All news with #critical infrastructure tag

⚠️ CISA warns that Radiometrics VizAir systems (versions prior to 08/2025) contain multiple critical vulnerabilities — including missing authentication for admin functions and an exposed REST API key — assigned CVE-2025-61945, CVE-2025-54863, and CVE-2025-61956 and rated CVSS v4 10.0. Remote attackers could alter weather parameters, disable alerts, manipulate runway settings, and extract sensitive meteorological data, potentially disrupting airport operations. Radiometrics has deployed updates to affected systems; CISA recommends minimizing network exposure, isolating control networks, and using secure remote access methods.

🔒 ISO 15118-2-compliant EV charging implementations using the SLAC protocol are vulnerable to spoofed measurements that can enable man‑in‑the‑middle attacks between vehicles and chargers, tracked as CVE-2025-12357 (CVSS v4 7.2). The issue is an improper restriction of communication channel (CWE-923) and may be exploitable wirelessly at close range via electromagnetic induction. ISO recommends using TLS (required in ISO 15118-20) with certificate chaining; CISA advises minimizing network exposure, isolating control networks, and using secure remote access methods.

⚠️ The Greens are calling for a rapid, pre-Christmas security offensive to counteract sabotage, espionage and cyberattacks, saying the federal government is moving too slowly to act. Parliamentary deputies Konstantin von Notz and Irene Mihalic welcome recognition of the threat by Chancellor Friedrich Merz and Interior Minister Alexander Dobrindt but demand immediate, concrete measures and activation of the National Security Council. They also press for a major intelligence service reform and criticize weaknesses in the draft bill to transpose NIS-2 obligations, warning exemptions and gaps would undermine resilience across public administration, municipalities and critical infrastructure.

⚠️ The Canadian Centre for Cyber Security warns that hacktivists recently breached multiple internet-exposed industrial control systems across Canada. Attackers modified settings at a water treatment facility, an oil and gas site (manipulating an Automated Tank Gauge), and a farm grain dryer, causing disruptions, false alarms, and potentially unsafe conditions. Authorities describe the intrusions as opportunistic attempts to attract media attention and erode public trust rather than highly sophisticated campaigns. The bulletin urges organizations to inventory exposed ICS assets, remove direct internet access, use VPNs with two‑factor authentication, keep firmware updated, and report suspicious activity.

⚠️ The German Federal Office for Information Security (BSI) warns that the majority of an estimated 33,000 publicly reachable Microsoft Exchange Server 2016 and 2019 installations still operate without vendor support after 14 October 2025. Without security updates, new critical Exchange vulnerabilities cannot be patched and affected systems may need to be taken offline to avoid compromise. The BSI highlights rapid network-wide compromise and ransomware risk and urges prompt upgrades, migrations, or protective measures such as VPNs or IP restrictions.

🔒 On October 25, 2025 the ransomware group Everest listed state grid operator Svenska kraftnät on its darknet leak site, claiming about 280 GB of stolen data. Svenska kraftnät confirmed on October 26 that attackers accessed certain sensitive information via an isolated external file-transfer solution and said investigations are underway. The utility — which operates roughly 16,000 km of high-voltage lines — said there is currently no indication the physical grid was affected and that it is coordinating with police and national cybersecurity authorities.

🛡️ Cloudflare assisted the Moldovan Central Election Commission (CEC) during the September 28, 2025 parliamentary vote, rapidly onboarding election sites and deploying mitigations under the Athenian Project. On election day Cloudflare mitigated over 898 million malicious requests across multiple DDoS waves, including a peak of 324,333 rps, keeping official result reporting and civic sites online. Automated defenses and coordination with STISC ensured no interruptions to public access and authoritative information.

🔍 This post introduces a reproducible, data-driven framework to quantify Internet resilience, motivated by the July 8, 2022 Rogers outage that affected millions. It defines resilience as the ability of a national or regional ecosystem to maintain diverse, secure routing and rapidly recover from failures. The framework combines public sources (RouteViews, RIPE RIS, traceroutes, IXPs, submarine cable maps) and focuses on measurable metrics such as RPKI, ROV, IXP distribution, submarine cable diversity, AS path diversity, and impact-weighted assessments.

🌐 In Q3 2025 Cloudflare observed a wide range of Internet disruptions affecting governments, carriers, and infrastructure worldwide. Incidents included government-directed shutdowns in Sudan, Syria, Iraq, Venezuela, and Afghanistan; submarine and terrestrial cable cuts; power outages; a major earthquake; a targeted cyberattack; and technical failures such as Great Firewall anomalies and Starlink outages. The post synthesizes observed traffic losses using Cloudflare Radar metrics.

🔒 A recent PPI survey of 50 banks and 53 insurers in Germany reports a sixfold rise in cyberattacks compared with 2021. Sixty-four percent of respondents now view cyberattacks as the sector's top challenge, ahead of digitization, credit quality and regulation. Firms cite low employee awareness and difficulty with real-time detection; malware installation and IT disruption are the most frequent attack types.

🔒 Cyber-physical systems (CPS) underpin critical infrastructure across industry, healthcare and buildings, and their continuous availability is essential to public safety and business continuity. The article urges CISOs to prioritize CPS security, invest in OT protection, close long-standing IT–OT silos and maintain accurate asset inventories. It highlights that many organizations lack OT incident response or business continuity plans and emphasizes that rapid recovery, segmentation and tested emergency procedures are key to minimizing downtime and harm. Analysts warn of steep recovery times and severe financial and human impacts if CPS resilience is not improved.

🔒 The cyberattack on Jaguar Land Rover in late August forced a global shutdown of IT systems and halted production across its factories. According to the Cyber Monitoring Centre, the weeks-long outage inflicted an estimated £1.9 billion in losses and affected more than 5,000 organizations, including suppliers and dealers. The UK government intervened with guarantees and up to £1.5 billion in support to secure the supply chain as production is gradually resumed.

🔍 China’s security authorities publicly accused the US National Security Agency of a covert operation against the National Time Service Center, alleging an SMS-service vulnerability was exploited beginning March 25, 2022 to compromise staff phones and steal data. Experts told CSO the claim is technically plausible but there is no public forensic evidence to confirm it conclusively. The alleged intrusion could affect Beijing Time, potentially disrupting communications, finance, power, transportation and space operations. Security specialists recommend hardening time infrastructure, avoiding SMS-based privileged logins, validating clocks against multiple trusted references, deploying cryptographic attestation for time signals, and following guidance from CISA.

🔍 China’s Ministry of State Security has accused the U.S. National Security Agency of conducting cyber intrusions against the National Time Service Center in Xi'an, alleging activity beginning in March 2022. The statement says the campaign initially exploited vulnerabilities in employees’ mobile phones and later affected center computers. Beijing warned that the center’s role in providing official time underpins communications, finance and power systems, and that interference could cause major disruptions. U.S. officials did not immediately respond to the allegation.

🔒 A foreign threat actor exploited unpatched Microsoft SharePoint vulnerabilities to infiltrate the Kansas City National Security Campus (KCNSC), which produces most non‑nuclear components for U.S. nuclear weapons. Honeywell FM&T, which manages the site for the NNSA, and the Department of Energy did not respond to requests for comment. Federal responders, including the NSA, were onsite in early August after Microsoft issued fixes on July 19. Attribution remains disputed between Chinese-linked groups and possible Russian actors; there is no public evidence that classified information was taken.

🕒 The Chinese Ministry of State Security (MSS) has accused the U.S. National Security Agency (NSA) of a "premeditated" multi-stage cyber intrusion targeting the National Time Service Center (NTSC), which manages Beijing Time. The MSS says the campaign began with SMS-based compromises of staff devices in March 2022 and escalated through credential reuse and a deployed "cyber warfare platform" between August 2023 and June 2024. According to the statement, the platform employed 42 specialized tools, forged digital certificates, and high-strength encryption while routing traffic through VPSes across the U.S., Europe, and Asia; Chinese agencies say they detected, neutralized the activity, and reinforced defenses.

🔒 Fortinet participated in the World Economic Forum’s Annual Meeting on Cybersecurity (AMC25) in Dubai, engaging government, industry, and civil leaders to advance global cyber resilience. Fortinet executives Dr. Carl Windsor and Derek Manky led sessions on public‑private collaboration, frameworks for scaling disruption, and the role of the Cybercrime Atlas in enabling coordinated action. They highlighted recent coordinated operations and impact reported in the 2025 Cybercrime Atlas: Impact Report, emphasizing that aligning policy, governance, and technical intelligence is essential to protect supply chains, AI systems, and critical infrastructure.

⚠️ Shadowserver Foundation reports 266,978 internet-exposed F5 BIG-IP instances after F5 disclosed a breach in which nation-state actors stole source code and information on undisclosed BIG-IP flaws. F5 issued patches addressing 44 vulnerabilities and urged immediate updates for BIG-IP, F5OS, BIG-IQ, and related products. CISA issued an emergency directive requiring federal agencies to patch or mitigate affected devices by set deadlines. Nearly half of the detected instances are in the United States, with most others across Europe and Asia.

⚠️Threat actors exploited a Cisco SNMP vulnerability (CVE-2025-20352) to achieve remote code execution on legacy IOS XE switches and install custom, largely fileless Linux rootkits that hook into the IOSd memory space, set universal passwords (including one containing 'Disco'), and hide processes and network activity. The rootkits spawn a UDP-based controller to toggle or zero logs, bypass access controls, and reset running-config timestamps to mask changes. Trend Micro also observed spoofed IP/MAC addresses and attempts to combine a retooled Telnet memory-access exploit to deepen persistence.

⚠️ A YouGov survey commissioned by the digital policy briefing Digitalwende for Süddeutsche Zeitung Dossier reports that 61% of more than 2,000 respondents view the threat from hybrid attacks as strong or very strong. The poll describes hybrid attacks as combinations of cyber operations, military actions and disinformation aimed at destabilizing societies. Perceived risk differs by party: Greens (72%), Union (71%), SPD (67%) and AfD (49%).