cyberattack on Water Installations","url":"https://www.timesofisrael.com/liveblog_entry/report-confirms-cyberattack-on-water-installations-last-month/","publisher":"The Times of Israel","publicationDate":"2020-05-07","accessedDate":"2026-11-02","supports":["dates","effect","limitations"]}],"evidenceNotes":"The Canadian Cyber Centre assesses Iranian sponsorship. Public reporting does not provide a full forensic report or identify the operators. Reports agree that no significant water-service damage occurred.","summary":"Actors targeted control systems at Israeli water facilities in April 2020. Operators detected the activity and prevented significant service disruption. The Canadian Cyber Centre assesses that Iranian-sponsored actors conducted the campaign."},{"id":"socksescort-avrecon-2020","title":"SocksEscort AVrecon proxy botnet","aliases":["AVrecon","SocksEscort"],"startDate":"2020-06-01","endDate":"2026-03-12","disclosureDate":"2023-07-12","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["router","residential-proxy","fraud","cybercrime"],"status":"disrupted","attributionActor":"Unknown SocksEscort operators","attributionConfidence":"unknown","victim":"Owners of compromised devices and victims of activity routed through them","sector":"Residential and small-business networks","country":"Approximately 163 countries","initialAccess":"Actors exploited known vulnerabilities in routers and other connected devices.","bridgePath":"AVrecon maintained access. SocksEscort sold the devices as residential proxy exit nodes.","otOrIotMechanism":"The devices routed customer traffic through victim internet addresses and exposed home networks to inbound traffic.","observedEffect":"The FBI assessed that SocksEscort had compromised and sold access to approximately 369,000 devices since 2020. Law enforcement disrupted the service in 2026.","intendedEffect":"Sell concealed network access for fraud, password attacks, and other malicious activity.","impactType":"residential-proxy","evolutionNote":"The campaign made compromised home routers a commercial access service.","significance":{"historicalImportance":2,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Routers Underground: Exposing AVrecon","url":"https://www.lumen.com/blog/en-us/routers-underground-exposing-avrecon","publisher":"Lumen Black Lotus Labs","publicationDate":"2023-07-12","accessedDate":"2026-11-02","supports":["access","mechanism","bridge","effect"]},{"title":"AVrecon Malware-Infected Routers Exploited as Residential Proxies by SocksEscort","url":"https://www.fbi.gov/file-repository/cyber-alerts/avrecon-malware-infected-routers-exploited-as-residential-proxies-by-socksescort.pdf","publisher":"Federal Bureau of Investigation","publicationDate":"2026-03-12","accessedDate":"2026-11-02","supports":["scale","effect","outcome"]}],"evidenceNotes":"Public reporting does not identify the operators. The device estimate covers access offered since 2020, not simultaneous active devices.","summary":"SocksEscort used AVrecon to maintain access to compromised routers and connected devices. It sold the devices as residential proxies. The FBI estimated approximately 369,000 affected devices. Law enforcement disrupted the service in 2026."},{"id":"honda-production-cyberattack-2020","title":"Honda production cyberattack","eventKind":"incident","aliases":["Honda June 2020 cyberattack","Honda EKANS incident"],"startDate":"2020-06-07","endDate":"2020-06-10","disclosureDate":"2020-06-08","datePrecision":"start-day; end-evidence-as-of-day; most affected United States plants had resumed; full recovery date unknown","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["automotive","manufacturing","ransomware","production-support-it"],"status":"successful","attributionActor":"Unknown cybercriminal actor; researchers linked the incident to Snake, also called EKANS, ransomware","attributionConfidence":"unknown","victim":"Honda Motor Company","sector":"Automotive and powersports manufacturing","country":"Multiple countries","initialAccess":"Honda did not disclose the first access method. Researchers found a Snake ransomware sample that checked for a Honda internal domain before it ran.","bridgePath":"The cyberattack affected Honda's internal IT network and production operations at some United States plants. Staff contained the incident and restored systems.","otOrIotMechanism":"Production operations depended on affected IT services. Public evidence does not show direct manipulation of industrial controllers.","observedEffect":"Honda reported that production operations at some United States plants were affected. Most affected United States plants had resumed production by June 10.","intendedEffect":"The malware evidence was consistent with ransomware. Honda did not identify an actor or confirm a separate objective against industrial equipment.","impactType":"it-to-manufacturing-cascade","evolutionNote":"The incident showed that a company-wide IT attack can affect production when plants depend on shared IT services.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"American Honda Affected by Cyberattack","url":"https://hondanews.com/en-US/releases/release-af666ce97900f4effc7ad4ea59000996-american-honda-affected-by-cyberattack","publisher":"American Honda Motor Company","publicationDate":"2020-06-10","accessedDate":"2026-11-02","supports":["dates","bridge","effect","limitations"]},{"title":"Targeted attacks on industrial companies using Snake ransomware","url":"https://ics-cert.kaspersky.com/publications/alerts/2020/06/17/targeted-attacks-on-industrial-companies-using-snake-ransomware/","publisher":"Kaspersky ICS CERT","publicationDate":"2020-06-17","accessedDate":"2026-11-02","supports":["mechanism","actor-characterization","limitations"]}],"evidenceNotes":"Honda confirmed that production operations at some United States plants were affected. It did not say that production stopped. By June 10, most affected plants had resumed, but Honda did not give a full recovery date. Honda did not confirm the malware family or first access method. Kaspersky linked a Honda-domain-gated sample to Snake, also called EKANS. This researcher assessment is not confirmed Honda attribution. The record does not claim direct OT compromise.","summary":"A cyberattack affected Honda's internal network and production operations at some United States plants. Most affected plants had resumed production by June 10. Researchers linked a Honda-domain-gated sample to Snake ransomware, but Honda did not confirm that malware family. Public evidence does not show direct manipulation of industrial controllers."},{"id":"ripple20-embedded-stack-capability-2020","title":"Ripple20 embedded TCP/IP supply-chain capability","eventKind":"capability","aliases":["Ripple20","Treck TCP/IP stack vulnerabilities"],"startDate":"2020-06-16","endDate":"2020-06-16","disclosureDate":"2020-06-16","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"attack-surface","secondaryTags":["embedded-stack","supply-chain","industrial-io","power-monitoring","remote-code-execution"],"status":"unknown","attributionActor":"Not applicable; coordinated vulnerability research","attributionConfidence":"not-applicable","victim":"Users of devices that embedded affected Treck TCP/IP stack versions; no confirmed malicious victim","sector":"manufacturing, energy distribution, health care, communications, transportation, and enterprise equipment","country":"Multiple countries","initialAccess":"Several flaws could be reached with malformed network packets. Some allowed remote code execution without authentication when the vulnerable stack was reachable.","bridgePath":"The Treck stack was embedded in products from multiple vendors. A flaw in the shared component created attack paths through industrial I/O modules, power monitors, printers, routers, medical equipment, and other connected devices.","otOrIotMechanism":"The nineteen disclosed flaws included remote code execution, denial of service, and information disclosure. Product impact depended on how each vendor integrated and configured the stack.","observedEffect":"Researchers and vendors confirmed affected products and released mitigations or firmware updates. Honeywell reported no known exploits in July 2020. Public evidence does not show a malicious operational effect.","intendedEffect":"The research showed how a shared embedded component could supply code execution or device disruption across many product families. It did not represent a hostile operation.","impactType":"embedded-component-attack-surface","evolutionNote":"Ripple20 showed how one low-level networking component could propagate a common attack surface through many industrial and connected-device supply chains.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"PN1508: Treck Ripple20 TCP/IP Vulnerabilities Affect Multiple Rockwell Automation Products","url":"https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.PN1508.html","publisher":"Rockwell Automation","publicationDate":"2020-06-16","accessedDate":"2026-11-02","supports":["affected-products","mechanism","effect","mitigation"]},{"title":"Ripple20 Vulnerability Notification","url":"https://www.honeywell.com/content/dam/honeywellbt/en/documents/downloads/product-security/security-notification/hon-corp-ripple20-vulnerability-2020-07-17-01.pdf","publisher":"Honeywell","publicationDate":"2020-07-17","accessedDate":"2026-11-02","supports":["affected-products","mechanism","effect","limitations"]}],"evidenceNotes":"The broad device counts were estimates. Product exposure depended on vendor integration and network configuration. The cited vendor notices confirm affected industrial products and state that no exploits were known at publication.","summary":"Ripple20 exposed flaws in a TCP/IP stack embedded in many connected products. Affected industrial products included I/O modules and power-monitoring equipment. Public evidence does not show malicious exploitation or an operational effect."},{"id":"industrial-remote-access-vpn-capability-2020","title":"Industrial remote-access VPN takeover capability","eventKind":"demonstration","aliases":["Secomea-Moxa-eWon remote-access flaws","Getting from 5 to 0"],"startDate":"2020-07-28","endDate":"2020-07-28","disclosureDate":"2020-07-28","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"access","secondaryTags":["industrial-vpn","remote-maintenance","secomea","moxa","ewon","remote-code-execution"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected Secomea, Moxa, and HMS eWon industrial remote-access products; no confirmed malicious victim","sector":"oil and gas, water, electricity, manufacturing, and industrial maintenance","country":"Multiple countries","initialAccess":"Researchers found unauthenticated server and gateway flaws and a client flaw that a malicious email or website could trigger.","bridgePath":"The affected products connected internet or cloud users to internal industrial networks and field devices. A successful compromise could place an attacker beyond perimeter controls with the access of a trusted remote user.","otOrIotMechanism":"Researchers demonstrated remote code execution against Secomea GateManager, Moxa EDR-G902 and EDR-G903 gateways, and the eWon eCatcher client. Vendors released patches.","observedEffect":"Researchers demonstrated code execution and full client takeover in controlled tests. Public evidence does not show malicious exploitation or physical damage through these flaws.","intendedEffect":"The research showed how attackers could use industrial remote-access infrastructure to reach controllers and field devices. It did not represent a hostile operation.","impactType":"industrial-remote-access-capability","evolutionNote":"The work identified industrial remote-access services as a direct bridge across expected OT network boundaries during rapid growth in remote maintenance.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Getting from 5 to 0: VPN Security Flaws Pose Cyber Risk to Organizations with Remote OT Personnel","url":"https://social.claroty.com/team82/research/vulnerabilities-found-in-industrial-remote-access-products","publisher":"Claroty Team82","publicationDate":"2020-07-28","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations","mitigation"]}],"evidenceNotes":"The report combines separate flaws in three products. It documents controlled demonstrations, not one malicious campaign. The affected vendors had released fixes by disclosure.","summary":"Researchers demonstrated code execution in three industrial remote-access products. The products connected remote users to controllers and field devices. Public evidence does not show malicious exploitation or physical damage."},{"id":"ring-swatting-campaign-2020","title":"Ring camera swatting and livestream campaign","aliases":["Ring doorbell swatting spree"],"startDate":"2020-11-07","endDate":"2020-11-13","disclosureDate":"2022-12-19","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["camera","credential-reuse","swatting","livestream","harassment"],"status":"successful","attributionActor":"James Thomas Andrew McCarty and co-conspirators; McCarty pleaded guilty","attributionConfidence":"high","victim":"Residents at 12 homes in the United States and responding police officers","sector":"Consumer physical security and emergency services","country":"United States","initialAccess":"The conspirators used credentials from compromised Yahoo accounts to enter Ring accounts that reused the same email addresses and passwords.","bridgePath":"The compromised cloud accounts supplied remote camera video, audio, and speaker control at victim homes.","otOrIotMechanism":"The conspirators watched police responses through doorbell cameras, transmitted audio and video on social media, and spoke through the camera devices.","observedEffect":"The conspirators made false emergency reports at 12 homes, livestreamed police responses, and taunted victims or officers through compromised cameras. McCarty pleaded guilty and received a seven-year sentence for conduct in two cases.","intendedEffect":"Cause armed police responses, observe them through victim cameras, and broadcast the events for harassment and entertainment.","impactType":"smart-camera-enabled-physical-harassment","evolutionNote":"The campaign joined cloud-account compromise with camera control and false emergency calls to create physical risk at victim homes.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Grand Jury Indicts 2 in ‘Swatting’ Scheme that Took Over Ring Doorbells Across U.S. to Livestream Police Response to Fake Calls","url":"https://www.justice.gov/usao-cdca/pr/grand-jury-indicts-2-swatting-scheme-took-over-ring-doorbells-across-us-livestream","publisher":"United States Department of Justice","publicationDate":"2022-12-19","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","intent"]},{"title":"Kayenta Resident Sentenced to Seven Years in Prison for Making Hoax Calls to Elicit SWAT Responses","url":"https://www.justice.gov/usao-az/pr/kayenta-resident-sentenced-seven-years-prison-making-hoax-calls-elicit-swat-responses","publisher":"United States Department of Justice","publicationDate":"2024-06-24","accessedDate":"2026-11-02","supports":["effect","attribution","outcome"]}],"evidenceNotes":"The first source describes indictment allegations. The second states that McCarty pleaded guilty to the Ring-account conspiracy and describes one completed intrusion and false call. The seven-year sentence covered conduct in two indictments.","summary":"Conspirators reused stolen credentials to control Ring doorbell cameras at victim homes. They made false emergency calls, watched and livestreamed police responses, and used camera speakers to taunt people. McCarty pleaded guilty."},{"id":"zuorat-soho-router-campaign-2020","title":"ZuoRAT home-office router campaign","aliases":["ZuoRAT"],"startDate":"2020-12-01","endDate":"2022-06-29","disclosureDate":"2022-06-29","datePrecision":"start-first-observed-month; end-publication-cutoff; disclosure-day","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"pivot","secondaryTags":["soho-router","dns-hijacking","http-hijacking","espionage","remote-work","proxy"],"status":"successful","attributionActor":"Unknown sophisticated threat actor","attributionConfidence":"unknown","victim":"At least 80 targets identified from router samples and nine months of telemetry","sector":"Small-office, home-office, and remote-work networks","country":"Predominantly the United States, Canada, and Western European countries","initialAccess":"Black Lotus Labs observed infections in ASUS, Cisco, DrayTek, and NETGEAR routers. It recovered an exploit script only for JCG-Q20 routers. That script used CVE-2020-26878 and CVE-2020-26879 to obtain credentials, bypass authentication, and install ZuoRAT.","bridgePath":"The compromised router supplied visibility into the adjacent local network and a possible path to deploy additional malware on connected workstations.","otOrIotMechanism":"ZuoRAT could enumerate routers and local networks, capture traffic, and perform Domain Name System and HTTP hijacking. Black Lotus Labs observed compromised routers that acted as proxy command-and-control nodes. It assessed that traffic hijacking could support deployment to systems on adjacent networks.","observedEffect":"Black Lotus Labs identified infections across several router vendors and observed compromised routers acting as proxy command-and-control nodes. It estimated that the campaign affected at least 80 targets. Malware analysis showed traffic-capture, network-reconnaissance, and communication-hijacking capabilities, but the source did not show that the actor used each capability at every target.","intendedEffect":"Collect network data, redirect traffic, maintain covert access, and compromise selected systems behind small-office and home-office routers.","impactType":"soho-router-to-lan-pivot","evolutionNote":"ZuoRAT used routers at remote-work boundaries for traffic collection, proxying, and possible deployment inside local networks.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"ZuoRAT Malware: How Compromised Routers Enable Cyber Espionage","url":"https://www.lumen.com/blog/en-us/zuorat-hijacks-soho-routers-silently-stalk-networks","publisher":"Lumen Black Lotus Labs","publicationDate":"2022-06-29","accessedDate":"2026-11-02","supports":["dates","access","devices","bridge","mechanism","effect","intent","limitations"]}],"evidenceNotes":"The earliest observed router sample was submitted in December 2020. The October 2020 registration of a default command-and-control domain does not prove campaign activity in that month. The end date is the reporting cutoff, not a confirmed campaign end. Black Lotus Labs estimated at least 80 targets, likely more. It did not identify the actor. Known-vulnerability exploitation is confirmed only for the recovered JCG-Q20 exploit script.","summary":"ZuoRAT infected small-office and home-office routers from several vendors. Black Lotus Labs observed infected routers that acted as proxy command-and-control nodes and estimated at least 80 targets. Malware analysis showed local-network reconnaissance, traffic capture, and traffic-hijacking capabilities."},{"id":"oldsmar-water-disputed-2021","title":"Oldsmar water-treatment case","eventKind":"incident","aliases":["Oldsmar water hack"],"startDate":"2021-02-05","endDate":"2021-02-05","disclosureDate":"2021-02-08","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["water","scada","remote-access","disputed-evidence"],"status":"unknown","attributionActor":"Unknown; the FBI did not confirm a targeted cyber intrusion","attributionConfidence":"unknown","victim":"City of Oldsmar water-treatment plant","sector":"water and wastewater","country":"United States","initialAccess":"Initial official reports described unauthorized remote access to an operator computer. A later FBI investigation did not confirm that a targeted cyber intrusion caused the event.","bridgePath":"The reported activity used a remote-access path to software that controlled the treatment process.","otOrIotMechanism":"An operator reported that a remote user changed the sodium-hydroxide setting in the supervisory control and data acquisition software. The operator immediately reversed the change.","observedEffect":"No unsafe water entered the distribution system. The FBI later said that it could not confirm a targeted cyber intrusion. A former city manager said that an operator error could have caused the event.","intendedEffect":"Public evidence does not establish attacker intent or confirm that an external attacker caused the setting change.","impactType":"disputed-direct-ot-event","evolutionNote":"The case became a widely known water-security warning. Later evidence showed why incident records must separate an initial report from a confirmed forensic conclusion.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":1,"laterInfluence":3,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Detectives Investigate Computer Software Intrusion at Oldsmar Water Treatment Plant","url":"https://newsite.pinellassheriff.gov/21-015-detectives-investigate-computer-software-intrusion-at-oldsmar-s-water-treatment-plant","publisher":"Pinellas County Sheriff's Office","publicationDate":"2021-02-08","accessedDate":"2026-11-02","supports":["dates","reported-access","reported-mechanism","effect"]},{"title":"Official Says Oldsmar Water Treatment Plant Hack Did Not Happen","url":"https://www.wusf.org/local-state/2023-04-13/official-hack-oldsmar-city-water-treatment-plant-2021","publisher":"WUSF Public Media","publicationDate":"2023-04-13","accessedDate":"2026-11-02","supports":["effect","fbi-assessment","limitations"]}],"evidenceNotes":"The initial law-enforcement account reported unauthorized remote access and a chemical-setting change. The FBI later said it could not confirm a targeted cyber intrusion. This record preserves both accounts and treats the cause and outcome as unknown.","summary":"An operator at the Oldsmar water plant reported a remote change to a chemical setting. The operator immediately reversed it, and no unsafe water entered distribution. The FBI later said that it could not confirm a targeted cyber intrusion."},{"id":"shadowpad-building-automation-2021","title":"ShadowPad building-automation campaign","eventKind":"campaign","aliases":["ShadowPad ICS campaign"],"startDate":"2021-03-01","endDate":"2021-10-31","disclosureDate":"2022-06-27","datePrecision":"start-month; end-month; disclosure-day","lane":"iiot-bridge","bridgeRole":"attack-surface","secondaryTags":["building-automation","engineering-computer","shadowpad","exchange","espionage"],"status":"successful","attributionActor":"Unidentified Chinese-speaking threat actor","attributionConfidence":"low","victim":"Telecommunications, manufacturing, and transport organizations in Pakistan, Afghanistan, and Malaysia","sector":"telecommunications, manufacturing, building automation, and transport","country":"Pakistan, Afghanistan, and Malaysia","initialAccess":"Attackers exploited Microsoft Exchange vulnerability CVE-2021-26855 at several victims. Public evidence does not establish the same entry method for every victim.","bridgePath":"ShadowPad infected engineering computers used for building automation at a telecommunications company. These systems supplied access to operational information and connected industrial environments.","otOrIotMechanism":"The backdoor supplied remote command execution and data collection on engineering computers. Public evidence does not show manipulation of building controls.","observedEffect":"Kaspersky found active ShadowPad infections on building-automation engineering computers and related industrial networks. It assessed that the activity likely collected data. No physical building effect was reported.","intendedEffect":"The campaign probably collected information and maintained access. Public evidence does not establish a destructive objective.","impactType":"building-automation-espionage","evolutionNote":"The campaign used building-automation engineering computers as an industrial attack surface for espionage and possible access to more secure infrastructure.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Attacks on industrial control systems using ShadowPad","url":"https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/","publisher":"Kaspersky ICS CERT","publicationDate":"2022-06-27","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","actor-characterization"]}],"evidenceNotes":"Kaspersky described the actor as Chinese-speaking but did not attribute the campaign to a named organization or government. The report confirms infected engineering computers. It does not confirm a physical process change or a pivot from those computers into another named target.","summary":"ShadowPad infected engineering computers used for building automation. The campaign affected telecommunications, manufacturing, and transport organizations. Kaspersky assessed that the activity likely collected data. Public evidence does not show a physical building effect."},{"id":"verkada-camera-platform-2021","title":"Verkada connected-camera platform breach","eventKind":"incident","aliases":["Verkada camera breach"],"startDate":"2021-03-08","endDate":"2021-03-09","disclosureDate":"2021-03-09","datePrecision":"day","lane":"iiot-bridge","bridgeRole":"attack-surface","secondaryTags":["ip-camera","physical-security","cloud-platform","shared-control-plane"],"status":"successful","attributionActor":"Tillie Kottmann and associates, as attributed by Verkada","attributionConfidence":"medium","victim":"Verkada and 97 customer organizations","sector":"physical security, health care, education, corrections, and manufacturing","country":"Multiple countries","initialAccess":"The attackers entered a misconfigured internet-facing support server. They found administrator credentials for the Verkada support interface.","bridgePath":"The shared support platform supplied access from one vendor system to connected cameras and customer data at many organizations. It also exposed some badge and Wi-Fi credentials.","otOrIotMechanism":"The support interface could emulate customer sessions and control connected cameras. The attackers viewed video, created or accessed archives, used analytics searches, and sent shell commands to 25 cameras.","observedEffect":"The attackers accessed camera or image data for 97 customer organizations. They accessed access-control data for eight organizations and Wi-Fi credentials for eight organizations. Verkada found no lateral movement into customer networks.","intendedEffect":"The public record shows unauthorized access and data collection. It does not establish a destructive objective.","impactType":"shared-iiot-platform-exposure","evolutionNote":"The breach showed that one cloud support system could expose connected physical-security devices at many organizations. The bridge was the shared vendor control plane, not a device-to-network pivot.","significance":{"historicalImportance":2,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"March 9, 2021 Security Incident Report, Version 1.2","url":"https://docs.verkada.com/docs/Security_Incident_Report_Version1.2.pdf","publisher":"Verkada","publicationDate":"2021-05-21","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","attribution","limitations"]},{"title":"FTC Takes Action Against Security Camera Firm Verkada","url":"https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-security-camera-firm-verkada-over-charges-it-failed-secure-videos-other","publisher":"Federal Trade Commission","publicationDate":"2024-08-30","accessedDate":"2026-11-02","supports":["access","scale","effect","regulatory-response"]}],"evidenceNotes":"The FTC said that the compromised account could reach more than 150,000 live cameras. Verkada identified 97 customer organizations whose camera or image data was accessed. Verkada found shell commands on 25 cameras but no backdoors, firmware changes, or lateral movement.","summary":"Attackers used credentials from a misconfigured Verkada support server to reach connected cameras at many customer organizations. They viewed video and accessed other customer data. The shared cloud control plane created the broad exposure. Investigators found no lateral movement into customer networks."},{"id":"molson-coors-cyber-2021","title":"Molson Coors cyber incident","eventKind":"incident","aliases":["Molson Coors systems outage"],"startDate":"2021-03-11","endDate":"2021-12-31","disclosureDate":"2021-03-11","datePrecision":"disclosure-day; operational-recovery-by-year-end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["food-and-beverage","brewery","manufacturing"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Molson Coors Beverage Company","sector":"Food and beverage manufacturing","country":"Multiple countries","initialAccess":"Molson Coors did not disclose the first access method.","bridgePath":"A cyber incident caused a systems outage. The outage disrupted brewery operations, production, and shipments.","otOrIotMechanism":"The incident interrupted supporting systems. Public evidence does not show direct manipulation of brewery controllers.","observedEffect":"Molson Coors reported delays and disruptions to brewery operations, production, and shipments. It reported lower first-quarter production and shipment volume, increased shipments during the rest of 2021, and operational recovery by December 31.","intendedEffect":"Public evidence does not show the intended operational effect.","impactType":"it-caused-operational-disruption","evolutionNote":"The incident showed that a systems outage can reduce brewery output and change shipment timing.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Molson Coors Beverage Company Current Report on Form 8-K","url":"https://www.sec.gov/Archives/edgar/data/24545/000110465921034789/tm219417d1_8k.htm","publisher":"United States Securities and Exchange Commission","publicationDate":"2021-03-11","accessedDate":"2026-11-02","supports":["dates","effect","scope"]},{"title":"Molson Coors Beverage Company Annual Report for 2021","url":"https://www.sec.gov/Archives/edgar/data/24545/000002454522000005/tap-20211231.htm","publisher":"United States Securities and Exchange Commission","publicationDate":"2022-02-23","accessedDate":"2026-11-02","supports":["effect","recovery","business-impact"]}],"evidenceNotes":"Company filings confirm the operational effect and recovery by year-end. They do not identify the actor, malware, first access method, or direct OT compromise. They do not establish March 31 as an incident end.","summary":"A cyber incident caused a Molson Coors systems outage. The outage disrupted brewery operations, production, and shipments. The company reported lower first-quarter volume and operational recovery by year-end."},{"id":"plc-logic-engine-attacks-2021","title":"PLC control-logic engine attack demonstrations","eventKind":"demonstration","aliases":["IEC 61131 logic-engine attacks"],"startDate":"2021-03-15","endDate":"2021-03-16","disclosureDate":"2021-03-15","datePrecision":"conference-days","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","control-logic","program-mode","process-stop","testbed"],"status":"successful","attributionActor":"Authorized researchers from Virginia Commonwealth University and Oak Ridge National Laboratory","attributionConfidence":"not-applicable","victim":"SEL, Schneider Electric, and Rockwell Automation controllers in controlled testbeds","sector":"electric power, manufacturing, and building automation","country":"Controlled research in the United States","initialAccess":"The demonstrations assumed access to controller management functions or the industrial network.","bridgePath":"The researchers sent direct commands to real PLCs and real-time automation controllers.","otOrIotMechanism":"The attacks abused native program-mode and start-stop functions to disable the IEC 61131 control-logic engine instead of injecting new process logic.","observedEffect":"Controlled attacks halted a power-substation process, a conveyor belt, and a four-floor elevator testbed. The work included devices with encrypted traffic and device access controls.","intendedEffect":"Demonstrate that legitimate PLC lifecycle functions can stop physical processes even when an attacker does not inject malicious ladder logic.","impactType":"controlled-direct-ot-disruption","evolutionNote":"The research shifted attention from malicious logic injection to abuse of the runtime engine and legitimate controller state changes.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Attacking the IEC-61131 Logic Engine in Programmable Logic Controllers in Industrial Control Systems","url":"https://www.ornl.gov/publication/attacking-iec-61131-logic-engine-programmable-logic-controllers-industrial-control","publisher":"Oak Ridge National Laboratory","publicationDate":"2021-03-15","accessedDate":"2026-11-02","supports":["researchers","target","mechanism","effect","limitations"]}],"evidenceNotes":"The effects occurred on research testbeds, not production infrastructure. The source identifies real industrial controller models and the physical testbed outcomes.","summary":"Researchers abused native PLC program and stop functions. The controlled attacks halted substation, conveyor, and elevator processes. The method targeted the control-logic engine instead of inserting new ladder logic."},{"id":"colonial-pipeline-darkside-2021","title":"Colonial Pipeline ransomware shutdown","eventKind":"incident","aliases":["Colonial Pipeline attack","DarkSide Colonial Pipeline incident"],"startDate":"2021-05-07","endDate":"2021-05-12","disclosureDate":"2021-05-08","datePrecision":"day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","pipeline","energy","it-ot-dependency","precautionary-shutdown"],"status":"successful","attributionActor":"DarkSide ransomware affiliate","attributionConfidence":"high","victim":"Colonial Pipeline Company","sector":"oil and refined-products pipeline","country":"United States","initialAccess":"The attackers used a compromised password for a legacy virtual private network account. The account did not use multifactor authentication.","bridgePath":"DarkSide ransomware affected the corporate IT network. Colonial stopped pipeline operations because the company did not know the intrusion scope and wanted to prevent possible spread into OT.","otOrIotMechanism":"The ransomware did not directly compromise OT. Loss of trusted IT services and uncertainty about network separation caused an operational shutdown. Staff used manual reporting while OT visibility was unavailable.","observedEffect":"Colonial stopped approximately 5,500 miles of pipeline on May 7. The company began to restore pipeline service on May 12. The interruption contributed to fuel shortages and panic buying on the United States East Coast.","intendedEffect":"The attackers tried to extort Colonial Pipeline. They encrypted business systems and threatened to disclose stolen data.","impactType":"it-to-operations-cascade","evolutionNote":"The incident showed that ransomware does not need to compromise control systems to stop physical operations. Loss of business systems, visibility, and confidence in IT and OT separation can cause an operator to stop a process.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks","url":"https://www.cisa.gov/sites/default/files/publications/AA21-131A_Darkside_Ransomware.pdf","publisher":"CISA and FBI","publicationDate":"2021-05-11","accessedDate":"2026-11-02","supports":["mechanism","effect","attribution"]},{"title":"Cyber Threats in the Pipeline: Using Lessons from the Colonial Ransomware Attack to Defend Critical Infrastructure","url":"https://www.congress.gov/117/chrg/CHRG-117hhrg45085/CHRG-117hhrg45085.pdf","publisher":"United States House Committee on Homeland Security","publicationDate":"2021-06-09","accessedDate":"2026-11-02","supports":["access","bridge","effect"]},{"title":"Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists DarkSide","url":"https://www.justice.gov/archives/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside","publisher":"United States Department of Justice","publicationDate":"2021-06-07","accessedDate":"2026-11-02","supports":["dates","attribution","effect"]}],"evidenceNotes":"Do not say that DarkSide compromised pipeline control systems. CISA and FBI reported no indication of direct OT impact. Colonial stopped operations because the intrusion scope was unknown and possible OT spread could not yet be excluded. The success label refers to the IT compromise, extortion, and resulting operational interruption.","summary":"DarkSide ransomware compromised Colonial Pipeline's IT network. Colonial stopped pipeline operations to contain possible spread into OT. Investigators found no direct OT compromise. The five-day interruption caused fuel shortages. It showed how an IT incident can stop physical operations through business and safety dependencies."},{"id":"siemens-s7-native-code-key-extraction-2021-2022","title":"Siemens S7 native-code execution and key extraction","eventKind":"demonstration","aliases":["CVE-2020-15782","CVE-2022-38465","The Race to Native Code Execution in PLCs"],"startDate":"2021-05-28","endDate":"2022-10-11","disclosureDate":"2021-05-28","datePrecision":"first-disclosure-day; follow-on-disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","siemens","native-code","cryptography","credential-extraction","protocol"],"status":"successful","attributionActor":"Authorized Claroty Team82 researchers","attributionConfidence":"not-applicable","victim":"Siemens SIMATIC S7-1200 and S7-1500 test controllers","sector":"cross-sector industrial automation","country":"Controlled research","initialAccess":"The native-code path required network access to TCP port 102 and a controller without access protection. Follow-on attacks used the recovered product-family private keys.","bridgePath":"Researchers communicated directly with Siemens PLCs and TIA Portal engineering communications.","otOrIotMechanism":"A memory-protection bypass enabled native code in protected PLC memory. Researchers then extracted global private keys, decrypted protected configuration data, recovered password hashes, and created privileged man-in-the-middle sessions.","observedEffect":"Controlled tests achieved remote native-code execution and full PLC memory access. Follow-on work recovered product-family keys and demonstrated decryption, credential recovery, controller impersonation, and privileged configuration changes.","intendedEffect":"Demonstrate complete controller compromise and show that fixed product-family keys could defeat legacy PLC communication protections.","impactType":"controlled-direct-plc-takeover","evolutionNote":"The research moved from a PLC sandbox escape to compromise of a shared trust mechanism. Siemens replaced legacy fixed-key protections with a TLS-based design and stronger default access controls.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"The Race to Native Code Execution in PLCs","url":"https://claroty.com/team82/research/the-race-to-native-code-execution-in-plcs","publisher":"Claroty Team82","publicationDate":"2021-05-28","accessedDate":"2026-11-02","supports":["researchers","access","mechanism","effect","vendor-response","limitations"]},{"title":"The Race to Native Code Execution in PLCs: Using RCE to Uncover Siemens SIMATIC S7-1200/1500 Hardcoded Cryptographic Keys","url":"https://claroty.com/team82/research/the-race-to-native-code-execution-in-plcs-using-rce-to-uncover-siemens-simatic-s7-1200-1500-hardcoded-cryptographic-keys","publisher":"Claroty Team82","publicationDate":"2022-10-11","accessedDate":"2026-11-02","supports":["mechanism","effect","vendor-response","limitations"]}],"evidenceNotes":"This was coordinated research, not observed production exploitation. Claroty stated that it knew of no public exploitation when it disclosed the native-code flaw. Siemens issued firmware and architecture changes.","summary":"Team82 escaped the runtime sandbox on Siemens S7 PLCs and executed native code. Follow-on work extracted shared private keys and defeated legacy configuration and communication protections. Siemens changed the security architecture."},{"id":"jbs-revil-2021","title":"JBS food-production ransomware shutdown","eventKind":"incident","aliases":["JBS cyberattack","JBS REvil attack"],"startDate":"2021-05-30","endDate":"2021-06-03","disclosureDate":"2021-05-31","datePrecision":"day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","food-production","supply-chain","revil"],"status":"successful","attributionActor":"REvil, also called Sodinokibi, as attributed by the United States Federal Bureau of Investigation","attributionConfidence":"high","victim":"JBS","sector":"Food production","country":"United States, Canada, and Australia","initialAccess":"The attack affected servers that supported JBS operations in North America and Australia. Public evidence does not identify the first access method.","bridgePath":"JBS shut affected systems down to contain the ransomware. The loss of supporting IT interrupted physical food production.","otOrIotMechanism":"Public evidence does not show direct manipulation of industrial controllers. Production depended on servers and business systems that the company isolated.","observedEffect":"Meat-production facilities in the United States, Canada, and Australia stopped. JBS stated that all facilities resumed production by June 3.","intendedEffect":"The attackers tried to extort JBS through ransomware.","impactType":"it-to-food-production-cascade","evolutionNote":"Ransomware against supporting IT interrupted a multinational physical food supply chain.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"FBI Statement on JBS Cyberattack","url":"https://www.fbi.gov/news/press-releases/fbi-statement-on-jbs-cyberattack","publisher":"United States Federal Bureau of Investigation","publicationDate":"2021-06-02","accessedDate":"2026-11-02","supports":["attribution"]},{"title":"JBS USA and Pilgrim's Announce All Facilities Are Operational","url":"https://www.sec.gov/Archives/edgar/data/802481/000080248121000057/exhibit991_pressrelease.htm","publisher":"JBS USA","publicationDate":"2021-06-03","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","response"]}],"evidenceNotes":"The FBI attributed the ransomware to REvil. Public reporting does not identify the affiliate who entered JBS. The record does not claim direct compromise of production controllers.","summary":"REvil ransomware affected servers that supported JBS operations. JBS shut systems down to contain the attack. Meat-production facilities in three countries stopped. Public evidence does not show direct manipulation of industrial controllers."},{"id":"meris-router-botnet-2021","title":"Mēris router botnet","aliases":["Meris botnet"],"startDate":"2021-06-01","endDate":"2021-11-08","disclosureDate":"2021-09-09","datePrecision":"start-month; end-reporting-cutoff","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["mikrotik","router","ddos","application-layer"],"status":"successful","attributionActor":"Unknown Mēris operators","attributionConfidence":"unknown","victim":"Websites and online services in multiple sectors","sector":"Financial services, publishing, gaming, and information technology","country":"Multiple countries","initialAccess":"Operators used compromised MikroTik routers. Public sources link the devices to a previously patched RouterOS vulnerability.","bridgePath":"The routers supplied high-capacity distributed traffic for application-layer denial-of-service attacks.","otOrIotMechanism":"The botnet directed compromised network equipment to send large numbers of HTTP requests.","observedEffect":"Cloudflare observed attacks against about 50 websites per day and an average of 104 attacks per day. One attack reached 17.2 million requests per second. Cloudflare mitigated attacks against its customers.","intendedEffect":"Overload websites and online services with distributed HTTP traffic.","impactType":"router-botnet-ddos","evolutionNote":"Mēris used high-capacity routers instead of low-power consumer appliances to increase application-layer attack traffic.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"A Brief History of the Meris Botnet","url":"https://radar.cloudflare.com/reports/meris-botnet","publisher":"Cloudflare","publicationDate":"2021-11-08","accessedDate":"2026-11-02","supports":["dates","devices","access","mechanism","scale","effect","limitations"]}],"evidenceNotes":"Cloudflare reports attack traffic and mitigation for its customers. It does not establish service outages at every target. The success label describes the botnet's delivery of large-scale attack traffic, not a confirmed outage for each victim.","summary":"Mēris used compromised MikroTik routers for distributed denial-of-service attacks. Cloudflare observed about 104 attacks per day and one attack at 17.2 million requests per second. Cloudflare mitigated attacks against its customers. Public evidence does not identify the operators."},{"id":"raptor-train-2024","title":"Raptor Train IoT botnet","aliases":["Flax Typhoon Raptor Train"],"startDate":"2021-06-01","endDate":"2024-09-18","disclosureDate":"2024-09-18","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["router","camera","dvr","nas","espionage"],"status":"disrupted","attributionActor":"Integrity Technology Group, linked by U.S. authorities to PRC state-sponsored Flax Typhoon","attributionConfidence":"high","victim":"Device owners and organizations targeted by Flax Typhoon","sector":"Government, education, manufacturing, and information technology","country":"Multiple countries","initialAccess":"Actors exploited vulnerabilities in routers and other internet-connected devices.","bridgePath":"A multi-tier botnet of consumer and small-network devices supplied proxy and command infrastructure.","otOrIotMechanism":"The botnet infected routers, cameras, digital video recorders, and network-attached storage devices.","observedEffect":"More than 200,000 devices were part of the botnet. A court-authorized operation disabled control infrastructure and malware functions.","intendedEffect":"Conceal and support malicious cyber operations.","impactType":"consumer-iot-proxy","evolutionNote":"Raptor Train showed how a managed IoT botnet could support state-linked operations at large scale.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Court-Authorized Operation Disrupts Worldwide Botnet Used by PRC State-Sponsored Hackers","url":"https://www.justice.gov/archives/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state","publisher":"United States Department of Justice","publicationDate":"2024-09-18","accessedDate":"2026-11-02","supports":["dates","devices","effect","attribution","outcome"]}],"evidenceNotes":"The device count describes botnet membership, not simultaneous active devices or distinct organizations.","summary":"Raptor Train used routers, cameras, recorders, and storage devices as proxy and command infrastructure. More than 200,000 devices joined the botnet. A court-authorized operation disrupted it in September 2024."},{"id":"kaseya-coop-supply-chain-2021","title":"Kaseya ransomware cascade at Coop Sweden","eventKind":"campaign","aliases":["Kaseya VSA ransomware attack","Coop Sweden checkout outage"],"startDate":"2021-07-02","endDate":"2021-07-08","disclosureDate":"2021-07-02","datePrecision":"start-day; end-Coop-operational-recovery-day; wider Kaseya campaign recovery not bounded","lane":"ot-bridge","bridgeRole":"access","secondaryTags":["ransomware","software-supply-chain","managed-service-provider","retail","point-of-sale"],"status":"successful","attributionActor":"Sodinokibi/REvil affiliate Yaroslav Vasinskyi and co-conspirators","attributionConfidence":"high","victim":"Kaseya VSA customers and downstream organizations, including Coop Sweden","sector":"IT services and food retail","country":"Multiple countries, with major operational effects in Sweden","initialAccess":"Attackers exploited zero-day vulnerabilities in on-premises Kaseya VSA servers. The flaws let them bypass authentication and run commands.","bridgePath":"The attackers used trusted remote-management software at service providers to deploy ransomware to downstream endpoints. The cascade reached Coop checkout systems through its service-provider chain.","otOrIotMechanism":"The VSA management plane had authorized control over many customer endpoints. Ransomware disabled point-of-sale systems that Coop needed to complete store transactions.","observedEffect":"Checkout systems failed across almost all Coop stores in Sweden. Stores closed and reopened in stages after technicians updated affected systems. Coop reported that all stores were open again on July 8.","intendedEffect":"The attackers used a software-management supply chain to deploy ransomware and demand payment from many downstream victims.","impactType":"vendor-control-plane-to-physical-operations","evolutionNote":"One compromise of a remote-management product crossed service-provider boundaries and stopped physical retail operations at downstream customers.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Incident Overview & Technical Details","url":"https://helpdesk.kaseya.com/hc/en-gb/articles/4403584098961-Incident-Overview-Technical-Details","publisher":"Kaseya","publicationDate":"2021-07-05","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect"]},{"title":"Nu är alla Coops butiker öppna","url":"https://pressrum.coop.se/?p=6869","publisher":"Coop Sweden","publicationDate":"2021-07-08","accessedDate":"2026-11-02","supports":["bridge","effect","recovery"]},{"title":"Ukrainian Arrested and Charged with Ransomware Attack on Kaseya","url":"https://www.justice.gov/usao-ndtx/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya","publisher":"United States Department of Justice","publicationDate":"2021-11-08","accessedDate":"2026-11-02","supports":["attribution","Kaseya-attack-link"]},{"title":"Sodinokibi/REvil Affiliate Sentenced for Role in $700M Ransomware Scheme","url":"https://www.justice.gov/archives/opa/pr/sodinokibirevil-affiliate-sentenced-role-700m-ransomware-scheme","publisher":"United States Department of Justice","publicationDate":"2024-05-01","accessedDate":"2026-11-02","supports":["attribution","ransomware-objective"]}],"evidenceNotes":"Kaseya documented the VSA exploit and ransomware delivery. The technical page first appeared with Kaseya's July 5 incident update; the current page does not show a publication date. Coop documented the checkout outage and July 8 store recovery. July 8 bounds the Coop cascade, not the wider Kaseya campaign. The Department of Justice later obtained Vasinskyi's guilty plea and sentence for Sodinokibi/REvil activity. The Kaseya case record tied him and co-conspirators to the July 2 attack. The sources do not show that attackers selected each Coop store individually.","summary":"Attackers exploited Kaseya VSA and used its trusted management functions to send ransomware through service providers to downstream systems. Coop checkout systems failed across Sweden. Almost all stores had to close until technicians restored the systems."},{"id":"codesys-wago-ot-cloud-bridge-2021","title":"CODESYS-WAGO bidirectional OT cloud bridge","eventKind":"demonstration","aliases":["OT cloud top-down and bottom-up attacks","CODESYS Automation Server takeover demonstration"],"startDate":"2021-07-21","endDate":"2021-07-21","disclosureDate":"2021-07-21","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["ot-cloud","codesys","wago","plc","cloud-management","bidirectional-pivot"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected CODESYS Automation Server and WAGO PFC products; no confirmed malicious victim","sector":"industrial automation and manufacturing","country":"Multiple countries","initialAccess":"Researchers used flaws in a WAGO PLC and the CODESYS cloud-management platform. The demonstrated paths started from either a compromised field device or unauthorized cloud access.","bridgePath":"A compromised WAGO PLC could send a malicious payload upstream and take over a CODESYS Automation Server account. A compromised cloud account could also control managed PLCs and field devices.","otOrIotMechanism":"The bottom-up chain used pre-authentication code execution on a WAGO PLC and a CODESYS WebVisu flaw. The top-down path used cloud-management functions to interact with device logic, data, and configuration.","observedEffect":"Researchers demonstrated takeover of a cloud-management account from a PLC and control paths from the cloud to managed devices. Public evidence does not show malicious exploitation or an industrial outage.","intendedEffect":"The research showed that an OT cloud service can create attack paths in both directions between field devices and centralized management. It did not represent a hostile operation.","impactType":"ot-cloud-direct-control-and-pivot-capability","evolutionNote":"The demonstration showed that cloud-managed automation can let one compromised field device threaten centralized management and let one compromised cloud account threaten many field devices.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Top-Down and Bottom-Up: Exploiting Vulnerabilities In the OT Cloud Era","url":"https://claroty.com/team82/research/exploiting-vulnerabilities-in-the-ot-cloud-era","publisher":"Claroty Team82","publicationDate":"2021-07-21","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]}],"evidenceNotes":"The paths were controlled demonstrations against affected versions. The top-down path gave the cloud account direct control of managed device logic, data, and configuration. The bottom-up path pivoted from one PLC to the cloud account. The report does not identify malicious deployment, production impact, or physical damage.","summary":"Researchers demonstrated attack paths between a WAGO PLC and the CODESYS cloud-management platform. A field device could compromise the cloud account. The cloud account could directly control managed devices. No malicious exploitation was reported."},{"id":"pwnedpiper-hospital-logistics-2021","title":"PwnedPiper hospital logistics capability","eventKind":"demonstration","aliases":["PwnedPiper","Swisslog Translogic vulnerabilities"],"startDate":"2021-08-02","endDate":"2021-08-02","disclosureDate":"2021-08-02","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["health-care","pneumatic-tube","hospital-logistics","remote-code-execution"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Hospitals that used Swisslog Translogic pneumatic-tube systems; no confirmed malicious victim","sector":"health care and hospital logistics","country":"Multiple countries","initialAccess":"The disclosed flaws included hard-coded credentials, memory-corruption errors, unauthenticated services, and an unsigned firmware-update process.","bridgePath":"The connected control panels managed a hospital-wide pneumatic-tube network and integrated with access-control and communication systems.","otOrIotMechanism":"An unauthenticated attacker could run code, stop stations, change routes, alter transfer speeds, or install persistent firmware on control panels.","observedEffect":"Researchers demonstrated paths to complete system control. Public evidence does not show malicious exploitation, service disruption, rerouted medication, damaged specimens, or patient harm.","intendedEffect":"The research showed how an attacker could disrupt hospital logistics or use the connected system for extortion. It did not represent a hostile operation.","impactType":"hospital-logistics-control-capability","evolutionNote":"The disclosure showed that hospital logistics equipment can connect a network flaw to the physical movement of medication, blood, and specimens.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"PwnedPiper","url":"https://www.armis.com/research/pwnedpiper/","publisher":"Armis","publicationDate":"2021-08-02","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"PwnedPiper Impact on Healthcare","url":"https://www.hhs.gov/sites/default/files/pwnedpiper-sector-alert-tlpwhite.pdf","publisher":"United States Department of Health and Human Services","publicationDate":"2021-08-03","accessedDate":"2026-11-02","supports":["sector","scale","mechanism","effect","mitigation"]}],"evidenceNotes":"PwnedPiper was a vulnerability disclosure and controlled demonstration. Public evidence does not show a hostile deployment. Potential physical effects depended on hospital configuration and integrations.","summary":"Researchers found nine flaws in hospital pneumatic-tube systems. The flaws could give an unauthenticated attacker control of stations and carrier routes. Public evidence does not show malicious exploitation or patient harm."},{"id":"predatory-sparrow-fuel-2021-2023","title":"Predatory Sparrow fuel-station campaigns","eventKind":"campaign","aliases":["Gonjeshke Darande fuel attacks","Iran fuel-card disruptions"],"startDate":"2021-10-26","endDate":"2023-12-18","disclosureDate":"2021-10-26","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["fuel","payment-system","smart-card","hacktivism"],"status":"successful","attributionActor":"Predatory Sparrow, based on claims for both disruptions","attributionConfidence":"medium","victim":"Iranian national fuel-distribution and subsidized-fuel systems","sector":"fuel distribution","country":"Iran","initialAccess":"Public evidence does not identify the first access method.","bridgePath":"The actor reached centralized systems that supported station operation and subsidized-fuel transactions.","otOrIotMechanism":"The disruptions prevented stations from using national fuel-card and payment functions. Public sources do not disclose the complete technical mechanism.","observedEffect":"The October 2021 attack disrupted subsidized-fuel purchases across Iran. In December 2023, approximately 70 percent of Iranian fuel stations went out of service. Operators used manual procedures during recovery.","intendedEffect":"The actor intended to disrupt public fuel distribution and amplify political messages.","impactType":"direct-operational-disruption","evolutionNote":"The campaigns showed that attacks on centralized transaction systems can stop distributed physical services without custom control-system malware.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"APT Attacks on Industrial Companies in H2 2021","url":"https://ics-cert.kaspersky.com/publications/reports/2022/02/28/apt-attacks-on-industrial-companies-in-h2-2021/","publisher":"Kaspersky ICS CERT","publicationDate":"2022-02-28","accessedDate":"2026-11-02","supports":["dates","target","effect","attribution"]},{"title":"A Suspected Cyberattack Paralyzes the Majority of Gas Stations Across Iran","url":"https://apnews.com/article/a9ae33c352812e40ca3d255a2533fea9","publisher":"Associated Press","publicationDate":"2023-12-18","accessedDate":"2026-11-02","supports":["dates","effect","attribution","recovery"]}],"evidenceNotes":"Predatory Sparrow claimed both attacks. Public reporting confirms the disruptions but does not disclose complete forensic evidence or prove state sponsorship. The record combines two attacks against the same national service and claimed actor.","summary":"Predatory Sparrow claimed two attacks against Iranian fuel services. The 2021 attack disrupted subsidized-fuel purchases. The 2023 attack disabled approximately 70 percent of fuel stations. Operators used manual procedures during recovery."},{"id":"cosmicenergy-capability-2023","title":"COSMICENERGY power-disruption capability","eventKind":"capability","aliases":["COSMICENERGY","PIEHOP","LIGHTWORK"],"startDate":"2021-12-01","endDate":"2023-05-25","disclosureDate":"2023-05-25","datePrecision":"sample-upload-month; disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","iec-104","rtu","capability-disclosure"],"status":"unknown","attributionActor":"Unknown developer; Mandiant found a possible link to a Russian cyber-range project","attributionConfidence":"unknown","victim":"No publicly confirmed victim or operational deployment","sector":"electric power","country":"No confirmed target country","initialAccess":"The tool does not provide initial access. An operator needs prior access and target-specific configuration data.","bridgePath":"PIEHOP can use a remote MSSQL server to upload files, execute commands, and launch LIGHTWORK against reachable IEC-104 devices.","otOrIotMechanism":"LIGHTWORK creates IEC-104 ON and OFF commands for remote terminal units. The analyzed PIEHOP sample has programming errors that prevent successful control.","observedEffect":"Mandiant found the samples in a public malware-scanning service. Public evidence does not show a victim, outage, or physical effect.","intendedEffect":"The capability can issue unauthorized IEC-104 commands and could disrupt electric transmission or distribution.","impactType":"pre-impact-ot-capability","evolutionNote":"COSMICENERGY showed that specialized power-disruption concepts could appear outside a confirmed attack operation.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises","url":"https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/","publisher":"Mandiant","publicationDate":"2023-05-25","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations","possible-origin"]}],"evidenceNotes":"The sample was uploaded from Russia in December 2021. Mandiant found insufficient evidence to identify its developer or purpose. This is a capability disclosure, not a failed attack.","summary":"Mandiant disclosed COSMICENERGY in May 2023. The tools can send commands through IEC-104, a power-system control protocol. An operator needs prior OT access and target configuration data. Public evidence does not show a victim, deployment, outage, or confirmed developer."},{"id":"apt28-moobot-edgerouters-2024","title":"APT28 operations through Moobot-infected routers","aliases":["APT28 Ubiquiti router campaign","Moobot EdgeRouter botnet"],"startDate":"2022-01-01","endDate":"2024-01-31","disclosureDate":"2024-02-15","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["ubiquiti","router","moobot","credential-theft","espionage"],"status":"disrupted","attributionActor":"APT28, Russia's GRU Unit 26165; separate criminal actors first installed Moobot","attributionConfidence":"high","victim":"Router owners and organizations targeted for espionage","sector":"Government, military, and multiple other sectors","country":"Multiple countries","initialAccess":"Criminal actors infected Ubiquiti EdgeRouters that used default administrator passwords.","bridgePath":"APT28 used access to the routers to proxy traffic, host spoofed pages, and collect credentials.","otOrIotMechanism":"The routers ran scripts and tools for authentication relay, credential collection, and covert traffic.","observedEffect":"APT28 used the routers in espionage campaigns. The FBI removed malicious files and restricted remote access on identified routers.","intendedEffect":"Conceal APT28 activity and support credential theft and espionage.","impactType":"consumer-router-proxy","evolutionNote":"APT28 reused criminal botnet access for state espionage.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the GRU","url":"https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian","publisher":"United States Department of Justice","publicationDate":"2024-02-15","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","attribution","outcome"]}],"evidenceNotes":"The criminal actors who installed Moobot were separate from APT28, which later used the infected routers.","summary":"Criminal actors infected Ubiquiti routers with Moobot. APT28 then used the routers to proxy traffic, host spoofed pages, and collect credentials. The FBI removed malicious files and restricted remote access on identified routers."},{"id":"volt-typhoon-kv-botnet-2022","title":"Volt Typhoon use of the KV Botnet","aliases":["KV Botnet","Volt Typhoon SOHO router campaign"],"startDate":"2022-01-01","endDate":"2024-01-31","disclosureDate":"2024-01-31","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["soho-router","proxy","critical-infrastructure","pre-positioning"],"status":"disrupted","attributionActor":"Volt Typhoon, attributed by U.S. and partner agencies to People's Republic of China state-sponsored actors","attributionConfidence":"high","victim":"Owners of compromised routers and critical infrastructure organizations","sector":"Communications, energy, transportation, water, and other critical infrastructure","country":"United States and global","initialAccess":"The botnet infected end-of-life Cisco and Netgear small-office and home-office routers.","bridgePath":"The routers relayed encrypted traffic and concealed the source of operations against critical infrastructure networks.","otOrIotMechanism":"A virtual private network module turned compromised routers into intermediary nodes.","observedEffect":"The botnet concealed activity against critical infrastructure. The FBI removed malware from hundreds of U.S. routers in a court-authorized operation.","intendedEffect":"Support persistent access and pre-positioning for possible disruptive activity during a future crisis.","impactType":"consumer-router-proxy","evolutionNote":"The campaign used residential edge devices as multi-hop infrastructure for state pre-positioning against critical infrastructure.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"U.S. Government Disrupts Botnet Used to Conceal Hacking of Critical Infrastructure","url":"https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical","publisher":"United States Department of Justice","publicationDate":"2024-01-31","accessedDate":"2026-11-02","supports":["devices","mechanism","effect","attribution","outcome"]},{"title":"State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure","url":"https://www.cisa.gov/sites/default/files/2024-02/aa24-038a-jcsa-prc-state-sponsored-actors-compromise-us-critical-infrastructure_1.pdf","publisher":"CISA, NSA, FBI, and international partners","publicationDate":"2024-02-07","accessedDate":"2026-11-02","supports":["target","intent","effect","attribution"]}],"evidenceNotes":"The disruption label applies to the KV Botnet infrastructure. It does not mean that all Volt Typhoon access was removed. Public evidence does not show a direct OT process effect from this router path.","summary":"Volt Typhoon used infected small-office and home-office routers to hide operations against critical infrastructure. The routers relayed encrypted traffic. The FBI removed malware from hundreds of U.S. routers, but the broader threat remained."},{"id":"pipedream-2022","title":"PIPEDREAM toolset discovery","eventKind":"capability","aliases":["INCONTROLLER"],"startDate":"2022-01-01","endDate":"2022-04-13","disclosureDate":"2022-04-13","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["multi-vendor","plc","opc-ua"],"status":"unknown","attributionActor":"Unspecified advanced persistent threat actors","attributionConfidence":"unknown","victim":"No public destructive victim","sector":"multiple industrial sectors","country":"Multiple countries","initialAccess":"The advisory did not identify a public victim access path.","bridgePath":"The tools were designed for use after access to an industrial control environment.","otOrIotMechanism":"The toolset could scan, compromise, and control devices from Schneider Electric and OMRON. It also used OPC UA servers.","observedEffect":"Government and industry partners disclosed the tools. Public evidence does not show a victim, destructive deployment, or physical effect.","intendedEffect":"The tools could cause disruption, sabotage, and unsafe conditions in several industrial environments.","impactType":"disrupted-pre-impact","evolutionNote":"PIPEDREAM supplied a reusable framework for several vendors and sectors instead of one custom process target.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"APT cyber tools targeting ICS and SCADA devices","url":"https://www.cisa.gov/sites/default/files/publications/AA22-103A_APT_Cyber_Tools_Targeting_ICS_SCADA_Devices.pdf","publisher":"CISA, DOE, NSA, and FBI","publicationDate":"2022-04-13","accessedDate":"2026-11-02","supports":["mechanism","effect","actor-characterization"]}],"evidenceNotes":"The agencies did not name the state actor in the public advisory. No public destructive deployment was documented at disclosure.","summary":"Government and industry partners disclosed PIPEDREAM in April 2022. Public evidence does not show a victim or destructive deployment. The tools could find and control devices from several industrial vendors. The reusable design could support attacks in different sectors."},{"id":"viasat-ka-sat-acidrain-2022","title":"KA-SAT AcidRain dependency cascade","eventKind":"incident","aliases":["Viasat attack","AcidRain"],"startDate":"2022-02-24","endDate":"2022-02-24","disclosureDate":"2022-03-30","datePrecision":"day","lane":"iiot-bridge","bridgeRole":"dependency","secondaryTags":["satcom","modem-wiper","wind-energy","remote-monitoring"],"status":"successful","attributionActor":"Russian state actors; the United Kingdom assessed that Russia was almost certainly responsible","attributionConfidence":"high","victim":"KA-SAT users in Ukraine and Europe; collateral effects included ENERCON wind farms","sector":"satellite communications, government, military, and wind energy","country":"Ukraine and multiple European countries","initialAccess":"The attacker exploited a misconfigured VPN appliance and entered a trusted KA-SAT management segment.","bridgePath":"The attacker did not pivot into turbine OT. The loss of satellite modems removed remote monitoring and control connectivity for wind farms.","otOrIotMechanism":"The attacker used network-management access to overwrite flash-memory data on many residential modems. Viasat confirmed the use of the AcidRain modem wiper.","observedEffect":"Tens of thousands of modems lost service. Approximately 5,800 ENERCON turbines lost remote monitoring and control. The turbines continued autonomous operation.","intendedEffect":"The United States assessed that Russia intended to disrupt Ukrainian command and control during the invasion.","impactType":"industrial-communications-dependency-loss","evolutionNote":"The incident showed how destruction of shared communications infrastructure can remove OT visibility and remote control without compromise of the industrial process.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"KA-SAT Network cyber attack overview","url":"https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/","publisher":"Viasat","publicationDate":"2022-03-30","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect"]},{"title":"Russia behind cyber attack with Europe-wide impact an hour before Ukraine invasion","url":"https://www.ncsc.gov.uk/news/russia-behind-cyber-attack-with-europe-wide-impact-hour-before-ukraine-invasion","publisher":"UK National Cyber Security Centre","publicationDate":"2022-05-10","accessedDate":"2026-11-02","supports":["dates","effect","attribution"]},{"title":"Distributed Energy Resources Cybersecurity Report and Threat Briefing","url":"https://www.energy.gov/sites/default/files/2022-11/DOE%20Distributed%20Energy%20Resources%20Cybersecurity%20Report%20and%20Threat%20Briefing%20Presentation%20110722.pdf","publisher":"United States Department of Energy","publicationDate":"2022-11-07","accessedDate":"2026-11-02","supports":["effect","industrial-dependency"]}],"evidenceNotes":"The attack affected the KA-SAT ground network and modems. It did not disable the satellite. Public evidence does not show that the attacker entered wind-turbine OT. Treat the turbine effect as loss of a communications dependency, not an OT pivot.","summary":"Russian state actors disrupted the KA-SAT service and wiped many modems. Approximately 5,800 wind turbines lost remote monitoring and control, but they continued autonomous operation. The incident showed how a communications dependency can remove OT visibility without direct compromise of the industrial process."},{"id":"bridgestone-americas-ransomware-2022","title":"Bridgestone Americas ransomware shutdown","eventKind":"incident","aliases":["Bridgestone Americas IT security incident"],"startDate":"2022-02-27","endDate":"2022-03-18","disclosureDate":"2022-03-18","datePrecision":"start-day; end-evidence-as-of-publication-day; operations had resumed earlier; exact recovery date unknown","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","tire-manufacturing","automotive-supply-chain","containment-shutdown"],"status":"successful","attributionActor":"Unknown ransomware operator; LockBit claimed responsibility","attributionConfidence":"low","victim":"Bridgestone Americas","sector":"Tire and rubber manufacturing","country":"United States and other countries in the Americas","initialAccess":"Bridgestone did not disclose the first access method. The company detected unauthorized access to its internal network on February 27.","bridgePath":"Bridgestone disconnected affected IT systems to contain ransomware. The network isolation and loss of business systems stopped production at manufacturing sites.","otOrIotMechanism":"Public evidence does not show direct manipulation of production controllers. Manufacturing depended on connected IT services that the company isolated during containment.","observedEffect":"Production stopped at multiple facilities in North and Latin America. Bridgestone restored systems and resumed operations after containment and inspection.","intendedEffect":"The incident was an untargeted ransomware attack, according to Bridgestone. LockBit claimed the incident, but the public company statement did not confirm that claim.","impactType":"it-to-manufacturing-cascade","evolutionNote":"Containment of ransomware in a shared corporate network stopped production across a regional manufacturing footprint.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"IT security incident at Bridgestone Group Company in Americas","url":"https://www.bridgestone.com/corporate/news/2022031801.html","publisher":"Bridgestone Corporation","publicationDate":"2022-03-18","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","actor-characterization","limitations"]},{"title":"H1 2022: a brief overview of the main incidents in industrial cybersecurity","url":"https://ics-cert.kaspersky.com/publications/reports/2022/09/08/h1-2022-a-brief-overview-of-the-main-incidents-in-industrial-cybersecurity/","publisher":"Kaspersky ICS CERT","publicationDate":"2022-09-08","accessedDate":"2026-11-02","supports":["bridge","effect","actor-claim"]}],"evidenceNotes":"Bridgestone confirmed ransomware, network disconnection, reconnection, and resumed operations. Its March 18 statement does not date the recovery. Kaspersky ICS CERT reported production stops and repeated LockBit's victim-list claim from secondary reporting. Treat the LockBit identity as an unconfirmed claim.","summary":"Bridgestone detected unauthorized access and disconnected systems across its Americas network. The incident stopped production at multiple sites. Bridgestone later identified untargeted ransomware. Public evidence does not show direct manipulation of production controllers."},{"id":"toyota-kojima-supply-chain-2022","title":"Toyota shutdown after Kojima Industries cyberattack","eventKind":"incident","aliases":["Kojima Industries ransomware incident"],"startDate":"2022-03-01","endDate":"2022-03-02","disclosureDate":"2022-03-01","datePrecision":"production-shutdown-day; restart-day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["automotive","supplier","ransomware","just-in-time"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Kojima Industries group; Toyota Motor Corporation was operationally affected","sector":"Automotive manufacturing","country":"Japan","initialAccess":"Japan's Information-technology Promotion Agency reported that the attacker exploited vulnerable remote-connection equipment at a Kojima subsidiary and entered Kojima's network.","bridgePath":"Ransomware disabled supplier systems. Toyota stopped domestic production because the supplier disruption prevented normal parts flow.","otOrIotMechanism":"The ransomware affected supplier IT. Public evidence does not show direct access to Toyota plant controllers.","observedEffect":"Toyota stopped all 28 lines at 14 domestic plants on March 1. It resumed all lines from the first shift on March 2.","intendedEffect":"The attacker encrypted supplier systems. Public evidence does not establish a payment demand or a separate intent to stop Toyota production.","impactType":"supplier-it-caused-shutdown","evolutionNote":"The incident showed that disruption at one supplier can stop a large just-in-time production network.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Resumption of Operations at Domestic Plants from March 2","url":"https://global.toyota/en/newsroom/corporate/36964956.html","publisher":"Toyota Motor Corporation","publicationDate":"2022-03-01","accessedDate":"2026-11-02","supports":["dates","effect","recovery","scope"]},{"title":"10 Major Security Threats 2023: For Organizations","url":"https://www.ipa.go.jp/security/10threats/t6hhco000000bc3m-att/setsumei_2023_soshiki_en.pdf","publisher":"Information-technology Promotion Agency, Japan","publicationDate":"2023-07-01","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution-limitations"]}],"evidenceNotes":"Toyota confirms the shutdown and restart. IPA identifies ransomware and the remote-equipment access path. The IPA document gives July 2023 without a day, so the publication date uses month-start normalization. The cited sources do not support a February 26 start, a parts-order-information failure, a payment demand, or a no-buffer claim.","summary":"Ransomware entered the Kojima group through remote-connection equipment at a subsidiary. Toyota stopped all 28 domestic production lines for one day. Public evidence does not show compromise of Toyota control systems."},{"id":"access7-axeda-device-agent-2022","title":"Access:7 connected-device agent capability","eventKind":"capability","aliases":["Access:7","PTC Axeda Agent vulnerabilities"],"startDate":"2022-03-08","endDate":"2022-03-08","disclosureDate":"2022-03-08","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"access","secondaryTags":["iot-agent","remote-service","medical-device","supply-chain","remote-code-execution"],"status":"unknown","attributionActor":"Not applicable; coordinated vulnerability research","attributionConfidence":"not-applicable","victim":"Users of products that embedded affected PTC Axeda Agent or Desktop Server versions; no confirmed malicious victim","sector":"health care, manufacturing, and connected-product service","country":"Multiple countries","initialAccess":"The seven flaws affected software agents that manufacturers embedded in connected products for remote service and monitoring. Some paths required network reachability but no valid device account.","bridgePath":"The Axeda agent connected deployed equipment to vendor and customer support functions. Successful exploitation could give an attacker access to the host device and its local network context.","otOrIotMechanism":"CISA reported that exploitation could provide full system access, remote code execution, configuration changes, file-system reads, log access, or denial of service.","observedEffect":"CISA and PTC confirmed the affected software and coordinated remediation. Public evidence does not show malicious exploitation, device disruption, or patient harm.","intendedEffect":"The research showed how a shared remote-service agent could expose many connected products. It did not represent a hostile operation.","impactType":"embedded-remote-service-agent-capability","evolutionNote":"Access:7 showed that a remote-support component embedded by many equipment makers can create a common bridge into connected products and their networks.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"CISA Releases Security Advisory on PTC Axeda Agent and Desktop Server","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/30dea89","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2022-03-08","accessedDate":"2026-11-02","supports":["mechanism","effect","mitigation"]},{"title":"Axeda Public Advisory","url":"https://www.ptc.com/en/documents/security/coordinated-vulnerability-disclosure/axeda-public-advisory","publisher":"PTC","publicationDate":"2022-03-08","accessedDate":"2026-11-02","supports":["product","bridge","effect","limitations","mitigation"]}],"evidenceNotes":"The record describes a disclosed capability, not malicious exploitation. Product impact depended on whether a manufacturer embedded an affected Axeda component and how the device was connected.","summary":"Seven flaws affected a remote-service agent embedded in connected products. Exploitation could give an attacker full device access or remote code execution. Public evidence does not show malicious exploitation or operational harm."},{"id":"rockwell-hidden-code-demonstration-2022","title":"Rockwell Logix hidden-code demonstration","eventKind":"demonstration","aliases":["The Old Switcheroo","CVE-2022-1161","CVE-2022-1159"],"startDate":"2022-03-31","endDate":"2022-03-31","disclosureDate":"2022-03-31","datePrecision":"disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","rockwell-automation","control-logic","stealth","engineering-workstation"],"status":"successful","attributionActor":"Authorized Claroty Team82 researchers","attributionConfidence":"not-applicable","victim":"Rockwell Automation ControlLogix, CompactLogix, and GuardLogix test controllers","sector":"cross-sector industrial automation","country":"Controlled research","initialAccess":"One path required the ability to modify a user program. A second path required administrator access to a Studio 5000 engineering workstation.","bridgePath":"The attack used Logix program download and upload functions between an engineering workstation and a PLC.","otOrIotMechanism":"The vulnerabilities allowed executed binary code and user-readable source code to differ. An engineer could retrieve benign source while the PLC ran modified logic.","observedEffect":"In a proof of concept, researchers changed automation tag values in the running binary while the engineering workstation showed benign logic. Rockwell released tools to detect the mismatch.","intendedEffect":"Demonstrate concealed changes to industrial automation logic and provide a detection method before public disclosure.","impactType":"controlled-stealthy-ot-manipulation","evolutionNote":"The work reproduced a central Stuxnet deception technique on widely used Rockwell controllers and led to vendor detection controls.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"The Old Switcheroo: Hiding Code on Rockwell Automation PLCs","url":"https://claroty.com/team82/research/hiding-code-on-rockwell-automation-plcs","publisher":"Claroty Team82","publicationDate":"2022-03-31","accessedDate":"2026-11-02","supports":["researchers","access","mechanism","effect","vendor-response","limitations"]}],"evidenceNotes":"This was coordinated vulnerability research, not observed exploitation in a plant. The proof of concept changed running tag values and concealed the change from the normal engineering view.","summary":"Team82 made Rockwell Logix controllers run modified binary logic while Studio 5000 showed benign source code. The proof of concept changed automation values without a matching visible source change. Rockwell added mismatch detection."},{"id":"industroyer2-2022","title":"Industroyer2 attack attempt","eventKind":"incident","aliases":["Industroyer2"],"startDate":"2022-04-08","endDate":"2022-04-08","disclosureDate":"2022-04-12","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","iec-104","wiper"],"status":"disrupted","attributionActor":"Sandworm","attributionConfidence":"high","victim":"An unnamed Ukrainian energy provider","sector":"electricity","country":"Ukraine","initialAccess":"Public reporting does not identify the first access path. Evidence shows that the actor had planned the operation for at least two weeks.","bridgePath":"The actor placed the OT malware and several data wipers in the energy provider networks.","otOrIotMechanism":"Industroyer2 used IEC-104 commands to operate grid equipment. Other malware tried to erase Windows, Linux, and Solaris systems.","observedEffect":"CERT-UA and ESET stopped the operation before the scheduled power disruption.","intendedEffect":"The operation tried to stop electricity in a Ukrainian region and erase evidence and support systems.","impactType":"disrupted-direct-ot-attack","evolutionNote":"The operation reused grid-protocol malware and coordinated it with cross-platform wipers during a military invasion.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Industroyer2: Industroyer reloaded","url":"https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/","publisher":"ESET Research","publicationDate":"2022-04-12","accessedDate":"2026-11-02","supports":["mechanism","effect","attribution"]},{"title":"Cyberattack on a Ukrainian energy facility","url":"https://cert.gov.ua/article/39518","publisher":"CERT-UA","publicationDate":"2022-04-12","accessedDate":"2026-11-02","supports":["effect","attribution"]},{"title":"Cyberattacks on critical infrastructure","url":"https://www.welivesecurity.com/2022/04/21/critical-infrastructure-cyberattack-longer-think/","publisher":"ESET","publicationDate":"2022-04-21","accessedDate":"2026-11-02","supports":["effect","context"]}],"evidenceNotes":"ESET worked with CERT-UA during incident response and assessed Sandworm responsibility with high confidence.","summary":"Sandworm prepared Industroyer2 to stop electricity in a Ukrainian region. The malware used IEC-104 commands. Other malware tried to erase several operating systems. CERT-UA and ESET stopped the operation before the scheduled disruption."},{"id":"deutsche-windtechnik-2022","title":"Deutsche Windtechnik remote-monitoring interruption","eventKind":"incident","aliases":["Deutsche Windtechnik cyberattack"],"startDate":"2022-04-11","endDate":"2022-04-14","disclosureDate":"2022-04-14","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["wind","vendor","remote-monitoring","ransomware"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Deutsche Windtechnik and its wind-turbine service customers","sector":"Electricity","country":"Germany","initialAccess":"Public evidence does not identify the first access path. The company confirmed a targeted attack on its information technology systems.","bridgePath":"The service provider disconnected remote data-monitoring links to customer wind turbines while it contained the information technology incident.","otOrIotMechanism":"The attack did not enter the turbines. The response removed a vendor monitoring dependency for one to two days.","observedEffect":"Remote data monitoring was unavailable for one to two days. Maintenance operations resumed on April 14 with minor restrictions. The turbines continued to operate and had no damage.","intendedEffect":"Public evidence does not show the attacker's intended operational effect.","impactType":"vendor-it-monitoring-interruption","evolutionNote":"The incident showed how an attack on a service provider can remove fleet monitoring without compromising or stopping the industrial assets.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Cyber attack on Deutsche Windtechnik","url":"https://www.deutsche-windtechnik.com/nl/news/press-releases/detail/cyber-attack-on-deutsche-windtechnik/","publisher":"Deutsche Windtechnik","publicationDate":"2022-04-22","accessedDate":"2026-11-02","supports":["dates","target","bridge","effect"]}],"evidenceNotes":"The bridge was a vendor monitoring dependency, not a pivot into turbines. The company said the turbines were not in danger and had no damage. Public reporting identified ransomware, but the company source does not name the malware or actor.","summary":"Attackers compromised Deutsche Windtechnik information technology systems. The service provider disconnected remote monitoring links to customer wind turbines during containment. Monitoring returned after one to two days. The turbines continued to operate and had no damage. The incident showed that a vendor attack can remove monitoring across an industrial fleet without entering the assets."},{"id":"r4iot-cross-domain-ransomware-2022","title":"R4IoT cross-domain ransomware demonstration","eventKind":"demonstration","aliases":["R4IoT","Next-generation ransomware proof of concept"],"startDate":"2022-06-02","endDate":"2022-06-02","disclosureDate":"2022-06-02","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"pivot","secondaryTags":["ip-camera","ransomware","it-ot-convergence","lateral-movement","denial-of-service"],"status":"unknown","attributionActor":"Not applicable; controlled proof-of-concept research","attributionConfidence":"not-applicable","victim":"A laboratory environment; no malicious victim","sector":"health care and converged enterprise-industrial networks","country":"Not applicable; laboratory demonstration","initialAccess":"The proof of concept exploited an internet-facing IP camera. The compromised camera supplied the first foothold in the IoT network segment.","bridgePath":"The researchers moved from the camera into a Windows enterprise network. They then used the enterprise network to reach connected medical and operational devices.","otOrIotMechanism":"The demonstration combined an IoT exploit, network tunneling, Windows discovery, credential attacks, data encryption, cryptomining, and denial-of-service traffic against connected equipment.","observedEffect":"Researchers completed the cross-domain path in a laboratory. A denial-of-service exploit crashed a WAGO PLC. The attached HVAC fan stopped and its lights went off. Public evidence does not show deployment by a ransomware group or harm at a production site.","intendedEffect":"The research showed how a ransomware operation could use an unmanaged IoT device for entry and then affect IT and operational equipment. It did not represent a hostile operation.","impactType":"iot-to-it-to-ot-pivot-demonstration","evolutionNote":"R4IoT assembled a complete attack chain in which an IP camera supplied initial access, enterprise systems supplied lateral movement, and connected operational devices supplied physical disruption leverage.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"R4IoT: Next-Generation Ransomware","url":"https://www.forescout.com/resources/r4iot-next-generation-ransomware-report/","publisher":"Forescout Vedere Labs","publicationDate":"2022-06-02","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"Vedere Labs details Ransomware for IoT approach of IT, OT, IoT asset vulnerabilities exploited by ransomware hackers","url":"https://industrialcyber.co/ransomware/vedere-labs-details-ransomware-for-iot-approach-of-it-ot-iot-asset-vulnerabilities-exploited-by-ransomware-hackers/","publisher":"Industrial Cyber","publicationDate":"2022-06-02","accessedDate":"2026-11-02","supports":["dates"]}],"evidenceNotes":"R4IoT was a laboratory proof of concept. The PLC crash and the stopped fan and lights were physical laboratory effects, not simulations. Do not state that a criminal group deployed the tool or that a production site or hospital was attacked.","summary":"Researchers used an IP camera as the first foothold in a ransomware proof of concept. They moved through a Windows network and reached operational devices. A denial-of-service exploit crashed a laboratory PLC and stopped an attached HVAC fan and lights."},{"id":"hid-mercury-door-control-demonstration-2022","title":"HID Mercury building-access control demonstration","eventKind":"demonstration","aliases":["Carrier LenelS2 HID Mercury vulnerabilities","HID Mercury access-panel research"],"startDate":"2022-06-09","endDate":"2022-06-09","disclosureDate":"2022-06-09","datePrecision":"public-demonstration-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["building-access","physical-security","door-controller","remote-code-execution","shared-oem-platform"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected HID Mercury access panels; no confirmed malicious victim","sector":"commercial facilities, health care, education, transportation, and government","country":"Multiple countries","initialAccess":"Researchers chained two remotely exploitable flaws. Six of the eight disclosed vulnerabilities did not require authentication.","bridgePath":"More than twenty original-equipment manufacturers used Mercury boards in building-access products. The shared controller connected network access to physical door relays.","otOrIotMechanism":"Researchers obtained root privileges and ran code beside the legitimate panel software. They controlled door locks and changed monitoring behavior.","observedEffect":"Trellix remotely unlocked and locked doors, subverted alarms, and undermined logs in a controlled demonstration. No malicious building intrusion was reported.","intendedEffect":"The research showed that an attacker could defeat physical access controls and monitoring. It did not represent a hostile operation.","impactType":"building-access-direct-control-capability","evolutionNote":"The demonstration showed that one widely reused controller platform could connect a network flaw to physical entry at many facilities.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Trellix Threat Labs Uncovers Critical Flaws in Widely Used Building Access Control System","url":"https://www.trellix.com/en-au/blogs/research/trellix-threat-labs-uncovers-critical-flaws/","publisher":"Trellix Threat Labs","publicationDate":"2022-06-09","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","scale","limitations"]},{"title":"HID Mercury: Carrier Global Product Cybersecurity Advisory 006","url":"https://www.corporate.carrier.com/Images/CARR-PSA-HID-Mercury-Vulnerabilities-006-0622_tcm558-170514.pdf","publisher":"Carrier Global","publicationDate":"2022-06-02","accessedDate":"2026-11-02","supports":["product","mechanism","response","mitigation"]}],"evidenceNotes":"Trellix demonstrated effects on test hardware. HID confirmed impact across original-equipment partners on specified controller platforms. Public evidence does not show hostile exploitation or unauthorized entry into a real facility.","summary":"Researchers chained network flaws in widely reused building-access panels. They gained root control and operated physical door locks. They also changed alarms and monitoring. The controlled demonstration did not document a malicious facility intrusion."},{"id":"ot-icefall-2022","title":"OT:ICEFALL insecure-by-design vulnerability set","eventKind":"demonstration","aliases":["OT:ICEFALL"],"startDate":"2022-06-21","endDate":"2023-06-20","disclosureDate":"2022-06-21","datePrecision":"initial-disclosure-day; first-extension-day; final-extension-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","rtu","dcs","insecure-by-design","multi-vendor","firmware"],"status":"successful","attributionActor":"Authorized Forescout Vedere Labs researchers","attributionConfidence":"not-applicable","victim":"OT products from 13 vendors evaluated in controlled research","sector":"manufacturing, energy, water, building automation, and other industrial sectors","country":"Global product exposure; controlled research","initialAccess":"Exploit conditions varied. Many findings required network access to industrial protocols or engineering services. Some affected devices were exposed to the internet.","bridgePath":"The attack paths connected directly to controllers, remote terminal units, distributed control systems, or engineering software.","otOrIotMechanism":"The findings covered insecure engineering protocols, weak authentication and cryptography, insecure firmware updates, and remote code execution through native functions.","observedEffect":"Researchers validated attacks that could change logic, manipulate device functions, upload malicious firmware, bypass authentication, or execute code. The original release contained 56 vulnerabilities across 10 vendors and found more than 5,000 affected devices exposed online.","intendedEffect":"Measure persistent insecure-by-design conditions in modern OT products and coordinate vendor remediation.","impactType":"multi-vendor-direct-ot-compromise-capability","evolutionNote":"OT:ICEFALL showed that techniques used by major OT malware remained broadly possible through native product functions and weak protocol design, a decade after Project Basecamp.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"OT:ICEFALL Vulnerability FAQ","url":"https://www.forescout.com/resources/ot-icefall-faq/","publisher":"Forescout Vedere Labs","publicationDate":"2022-06-21","accessedDate":"2026-11-02","supports":["researchers","target","access","mechanism","effect","exposure","vendor-response"]},{"title":"Concluding OT:ICEFALL: New Vulnerabilities and a Retrospect on OT Security Design and Patching","url":"https://www.forescout.com/resources/concluding-ot-icefall-report/","publisher":"Forescout Vedere Labs","publicationDate":"2023-06-20","accessedDate":"2026-11-02","supports":["scope","dates","vendor-response","limitations"]}],"evidenceNotes":"The effects were validated in research, not reported as one production campaign. Forescout announced 56 vulnerabilities across 10 vendors on June 21, 2022. It announced three more vulnerabilities on November 29, 2022. It announced the final two vulnerabilities on June 20, 2023. The full set contained 61 vulnerabilities across 13 vendors.","summary":"Forescout disclosed 56 vulnerabilities across 10 OT vendors, then extended the set. Tests showed logic change, authentication bypass, firmware abuse, and code execution paths. More than 5,000 affected devices were visible online at the initial disclosure."},{"id":"predatory-sparrow-steel-2022","title":"Predatory Sparrow Iranian steel attacks","eventKind":"campaign","aliases":["Gonjeshke Darande steel attacks","UNC4368 steel attacks"],"startDate":"2022-06-27","endDate":"2022-06-27","disclosureDate":"2022-06-27","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["steel","manufacturing","hacktivism","physical-damage"],"status":"successful","attributionActor":"Predatory Sparrow, based on the group's claim and released evidence","attributionConfidence":"medium","victim":"Khouzestan Steel Company, Mobarakeh Steel Company, and Hormozgan Steel Company","sector":"steel manufacturing","country":"Iran","initialAccess":"Public evidence does not identify the first access method.","bridgePath":"The actor reported access to industrial control systems at three steel manufacturers.","otOrIotMechanism":"Public evidence shows interaction with industrial equipment. It does not disclose the complete command path or malware.","observedEffect":"The attacks disrupted production. Released video showed molten material and fire at Khouzestan Steel. Public sources do not independently confirm the full claimed damage at all three plants.","intendedEffect":"Predatory Sparrow stated that it intended to disrupt steel production and damage industrial equipment.","impactType":"direct-ot-damage","evolutionNote":"The campaign combined industrial disruption with public video and political messaging. It showed how an actor could use physical effects as part of an influence operation.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"We (Did!) Start the Fire: Hacktivists Increasingly Claim Targeting of OT Systems","url":"https://cloud.google.com/blog/topics/threat-intelligence/hacktivists-targeting-ot-systems","publisher":"Mandiant","publicationDate":"2023-03-22","accessedDate":"2026-11-02","supports":["dates","target","mechanism","claimed-effect","attribution","limitations"]},{"title":"Iran Turning to Cyber-Enabled Influence Operations for Greater Effect","url":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Iran-turning-to-cyber-enabled-influence-operations-for-greater-effect-05022023.pdf","publisher":"Microsoft Threat Intelligence","publicationDate":"2023-05-02","accessedDate":"2026-11-02","supports":["effect","attribution","influence-operation-context"]}],"evidenceNotes":"Predatory Sparrow supplied the public videos and claim. The evidence supports a disruptive industrial incident, but it does not independently prove every claimed effect. Public evidence does not confirm Israeli government control.","summary":"Predatory Sparrow claimed attacks against three Iranian steel manufacturers. Production stopped at affected sites. Released video showed molten material and fire at Khouzestan Steel. Public evidence does not confirm the full claimed damage at all three plants."},{"id":"hiatusrat-edge-camera-campaign-2022","title":"HiatusRAT edge-router and camera campaign","eventKind":"campaign","aliases":["Hiatus campaign","HiatusRAT camera and DVR scanning"],"startDate":"2022-07-01","endDate":"2024-12-16","disclosureDate":"2024-12-16","datePrecision":"start-month; observed-camera-activity-month; end-publication-cutoff","lane":"iiot-bridge","bridgeRole":"proxy","secondaryTags":["edge-router","ip-camera","dvr","traffic-collection","command-and-control","reconnaissance"],"status":"mixed","attributionActor":"Unknown HiatusRAT operators","attributionConfidence":"unknown","victim":"Owners of compromised edge routers and organizations whose cameras, recorders, or networks were targeted","sector":"government, defense contracting, physical security, telecommunications, and multiple enterprise sectors","country":"Latin America, Europe, Taiwan, United States, Australia, Canada, New Zealand, and United Kingdom","initialAccess":"The campaign first targeted outdated edge routers. In March 2024, the actors scanned exposed cameras and digital video recorders for known flaws, Telnet access, and weak vendor passwords.","bridgePath":"Compromised routers passively collected traffic and supplied covert command-and-control infrastructure. Targeted cameras and recorders could provide additional remotely controlled devices at enterprise sites.","otOrIotMechanism":"HiatusRAT supplied remote control of Linux-based edge devices. The camera campaign used Ingram for scanning and Medusa for password attacks against Hikvision devices.","observedEffect":"Security researchers observed compromised routers collecting traffic and acting as command-and-control nodes. The FBI confirmed scanning against cameras and recorders. Public evidence does not confirm compromise of the scanned camera fleet or a physical-security effect.","intendedEffect":"Observed activity supported traffic collection, covert infrastructure, reconnaissance, and likely future exploitation of cameras and recorders.","impactType":"edge-device-surveillance-and-proxy","evolutionNote":"The campaign expanded from business routers used for surveillance and covert infrastructure to cameras and recorders that form enterprise physical-security systems.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"HiatusRAT Actors Targeting Web Cameras and DVRs","url":"https://www.ic3.gov/CSA/2024/241216.pdf","publisher":"Federal Bureau of Investigation","publicationDate":"2024-12-16","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","limitations"]},{"title":"No rest for the wicked: HiatusRAT takes little time off in a return to action","url":"https://www.lumen.com/blog/en-us/hiatusrat-takes-little-time-off-return-action","publisher":"Lumen Black Lotus Labs","publicationDate":"2023-08-18","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","targeting","attribution-limitations"]},{"title":"New HiatusRAT router malware covertly spies on victims","url":"https://www.lumen.com/blog/en-us/new-hiatusrat-router-malware-covertly-spies-victims","publisher":"Lumen Black Lotus Labs","publicationDate":"2023-03-06","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","geography","limitations"]}],"evidenceNotes":"Lumen confirmed more than 100 compromised routers, mainly in Latin America and Europe, and later targeting in Taiwan and the United States. The FBI confirmed camera and recorder scanning in five countries but did not confirm compromise of the scanned fleet. Lumen tracks HiatusRAT as a distinct cluster and does not attribute it to a named actor or state.","summary":"HiatusRAT operators compromised edge routers for traffic collection and covert command infrastructure, mainly in Latin America and Europe. They later targeted Taiwan and the United States and scanned cameras and video recorders in five countries. The FBI did not confirm compromise of the scanned camera fleet."},{"id":"micodus-fleet-control-capability-2022","title":"MiCODUS fleet-tracker control capability","eventKind":"demonstration","aliases":["MiCODUS MV720 vulnerabilities","AV22-397"],"startDate":"2022-07-19","endDate":"2022-07-19","disclosureDate":"2022-07-19","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["fleet-management","gps-tracker","vehicle-control","cloud-platform","authentication-bypass"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of MiCODUS MV720 vehicle trackers; no confirmed malicious victim","sector":"transport, logistics, government, military, and fleet management","country":"Multiple countries","initialAccess":"The disclosed flaws included hard-coded credentials, weak authentication, and authorization bypass through a user-controlled key.","bridgePath":"The tracker and its cloud service connected remote users to vehicle location, alarm, and fuel-control functions.","otOrIotMechanism":"An attacker could take control of a tracker, view location data, disable alarms, or use the fuel-cutoff function. The effect depended on the vehicle installation.","observedEffect":"Researchers demonstrated the vulnerable control paths. Public evidence does not show malicious exploitation, vehicle stoppage, injury, or another operational effect.","intendedEffect":"The research identified how an attacker could surveil vehicles or interfere with fleet operations. It did not represent a hostile operation.","impactType":"fleet-control-capability","evolutionNote":"The disclosure showed that one fleet-control platform could connect a remote account compromise to physical vehicle functions.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"MiCODUS security advisory AV22-397","url":"https://www.cyber.gc.ca/en/alerts-advisories/control-systems-micodus-security-advisory-av22-397","publisher":"Canadian Centre for Cyber Security","publicationDate":"2022-07-19","accessedDate":"2026-11-02","supports":["product","access","mechanism","effect","mitigation"]},{"title":"Critical Vulnerabilities Discovered in Popular Automotive GPS Tracking Device","url":"https://www.bitsight.com/sites/default/files/2022-07/MiCODUS-GPS-Report-Final.pdf","publisher":"BitSight","publicationDate":"2022-07-19","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","scale","limitations"]}],"evidenceNotes":"The physical effects were demonstrated capabilities, not observed malicious outcomes. The vendor's deployment figure was not independently verified. Do not describe the record as an attack campaign.","summary":"Researchers found flaws in MiCODUS vehicle trackers and their control platform. An attacker could obtain location data and access alarm or fuel-control functions. Public evidence does not show malicious exploitation or vehicle harm."},{"id":"evil-plc-demonstration-2022","title":"Evil PLC engineering-workstation attack demonstration","eventKind":"demonstration","aliases":["Evil PLC Attack"],"startDate":"2022-08-13","endDate":"2022-08-13","disclosureDate":"2022-08-13","datePrecision":"disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","engineering-workstation","supply-chain","lateral-movement","multi-vendor"],"status":"successful","attributionActor":"Authorized Claroty Team82 researchers","attributionConfidence":"not-applicable","victim":"Engineering software from seven industrial automation vendors in controlled tests","sector":"cross-sector industrial automation","country":"Controlled research","initialAccess":"The attack model required prior access to a PLC through the internet, an OT network, or a malicious project download.","bridgePath":"A weaponized PLC sent crafted project data to an engineer who connected and uploaded the controller project for diagnosis.","otOrIotMechanism":"Trusted PLC project data exploited parsing flaws in engineering software. The payload executed code on the workstation and could provide access to other controllers that the engineer managed.","observedEffect":"Working proof-of-concept exploits achieved code execution against engineering platforms from Rockwell Automation, Schneider Electric, GE, B&R, Xinje, OVARRO, and Emerson.","intendedEffect":"Demonstrate that a compromised controller can attack trusted engineering workstations and expand access across OT environments.","impactType":"controlled-plc-to-engineering-workstation-compromise","evolutionNote":"The technique reversed the normal attack direction. It used a PLC as the source of workstation compromise and as a possible path to other industrial controllers.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Evil PLC Attack: Using a Controller as Predator Rather than Prey","url":"https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey","publisher":"Claroty Team82","publicationDate":"2022-08-13","accessedDate":"2026-11-02","supports":["researchers","target","access","mechanism","effect","vendor-response","limitations"]}],"evidenceNotes":"This was controlled research. It did not show a production incident. Team82 reported the flaws to affected vendors, and most vendors issued fixes, patches, or mitigations.","summary":"Team82 weaponized PLC project data to attack engineering workstations. Working exploits achieved code execution in software from seven automation vendors. The technique could turn one compromised controller into a path toward other OT systems."},{"id":"dsb-supeo-train-stop-2022","title":"DSB train stoppage after subcontractor cyberattack","eventKind":"incident","aliases":["DSB subcontractor cyberattack"],"startDate":"2022-10-01","endDate":"2022-10-01","disclosureDate":"2023-02-09","datePrecision":"incident-month normalized to month start; annual-report disclosure-day","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["rail","supplier","safety-information"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"An unnamed DSB subcontractor was attacked; DSB train operations were affected","sector":"Rail transport","country":"Denmark","initialAccess":"An attacker compromised a test server at a DSB subcontractor. Public evidence does not give the first access method.","bridgePath":"The subcontractor shut down production servers for security. Train drivers lost required digital information, and the offline copy did not work.","otOrIotMechanism":"The attack did not manipulate signalling or train controls. DSB safety procedure required trains to stop when drivers could not obtain current operating information.","observedEffect":"Many DSB trains stood idle for four hours. DSB states that the traffic stop complied with its safety procedures.","intendedEffect":"Public evidence does not show the attacker's intent. DSB found no indication that its systems were targeted.","impactType":"supplier-it-caused-safety-stop","evolutionNote":"The event showed that a subcontractor outage and a failed offline fallback can stop rail service without intrusion into signalling equipment.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Resultat før skat udgjorde i 2022 et overskud på 229 mio. kr.","url":"https://www.dsb.dk/om-dsb/presse/pressemeddelelser/resultat-for-skat-udgjorde-i-2022-et-overskud-pa-229-mio.-kr/","publisher":"DSB","publicationDate":"2023-02-09","accessedDate":"2026-11-02","supports":["disclosure","annual-report-publication"]},{"title":"DSB Annual Report 2022","url":"https://www.dsb.dk/globalassets/arsrapport/2022/dsb-annual-report-2022.pdf","publisher":"DSB","publicationDate":"2023-02-09","accessedDate":"2026-11-02","supports":["dates","effect","dependency","duration","mechanism","recovery"]}],"evidenceNotes":"DSB documents an October incident, the four-hour stop, the test-server attack, and the failed offline fallback. The exact incident day, subcontractor name, product name, actor, and financial motive are not established by these sources.","summary":"An attacker compromised a test server at a DSB subcontractor. The subcontractor shut production servers down. Drivers lost required information because the offline fallback failed. Many trains stopped for four hours under DSB safety procedures."},{"id":"sandworm-lotl-grid-2022","title":"Sandworm living-off-the-land grid attack","eventKind":"incident","aliases":["MicroSCADA attack"],"startDate":"2022-10-10","endDate":"2022-10-12","disclosureDate":"2023-11-09","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","living-off-the-land","microscada"],"status":"successful","attributionActor":"Sandworm","attributionConfidence":"high","victim":"An unnamed Ukrainian critical infrastructure organization","sector":"electricity","country":"Ukraine","initialAccess":"The intrusion started on or before June 2022. The first access vector is unknown.","bridgePath":"The actor reached a hypervisor that hosted a SCADA management system.","otOrIotMechanism":"The actor used a native MicroSCADA program and unauthorized commands. No custom OT malware was necessary.","observedEffect":"The operation likely opened substation breakers and caused an unplanned power outage. A later wiper affected the IT environment.","intendedEffect":"The operation tried to disrupt power during Russian missile attacks and then damage supporting IT systems.","impactType":"direct-ot-operation","evolutionNote":"The actor used legitimate OT software to cause the probable physical effect. This method reduced the need for custom malware.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Sandworm disrupts power using a novel OT attack","url":"https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology/","publisher":"Mandiant","publicationDate":"2023-11-09","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution"]}],"evidenceNotes":"Mandiant assessed that unauthorized commands likely caused the outage. It attributed the activity to Sandworm based on the intrusion and related wiper activity.","summary":"Sandworm reached a supervisory control and data acquisition system in Ukraine. The actor used a legitimate MicroSCADA program to send unauthorized commands. Mandiant assessed that the commands probably opened substation breakers and caused an outage. A later wiper affected the IT network. The operation did not require custom OT malware."},{"id":"infectedslurs-iot-botnet-2022","title":"InfectedSlurs router and video-recorder botnet","eventKind":"campaign","aliases":["InfectedSlurs","JenX Mirai zero-day campaign"],"startDate":"2022-12-01","endDate":"2023-11-21","disclosureDate":"2023-11-21","datePrecision":"start-late-2022 normalized to December; end-publication-cutoff with activity continuing","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["routers","network-video-recorders","mirai","zero-day","ddos"],"status":"successful","attributionActor":"Unknown botnet operators","attributionConfidence":"unknown","victim":"Owners of vulnerable routers and network video recorders","sector":"Consumer and small-business networking and video surveillance","country":"Multiple countries","initialAccess":"The campaign exploited two remote-code-execution zero-days. One affected device class also used documented default administrator credentials.","bridgePath":"Routers and video recorders became remotely controlled nodes that supplied denial-of-service traffic.","otOrIotMechanism":"The attacker installed a JenX-derived Mirai variant and controlled devices through shared command infrastructure.","observedEffect":"Akamai observed active exploitation and bot enrollment. Akamai cited RedDrip Team reporting that the same command infrastructure targeted a Russian news website in May 2023.","intendedEffect":"The campaign tried to build and operate a distributed denial-of-service botnet.","impactType":"iot-botnet-attack-capacity","evolutionNote":"The campaign combined Mirai code with device-specific zero-days and showed how old botnet software can remain effective with new access methods.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"InfectedSlurs Botnet Spreads Mirai via Zero-Days","url":"https://www.akamai.com/blog/security-research/new-rce-botnet-spreads-mirai-via-zero-days","publisher":"Akamai Security Intelligence Response Team","publicationDate":"2023-11-21","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect","scope","third-party-target-report","limitations"]},{"title":"Information Security White Paper 2024","url":"https://www.ipa.go.jp/publish/wp-security/eid2eo0000007gv4-att/2024_Chap3.pdf","publisher":"Information-technology Promotion Agency, Japan","publicationDate":"2024-07-30","accessedDate":"2026-11-02","supports":["access","mechanism","effect","context"]}],"evidenceNotes":"Akamai says monitoring began in late 2022 and that exploitation was active at publication. December 1 is a month-level normalization, and November 21 is a publication cutoff. The Russian news website is a third-party-reported target, not a confirmed victim in this record. RedDrip Team is the reporting research team, not the operator.","summary":"InfectedSlurs exploited zero-days in routers and network video recorders. It installed a JenX-derived Mirai variant and enrolled devices as denial-of-service capacity. The operator remains unknown, and activity continued at disclosure."},{"id":"mks-instruments-ransomware-2023","title":"MKS Instruments ransomware production shutdown","eventKind":"incident","aliases":["MKS February 2023 ransomware event"],"startDate":"2023-02-03","endDate":"2023-08-04","disclosureDate":"2023-02-06","datePrecision":"start-day; end-evidence-as-of-filing-day; exact recovery date unknown","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","semiconductor-supply-chain","production-systems","enterprise-resource-planning"],"status":"successful","attributionActor":"Unknown ransomware operator","attributionConfidence":"unknown","victim":"MKS Instruments","sector":"Semiconductor, photonics, and industrial equipment manufacturing","country":"Multiple countries","initialAccess":"MKS did not disclose the first access method. The company concluded that ransomware actors deployed malware and encrypted systems.","bridgePath":"Ransomware affected business systems, including production-related systems. MKS suspended work at some facilities and lost access to enterprise resource planning functions.","otOrIotMechanism":"Manufacturing and service operations depended on production-related IT and enterprise resource planning systems. Public evidence does not show direct control-system manipulation.","observedEffect":"MKS temporarily suspended operations at some facilities. The incident delayed orders, shipments, and service. MKS estimated a negative first-quarter revenue effect of approximately USD 160 million.","intendedEffect":"The attackers deployed malware and encrypted systems. Public evidence does not document a ransom demand, identify the operator, or show a separate objective against industrial controllers.","impactType":"it-to-manufacturing-and-supply-chain-cascade","evolutionNote":"The incident linked one supplier's IT outage to semiconductor and industrial production dependencies. It also showed the operational importance of enterprise resource planning systems.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"MKS Instruments Form 8-K filed February 6, 2023","url":"https://www.sec.gov/Archives/edgar/data/1049502/000119312523024904/d420671d8k.htm","publisher":"MKS Instruments via United States Securities and Exchange Commission","publicationDate":"2023-02-06","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect"]},{"title":"MKS Instruments Form 10-Q for the quarter ended June 30, 2023","url":"https://www.sec.gov/Archives/edgar/data/1049502/000095017023038457/mksi-20230630.htm","publisher":"MKS Instruments via United States Securities and Exchange Commission","publicationDate":"2023-08-04","accessedDate":"2026-11-02","supports":["mechanism","effect","financial-effect","recovery","limitations"]}],"evidenceNotes":"MKS documented encrypted systems, production-related system effects, facility suspensions, and the revenue effect. By the August 4 filing, MKS had reopened affected manufacturing and service operations and had restored virtually all IT systems. The filing does not establish that this work finished by June 30 or give an exact recovery date. The filings do not document a ransom demand or identify the actor or first access method.","summary":"Ransomware encrypted MKS systems and affected production-related IT. MKS suspended operations at some facilities. Order, shipment, and service delays reduced first-quarter revenue by an estimated USD 160 million. Public evidence does not show direct manipulation of industrial controllers."},{"id":"akuvox-e11-intercom-capability-2023","title":"Akuvox E11 smart-intercom takeover capability","eventKind":"demonstration","aliases":["Akuvox E11 vulnerabilities","The Silent Spy Among Us"],"startDate":"2023-03-09","endDate":"2023-03-09","disclosureDate":"2023-03-09","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["smart-building","intercom","camera","microphone","sip","cloud-service"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected Akuvox E11 intercoms; no confirmed malicious victim","sector":"commercial and residential building management","country":"Multiple countries","initialAccess":"The thirteen flaws exposed local network, internet-facing, and cloud-assisted attack paths. Some paths required only a target device identifier or account information.","bridgePath":"The intercom joined building networks and used Akuvox cloud and SIP services. These connections exposed device sensors and supplied a possible network foothold.","otOrIotMechanism":"An attacker could run code, activate the camera and microphone, collect images, impersonate calls, or access insecurely stored data.","observedEffect":"Team82 demonstrated the attack paths on research devices. Public evidence at disclosure did not show malicious surveillance, network pivoting, or door operation.","intendedEffect":"The research showed how an attacker could surveil occupants or use an intercom as a building-network foothold. It did not represent a hostile operation.","impactType":"smart-building-intercom-control-capability","evolutionNote":"Cloud and SIP services changed a local building intercom into a remotely reachable sensor platform.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"The Silent Spy Among Us: Smart Intercom Attacks","url":"https://claroty.com/team82/research/the-silent-spy-among-us-modern-attacks-against-smart-intercoms","publisher":"Claroty Team82","publicationDate":"2023-03-09","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"Security Advisory: Akuvox E11 Series Product Vulnerability Disclosure","url":"https://www.akuvox.com/asrc/notification/series-product-vulnerability-disclosure","publisher":"Akuvox","publicationDate":"2023-03-22","accessedDate":"2026-11-02","supports":["product","response","mitigation"]}],"evidenceNotes":"The research confirmed control of camera, microphone, and device software. Public evidence did not establish malicious exploitation at disclosure. Door-control impact would depend on the intercom's installation and integrations.","summary":"Researchers found thirteen flaws in a smart-building intercom. They demonstrated remote sensor access, code execution, and cloud-assisted abuse. The device could also supply a foothold on a building network. No malicious physical effect was confirmed."},{"id":"denmark-zyxel-energy-2023","title":"Danish energy-sector edge-device campaign","eventKind":"campaign","aliases":["Attack against Danish critical infrastructure","Danish Zyxel campaign"],"startDate":"2023-05-11","endDate":"2023-06-02","disclosureDate":"2023-11-01","datePrecision":"event-days; disclosure-month","lane":"iiot-bridge","bridgeRole":"access","secondaryTags":["energy","zyxel","firewall","industrial-edge","island-mode"],"status":"mixed","attributionActor":"Unknown actors; SektorCERT found limited indicators that could suggest state involvement","attributionConfidence":"low","victim":"Twenty-two Danish energy-sector companies","sector":"electricity and district energy","country":"Denmark","initialAccess":"The first wave exploited CVE-2023-28771 in internet-facing Zyxel firewalls. Later waves used other Zyxel vulnerabilities that were not public when the attacks began.","bridgePath":"The vulnerable firewalls protected industrial networks. Eleven of sixteen targets in the first wave lost control of their firewalls. The compromise supplied access to infrastructure behind the devices.","otOrIotMechanism":"Attackers ran commands with root privileges on firewalls. They collected configuration data and user names. Later attackers installed botnet software on some devices and used them for distributed denial-of-service attacks.","observedEffect":"Attackers compromised infrastructure at twenty-two energy companies. Defenders stopped the first wave before attackers used the access against industrial operations. Several companies disconnected from the internet or entered island mode. Customers did not lose electricity or heat.","intendedEffect":"Public evidence does not establish one objective for all waves. Observed activity included reconnaissance, persistent access, and use of compromised devices for denial-of-service attacks.","impactType":"industrial-edge-access","evolutionNote":"The campaign showed how one vulnerable edge-device family could expose many decentralized energy operators at the same time.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"The attack against Danish critical infrastructure","url":"https://sektorcert.dk/wp-content/uploads/2023/11/SektorCERT-The-attack-against-Danish-critical-infrastructure-TLP-CLEAR.pdf","publisher":"SektorCERT","publicationDate":"2023-11-01","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","attribution-limitations"]}],"evidenceNotes":"SektorCERT observed several attack waves and did not prove that one actor caused all of them. It found possible Sandworm indicators but stated that evidence did not confirm Russian involvement. The mixed outcome records successful device compromise and successful defensive containment before customer service failed.","summary":"Attackers compromised edge firewalls at Danish energy companies. The devices protected industrial networks. Defenders contained the access before customers lost electricity or heat. Some operators disconnected from the internet or entered island mode. SektorCERT did not confirm one actor for all attack waves."},{"id":"ovrc-cloud-device-hijack-demonstration-2024","title":"OvrC shared IoT control-plane hijack demonstration","eventKind":"demonstration","aliases":["OvrC cloud vulnerabilities","Snap One OvrC hijacking"],"startDate":"2023-05-16","endDate":"2024-11-12","disclosureDate":"2023-05-16","datePrecision":"start-day; end-day; disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["cloud-control-plane","shared-platform","remote-management","power-device","camera","router","building-automation"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Businesses and consumers that used affected OvrC services; no confirmed malicious victim","sector":"commercial facilities, physical security, networking, and building automation","country":"Multiple countries","initialAccess":"Researchers chained authentication, authorization, device-identity, update, and command-execution flaws in OvrC Pro, OvrC Connect, and cloud services.","bridgePath":"The shared cloud platform remotely managed power supplies, cameras, routers, and automation devices. Cloud trust bypassed local firewalls and network address translation.","otOrIotMechanism":"Researchers enumerated, claimed, impersonated, and controlled cloud-managed devices. Some paths permitted arbitrary code execution on a hub.","observedEffect":"Team82 demonstrated device hijacking and code execution in controlled research. It did not report malicious exploitation, power loss, camera misuse, or a building effect.","intendedEffect":"The research showed how an attacker could control, disrupt, or profile many connected devices through one cloud service. It did not represent a hostile operation.","impactType":"shared-iot-cloud-control-plane-capability","evolutionNote":"The demonstration showed how one shared cloud control plane could turn weak device identity into cross-customer control of connected equipment.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"The Problem with IoT Cloud-Connectivity and How it Exposed All OvrC Devices to Hijacking","url":"https://claroty.com/team82/research/the-problem-with-iot-cloud-connectivity-and-how-it-exposed-all-ovrc-devices-to-hijacking","publisher":"Claroty Team82","publicationDate":"2024-11-12","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","scale","limitations","mitigation"]},{"title":"Snap One OvrC Cloud (Update A)","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2023-05-16","accessedDate":"2026-11-02","supports":["product","mechanism","response","mitigation"]}],"evidenceNotes":"CISA first published the advisory for eight vulnerabilities on 2023-05-16. CISA updated it after the final two fixes on 2024-11-12. An OvrC webinar cited 9.2 million monitored devices in 2020. Team82 inferred that about 10 million devices could have been affected by 2024. This value is an estimate, not a measured vulnerable-device count. Snap One fixed all ten disclosed flaws.","summary":"Researchers chained flaws in a shared cloud platform for connected equipment. They claimed devices, impersonated hubs, and ran code through trusted cloud paths. The vendor fixed all ten flaws. No malicious device or building effect was confirmed."},{"id":"fuxnet-moskollektor-2024","title":"Fuxnet attack on Moscow sensor infrastructure","eventKind":"incident","aliases":["MOSCOLLECTOR TAKEDOWN","BlackJack Fuxnet campaign"],"startDate":"2023-06-01","endDate":"2024-04-09","disclosureDate":"2024-04-09","datePrecision":"start-actor-claimed-month; end-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["industrial-sensors","sensor-gateway","m-bus","wiper"],"status":"successful","attributionActor":"BlackJack, based on the group's claim and released intrusion data; reported state links are unconfirmed","attributionConfidence":"medium","victim":"Moskollektor municipal infrastructure monitoring network","sector":"municipal infrastructure monitoring","country":"Russia","initialAccess":"Released data indicates access to routers and sensor gateways, likely through default credentials. The first access method is not confirmed.","bridgePath":"The actor reached industrial sensor gateways that connected to field sensors through serial M-Bus links.","otOrIotMechanism":"Fuxnet combined Linux data destruction for gateways with repeated M-Bus traffic intended to prevent sensor data acquisition.","observedEffect":"Dragos assessed that some sensor and gateway disruption likely occurred. The scale was smaller than BlackJack claimed. Permanent damage and the claimed 87,000-device effect remain unconfirmed.","intendedEffect":"Destroy sensor gateways, deny monitoring data, disrupt operations, and destroy supporting IT systems.","impactType":"direct-ot-damage","evolutionNote":"Fuxnet combined destructive Linux malware with a function that interfered with industrial sensor communications.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Unpacking the Blackjack Group's Fuxnet Malware","url":"https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware","publisher":"Claroty Team82","publicationDate":"2024-04-12","accessedDate":"2026-11-02","supports":["access","mechanism","claimed-effect","attribution","limitations"]},{"title":"Dragos 2025 OT/ICS Cybersecurity Report","url":"https://www.dragos.com/dragos-2025-ot-cybersecurity-report-a-year-in-review","publisher":"Dragos","publicationDate":"2025-02-25","accessedDate":"2026-11-02","supports":["effect","limitations"]}],"evidenceNotes":"BlackJack supplied the public intrusion evidence. Vendor researchers could not confirm the claimed scale. No public victim confirmation or malware binary is available.","summary":"BlackJack attacked an industrial monitoring network with Fuxnet. The malware targeted sensor gateways. It sent repeated traffic over Meter-Bus, an industrial sensor protocol. Dragos assessed that some disruption probably occurred. Public evidence does not confirm the claimed effect on 87,000 devices."},{"id":"brunswick-it-operations-2023","title":"Brunswick global operations cyber incident","eventKind":"incident","aliases":["Brunswick June 2023 IT security incident"],"startDate":"2023-06-13","endDate":"2023-06-22","disclosureDate":"2023-06-13","datePrecision":"start-disclosure day; incident start unknown; end-derived upper bound from nine-day recovery statement","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["marine-manufacturing","facility-shutdown","production-support-it","containment"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Brunswick Corporation","sector":"Marine engines, boats, and equipment manufacturing","country":"Multiple countries","initialAccess":"Brunswick did not disclose the first access method or malware family.","bridgePath":"An IT security incident affected systems and global facilities. Brunswick paused operations at some locations while it contained and restored systems.","otOrIotMechanism":"Brunswick paused operations at some locations while it contained and restored affected systems. This record infers an IT dependency from that sequence. The company did not identify the systems or report direct industrial-control-system effects.","observedEffect":"Brunswick paused operations at some locations. Normal global business operations resumed over nine days. The company estimated USD 80 million to USD 85 million in lost revenue and USD 35 million to USD 40 million in lost operating earnings.","intendedEffect":"Public evidence does not establish the actor, malware, or objective.","impactType":"it-to-manufacturing-cascade","evolutionNote":"The incident provides a measured example of how an unspecified IT compromise can pause facility operations and create large operational losses.","significance":{"historicalImportance":3,"technicalNovelty":0,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Brunswick Corporation 2023 Form 10-K","url":"https://www.sec.gov/Archives/edgar/data/14930/000001493024000054/bcorp-20231231.htm","publisher":"Brunswick Corporation via United States Securities and Exchange Commission","publicationDate":"2024-02-16","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","financial-effect","limitations"]}],"evidenceNotes":"Brunswick disclosed the incident on June 13, an operational pause, a nine-day recovery period, and the financial effect. June 13 is not a proven first-compromise date. June 22 is a calculated upper bound, not a reported recovery day. Brunswick did not identify the affected systems, facilities, actor, malware family, first access method, or objective. The IT-to-facility bridge is an inference from the pause during containment and restoration. Do not characterize the incident as ransomware.","summary":"An IT security incident affected Brunswick systems and global facilities. Brunswick paused operations at some locations. Normal operations returned over nine days. The company estimated up to USD 85 million in lost revenue. The actor and malware remain undisclosed."},{"id":"nagoya-port-ransomware-2023","title":"Nagoya Port ransomware shutdown","eventKind":"incident","aliases":["Nagoya United Terminal System ransomware incident","NUTS ransomware attack"],"startDate":"2023-07-04","endDate":"2023-07-06","disclosureDate":"2023-07-05","datePrecision":"day; staged-recovery end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["port","logistics","ransomware","terminal-system"],"status":"successful","attributionActor":"Unknown actor; a LockBit-branded ransom note was reported","attributionConfidence":"unknown","victim":"Nagoya Harbor Transportation Association and users of the Port of Nagoya container terminals","sector":"Maritime transport and logistics","country":"Japan","initialAccess":"The final committee report assesses maintenance VPN access as the most appropriate hypothesis. It states that the route could not be determined.","bridgePath":"Ransomware encrypted the shared terminal system used at five container terminals and the centralized gate. The unavailable system stopped normal container entry and exit.","otOrIotMechanism":"Ransomware encrypted all eight physical servers and the virtual-server environment. Public evidence does not show manipulation of cranes or vehicle controllers.","observedEffect":"NUTS stopped at about 06:30 on July 4. Work resumed in stages on July 6. The report identifies 37 affected vessel schedules and an estimated 20,000 affected container entries and exits.","intendedEffect":"The ransom note indicates an apparent extortion purpose. Public evidence does not establish the operator or a wider strategic intent.","impactType":"it-caused-logistics-shutdown","evolutionNote":"The case showed that one shared terminal platform can become an operational choke point for several port terminals.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Committee on Information Security Measures at Container Terminals","url":"https://www.mlit.go.jp/kowan/kowan_mn2_000006.html","publisher":"Ministry of Land, Infrastructure, Transport and Tourism, Japan","publicationDate":"2023-07-31","accessedDate":"2026-11-02","supports":["scope","effect","duration"]},{"title":"Final Report of the Committee on Information Security Measures at Container Terminals","url":"https://www.mlit.go.jp/kowan/content/001719866.pdf","publisher":"Ministry of Land, Infrastructure, Transport and Tourism, Japan","publicationDate":"2024-01-24","accessedDate":"2026-11-02","supports":["dates","access-hypothesis","mechanism","effect","scope","recovery","limitations"]}],"evidenceNotes":"The final report supports the server encryption, staged recovery, terminal scope, 37 affected vessel schedules, and approximately 20,000 affected container entries and exits. It does not determine the access route. A LockBit-branded note is not actor attribution.","summary":"Ransomware encrypted the shared system used at five Nagoya container terminals and the centralized gate. Container entry and exit resumed in stages after about three days. The report estimates that 20,000 container movements and 37 vessel schedules were affected."},{"id":"clorox-cyberattack-2023","title":"Clorox cyberattack supply disruption","eventKind":"incident","aliases":["Clorox August 2023 cyberattack"],"startDate":"2023-08-11","endDate":"2024-08-08","disclosureDate":"2023-08-14","datePrecision":"start-day; end-evidence-as-of-filing-day; exact normalization date unknown","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["consumer-products","manufacturing","order-processing","manual-operations","product-shortage"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"The Clorox Company","sector":"Consumer and professional products manufacturing","country":"United States and other markets","initialAccess":"Clorox disclosed unauthorized activity in its IT systems but did not disclose the first access method or malware family.","bridgePath":"Clorox took IT systems offline to contain the attack. Manual ordering and processing worked at a reduced rate. The loss of automated business systems disrupted supply and distribution.","otOrIotMechanism":"The incident affected IT systems used for ordering and processing. The outage disrupted supply and distribution. Public evidence does not show that manufacturing systems or plant controllers were affected.","observedEffect":"The attack caused wide-scale business disruption, order delays, and significant product outages. Clorox used reduced-rate manual processes and later rebuilt supply and distribution.","intendedEffect":"Public evidence does not establish the actor, malware, or objective.","impactType":"it-to-supply-and-distribution-cascade","evolutionNote":"The incident showed that loss of order-processing systems can disrupt supply and distribution and create retail product shortages.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"The Clorox Company 2024 Form 10-K","url":"https://www.sec.gov/Archives/edgar/data/21076/000002107624000030/clx-20240630.htm","publisher":"The Clorox Company via United States Securities and Exchange Commission","publicationDate":"2024-08-08","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","recovery","limitations"]}],"evidenceNotes":"Clorox documented IT containment, reduced-rate manual ordering and processing, supply disruption, order delays, and product outages. By the August 8 filing, operations had returned to a substantially normalized state. The filing does not give the normalization date or state that manufacturing systems were affected. It does not identify the actor or malware. The record does not claim direct OT compromise.","summary":"Clorox took IT systems offline after unauthorized activity. Manual ordering and processing continued at a reduced rate. The loss of automated systems disrupted supply and caused significant product outages. Public evidence does not show direct manipulation of plant controllers."},{"id":"poland-radio-stop-2023","title":"Polish railway radio-stop attacks","eventKind":"campaign","aliases":["Polish railway radio interference"],"startDate":"2023-08-25","endDate":"2023-08-28","disclosureDate":"2023-08-26","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["rail","radio","safety-system","transportation"],"status":"successful","attributionActor":"Unknown actors; two Polish men were charged for part of the activity","attributionConfidence":"unknown","victim":"Polish railway operators and passengers","sector":"rail transportation","country":"Poland","initialAccess":"Actors transmitted unauthorized signals through the railway radio system. They did not need access to an enterprise network.","bridgePath":"The radio channel provided a direct path to the train emergency-stop function.","otOrIotMechanism":"The analog railway system accepted a standard radio-stop sequence without strong sender authentication. Trains that received the signal applied emergency braking.","observedEffect":"Unauthorized signals halted or delayed nearly 100 trains in several regions. Authorities reported no injuries or threat to passenger safety.","intendedEffect":"Public evidence does not establish one motive for all incidents. The broadcasts caused rail disruption.","impactType":"direct-wireless-ot-control","evolutionNote":"The incidents showed that an old wireless safety function could permit direct operational disruption with inexpensive radio equipment.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"No Indication of Russian Role in Train Interference","url":"https://www.pap.pl/en/news/no-indication-russian-role-train-interference-says-security-official","publisher":"Polish Press Agency","publicationDate":"2023-08-30","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","attribution","limitations"]},{"title":"Cyber Security Brief 23-09","url":"https://cert.europa.eu/publications/threat-intelligence/cb23-09/","publisher":"CERT-EU","publicationDate":"2023-09-01","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","context"]}],"evidenceNotes":"Two men were charged in connection with incidents in one region. Public evidence does not show that they caused every event. Polish officials said that available evidence did not establish Russian direction.","summary":"Actors broadcast unauthorized emergency-stop signals over the Polish railway radio system. The signals halted or delayed nearly 100 trains. Two men were charged for part of the activity. Officials found no evidence of Russian direction."},{"id":"connectedio-cloud-router-demonstration-2023","title":"ConnectedIO cloud-managed 4G router demonstration","eventKind":"demonstration","aliases":["ConnectedIO ER2000 vulnerabilities","The Path to the Cloud is Filled with Holes"],"startDate":"2023-10-03","endDate":"2023-10-03","disclosureDate":"2023-10-03","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["4g-router","cloud-control-plane","mqtt","industrial-edge","remote-management"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected ConnectedIO routers and cloud services; no confirmed malicious victim","sector":"industrial remote operations and connected-device management","country":"Multiple countries","initialAccess":"Researchers found exposed credentials and weaknesses in the device-to-cloud protocol. A vulnerable MQTT broker accepted device impersonation.","bridgePath":"ConnectedIO cloud services managed 4G edge routers behind firewalls. The trusted cloud channel could send operating-system commands to remote routers.","otOrIotMechanism":"Researchers impersonated the management platform and issued commands to connected devices. Router takeover could expose traffic and devices on internal networks.","observedEffect":"Team82 demonstrated remote command execution through the cloud path. It did not report malicious exploitation, a remote-site outage, or an industrial process effect.","intendedEffect":"The research showed how an attacker could control remote routers, intercept traffic, disable a site, or attack attached devices. It did not represent a hostile operation.","impactType":"cloud-managed-cellular-router-control-capability","evolutionNote":"The trusted cloud channel bypassed perimeter controls. One platform weakness could expose many remote industrial sites.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"The Path to the Cloud is Filled with Holes: Exploiting 4G Edge Routers","url":"https://claroty.com/team82/research/the-path-to-the-cloud-is-filled-with-holes-exploiting-4g-edge-routers","publisher":"Claroty Team82","publicationDate":"2023-10-03","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations","mitigation"]}],"evidenceNotes":"Team82 demonstrated control in a research environment. Public evidence does not show hostile exploitation. Operational effects would depend on the networks and devices attached to each router.","summary":"Researchers abused a cloud platform that managed industrial 4G routers. They impersonated the platform and sent operating-system commands to remote devices. The trusted channel reached routers behind perimeter controls. No malicious operational effect was confirmed."},{"id":"bauxite-iocontrol-2023","title":"BAUXITE IOCONTROL industrial device campaign","eventKind":"campaign","aliases":["IOCONTROL","OrpaCrab"],"startDate":"2023-10-15","endDate":"2024-08-31","disclosureDate":"2024-12-10","datePrecision":"approximate-campaign-window","lane":"iiot-bridge","bridgeRole":"attack-surface","secondaryTags":["embedded-linux","fuel-management","mqtt-c2"],"status":"successful","attributionActor":"BAUXITE, with technical overlap to CyberAv3ngers","attributionConfidence":"low","victim":"Internet-exposed OT and IoT devices, including Orpak and Gasboy fuel systems","sector":"energy and fuel management","country":"Multiple countries","initialAccess":"The deployment method is unknown. The campaign targeted internet-exposed OT and IoT devices.","bridgePath":"IOCONTROL installed a persistent backdoor on industrial devices. It could scan ports and run Linux commands. Public reports do not confirm a pivot into a named separate network.","otOrIotMechanism":"The embedded Linux backdoor used MQTT for command and control. It could collect data, run commands, scan ports, and wipe device storage. It did not control industrial processes.","observedEffect":"Dragos reported more than 400 affected devices and firewalls. An installation error took an Orpak device fleet offline. Other operational effects are unknown.","intendedEffect":"The campaign maintained unauthorized access to industrial devices. Public evidence does not establish the intent for each victim.","impactType":"iiot-surveillance-foothold","evolutionNote":"The campaign placed a custom backdoor on industrial embedded devices. It supplied persistent access without industrial process-control functions.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":1,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Inside a New OT/IoT Cyberweapon: IOCONTROL","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol","publisher":"Claroty Team82","publicationDate":"2024-12-10","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution"]},{"title":"Dragos 2025 OT/ICS Cybersecurity Report","url":"https://www.dragos.com/dragos-2025-ot-cybersecurity-report-a-year-in-review","publisher":"Dragos","publicationDate":"2025-02-25","accessedDate":"2026-11-02","supports":["mechanism","effect","attribution"]}],"evidenceNotes":"Dragos reports more than 400 devices, not more than 400 distinct victims. Claroty says the deployment method is unknown. BAUXITE is a tracking label. Its overlap with CyberAv3ngers does not prove identical operators.","summary":"BAUXITE used IOCONTROL against industrial and connected devices. The malware gave actors remote access. It also collected data, ran commands, and scanned networks. Dragos reported more than 400 affected devices and firewalls. The malware did not contain functions that directly controlled industrial processes."},{"id":"dp-world-australia-ports-2023","title":"DP World Australia port-operations shutdown","eventKind":"incident","aliases":["DP World Australia cyber incident"],"startDate":"2023-11-10","endDate":"2023-11-20","disclosureDate":"2023-11-11","datePrecision":"day; backlog-clearance end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["port","logistics","network-isolation","container-backlog","supply-chain"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"DP World Australia","sector":"Maritime ports and logistics","country":"Australia","initialAccess":"An unauthorized party accessed the DP World Australia corporate network. DP World did not disclose the first access method.","bridgePath":"DP World disconnected its corporate network from the internet to contain the intrusion. This action made key landside port systems unavailable and stopped normal freight movement.","otOrIotMechanism":"The incident did not directly control cargo equipment. Landside container movements depended on networked corporate and logistics systems.","observedEffect":"Landside operations stopped from November 10 to November 13. DP World cleared a backlog of 30,137 containers by November 20.","intendedEffect":"The intruder accessed files and exfiltrated a small amount of data. DP World found no ransomware executable, encrypted files, or ransom demand. The full objective remains unknown.","impactType":"corporate-network-to-port-operations-cascade","evolutionNote":"A containment decision in a corporate network stopped landside freight at several major terminals. The effect came from a shared digital dependency, not direct control of cargo machinery.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Media Statement: Update on Cybersecurity Incident","url":"https://www.dpworld.com/en/news/releases/australia/media-statement-update-on-cybersecurity-incident","publisher":"DP World Australia","publicationDate":"2023-11-28","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","scale","limitations"]},{"title":"Second Pass Impact Analysis: Transport Security Amendment Bill","url":"https://oia.pmc.gov.au/sites/default/files/posts/2024/12/Impact%20Analysis_0.pdf","publisher":"Australian Government Office of Impact Analysis","publicationDate":"2024-12-13","accessedDate":"2026-11-02","supports":["bridge","effect","scale","policy-context"]}],"evidenceNotes":"DP World confirmed corporate-network access, internet disconnection, landside operational effects, and the backlog. It explicitly stated that it found no ransomware. Do not call this a ransomware incident or say that all Australian ports closed.","summary":"An intruder accessed the DP World Australia corporate network. DP World disconnected the network to contain the incident. Landside container operations stopped for three days, and more than 30,000 containers accumulated. DP World found no ransomware."},{"id":"cyberav3ngers-unitronics-2023","title":"CyberAv3ngers Unitronics campaign","eventKind":"campaign","aliases":["IRGC Unitronics PLC campaign"],"startDate":"2023-11-22","endDate":"2023-12-14","disclosureDate":"2023-12-01","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["water","plc","default-password"],"status":"successful","attributionActor":"IRGC-affiliated CyberAv3ngers","attributionConfidence":"high","victim":"Water and wastewater facilities in the United States and other countries","sector":"water and wastewater","country":"Multiple countries","initialAccess":"The actors used internet-accessible Unitronics PLCs that still had a default password.","bridgePath":"The actors connected directly to PLCs with integrated operator displays.","otOrIotMechanism":"The actors changed the PLC display and made some equipment unavailable for normal remote operation.","observedEffect":"Several facilities found defaced PLCs. Some operators changed to manual control. Public reporting did not show unsafe water.","intendedEffect":"The campaign tried to disrupt or intimidate operators that used Israeli-made equipment.","impactType":"direct-ot-access","evolutionNote":"The campaign showed that simple internet exposure and a default password could produce operational effects without custom malware.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"IRGC-affiliated actors exploit PLCs","url":"https://www.cisa.gov/sites/default/files/2023-12/aa23-335a-irgc-affiliated-cyber-actors-exploit-plcs-in-multiple-sectors-1.pdf","publisher":"CISA, FBI, NSA, EPA, and INCD","publicationDate":"2023-12-01","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution"]},{"title":"Water and Wastewater Sector Incident Response Guide","url":"https://www.epa.gov/system/files/documents/2024-01/wws-sector_incident-response-guide.pdf","publisher":"CISA, FBI, and EPA","publicationDate":"2024-01-01","accessedDate":"2026-11-02","supports":["access","attribution","context"]}],"evidenceNotes":"The joint advisory separates observed compromises from false claims that the group posted online.","summary":"CyberAv3ngers connected to internet-accessible Unitronics PLCs. The devices still had a default password. The actors changed displays and affected remote operation. Some facilities changed to manual control. A joint government advisory linked the activity to Iran's Islamic Revolutionary Guard Corps."},{"id":"sierra21-cellular-router-capability-2023","title":"Sierra:21 industrial cellular-router capability","eventKind":"capability","aliases":["Sierra:21","AirLink ALEOS vulnerabilities"],"startDate":"2023-12-06","endDate":"2023-12-06","disclosureDate":"2023-12-06","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"access","secondaryTags":["cellular-router","airlink","critical-infrastructure","remote-monitoring","supply-chain"],"status":"unknown","attributionActor":"Not applicable; coordinated vulnerability research","attributionConfidence":"not-applicable","victim":"Users of affected Sierra Wireless AirLink routers and affected open-source components; no confirmed malicious victim","sector":"manufacturing, health care, government, energy, water, transportation, emergency services, retail, and physical security","country":"Multiple countries","initialAccess":"The twenty-one flaws affected AirLink router services and included a critical path. Exploitation conditions differed by flaw and device configuration.","bridgePath":"AirLink routers connected remote industrial equipment, substations, cameras, vehicles, and other local systems to central networks through cellular services.","otOrIotMechanism":"The flaws could allow credential theft, code injection, router takeover, persistence, or use of the router as an entry point. Forescout found more than 86,000 exposed routers during its study.","observedEffect":"Researchers confirmed the flaws and vendors released fixes. Public evidence does not show malicious exploitation through Sierra:21 or an operational effect.","intendedEffect":"The research showed how an attacker could take control of an industrial cellular router and enter a connected critical network. It did not represent a hostile operation.","impactType":"industrial-cellular-edge-capability","evolutionNote":"Sierra:21 showed how cellular routers can connect remote critical equipment to the internet and can become an access bridge when their device and software supply chains contain flaws.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":1,"laterInfluence":3,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Sierra:21 Living on the Edge Supply Chain Vulnerabilities in OT/IoT Routers","url":"https://www.forescout.com/resources/sierra21-vulnerabilities/","publisher":"Forescout Vedere Labs","publicationDate":"2023-12-06","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","scale","limitations","mitigation"]}],"evidenceNotes":"The internet-exposure count came from researcher measurements and did not prove that every device was exploitable. The report documents a capability and attack surface, not observed malicious use of the new flaws. The report title and publication date follow the report itself.","summary":"Researchers found twenty-one flaws in industrial cellular routers and their software components. The routers connected remote critical equipment to central networks. Public evidence does not show malicious exploitation or an operational effect."},{"id":"apt28-router-dns-hijacking-2026","title":"APT28 router DNS hijacking","aliases":["APT28 SOHO router campaign"],"startDate":"2024-01-01","endDate":"2026-04-07","disclosureDate":"2026-04-07","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"access","secondaryTags":["router","dns-hijacking","credential-theft","adversary-in-the-middle"],"status":"unknown","attributionActor":"APT28, assessed by the UK NCSC as Russia's GRU Unit 26165","attributionConfidence":"high","victim":"Users and organizations behind compromised TP-Link and MikroTik routers","sector":"Multiple sectors","country":"Multiple countries","initialAccess":"APT28 exploited vulnerable internet-facing routers.","bridgePath":"Changed router DHCP and DNS settings redirected selected downstream web and email lookups through actor infrastructure.","otOrIotMechanism":"The routers acted as redirection points for adversary-in-the-middle credential theft.","observedEffect":"The NCSC documented DNS hijacking activity. Public reporting does not quantify victims or confirmed stolen credentials.","intendedEffect":"Harvest passwords and authentication tokens from targets of intelligence interest.","impactType":"router-enabled-credential-theft","evolutionNote":"The campaign extended router abuse from traffic proxying to selective changes in name resolution for downstream users.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"APT28 exploit routers to enable DNS hijacking operations","url":"https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations","publisher":"UK National Cyber Security Centre","publicationDate":"2026-04-07","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","intent","attribution"]}],"evidenceNotes":"The NCSC documents the technique and attribution. Public evidence does not establish the number of victims or the amount of credentials stolen.","summary":"APT28 exploited home and small-business routers. It changed Domain Name System settings on the routers. These changes could redirect selected web and email traffic for credential theft. Public evidence does not quantify victims or confirmed theft."},{"id":"badbox-2-0-2025","title":"BADBOX 2.0 consumer-device botnet","aliases":["BADBOX2.0"],"startDate":"2024-01-01","endDate":"2025-07-17","disclosureDate":"2025-06-05","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"proxy","secondaryTags":["android","streaming-device","supply-chain","ad-fraud","residential-proxy"],"status":"successful","attributionActor":"Unknown cybercriminal operators","attributionConfidence":"unknown","victim":"Owners of uncertified Android consumer devices","sector":"Consumer electronics and online advertising","country":"Multiple countries","initialAccess":"Malware was installed before purchase on some devices or delivered through malicious setup applications.","bridgePath":"Compromised devices joined botnet and residential proxy services that routed criminal traffic through home networks.","otOrIotMechanism":"Android streaming devices, projectors, vehicle systems, and picture frames became remotely controlled nodes.","observedEffect":"The FBI reported millions of infected devices. Google alleged more than 10 million compromised devices. Reported uses included proxying and advertising fraud.","intendedEffect":"Monetize infected devices through proxy access, fraud, and concealed traffic.","impactType":"consumer-iot-proxy","evolutionNote":"BADBOX 2.0 combined preinstalled malware with malicious setup applications across many low-cost consumer products.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Home Internet Connected Devices Facilitate Criminal Activity","url":"https://www.fbi.gov/investigate/cyber/alerts/2025/home-internet-connected-devices-facilitate-criminal-activity","publisher":"Federal Bureau of Investigation","publicationDate":"2025-06-05","accessedDate":"2026-11-02","supports":["access","devices","mechanism","effect"]},{"title":"Google takes legal action against BadBox 2.0 cyberattack","url":"https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/","publisher":"Google","publicationDate":"2025-07-17","accessedDate":"2026-11-02","supports":["scale","bridge","effect"]}],"evidenceNotes":"The figure above 10 million comes from Google's legal allegation. It is not a verified simultaneous active-device count. Public evidence does not show a complete takedown.","summary":"BADBOX 2.0 infected consumer Android devices before sale or during setup. The devices joined botnet and residential proxy services. Operators used them for advertising fraud and other crime. Public sources report millions of affected devices."},{"id":"elmatic-sparrow-router-abuse-2024","title":"Elmatic Sparrow industrial-router proxy abuse","eventKind":"campaign","aliases":["NavigateWorx router abuse","CERT Polska industrial-router case"],"startDate":"2024-01-01","endDate":"2024-05-17","disclosureDate":"2024-05-17","datePrecision":"start-year; disclosure-day","lane":"iiot-bridge","bridgeRole":"proxy","secondaryTags":["industrial-router","cellular-router","ssh-tunnel","default-credentials","brute-force"],"status":"successful","attributionActor":"Unknown actors","attributionConfidence":"unknown","victim":"Operators of internet-facing Elmatic Sparrow and NavigateWorx industrial cellular routers","sector":"multiple industrial sectors","country":"Poland","initialAccess":"Affected routers accepted the default administrator credentials over SSH. The SSH service was enabled on the internet-facing interface.","bridgePath":"CERT Polska assessed that attackers used SSH tunnels to make industrial routers act as proxies. The same configuration could bypass a virtual private network and expose devices on the local industrial network.","otOrIotMechanism":"The routers connected industrial protocols and controllers to cellular networks. Attackers used their public addresses to send brute-force traffic to many external targets.","observedEffect":"CERT Polska confirmed that brute-force attacks came from two industrial-router addresses. It found no suspicious traffic from devices behind one affected router. Public evidence does not confirm lateral access into the attached industrial networks.","intendedEffect":"The observed objective was to use trusted industrial addresses as attack proxies. Public evidence does not establish an objective against the attached industrial processes.","impactType":"industrial-router-proxy","evolutionNote":"The case showed that weak credentials on an industrial router can turn the device into an attack proxy and can bypass expected network controls.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Recommendations for strengthening OT system protection","url":"https://cert.pl/posts/2024/05/rekomendacje-ot/","publisher":"CERT Polska","publicationDate":"2024-05-17","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]}],"evidenceNotes":"CERT Polska confirmed default credentials and attack traffic from affected addresses. It did not recover the attacker method from the routers. SSH tunneling was its evidence-based explanation. Do not state that attackers entered the attached industrial networks.","summary":"Attackers used industrial cellular routers as proxies for brute-force attacks. The routers accepted default administrator credentials over an internet-facing SSH service. CERT Polska did not confirm access to the industrial networks behind the routers."},{"id":"linear-emerge-exploitation-2024","title":"Linear eMerge building-access exploitation","eventKind":"campaign","aliases":["Nice Linear eMerge attacks","CVE-2019-7256 exploitation"],"startDate":"2024-01-01","endDate":"2024-03-26","disclosureDate":"2024-03-25","datePrecision":"start-month; end-day; disclosure-day","lane":"iiot-bridge","bridgeRole":"direct-control","secondaryTags":["building-access","door-controller","command-injection","known-exploited-vulnerability","internet-exposed"],"status":"successful","attributionActor":"Unknown actors","attributionConfidence":"unknown","victim":"Operators of vulnerable Linear eMerge access-control systems","sector":"commercial and industrial building access","country":"Multiple countries","initialAccess":"Attackers exploited an unauthenticated command-injection flaw in reachable Linear eMerge E3 systems. Public evidence does not identify one common access campaign.","bridgePath":"The internet-reachable access controller joined remote administration to physical building-entry systems. Full system access could reach configured door-control functions.","otOrIotMechanism":"CVE-2019-7256 permitted remote operating-system command execution. Related flaws exposed credentials, files, and administrative functions.","observedEffect":"CISA confirmed active exploitation. FortiGuard observed attack attempts against about 1,000 protected devices each day. Public evidence does not confirm that attackers opened doors.","intendedEffect":"Public evidence confirms exploitation of the vulnerability. It does not establish the attackers' objectives or a physical-entry objective.","impactType":"exploited-building-access-controller","evolutionNote":"The activity moved a building-access flaw from research into confirmed exploitation of connected physical-security controllers.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Nice Linear eMerge E3-Series","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2024-03-05","accessedDate":"2026-11-02","supports":["access","mechanism","product","mitigation"]},{"title":"Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7256","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2024-03-25","accessedDate":"2026-11-02","supports":["effect","exploitation-status"]},{"title":"Nice Linear eMerge Command Injection Vulnerability","url":"https://www.fortiguard.com/outbreak-alert/nice-linear-emerge-attack","publisher":"FortiGuard Labs","publicationDate":"2024-03-26","accessedDate":"2026-11-02","supports":["campaign-window","effect","scale","limitations"]}],"evidenceNotes":"CISA added CVE-2019-7256 to the Known Exploited Vulnerabilities Catalog. FortiGuard observed and blocked attack attempts. Public sources do not identify victims, one operator, or a confirmed physical door action.","summary":"Unknown actors exploited a command-injection flaw in connected building-access controllers. CISA confirmed active exploitation. The flaw supplied full system access. Public evidence does not confirm that attackers opened doors."},{"id":"carr-water-2024","title":"Cyber Army of Russia Reborn water attacks","eventKind":"campaign","aliases":["CARR water campaign"],"startDate":"2024-01-01","endDate":"2024-01-31","disclosureDate":"2024-07-19","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["water","hmi","hacktivist"],"status":"successful","attributionActor":"Cyber Army of Russia Reborn","attributionConfidence":"high","victim":"Water facilities in Abernathy and Muleshoe, Texas","sector":"water and wastewater","country":"United States","initialAccess":"The public government report describes unsophisticated access but does not give the exact first access vector.","bridgePath":"The actors reached internet-connected human-machine interfaces for water systems.","otOrIotMechanism":"The actors changed control values through the human-machine interfaces.","observedEffect":"Water storage tanks overflowed. The facilities lost tens of thousands of gallons of water. No major damage occurred.","intendedEffect":"The campaign tried to disrupt critical infrastructure and publish proof of access.","impactType":"direct-ot-operation","evolutionNote":"The campaign showed that low-skill actors could create physical effects through exposed operator interfaces.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Treasury sanctions Cyber Army of Russia Reborn members","url":"https://home.treasury.gov/news/press-releases/jy2473/","publisher":"United States Department of the Treasury","publicationDate":"2024-07-19","accessedDate":"2026-11-02","supports":["mechanism","effect","attribution"]}],"evidenceNotes":"The United States Treasury identified the group members and documented the water loss. The report states that major damage was avoided.","summary":"Cyber Army of Russia Reborn reached water-system operator interfaces in Texas. The actors changed control values and caused storage tanks to overflow. The facilities lost tens of thousands of gallons of water. The operation used simple methods but caused a physical effect."},{"id":"frostygoop-2024","title":"FrostyGoop heating disruption","eventKind":"incident","aliases":["BUSTLEBERM"],"startDate":"2024-01-22","endDate":"2024-01-23","disclosureDate":"2024-07-23","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["district-heating","modbus","enco"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Municipal district heating company in Lviv","sector":"district energy","country":"Ukraine","initialAccess":"Investigators assessed that the actor likely exploited an internet-facing service. Public evidence does not confirm the exact vector.","bridgePath":"The actor reached internet-accessible ENCO heating controllers.","otOrIotMechanism":"FrostyGoop used Modbus commands to change controller data and impair heating operation.","observedEffect":"More than 600 apartment buildings lost heating for approximately two days during winter.","intendedEffect":"The operation tried to disrupt district heating service.","impactType":"direct-ot-manipulation","evolutionNote":"FrostyGoop used a simple and common industrial protocol. The operation did not need a complex vendor-specific exploit.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Impact of FrostyGoop ICS malware","url":"https://hub.dragos.com/hubfs/117-Webinar-Slides/2024/8-06-24%20-%20Dragos%20FrostyGoop%20ICS%20Malware%20Impact%20on%20OT%20Systems.pdf","publisher":"Dragos","publicationDate":"2024-08-06","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]},{"title":"FrostyGoop incident C0041","url":"https://attack.mitre.org/campaigns/C0041/","publisher":"MITRE ATT&CK","publicationDate":"2024-11-20","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]}],"evidenceNotes":"Dragos linked the malware to the outage from incident data that the Ukrainian security service supplied. The actor remains unknown.","summary":"FrostyGoop used Modbus commands against heating controllers in Lviv. The attack stopped heating for more than 600 apartment buildings for approximately two days. The malware used a common industrial protocol. Investigators did not identify the actor."},{"id":"change-healthcare-alphv-2024","title":"Change Healthcare ransomware dependency cascade","eventKind":"incident","aliases":["Change Healthcare cyberattack","ALPHV Change Healthcare attack"],"startDate":"2024-02-12","endDate":"2024-05-01","disclosureDate":"2024-02-21","datePrecision":"initial-access day; end-evidence-as-of-testimony day; restoration incomplete; not incident end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","healthcare","shared-service","identity","remote-access","pharmacy"],"status":"successful","attributionActor":"ALPHV, also called BlackCat, ransomware operation; specific affiliate unknown","attributionConfidence":"medium","victim":"Change Healthcare, health-care providers, pharmacies, payers, and patients","sector":"Health-care payment, claims, and pharmacy services","country":"United States","initialAccess":"Criminals used compromised credentials to enter a Change Healthcare Citrix remote-access portal. The portal did not use multifactor authentication.","bridgePath":"The attackers moved inside Change Healthcare, stole data, and deployed ransomware. UnitedHealth disconnected Change systems. This removed a shared transaction service used by pharmacies, providers, and payers.","otOrIotMechanism":"Patient care depended on digital pharmacy claims, medical claims, and payment flows. The attack did not need to compromise medical devices to delay access to medicines and strain care providers.","observedEffect":"Pharmacists had to submit claims manually, some patients had difficulty obtaining medicines, and providers lost normal claims and payment flows. HHS called the incident a direct threat to patient care and essential health-care operations.","intendedEffect":"The attackers encrypted systems, stole protected health information, and demanded ransom.","impactType":"shared-healthcare-service-to-care-cascade","evolutionNote":"The incident showed how one remote-access and identity failure at a concentrated service provider can disrupt care across many independent organizations.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Testimony of Andrew Witty: Hacking America's Health Care","url":"https://www.finance.senate.gov/wp-content/uploads/meetings/78B31273-BC4A-06EF-54B4-84F7B588A49E/0501_witty_testimony.pdf","publisher":"UnitedHealth Group testimony to the United States Senate Committee on Finance","publicationDate":"2024-05-01","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","attribution"]},{"title":"Dear Colleague Letter: Cyberattack on Change Healthcare","url":"https://www.hhs.gov/sites/default/files/cyberattack-change-healthcare.pdf","publisher":"United States Department of Health and Human Services","publicationDate":"2024-03-13","accessedDate":"2026-11-02","supports":["effect","scale","critical-dependency"]}],"evidenceNotes":"UnitedHealth testimony supports the access path, missing multifactor authentication, ransomware deployment, service effects, and the ALPHV claim. On May 1, payment processing remained below its pre-incident level, so that date is an evidence bound and not an incident end. Confidence is medium because victim testimony identifies the operation but not the individual affiliate.","summary":"Attackers used stolen credentials to enter a Citrix portal that did not use multifactor authentication. They deployed ALPHV ransomware, and UnitedHealth disconnected Change systems. Pharmacies and providers lost shared claims and payment services, which affected access to medicines and patient care."},{"id":"web-plc-malware-demonstration-2024","title":"Web-based PLC malware demonstration","eventKind":"demonstration","aliases":["Web-based PLC malware"],"startDate":"2024-02-26","endDate":"2024-03-01","disclosureDate":"2024-02-26","datePrecision":"conference-window","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","embedded-web-server","malware","sensor-spoofing","safety-alarm","actuator"],"status":"successful","attributionActor":"Authorized Georgia Institute of Technology researchers","attributionConfidence":"not-applicable","victim":"A widely used PLC in a controlled physical-process testbed","sector":"cross-sector industrial automation","country":"Controlled research in the United States","initialAccess":"The prototype exploited four zero-day vulnerabilities in a PLC embedded web application. The attack required a path to the web service.","bridgePath":"The malware ran inside the PLC web application and used legitimate administrative web APIs to reach process functions.","otOrIotMechanism":"The malware falsified sensor readings, disabled safety alarms, and manipulated physical actuators without changing the PLC control logic or base firmware.","observedEffect":"Researchers performed a Stuxnet-style physical-process attack on a real PLC testbed. The prototype concealed sensor changes, inhibited alarms, and controlled actuators. The researchers found the attack class across PLC vendors that represented about 80 percent of the market.","intendedEffect":"Demonstrate that embedded PLC web applications can provide a persistent and partly platform-independent path to physical process manipulation.","impactType":"controlled-direct-ot-manipulation","evolutionNote":"The work introduced a third PLC malware layer. It targeted the embedded web application instead of control logic or firmware and used legitimate web APIs for physical effects.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware","url":"https://www.ndss-symposium.org/ndss-paper/compromising-industrial-processes-using-web-based-programmable-logic-controller-malware/","publisher":"Network and Distributed System Security Symposium","publicationDate":"2024-02-26","accessedDate":"2026-11-02","supports":["researchers","access","mechanism","effect","scope","limitations"]}],"evidenceNotes":"This was peer-reviewed controlled research, not observed production malware. The authors validated the technique on a physical PLC testbed and coordinated fixes for four vulnerabilities.","summary":"Researchers placed malware in a PLC embedded web application. The prototype used legitimate web APIs to falsify sensors, disable safety alarms, and manipulate actuators. It did not need to change control logic or base firmware."},{"id":"cinterion-cellular-modem-capability-2024","title":"Cinterion cellular-modem remote takeover capability","eventKind":"demonstration","aliases":["Cinterion EHS5 research","CVE-2023-47610"],"startDate":"2024-05-10","endDate":"2024-05-10","disclosureDate":"2024-05-10","datePrecision":"disclosure-day","lane":"iiot-bridge","bridgeRole":"pivot","secondaryTags":["cellular-modem","sms","m2m","vehicle-telematics","embedded-module","industrial-wireless"],"status":"unknown","attributionActor":"Not applicable; controlled vulnerability research","attributionConfidence":"not-applicable","victim":"Users of products that embedded affected Cinterion modems; no confirmed malicious victim","sector":"industrial systems, health care, automotive, finance, and telecommunications","country":"Multiple countries","initialAccess":"One critical flaw could process a malicious cellular message without authentication. Other paths required local modem access or code execution on the host device.","bridgePath":"Manufacturers embedded the modem in machine-to-machine products and vehicle telematics units. Modem control could supply a foothold in the host system.","otOrIotMechanism":"Researchers obtained code execution and modem control. In a separate truck audit, they moved from a modem foothold through the telematics unit to vehicle control networks.","observedEffect":"Kaspersky demonstrated the modem flaws and a remote vehicle pivot in controlled research. It did not report malicious exploitation, a road incident, or an industrial process effect.","intendedEffect":"The research showed how an attacker could control communications, inspect data, or pivot toward host functions. It did not represent a hostile operation.","impactType":"cellular-module-to-host-pivot-capability","evolutionNote":"The cellular module supplied communications. It also created a remote entry path into the host device.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cinterion EHS5 3G UMTS/HSPA Module Research","url":"https://ics-cert.kaspersky.com/publications/reports/2024/06/13/cinterion-ehs5-3g-umts-hspa-module-research/","publisher":"Kaspersky ICS CERT","publicationDate":"2024-06-13","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations","mitigation"]},{"title":"Kaspersky identifies significant security risks in widely used Cinterion modems","url":"https://www.kaspersky.com/about/press-releases/kaspersky-identifies-significant-security-risks-in-widely-used-cinterion-modems","publisher":"Kaspersky","publicationDate":"2024-05-10","accessedDate":"2026-11-02","supports":["scale","sector","mechanism","effect"]}],"evidenceNotes":"The researchers tested specified modem models and configurations. The truck pivot came from a separate security audit. It does not prove the same path exists in every embedded product. No hostile exploitation was reported.","summary":"Researchers found remote takeover flaws in cellular modules used by many connected products. They also demonstrated a pivot from one modem into a truck's control networks. Product impact depended on integration. No malicious operational effect was confirmed."},{"id":"synnovis-ransomware-2024","title":"Synnovis pathology ransomware disruption","eventKind":"incident","aliases":["Synnovis cyberattack","South East London pathology ransomware incident"],"startDate":"2024-06-03","endDate":"2024-12-31","disclosureDate":"2024-06-04","datePrecision":"start-day; services-restored-by-month-end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["ransomware","healthcare","pathology","vendor","blood-testing","clinical-operations"],"status":"successful","attributionActor":"Unknown ransomware operator","attributionConfidence":"unknown","victim":"Synnovis, partner NHS trusts, primary-care services, and patients","sector":"Health-care pathology and laboratory services","country":"United Kingdom","initialAccess":"Synnovis and NHS England did not publicly establish the first access method.","bridgePath":"Ransomware disabled systems at a shared pathology provider. Hospitals and clinics could not use systems required for blood tests and other laboratory services.","otOrIotMechanism":"Clinical operations depended on laboratory information systems and the provider's ability to process specimens. The ransomware did not need to compromise medical devices to stop tests and delay procedures.","observedEffect":"Pathology capacity fell sharply. NHS England reported 1,134 postponed elective procedures and 2,194 postponed outpatient appointments by June 16 at the two most affected trusts. Services returned fully by December 2024.","intendedEffect":"The attackers encrypted systems, stole data, and used ransomware for extortion. Public authoritative sources do not establish a reliable actor identity.","impactType":"vendor-it-to-clinical-operations-cascade","evolutionNote":"The incident showed how one specialist provider's IT systems can be a shared clinical dependency for hospitals, clinics, laboratories, and blood supplies.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Update on cyber incident: clinical impact in South East London, Thursday 20 June","url":"https://www.england.nhs.uk/london/2024/06/20/update-on-cyber-incident-clinical-impact-in-south-east-london-thursday-20-june/","publisher":"NHS England London","publicationDate":"2024-06-20","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","scale"]},{"title":"Synnovis cyber incident: public questions and answers","url":"https://www.england.nhs.uk/synnovis-cyber-incident/questions-and-answers/","publisher":"NHS England","publicationDate":"2025-11-10","accessedDate":"2026-11-02","supports":["mechanism","effect","recovery","actor-limitations"]}],"evidenceNotes":"NHS England documented the ransomware, the laboratory-system dependency, postponed care, reduced testing capacity, and restoration. Public authoritative reporting does not establish the first access method or a reliable actor identity.","summary":"Ransomware disabled systems at Synnovis, a shared pathology provider. Hospitals and clinics lost much of their blood-test capacity. Thousands of procedures and appointments were postponed. The clinical effect came from dependence on vendor laboratory systems, not direct compromise of medical devices."},{"id":"kia-connect-license-plate-demo-2024","title":"Kia Connect license-plate vehicle-control demonstration","aliases":["Kia dealer-portal takeover demonstration"],"startDate":"2024-06-11","endDate":"2024-08-14","disclosureDate":"2024-09-26","datePrecision":"discovery-day; remediation-day; disclosure-day","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["connected-vehicle","cloud-api","dealer-portal","account-takeover","location-tracking"],"status":"successful","attributionActor":"Authorized security researchers Neiko Rivera, Sam Curry, Justin Rhinehart, Ian Carroll, and Kenneth Lugo","attributionConfidence":"not-applicable","victim":"An authorized rental research vehicle; potentially affected hardware-equipped Kia vehicles","sector":"Automotive","country":"United States","initialAccess":"The researchers generated a dealer token through Kia web services and used a vehicle identification number derived from a license plate.","bridgePath":"Kia's dealer and owner cloud services supplied a remote path from a public identifier to vehicle account reassignment and telematics commands.","otOrIotMechanism":"The proof-of-concept tool changed account roles, added a researcher as the primary owner, and supplied lock, unlock, start, stop, horn, and location commands.","observedEffect":"The researchers used a locked rental Kia for an authorized proof of concept. They reassigned primary ownership and executed lock, unlock, start, stop, horn, and location commands from a phone. The source states that Kia completed remediation and validated that it found no malicious exploitation.","intendedEffect":"Demonstrate that web-service authorization flaws could expose owner data and remote vehicle functions.","impactType":"connected-vehicle-cloud-control","evolutionNote":"The work showed that a license plate and cloud-service flaws could replace direct vehicle-network access as the path to remote control.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Hacking Kia: Remotely Controlling Cars With Just a License Plate","url":"https://samcurry.net/hacking-kia","publisher":"Sam Curry","publicationDate":"2024-09-20","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","remediation","limitations"]}],"evidenceNotes":"This was coordinated research, not malicious activity. The success label applies only to the authorized proof of concept. The tool was not released. The researchers state that Kia remediated the flaws and validated that it found no malicious exploitation. The page displays September 20, 2024, but its timeline gives September 26, 2024, as the public disclosure date.","summary":"Researchers used Kia cloud-service flaws and a license plate to reassign access to a rental research vehicle. They executed remote vehicle commands in an authorized demonstration. The researchers state that Kia fixed the flaws and found no malicious exploitation."},{"id":"subaru-starlink-admin-demo-2024","title":"Subaru STARLINK administrator takeover demonstration","aliases":["Subaru STARLINK admin-panel vulnerability"],"startDate":"2024-11-20","endDate":"2024-11-21","disclosureDate":"2025-01-23","datePrecision":"discovery-day; remediation-day; disclosure-day","eventKind":"demonstration","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["connected-vehicle","cloud-admin","location-history","account-takeover","surveillance"],"status":"successful","attributionActor":"Authorized security researchers Sam Curry and Shubham Shah","attributionConfidence":"not-applicable","victim":"The researchers' own vehicle and a consented friend's vehicle; potentially affected connected Subaru vehicles in the United States, Canada, and Japan","sector":"Automotive","country":"United States, Canada, and Japan","initialAccess":"The researchers enumerated a STARLINK employee account, reset its password without a confirmation token, and bypassed a client-side second-factor prompt.","bridgePath":"The compromised administrator portal connected public customer identifiers to stored location histories, personal data, account permissions, and remote vehicle commands.","otOrIotMechanism":"The researchers searched for vehicles, added an authorized user, retrieved telematics history, and issued a remote unlock command. The portal also exposed start, stop, lock, location, and other customer-data functions.","observedEffect":"The researchers retrieved approximately 1,600 historical coordinates from the researcher's family vehicle. With consent, they added themselves to a friend's vehicle and unlocked it. The researchers state that Subaru fixed the vulnerability within 24 hours and that no malicious exploitation occurred.","intendedEffect":"Demonstrate that weak administrator authentication exposed centralized surveillance data and remote vehicle controls.","impactType":"connected-vehicle-cloud-surveillance-and-control","evolutionNote":"The demonstration linked centralized support access to both long-term physical-location surveillance and immediate vehicle commands.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel","url":"https://samcurry.net/hacking-subaru","publisher":"Sam Curry","publicationDate":"2025-01-23","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","remediation","limitations"]}],"evidenceNotes":"This was authorized research on vehicles whose owners consented. The success label applies only to the demonstration. Only the unlock command is documented as executed on the friend's vehicle. Other commands describe the portal's capability. The researchers, not a separate Subaru source, state that Subaru fixed the flaw within 24 hours and that no malicious exploitation occurred.","summary":"Researchers took over a Subaru STARLINK administrator account. They retrieved approximately 1,600 historical coordinates from a research vehicle and remotely unlocked a consented vehicle. The researchers state that Subaru fixed the flaw within 24 hours and that no malicious exploitation occurred."},{"id":"aisuru-kimwolf-botnets-2026","title":"Aisuru and KimWolf IoT botnets","aliases":["Aisuru","KimWolf"],"startDate":"2025-01-01","endDate":"2026-03-19","disclosureDate":"2026-03-19","eventKind":"campaign","lane":"consumer-iot-bridge","bridgeRole":"attack-capacity","secondaryTags":["router","camera","dvr","ddos","cybercrime-as-a-service"],"status":"disrupted","attributionActor":"Unknown cybercriminal operators","attributionConfidence":"unknown","victim":"Owners of infected devices and distributed denial-of-service targets","sector":"Consumer networks and internet services","country":"Multiple countries","initialAccess":"The public Department of Justice release does not state the initial access methods.","bridgePath":"Infected recorders, cameras, and routers supplied attack capacity. Operators also sold access to devices.","otOrIotMechanism":"Operators and customers instructed infected devices to send distributed denial-of-service traffic.","observedEffect":"Four botnets in the enforcement action infected more than three million devices and launched hundreds of thousands of attacks. Some attacks reached approximately 30 terabits per second.","intendedEffect":"Disrupt or extort services and sell access to infected devices.","impactType":"iot-botnet-ddos","evolutionNote":"The operation showed how criminals sold large internet-of-things botnets as attack services.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Authorities disrupt world's largest IoT DDoS botnets","url":"https://www.justice.gov/usao-ak/pr/authorities-disrupt-worlds-largest-iot-ddos-botnets-responsible-record-breaking-attacks","publisher":"United States Department of Justice","publicationDate":"2026-03-19","accessedDate":"2026-11-02","supports":["devices","bridge","effect","outcome"]}],"evidenceNotes":"The more-than-three-million device count and aggregate attack count apply to four botnets in the operation, not only Aisuru and KimWolf. Public reporting does not identify the operators.","summary":"Aisuru and KimWolf were among four internet-of-things botnets disrupted in March 2026. The botnets used recorders, cameras, and routers for distributed denial-of-service attacks. Together, the four botnets infected more than three million devices and launched hundreds of thousands of attacks."},{"id":"ot-wiper-hacktivist-trend-2025","title":"OT wiper wave and hacktivist blur","eventKind":"trend","aliases":["2025 OT wiper wave"],"startDate":"2025-01-01","endDate":"2025-12-31","disclosureDate":"2026-10-01","datePrecision":"year","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["wiper","hacktivist","pre-positioning","capability"],"status":"mixed","attributionActor":"Multiple unrelated actors and activity clusters","attributionConfidence":"not-applicable","victim":"Critical infrastructure organizations and prospective targets in Ukraine, Poland, and the United States","sector":"multiple critical infrastructure sectors","country":"Multiple countries","initialAccess":"The component cases used different access paths. Public reports do not support one common campaign or operator.","bridgePath":"The trend joined destructive IT wiping, direct OT device damage, reconnaissance, and claimed or incomplete ICS capabilities.","otOrIotMechanism":"PathWiper destroyed data at an unnamed Ukrainian critical infrastructure entity. DynoWiper was blocked at a Polish CHP plant. Other named clusters focused on access, mapping, or unproven capability.","observedEffect":"Reported outcomes differed. Polish renewable sites lost remote control after attackers damaged OT devices. Security software blocked a wiper at a combined heat and power plant. PathWiper destroyed data. Public sources did not confirm physical effects for the other components.","intendedEffect":"The component activity included destruction, disruption, reconnaissance, pre-positioning, and publicity.","impactType":"mixed-ot-trend","evolutionNote":"By 2025, public reporting mixed state activity, hacktivist claims, access teams, wipers, and incomplete OT tools. The trend requires separate evidence labels for each component.","significance":{"historicalImportance":2,"technicalNovelty":2,"documentedEffect":2,"laterInfluence":3,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"PathWiper targets critical infrastructure in Ukraine","url":"https://blog.talosintelligence.com/pathwiper-targets-ukraine/","publisher":"Cisco Talos","publicationDate":"2025-06-05","accessedDate":"2026-11-02","supports":["mechanism","effect"]},{"title":"Energy Sector Incident Report - 29 December 2025","url":"https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/","publisher":"CERT Polska","publicationDate":"2026-01-30","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations"]},{"title":"ZION SIPHON OT Malware Analysis","url":"https://www.dragos.com/blog/zionsiphon-ot-malware-analysis","publisher":"Dragos","publicationDate":"2026-09-01","accessedDate":"2026-11-02","supports":["mechanism","effect","limitations"]}],"evidenceNotes":"This record is an editorial trend, not one campaign. PYROXENE, GRAPHITE, and KAMACITE are activity-group labels. ZionSiphon was not a credible working ICS capability. DynoWiper belongs to the Poland incident. The detail view must not present these components as equal or related.","summary":"This record describes a trend, not one campaign. In 2025, reports covered destructive software, direct OT damage, blocked attacks, reconnaissance, and incomplete tools. Each component had different evidence and outcomes."},{"id":"global-exposed-plc-campaign-2025-2026","title":"Global internet-exposed PLC disruption campaign","eventKind":"campaign","aliases":["AI-assisted PLC exploitation campaign","Opportunistic exposed-PLC campaign"],"startDate":"2025-10-01","endDate":"2026-09-14","disclosureDate":"2026-09-14","datePrecision":"start-month; end-publication-cutoff","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","internet-exposed","water","ai-assisted","weak-password"],"status":"successful","attributionActor":"Unattributed cyber threat actors","attributionConfidence":"unknown","victim":"Canadian and U.S. organizations with internet-exposed industrial control systems","sector":"water, manufacturing, energy, chemical, food, and commercial facilities","country":"Canada, United States, and other countries","initialAccess":"The campaign used internet scanning to find exposed PLCs. Actors used weak, default, or absent passwords.","bridgePath":"The actors accessed industrial controllers through public internet exposure or poorly controlled remote connections.","otOrIotMechanism":"The actors changed PLC settings, disabled alarms, changed passwords, and changed network addresses. The campaign also used AI-generated exploitation scripts.","observedEffect":"An October 2025 incident changed water-pressure controls in Canada. July 2026 U.S. attacks locked operators out or took PLCs offline. Some utilities issued boil-water advisories and used manual operations.","intendedEffect":"Actors attempted operational disruption and performed reconnaissance to prepare future effects.","impactType":"direct-ot-manipulation","evolutionNote":"The campaign used public scanning and weak credentials. The advisory also described AI-generated scripts. It did not show that those scripts caused the reported effects.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cyber threat actors use artificial intelligence in an active global campaign to disrupt internet-exposed programmable logic controllers","url":"https://www.cyber.gc.ca/en/news-events/cyber-threat-actors-use-artificial-intelligence-active-global-campaign-disrupt-internet-exposed-programmable-logic-controllers","publisher":"Canadian Centre for Cyber Security","publicationDate":"2026-09-14","accessedDate":"2026-11-02","supports":["access","mechanism","effect"]},{"title":"CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs","url":"https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs","publisher":"Cybersecurity and Infrastructure Security Agency","publicationDate":"2026-07-30","accessedDate":"2026-11-02","supports":["mechanism","effect"]}],"evidenceNotes":"Public reporting does not identify one operator or prove that one group caused every incident. It does not prove that AI-generated scripts caused the named service effects. The campaign was active at publication.","summary":"Unattributed actors targeted internet-connected programmable logic controllers. They scanned for devices and used weak credentials. Reported incidents changed water controls, locked operators out, and took controllers offline. A government advisory also described AI-generated scripts. It did not link those scripts to the reported service effects."},{"id":"poland-private-apn-wago-2025","title":"Polish CHP private-APN bridge","eventKind":"incident","aliases":["December 2025 private APN intrusion"],"startDate":"2025-12-18","endDate":"2025-12-29","disclosureDate":"2026-08-08","datePrecision":"day","lane":"iiot-bridge","bridgeRole":"pivot","secondaryTags":["private-apn","wago-pfc200","cellular-router"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"An unnamed Polish combined heat and power plant that served approximately 50,000 residents","sector":"district energy","country":"Poland","initialAccess":"The attacker entered an internet-facing FortiGate at a wind farm. The attacker then accessed a Teltonika router. Investigators did not determine how the attacker obtained the router password.","bridgePath":"The attacker used the router to reach a private APN. A WAGO PFC200 on the APN used default credentials. The attacker enabled SSH and used the controller as a tunnel into the plant OT network.","otOrIotMechanism":"The attacker reached SCADA and Siemens PLCs. The attacker put PLCs in STOP mode and changed or reset network devices.","observedEffect":"The steam turbine and process-water treatment system stopped. Operators restored them before customers lost heat or electricity.","intendedEffect":"CERT Polska described the broader campaign as destructive. It did not separately establish intent for this access path.","impactType":"iiot-controller-bridge-to-ot","evolutionNote":"The attacker used a private cellular network and an industrial controller as a path between operational sites. The incident showed that a private cellular network does not guarantee isolation.","significance":{"historicalImportance":2,"technicalNovelty":3,"documentedEffect":2,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Follow-Up Analysis of the 29 December 2025 Energy Sector Incident","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025.pdf","publisher":"CERT Polska","publicationDate":"2026-08-08","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect"]},{"title":"Energy Sector Incident Report - 29 December 2025","url":"https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/","publisher":"CERT Polska","publicationDate":"2026-01-30","accessedDate":"2026-11-02","supports":["campaign","effect","attribution"]}],"evidenceNotes":"CERT reconstructed the path from network and router records. It recovered no data from the damaged WAGO controller. CERT did not publicly attribute this private-APN incident.","summary":"An attacker entered a wind-farm network and reached a private cellular network. The attacker used a WAGO industrial controller as a tunnel into a heat plant. The attacker stopped a turbine and a process-water treatment system for a short time. Customer heat and electricity supplies continued."},{"id":"poland-energy-ot-2025","title":"Polish renewable energy and CHP OT attacks","eventKind":"campaign","aliases":["December 2025 Polish energy-sector attacks"],"startDate":"2025-12-29","endDate":"2025-12-29","disclosureDate":"2026-01-30","datePrecision":"day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","renewable-energy","chp","firmware","wiper"],"status":"successful","attributionActor":"Unconfirmed; CERT Polska found infrastructure overlap with the cluster tracked as Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly","attributionConfidence":"low","victim":"More than 30 Polish wind and photovoltaic farms, plus a large combined heat and power plant","sector":"electricity and district energy","country":"Poland","initialAccess":"CERT Polska reported attacker access to the networks. The initial access path is not public.","bridgePath":"Attackers reached OT devices at renewable substations and a large combined heat and power plant.","otOrIotMechanism":"At renewable sites, attackers damaged controller firmware and system files and used wiper malware. Endpoint protection blocked a wiper at the large CHP plant.","observedEffect":"Renewable sites lost communication with distribution operators and remote control, but continued producing electricity. The large CHP attack did not disrupt heat supply.","intendedEffect":"CERT Polska assessed the attacks as destructive. The large CHP attack aimed to destroy data and disrupt heat supply.","impactType":"direct-ot-damage","evolutionNote":"The attacks combined destructive actions against distributed OT equipment with a wiper attempt against a large CHP plant.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Energy Sector Incident Report - 29 December 2025","url":"https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/","publisher":"CERT Polska","publicationDate":"2026-01-30","accessedDate":"2026-11-02","supports":["mechanism","effect","attribution"]}],"evidenceNotes":"The renewable sites lost communications and remote control, but production continued. The CHP attack was blocked. Attribution rests on infrastructure overlap, not a confirmed identity.","summary":"Attackers damaged OT devices at more than 30 Polish renewable sites and targeted a large CHP plant. Renewable sites lost remote communication and control but continued producing electricity. Security software blocked the CHP wiper before it disrupted heat supply."},{"id":"iranian-plc-campaign-2026","title":"Iran-affiliated internet-facing PLC campaign","eventKind":"campaign","aliases":["AA26-097A","Rockwell and Allen-Bradley PLC disruption campaign"],"startDate":"2026-03-01","endDate":"2026-04-07","disclosureDate":"2026-04-07","datePrecision":"start-month; end-publication-cutoff","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["plc","internet-exposed","water","energy","hmi","scada"],"status":"successful","attributionActor":"Iranian-affiliated APT actors, as assessed by FBI, CISA, NSA, EPA, DOE, and CNMF","attributionConfidence":"high","victim":"Multiple U.S. critical infrastructure organizations","sector":"government services, water and wastewater, and energy","country":"United States","initialAccess":"The actors connected to internet-facing PLCs and used legitimate engineering software. The advisory does not report exploitation of a specific vulnerability.","bridgePath":"The actors accessed PLCs directly through public internet connections. No enterprise IT-to-OT pivot was required.","otOrIotMechanism":"The actors interacted with PLC project files, changed information shown on HMI and SCADA displays, and installed Dropbear SSH on some endpoints.","observedEffect":"The actors disrupted PLC functions across multiple critical infrastructure sectors. Some victims had operational disruption and financial loss.","intendedEffect":"The authoring agencies assessed that the actors intended to cause disruptive effects in the United States.","impactType":"direct-ot-manipulation","evolutionNote":"The campaign used legitimate configuration software and direct internet access. It caused OT effects without custom ICS malware or an enterprise-network pivot.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure","url":"https://media.defense.gov/2026/Apr/07/2003907538/-1/-1/0/AA26-097A-IRANIAN-AFFILIATED-CYBER-ACTORS-EXPLOIT-PROGRAMMABLE-LOGIC-CONTROLLERS-ACROSS-US-CRITICAL-INFRASTRUCTURE_508C.PDF","publisher":"FBI, CISA, NSA, EPA, DOE, and CNMF","publicationDate":"2026-04-07","accessedDate":"2026-11-02","supports":["access","mechanism","effect","attribution"]}],"evidenceNotes":"The activity began at least in March 2026. April 7 is the publication cutoff, not a confirmed campaign end. The agencies do not name the group.","summary":"Iran-affiliated actors directly accessed internet-facing PLCs at U.S. critical infrastructure sites. They interacted with project files and manipulated HMI and SCADA data. Multiple organizations experienced PLC disruption. Some experienced operational disruption and financial loss."},{"id":"uk-micro-generator-cyber-2026","title":"UK small-scale generator cyber shutdown","eventKind":"incident","aliases":["July 2026 UK micro-generator shutdown"],"startDate":"2026-07-01","disclosureDate":"2026-08-23","datePrecision":"incident-month only; four-day duration; disclosure-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","small-generator","operational-shutdown"],"status":"successful","attributionActor":"Iran-linked threat actors, as reported by news media and CERT-EU","attributionConfidence":"low","victim":"An unnamed small-scale electricity generator","sector":"electricity generation","country":"United Kingdom","initialAccess":"Public sources do not identify the access path, malware, vulnerability, or compromised system.","bridgePath":"Public sources do not show whether the attack entered through business systems, remote access, or an OT interface.","otOrIotMechanism":"A cyberattack caused the generator to shut down for four days. Public sources do not establish direct OT access, a stop command, or manipulation of a named controller.","observedEffect":"The small-scale generator remained offline for four days in July 2026. The UK government said that the incident did not put the wider energy system at risk. No customer power outage was reported.","intendedEffect":"Public evidence does not establish the intended effect.","impactType":"cyber-caused-generation-shutdown","evolutionNote":"The incident shows that a cyberattack can stop a small generator while the wider grid continues to operate. Public reporting did not include technical or recovery details.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Iran-linked hackers blamed for cyber-attack that shut down UK power plant","url":"https://www.theguardian.com/world/2026/aug/23/iran-linked-hackers-blamed-cyber-attack-british-power-plant","publisher":"The Guardian","publicationDate":"2026-08-23","accessedDate":"2026-11-02","supports":["date","target","effect","government-response","reported-attribution"]},{"title":"Iran-linked cyberattack shut down a UK power plant","url":"https://www.theregister.com/security/2026/08/24/iran-linked-cyberattack-shut-down-a-uk-power-plant/","publisher":"The Register","publicationDate":"2026-08-24","accessedDate":"2026-11-02","supports":["effect","government-response","limitations"]},{"title":"Cyber Brief 26-09 - August 2026","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","publisher":"CERT-EU","publicationDate":"2026-09-03","accessedDate":"2026-11-02","supports":["effect","government-response","reported-attribution"]}],"evidenceNotes":"The exact July dates, facility identity, location, capacity, generation technology, access path, and affected systems are not public. The July 1 start encodes incident-month precision, not the exact incident date. The Guardian and CERT-EU reported an Iran link. The UK government and National Cyber Security Centre did not publicly attribute the attack to Iran or another actor. The government confirmed the incident and four-day shutdown but did not confirm direct OT manipulation.","summary":"A cyberattack stopped an unnamed small-scale UK generator for four days in July 2026. The wider electricity system continued to operate, and no customer outage was reported. News media and CERT-EU linked the attack to Iran, but the UK government did not publicly attribute it. Public sources do not identify the facility, access path, or affected systems."},{"id":"north-carolina-ports-cyber-2026","title":"North Carolina Ports cyberattack","eventKind":"incident","aliases":["North Carolina State Ports Authority cyberattack","NC Ports August 2026 cyberattack"],"startDate":"2026-08-04","disclosureDate":"2026-08-05","datePrecision":"start-day; recovery timing differs by source: WECT reported normal gate schedules resumed on August 6, while an authority update quoted by BleepingComputer said gates would follow a normal schedule on August 7; manual processing and system restoration continued","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["port","maritime-logistics","gate-operations","containment","terminal-it"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"North Carolina State Ports Authority","sector":"Maritime ports and logistics","country":"United States","initialAccess":"The authority did not disclose the first access method, malware family, or affected system details.","bridgePath":"A cyberattack caused a system-wide outage at the Port of Wilmington, the Port of Morehead City, and the Charlotte Inland Port. Port gates and truck processing depended on the affected IT services.","otOrIotMechanism":"The outage delayed gate operations and cargo movement. Public evidence does not show access to or manipulation of cranes, vehicles, or industrial controllers.","observedEffect":"The three facilities opened their gates late on August 5. The outage delayed port operations and truckers. WECT reported that normal gate schedules resumed on August 6 while operations remained manual. An authority update quoted by BleepingComputer said gates would follow a normal schedule on August 7, with delays still expected during restoration. Vessel activity continued.","intendedEffect":"Public evidence does not establish the actor, malware, or objective.","impactType":"port-it-to-gate-operations","evolutionNote":"The incident showed that a system-wide port IT outage can delay gates and truck processing without direct compromise of cargo-handling controllers.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":2,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"North Carolina Ports confirms cyberattack disrupting operations","url":"https://www.bleepingcomputer.com/news/security/north-carolina-ports-confirms-cyberattack-disrupting-operations/","publisher":"BleepingComputer","publicationDate":"2026-08-07","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","recovery","limitations"]},{"title":"NC Ports operating manually after cyberattack disrupts statewide systems","url":"https://www.wect.com/2026/08/06/nc-ports-operating-manually-after-cyberattack-disrupts-statewide-systems/","publisher":"WECT","publicationDate":"2026-08-06","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","recovery"]}],"evidenceNotes":"WECT reports direct confirmation from a North Carolina Ports spokesperson and says normal gate schedules resumed on August 6 while operations remained manual. BleepingComputer quotes an authority status update saying gates would follow a normal schedule on August 7, with delays still expected during restoration. The sources therefore disagree by one day on the return to normal gate schedules. They document the system-wide outage, late gate opening, delays, and continued vessel activity. The authority did not identify the actor, malware, first access method, or exact affected systems. The record does not claim direct OT compromise.","summary":"A cyberattack caused a system-wide outage at three North Carolina port facilities. Gates opened late, and the outage delayed truck and port operations. Vessel activity continued. Public evidence does not show direct manipulation of cargo-handling equipment or industrial controllers."},{"id":"suisun-emergency-services-cyber-2026","title":"Suisun City emergency services cyber incident","eventKind":"incident","aliases":["Suisun City August 2026 cybersecurity incident"],"startDate":"2026-08-07","disclosureDate":"2026-08-08","datePrecision":"start-day; September 22 is a service-reopening milestone, not the incident end","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["municipal-services","emergency-communications","911","police-dispatch","fire-dispatch","malware"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"City of Suisun City","sector":"Municipal government and emergency services","country":"United States","initialAccess":"The city did not disclose the first access method. It reported that malicious software infected and compromised city IT systems on August 7.","bridgePath":"City IT systems supported 911 routing, police and fire dispatch, records, and City services. The city shut down its network to contain the incident and moved dispatch work to the Solano County dispatch center.","otOrIotMechanism":"The incident affected IT and communications services that supported physical emergency response. Public evidence does not show compromise of emergency vehicles, field equipment, or operational technology.","observedEffect":"The incident disrupted city 911 routing and police and fire dispatch systems. Dispatchers worked from the Solano County dispatch center while police and fire units continued to respond. The city also closed City Hall and made online and internal services unavailable during recovery. On September 22, 911 and non-emergency calls still used the Solano County dispatch center, and full network recovery continued.","intendedEffect":"Public evidence does not establish the actor's objective. The city reported malicious software but did not confirm ransomware.","impactType":"municipal-it-to-emergency-response-cascade","evolutionNote":"The incident showed how one municipal IT compromise can affect emergency communications and require a regional dispatch fallback while field response continues.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Suisun City Council Declares State of Emergency","url":"https://www.suisun.com/News-articles/Suisun-City-Council-Declares-State-of-Emergency-in-response-to-Cybersecurity-Incident","publisher":"City of Suisun City","publicationDate":"2026-08-08","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","limitations"]},{"title":"Suisun City Reopens City Hall Amid Cybersecurity Incident Recovery","url":"https://www.suisun.com/News-articles/20260922Suisun-City-Reopens-City-Hall-Services-Amid-Ongoing-Cybersecurity-Incident-Recovery","publisher":"City of Suisun City","publicationDate":"2026-09-22","accessedDate":"2026-11-02","supports":["effect","recovery","limitations"]}],"evidenceNotes":"The city confirmed that malicious software compromised its IT systems and affected 911 routing, police and fire dispatch, records, and City services. Emergency response continued after dispatchers moved to the county center. Public access to all City Hall departments resumed on September 22, but dispatch still used the county center and full network restoration continued. The city did not identify the actor or confirm ransomware. The record does not claim compromise of operational technology or field equipment.","summary":"Malicious software compromised Suisun City IT systems and affected 911 routing and police and fire dispatch. Dispatchers moved to a county center while field services continued. The city closed City Hall and online services during recovery. Public evidence does not show compromise of operational technology or emergency-response equipment."},{"id":"cloud-native-carjacking-2026","title":"Cloud-native carjacking demonstration","eventKind":"demonstration","aliases":["Fleet-wide compromise via telematics authorization failures"],"startDate":"2026-08-12","endDate":"2026-08-14","disclosureDate":"2026-08-12","datePrecision":"paper-release-and-conference-window; laboratory-testing-dates-not-disclosed","lane":"consumer-iot-bridge","bridgeRole":"direct-control","secondaryTags":["vehicle","telematics","cloud","mqtt","authorization","fleet"],"status":"successful","attributionActor":"Not applicable to controlled security research","attributionConfidence":"not-applicable","victim":"Three unnamed vehicle manufacturers and their connected-vehicle platforms","sector":"Automotive","country":"Not disclosed","initialAccess":"Researchers extracted reusable credentials and session material from one vehicle that they controlled.","bridgePath":"Cloud telematics services accepted valid credentials without consistently binding them to one vehicle identity or command target.","otOrIotMechanism":"The researchers changed logical vehicle identifiers in MQTT, HTTPS, and short-message-service requests. The authorization failures enabled cross-vehicle access and commands.","observedEffect":"The controlled tests demonstrated remote vehicle control, access to private surveillance media, and spoofed fallback commands across platforms from three manufacturers. The researchers used coordinated disclosure.","intendedEffect":"The research tried to identify fleet-wide risk from weak authorization in vehicle cloud services.","impactType":"vehicle-cloud-fleet-control","evolutionNote":"The research moved the vehicle threat model from one compromised car to cross-vehicle privilege escalation through shared cloud control planes.","significance":{"historicalImportance":3,"technicalNovelty":3,"documentedEffect":3,"laterInfluence":1,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cloud-Native Carjacking: Fleet-wide Compromise via Telematics Authorization Failures","url":"https://www.usenix.org/conference/usenixsecurity26/presentation/liu-yangyang","publisher":"USENIX Association","publicationDate":"2026-08-12","accessedDate":"2026-11-02","supports":["dates","access","mechanism","effect"]}],"evidenceNotes":"The dates are the paper-release and conference window, not the dates of laboratory testing. The peer-reviewed paper does not disclose the three manufacturers or affected-fleet geography. It describes a capability with fleet-wide scope, but does not claim compromise of an entire production fleet. It documents controlled research and coordinated disclosure, not hostile use against customer vehicles.","summary":"Researchers recovered credentials from one vehicle and tested three unnamed vehicle cloud platforms. The platforms did not consistently bind valid credentials to one vehicle. The researchers changed logical vehicle identifiers and demonstrated cross-vehicle access. The effects included remote control, surveillance-media access, and spoofed fallback commands. The work showed a fleet-wide risk in shared telematics control planes."},{"id":"boston-scientific-cyber-2026","title":"Boston Scientific cyber incident","eventKind":"incident","aliases":["Boston Scientific August 2026 cybersecurity incident"],"startDate":"2026-08-25","endDate":"2026-09-09","disclosureDate":"2026-08-26","datePrecision":"start-identification day; end-manufacturing-order-fulfillment-and-shipping-restoration day; investigation continued","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["medical-devices","manufacturing","order-fulfillment","shipping","cardiac-monitoring","healthcare-supply-chain"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Boston Scientific Corporation","sector":"Medical device manufacturing and services","country":"Multiple countries","initialAccess":"Boston Scientific did not disclose the first access method. The company reported unauthorized access to selected internal IT infrastructure.","bridgePath":"Internal IT systems and business applications supported manufacturing, order processing, shipping, and activation of some cardiac remote-monitoring services. The network outage disrupted these operational functions.","otOrIotMechanism":"The incident affected internal IT and service onboarding. Boston Scientific reported no known effect on implantable device function, enrolled remote monitoring, or product technology.","observedEffect":"The global network disruption affected manufacturing and the processing and shipment of customer orders. It also paused new activations for cardiac device implant communicators and insertable cardiac monitor remote monitoring. Manufacturing, order fulfillment, and shipping were fully restored by September 9.","intendedEffect":"Public evidence does not establish the actor, malware, or objective.","impactType":"corporate-it-to-medical-manufacturing-and-monitoring-cascade","evolutionNote":"The incident linked internal IT availability to medical-device manufacturing, distribution, and remote-monitoring activation without evidence of compromise to implanted devices.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Boston Scientific Form 8-K filed August 26, 2026","url":"https://www.sec.gov/Archives/edgar/data/885725/000088572526000056/bsx-20260826.htm","publisher":"Boston Scientific Corporation via United States Securities and Exchange Commission","publicationDate":"2026-08-26","accessedDate":"2026-11-02","supports":["dates","bridge","effect","limitations"]},{"title":"Archived update on cybersecurity incident, September 3, 2026","url":"https://news.bostonscientific.com/9-3-26-cyber-update-archive","publisher":"Boston Scientific Corporation","publicationDate":"2026-09-03","accessedDate":"2026-11-02","supports":["access","bridge","mechanism","effect","limitations"]},{"title":"Archived update on cybersecurity incident, September 9, 2026","url":"https://news.bostonscientific.com/9-09-26-cyber-update-archive","publisher":"Boston Scientific Corporation","publicationDate":"2026-09-09","accessedDate":"2026-11-02","supports":["effect","recovery","limitations"]}],"evidenceNotes":"Boston Scientific confirmed a global operational disruption after unauthorized access to selected internal IT infrastructure. Manufacturing, order fulfillment, and shipping were fully restored on September 9. New remote-monitoring activations were affected during the outage. Devices already enrolled for remote monitoring continued to work, and the company found no known effect on implantable device function or product technology. The company did not identify the actor or describe the incident as ransomware.","summary":"Unauthorized access to Boston Scientific internal IT caused a global network outage. The outage disrupted medical-device manufacturing, order processing, shipping, and some new remote-monitoring activations. The company reported no known effect on implanted devices, enrolled remote monitoring, or product technology."},{"id":"chile-huatacondo-cyber-2026","title":"Cyber outage at Huatacondo photovoltaic plant and battery system","eventKind":"incident","aliases":["Huatacondo cyber outage"],"startDate":"2026-08-27","endDate":"2026-10-27","disclosureDate":"2026-08-28","datePrecision":"start-day; end-last-observed-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","solar","bess","forced-disconnection"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Huatacondo photovoltaic plant and Huatacondo battery system","sector":"electricity generation and storage","country":"Chile","initialAccess":"Public sources do not identify the initial access path, affected systems, malware, or vulnerability.","bridgePath":"Public sources do not show whether the actor entered through business systems, remote access, or an OT interface.","otOrIotMechanism":"The operator reported a cyberattack and requested forced disconnection of the Huatacondo photovoltaic plant and battery system. Public forensic evidence does not show the commands or devices involved.","observedEffect":"The approximately 103 MW photovoltaic plant and 98 MW/312 MWh battery system disconnected from the national grid. They remained at zero percent availability on October 27. The battery system was still in commissioning. No customer outage was reported.","intendedEffect":"Public evidence does not establish the intended effect.","impactType":"direct-energy-operation-disruption","evolutionNote":"The incident shows a long loss of renewable generation and storage after an operator-reported cyberattack. The public record does not explain why recovery took more than two months.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":2,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Informe Diario - 28 de Agosto del 2026","url":"https://www.coordinador.cl/wp-content/uploads/2026/08/Informe-Diario-28-08-2026.pdf","publisher":"Coordinador Eléctrico Nacional","publicationDate":"2026-08-28","accessedDate":"2026-11-02","supports":["date","target","reported-cause","effect"]},{"title":"Informe Diario - 27 de Octubre del 2026","url":"https://www.coordinador.cl/wp-content/uploads/2026/10/Informe-Diario-27-10-2026.pdf","publisher":"Coordinador Eléctrico Nacional","publicationDate":"2026-10-27","accessedDate":"2026-11-02","supports":["effect","duration","status"]},{"title":"Huatacondo solar park and its battery have been offline for two months after a reported cyberattack","url":"https://energiafutura.cl/en/news/huatacondo-solar-park-and-its-battery-have-been-offline-for-two-months-after-a-reported-cyberattack","publisher":"Energia Futura","publicationDate":"2026-10-29","accessedDate":"2026-11-02","supports":["date","target","effect","limitations"]}],"evidenceNotes":"The grid records repeat the cause that the operator supplied. They are not a public forensic finding. October 27 is the last checked outage date, not a confirmed recovery date. A concurrent Santa Rita transformer outage is excluded because public evidence does not prove a link to Huatacondo. Public evidence does not identify the actor, access path, affected systems, or technical method.","summary":"On August 27, the operator reported a cyberattack at Huatacondo and requested forced grid disconnection. The photovoltaic plant and battery system remained unavailable on October 27. Public evidence does not identify the actor, access path, affected systems, or technical method."},{"id":"chile-los-espinos-olivos-2026","title":"Los Espinos and Olivos telecontrol outage","eventKind":"incident","aliases":["Los Vilos generator cyber outage"],"startDate":"2026-08-27","endDate":"2026-09-12","disclosureDate":"2026-08-28","datePrecision":"start-day; end-last-observed-day","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["electricity","thermal-generation","scada","telecontrol","loss-of-view"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Los Espinos and Olivos thermal power plants","sector":"electricity generation","country":"Chile","initialAccess":"Public sources do not identify the initial access path, malware, credentials, or affected product.","bridgePath":"Public sources do not show an enterprise-to-OT path or a direct remote-access path.","otOrIotMechanism":"The plants lost remote supervision and telecontrol. The operator reported a cyberattack as the cause. Public forensic evidence does not show how the control connection failed or whether an actor changed plant equipment.","observedEffect":"Los Espinos and Olivos became unavailable for dispatch after loss of remote supervision and telecontrol at 21:30 on August 27. Grid reports still listed the control outage on September 12. No customer outage was reported.","intendedEffect":"Public evidence does not establish the intended effect.","impactType":"direct-ot-visibility-and-control-loss","evolutionNote":"The incident removed remote visibility and control at two small generators for at least 16 days. It shows the operational effect of a control-channel failure even when the wider grid continues to operate.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":2,"publicRecognition":1,"evolutionValue":3},"sources":[{"title":"Informe Diario - 29 de Agosto del 2026","url":"https://www.coordinador.cl/wp-content/uploads/2026/08/Informe-Diario-29-08-2026.pdf","publisher":"Coordinador Eléctrico Nacional","publicationDate":"2026-08-29","accessedDate":"2026-11-02","supports":["date","target","mechanism","effect"]},{"title":"Informe Diario - 12 de Septiembre del 2026","url":"https://www.coordinador.cl/wp-content/uploads/2026/09/Informe-Diario-12-09-2026.pdf","publisher":"Coordinador Eléctrico Nacional","publicationDate":"2026-09-12","accessedDate":"2026-11-02","supports":["effect","duration","status"]},{"title":"Huatacondo solar park and its battery have been offline for two months after a reported cyberattack","url":"https://energiafutura.cl/en/news/huatacondo-solar-park-and-its-battery-have-been-offline-for-two-months-after-a-reported-cyberattack","publisher":"Energia Futura","publicationDate":"2026-10-29","accessedDate":"2026-11-02","supports":["reported-cause","effect","limitations"]}],"evidenceNotes":"The grid reports document the loss of remote supervision and telecontrol. The cyberattack cause is an operator report, not a public forensic finding. The outage occurred on the same day as the Huatacondo and Santa Rita events. Public evidence does not prove a common actor or intrusion. September 12 is the last checked date that still lists the control outage, not a confirmed recovery date.","summary":"Los Espinos and Olivos lost remote supervision and telecontrol on August 27. The operator reported a cyberattack as the cause. Grid reports still listed the control outage on September 12. The plants were unavailable for dispatch, but no customer outage was reported. Public evidence does not identify the actor or prove a link to other Chilean events that day."},{"id":"tanjung-pelepas-cyber-2026","title":"Port of Tanjung Pelepas cyber incident","eventKind":"incident","aliases":["Tanjung Pelepas terminal cyberattack","PTP September 2026 cyber incident"],"startDate":"2026-09-09","endDate":"2026-09-15","disclosureDate":"2026-09-10","datePrecision":"start-minute known as 23:34 local time; end-day by which container operations had fully resumed","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["port","container-terminal","maritime-logistics","terminal-operating-system","manual-processing"],"status":"successful","attributionActor":"Unknown actor; Dire Wolf claimed responsibility","attributionConfidence":"unknown","victim":"Port of Tanjung Pelepas","sector":"Maritime ports and logistics","country":"Malaysia","initialAccess":"The operator did not disclose the first access method or malware family. Dire Wolf later claimed the incident, but the operator did not confirm this claim.","bridgePath":"The cyber incident affected terminal operating systems. The operator isolated affected systems, and container handling stopped until a controlled restart began.","otOrIotMechanism":"Physical container operations depended on the affected terminal systems. The operator used manual processing for some export container gate-ins during recovery. Public evidence does not show access to or manipulation of cranes, vehicles, or industrial controllers.","observedEffect":"The terminal suspended container operations for several hours. A phased restart began on September 10. The operator warned that some vessels could be delayed. Container operations had fully resumed by September 15.","intendedEffect":"Dire Wolf claimed the incident and threatened to publish data. The operator did not confirm ransomware, data theft, or the actor's objective.","impactType":"terminal-system-to-container-operations","evolutionNote":"The incident showed that loss of terminal operating systems can stop container handling at a major transshipment port and force manual gate processing.","significance":{"historicalImportance":3,"technicalNovelty":2,"documentedEffect":3,"laterInfluence":1,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Cyber attack disrupts operations at Malaysia's Port of Tanjung Pelepas","url":"https://www.lloydslist.com/LL1158420/Cyber-attack-disrupts-operations-at-Malaysia%E2%80%99s-Port-of-Tanjung-Pelepas","publisher":"Lloyd's List","publicationDate":"2026-09-11","accessedDate":"2026-11-02","supports":["dates","bridge","mechanism","effect","recovery","limitations"]},{"title":"Cyber-attack halts operations at Malaysia's Tanjung Pelepas Port","url":"https://theloadstar.com/cyber-attack-halts-operations-at-malaysias-tanjung-pelepas-port/","publisher":"The Loadstar","publicationDate":"2026-09-11","accessedDate":"2026-11-02","supports":["dates","operator-advisory","effect","recovery","vessel-delays"]},{"title":"2026-09 September Malaysian Threat Landscape Recap","url":"https://rectifyq.com/my-threat-landscape/radar/2026-09","publisher":"Threat Intelligence Malaysia","publicationDate":"2026-10-01","accessedDate":"2026-11-02","supports":["dates","mechanism","effect","recovery","actor-claim","limitations"]}],"evidenceNotes":"Lloyd's List and The Loadstar report operator and Maersk statements about the affected systems, suspension, and phased restart. Threat Intelligence Malaysia separates the confirmed cyber incident from Dire Wolf's unconfirmed claim and gives the September 15 recovery bound. The operator did not confirm ransomware, data theft, first access, or attribution. The record does not claim direct OT compromise.","summary":"A cyber incident affected terminal operating systems at the Port of Tanjung Pelepas. Container operations stopped and then restarted in phases. Staff used manual processing for some export gate-ins. Public evidence does not show direct manipulation of cranes, vehicles, or industrial controllers."},{"id":"france-supermarket-refrigeration-2026","title":"France supermarket refrigeration attack","eventKind":"campaign","aliases":["France supermarket freezer attack"],"startDate":"2026-10-11","disclosureDate":"2026-10-12","datePrecision":"start-day; activity was still reported as possibly ongoing on 2026-10-14","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["food-retail","refrigeration","remote-control","cold-chain"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"Hundreds of supermarkets and food stores in France","sector":"food retail","country":"France","initialAccess":"Attackers reached refrigeration management interfaces that were directly exposed to the Internet. British cyber officials said affected French systems used default passwords and known vulnerabilities. Public evidence does not identify one access method for every victim.","bridgePath":"The attackers connected to remote refrigeration controllers. Public evidence does not show movement through a business network.","otOrIotMechanism":"CERT-FR identified compromises of Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB controllers. Attackers changed settings and activated defrost functions at some sites.","observedEffect":"Temperatures in some refrigerators and freezers increased to 50 degrees Celsius for approximately six hours. Stores discarded fresh and frozen food. Some stores reported equipment fires and water damage.","intendedEffect":"Public evidence does not show the intended effect.","impactType":"direct-ot-manipulation","evolutionNote":"The attack used Internet access to commercial refrigeration controls to cause direct cold-chain loss at national scale.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération","url":"https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012","publisher":"CERT-FR","publicationDate":"2026-10-12","accessedDate":"2026-11-02","supports":["target","access","mechanism","status"]},{"title":"French cybersecurity authority warns attack may be ongoing as stores scramble to restock","url":"https://apnews.com/article/81c2d5721f4df77f601f71741ef7c291","publisher":"Associated Press","publicationDate":"2026-10-14","accessedDate":"2026-11-02","supports":["target","effect","recovery","attribution"]},{"title":"A disastrous day for French supermarkets after massive cyberattack targets refrigeration systems","url":"https://www.lemonde.fr/en/economy/article/2026/10/13/a-disastrous-day-for-french-supermarkets-after-massive-cyberattack-targets-refrigeration-systems_6758535_19.html","publisher":"Le Monde","publicationDate":"2026-10-13","accessedDate":"2026-11-02","supports":["target","effect","timeline"]},{"title":"European supermarkets face spoiled food losses after fridge cyberattacks","url":"https://apnews.com/article/supermarkets-europe-internet-cyberattack-food-fridges-hacked-b6abfab3f5cdd65c19476b9032eb7a9d","publisher":"Associated Press","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["access","mechanism","attribution","investigation"]}],"evidenceNotes":"CERT-FR confirms many controller compromises and names the affected product families. Reports give different store totals. British cyber officials said the attack exploited known vulnerabilities and default passwords. Public evidence does not prove one access method for every victim or identify the actor.","summary":"Attackers remotely changed refrigeration controls at hundreds of food stores in France. Some systems reached 50 degrees Celsius. Stores discarded fresh and frozen food. Some stores also reported fires and water damage. Officials linked the access to Internet-exposed legacy systems, known vulnerabilities, and default passwords. No public source identifies the actor."},{"id":"unm-health-cyber-2026","title":"UNM Health cyber incident","eventKind":"incident","aliases":["University of New Mexico Health Sciences Center October 2026 cybersecurity incident"],"startDate":"2026-10-26","endDate":"2026-10-28","disclosureDate":"2026-10-26","datePrecision":"start-identification-and-operational-effect day; end-full-clinical-operation day; criminal investigation continued","lane":"ot-bridge","bridgeRole":"dependency","secondaryTags":["healthcare","ambulance-diversion","surgery","clinical-appointments","hospital-it","trauma-care"],"status":"successful","attributionActor":"Unknown actor","attributionConfidence":"unknown","victim":"University of New Mexico Health Sciences Center and UNM Health","sector":"Healthcare and medical education","country":"United States","initialAccess":"UNM did not disclose the first access method. Its assessment found effects on some end-user devices and no penetration of core systems or servers.","bridgePath":"Clinical operations depended on available electronic systems and workstations. System outages during containment caused UNM Health to limit new patient intake, divert ambulances, and suspend outpatient procedures and appointments.","otOrIotMechanism":"The incident affected end-user IT and care-delivery support systems. Public evidence does not show compromise of medical devices, building systems, or operational technology.","observedEffect":"UNM Health diverted ambulance traffic to other health systems from 12:30 p.m. to 2:30 p.m. on October 26. It suspended outpatient surgeries and appointments for the rest of that day. Critical electronic systems and normal ambulance operations returned on October 27, and all clinical operations were fully functional on October 28.","intendedEffect":"Public evidence does not establish the actor's objective. UNM reported a cybersecurity threat and did not confirm ransomware.","impactType":"healthcare-it-to-care-delivery-cascade","evolutionNote":"The incident showed that effects limited to end-user IT can still interrupt patient intake, ambulance routing, surgery schedules, and outpatient care.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":1,"sourceQuality":3,"publicRecognition":3,"evolutionValue":3},"sources":[{"title":"UNM Warns Public Not to Engage with Any Groups Claiming Responsibility for Cybersecurity Threat","url":"https://hscnews.unm.edu/news/ambulance-traffic-diverted-clinical-appointments-cancelled-and-classes-cancelled-due-to-cybersecurity-issue-at-unm-hsc","publisher":"University of New Mexico Health Sciences Center","publicationDate":"2026-10-28","accessedDate":"2026-11-02","supports":["dates","access","bridge","mechanism","effect","recovery","limitations"]}],"evidenceNotes":"UNM confirmed the cybersecurity event, the end-user device effects, the ambulance diversion, and the suspension of outpatient surgeries and appointments. UNM said the event did not penetrate core systems or servers. Clinical operations were fully functional by October 28. Claims by groups that said they caused the incident were not verified. The record does not claim ransomware or compromise of medical devices or operational technology.","summary":"A cybersecurity event affected end-user devices at UNM Health. System outages led to a two-hour ambulance diversion and suspension of outpatient surgeries and appointments. Clinical operations were fully functional by October 28. Public evidence does not show compromise of core servers, medical devices, or operational technology."},{"id":"europe-refrigeration-wave-2026","title":"European refrigeration-control incident cluster","eventKind":"campaign","aliases":["European supermarket refrigeration attack wave","November 2026 European freezer attacks"],"startDate":"2026-11-01","disclosureDate":"2026-11-02","datePrecision":"start-night; reports continued through the 2026-11-04 research cutoff; investigations remained open","lane":"pure-ot","bridgeRole":"not-applicable","secondaryTags":["food-retail","refrigeration","remote-control","cold-chain","multi-country","blood-bank","healthcare-cold-chain"],"status":"mixed","attributionActor":"No common actor publicly identified","attributionConfidence":"unknown","victim":"Supermarket chains, food wholesalers, processors, independent food businesses, and three French Blood Establishment plasma-storage sites","sector":"food retail, food wholesale, food processing, and blood services","country":"Belgium, Denmark, Estonia, France, Germany, Greece, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Sweden, and the United Kingdom; Finland suspected","initialAccess":"Danfoss said at least 17 Dutch victims used refrigeration systems with default passwords that were not on protected networks. United Kingdom reporting described vulnerable Internet-connected legacy controllers. Portugal's Intermarché operator said the incidents appeared to target an external refrigeration-management service provider. The French Blood Establishment said an incident affected a refrigeration-equipment provider that served three of its sites. Public evidence does not identify one access method for every victim.","bridgePath":"Attackers connected to refrigeration control systems at stores, food businesses, and three French Blood Establishment sites. Public evidence does not show movement through a business network at every victim.","otOrIotMechanism":"Attackers changed temperature and defrost settings and, at some sites, disabled temperature alerts. At the three French Blood Establishment sites, served by the provider Coolworld, temperature and defrost thresholds were driven to extremely high values, reportedly as high as 110 degrees Celsius against the roughly minus 30 degrees Celsius the plasma requires. Danfoss and Copeland equipment was affected elsewhere. Public evidence does not identify the product model, access path, or control changes at every victim.","observedEffect":"More than 100 stores and food businesses reported refrigeration problems. Named reports account for approximately 150 food-sector sites. Totals and overlaps remained uncertain. The Associated Press reported tons of spoiled food at a total cost of millions of euros across the European incidents. Reuters reported that one Belgian butcher discarded about 15,000 euros of meat. German stores also discarded food after controls were set to heat. Sweden reported 23 affected ICA stores and seven Coop stores. The Netherlands reported at least 17 businesses. Ireland reported 13 SuperValu stores. Portugal reported seven Intermarché stores. Denmark reported five businesses. Several United Kingdom meat suppliers reported incidents. At three French Blood Establishment plasma-storage sites, the change was caught overnight. The French Blood Establishment credited its monitoring and alarm systems, while French reporting attributed the catch to an on-call technician who noticed the temperatures climbing during the night; the accounts were not fully reconciled and the exact alert chain was not disclosed. Staff transferred or secured plasma. The French Blood Establishment reported no health effect, and no blood products or samples were lost or altered. Blood collection and distribution continued. Other victims restored control before major loss.","intendedEffect":"Public evidence does not establish a common intent across the incident cluster.","impactType":"direct-ot-manipulation","evolutionNote":"The cluster followed the French refrigeration attack by three weeks. It extended the demonstrated cold-chain risk from food businesses to plasma storage. Exposed legacy controllers, service providers, and uneven remediation can enable technically similar incidents across independent operators. The technical similarities do not prove a common actor or coordinated operation.","significance":{"historicalImportance":3,"technicalNovelty":1,"documentedEffect":3,"laterInfluence":2,"sourceQuality":3,"publicRecognition":2,"evolutionValue":3},"sources":[{"title":"Impact très limité sur les installations frigorifiques chez Carrefour Belgique","url":"https://newsroom.carrefour.be/impact-tres-limite-sur-les-installations-frigorifiques-chez-carrefour-belgique-les-produits-restent-disponibles-et-lensemble-des-magasins-est-ouvert-oi9rj2","publisher":"Carrefour Belgium","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","effect","status"]},{"title":"Cyberangrepp mot uppkopplade frys- och kylsystem","url":"https://www.cert.se/2026/11/cyberangrepp-mot-uppkopplade-frys-och-kylsystem.html","publisher":"CERT-SE","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","incident-confirmation","status"]},{"title":"Cyberattacks on freezing and refrigeration systems","url":"https://www.krisinformation.se/en/latest/news/cyberattacks-on-freezing-and-refrigeration-systems/","publisher":"Krisinformation.se and the Swedish National Cyber Security Centre","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","response"]},{"title":"Viðvörun – Netárásir á kælibúnað","url":"https://cert.is/frettasafn/vidvorun-netarasir-a-kaelibunad/","publisher":"CERT-IS","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["scope","access","mechanism","response"]},{"title":"Ook koelsystemen in Nederland aangevallen, bij 17 bedrijven temperatuur aangepast","url":"https://nos.nl/artikel/2637734-ook-koelsystemen-in-nederland-aangevallen-bij-17-bedrijven-temperatuur-aangepast","publisher":"NOS","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","access","mechanism","effect"]},{"title":"Factbox-European retailers hit by supermarket fridge hack","url":"https://live.euronext.com/en/financial-news/factbox-european-retailers-hit-supermarket-fridge-hack","publisher":"Reuters","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","effect","scope","operator-statements"]},{"title":"SuperValu stores hit by cyber attack now back to normal","url":"https://www.rte.ie/news/business/2026/1102/1597612-13-supervalu-stores-hit-by-suspected-cyber-attack/","publisher":"RTÉ","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","effect","recovery","operator-statement"]},{"title":"Hackers raised freezer temperature at Selver supermarket to +50°C","url":"https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c","publisher":"ERR","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","mechanism","effect","recovery"]},{"title":"Five Danish companies were targeted by cyberattacks on their cooling and freezing systems Monday","url":"https://cphpost.dk/2026-11-03/news/round-up/cyberattacks-on-refrigeration-systems-spread-to-more-danish-businesses/","publisher":"Ritzau via The Copenhagen Post","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","effect","recovery","government-confirmation"]},{"title":"UK meat suppliers’ fridges heat up after cyber attacks hit Europe","url":"https://www.itv.com/news/2026-11-03/uk-meat-suppliers-fridges-heat-up-after-cyber-attacks-hit-europe","publisher":"ITV News","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","recovery","operator-statements","NCSC-confirmation"]},{"title":"Veg wholesaler Langridge Organic among UK victims of fridge cyberattack","url":"https://www.thegrocer.co.uk/news/fridge-cyberattacks-claim-more-uk-victims/725503.article","publisher":"The Grocer","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","recovery","operator-statement"]},{"title":"Sete lojas do Intermarché atingidas por ciberataque em Portugal","url":"https://www.rtp.pt/noticias/pais/sete-lojas-do-intermarche-atingidas-por-ciberataque-em-portugal_n1776375","publisher":"RTP","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","access","effect","recovery","operator-statement"]},{"title":"Italian Cybersecurity Agency issues alert over hacker attacks on supermarkets","url":"https://www.ansa.it/english/newswire/english_service/2026/11/02/italian-cybersecurity-agency-issues-alert-over-hacker-attacks-on-supermarkets-4_4d9ab5a3-a416-462b-8189-c8d6c9c84dad.html","publisher":"ANSA","publicationDate":"2026-11-02","accessedDate":"2026-11-04","supports":["target","effect","government-confirmation","response"]},{"title":"Hackers target commercial refrigerators in Greece, attempt to raise temperature to 150°C","url":"https://www.skai.gr/en/news/greece/hackers-target-commercial-refrigerators-in-greece-attempt-to-raise-temperature-to-150%C2%B0c","publisher":"SKAI","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","operator-statement"]},{"title":"Cyberangriffe auf Kühlanlagen auch in deutschen Supermärkten","url":"https://www.tagesschau.de/inland/cyberangriffe-supermarkt-hacker-100.html","publisher":"Tagesschau","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","investigation"]},{"title":"European supermarkets face spoiled food losses after fridge cyberattacks","url":"https://apnews.com/article/supermarkets-europe-internet-cyberattack-food-fridges-hacked-b6abfab3f5cdd65c19476b9032eb7a9d","publisher":"Associated Press","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","access","mechanism","effect","attribution","campaign-limitations"]},{"title":"New cyberattack on supermarket fridges sweeps across Europe","url":"https://live.euronext.com/en/financial-news/new-cyberattack-supermarket-fridges-sweeps-across-europe","publisher":"Reuters via Euronext","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","food-loss","attribution-limitations"]},{"title":"L'EFS confirme l'incident de cybersécurité impactant un de ses prestataires d'équipement frigorifique","url":"https://presse.efs.sante.fr/actualites/l-efs-confirme-l-incident-de-cybersecurite-impactant-un-de-ces-prestataires-d-equipement-frigorifique-2c07c-08a0a.html","publisher":"Établissement français du sang","publicationDate":"2026-11-03","accessedDate":"2026-11-04","supports":["target","mechanism","effect","response","status"]},{"title":"Cyberattack hits French blood bank site but no blood products were compromised","url":"https://apnews.com/article/12b80bcf93b8404264209e519c204919","publisher":"Associated Press","publicationDate":"2026-11-04","accessedDate":"2026-11-04","supports":["target","mechanism","effect","response","status","campaign-limitations"]},{"title":"French blood storage facilities targeted in cyberattack: Report","url":"https://www.aa.com.tr/en/science-technology/french-blood-storage-facilities-targeted-in-cyberattack-report/4110658","publisher":"Anadolu Agency","publicationDate":"2026-11-04","accessedDate":"2026-11-04","supports":["mechanism","effect","detection","response"]},{"title":"Cyberattacks Target French Blood Banks After Supermarkets Hit","url":"https://www.newsweek.com/cyberattacks-target-french-blood-banks-refrigeration-supermarkets-12661343","publisher":"Newsweek","publicationDate":"2026-11-04","accessedDate":"2026-11-04","supports":["effect","detection","response"]}],"evidenceNotes":"This record is an analytical aggregate of a tightly timed cluster, not proof of one campaign. No public source proves a common actor, shared command infrastructure, or coordinated operation. Similar timing, equipment, and control changes do not establish coordination. The approximate 150-site figure is an inference from named food-sector reports and excludes the three French Blood Establishment sites. The Associated Press aggregate of tons of spoiled food and millions of euros was not itemized. It must not be added to victim-level loss figures. The French Blood Establishment incident is grouped by timing and refrigeration-control method. Authorities had not formally linked it to the food-sector incidents by the cutoff. The EFS provider was reported as Coolworld. The exact EFS detection mechanism, automated monitoring versus the on-call technician who noticed the temperatures rising overnight, was not disclosed in public reporting by the cutoff. Delhaize totals for Belgium and Luxembourg can overlap. Some national totals remained unsettled. Dutch default-password evidence does not apply to every victim. Finland reported suspected incidents that remained under investigation. CERT-IS issued a regional warning but did not identify an Icelandic victim. No reviewed source established a Latvian victim. Iceland and Latvia are therefore not included as affected countries. The source and event cutoff is 2026-11-04. Later findings are excluded.","summary":"Reported or confirmed refrigeration-control incidents affected approximately 150 named food-sector sites across Europe and three French Blood Establishment sites. Attackers changed temperature and defrost settings, and some disabled alerts. The incidents caused tons of spoiled food and losses of millions of euros. At the EFS, monitoring and an on-call technician caught the change overnight; staff secured the plasma, and no blood products or samples were lost. Public evidence confirms several access conditions, but no public source identifies a common actor or proves one coordinated operation."}]