Critical-Infrastructure on CuraSec

ThreatsDay Digest: IoT Botnet, Water Systems, SharePoint RCE

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: SharePoint RCE chain and AI-assisted botnet techniques are worth tracking, but the summary provides no CVE, EPSS, KEV, or patch target — read the full digest to identify whether any specific component you run is affected.
SOC/IR — Learn: C2 traffic hiding in public infrastructure and delayed-payload malware are tactically interesting detection themes, but no IOCs or ATT&CK mappings are surfaced here — use this as a prompt to review whether relevant log sources (DNS, proxy) would catch these patterns.
Leader — Learn: The mention of over 100 water systems targeted is notable for critical-infrastructure sector awareness, but this is a vague digest with no specifics suitable for a leadership brief or risk-register update.

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

Wed, 26 Aug 2026 11:42:13 +0000

Engineer — Skip
SOC/IR — Learn: Attribution of Iranian cyber actors to critical infrastructure breaches is useful for sector threat modeling, but the summary contains no IOCs, TTPs, or detection-ready material to act on.
Leader — Learn: Relevant geopolitical context for board-level risk briefings on nation-state threats to critical infrastructure, but no specific sectors or victims are named here, so no immediate exposure assessment is warranted.

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Siemens S7 PLCs are OT/ICS territory outside typical cloud/AppSec scope, but the technique of using AI-generated scripts disguised as legitimate monitoring tools is a design-relevant threat model for anyone operating industrial or hybrid environments.
SOC/IR — Plan: No IOCs are published yet, but a U.S. government active-threat designation warrants developing detections for anomalous PLC communication and tools impersonating legitimate monitoring agents in OT network segments; queue a hunt playbook now.
Leader — Act: A formal U.S. government active-threat warning against critical infrastructure is board-question territory — confirm this week whether your organization or OT vendors operate Siemens S7 equipment and brief leadership before they read it elsewhere.

US warns of AI-powered attacks on Siemens S7 PLCs in critical infrastructure

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Learn: AI-generated exploit scripts targeting Siemens S7 PLCs represents a novel offensive technique for ICS environments, but the thin summary offers no CVE, version range, or patch to act on. Engineers supporting OT/ICS should monitor for follow-on advisories with technical specifics.
SOC/IR — Learn: No IOCs, TTPs, or detection surface are described in this advisory, leaving nothing actionable to hunt or tune. Analysts in critical infrastructure sectors should track follow-up CISA publications for actor behaviors and log sources to enable.
Leader — Plan: A formal US government warning about AI-assisted attacks on critical infrastructure PLCs warrants a check of whether the organization operates or depends on Siemens S7 equipment, and a brief to OT security owners and relevant leadership before this surfaces in board-level news cycles.

CISA: Medusa ransomware breached 500+ critical infrastructure orgs

Wed, 19 Aug 2026 11:36:35 +0000

Engineer — Learn: The CISA/FBI advisory likely details initial-access vectors (historically RDP abuse and phishing) worth reviewing to validate existing hardening; no specific exploited CVE is surfaced in this summary, so no emergency patch action required.
SOC/IR — Act: Pull the full CISA advisory for Medusa IOCs and ATT&CK TTPs, then hunt for those indicators in endpoint and network telemetry dating back to mid-2021 if within retention; tune ransomware-staging detections against the published behaviors.
Leader — Act: A named campaign with 500+ confirmed critical-infrastructure victims backed by a joint CISA/FBI advisory is likely to generate board and customer questions this week; brief leadership on your sector’s exposure and confirm your ransomware IR plan and backup posture are current.

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Act: Fortinet and Schneider Electric products are named as actively exploited entry points in a joint US/South Korea advisory; audit Fortinet appliances and OT-facing Schneider devices for unpatched vulnerabilities and apply vendor patches immediately.
SOC/IR — Act: Joint government advisory signals published TTPs and IOCs are available; run a Gunra hunt across network and endpoint telemetry now, prioritizing environments in healthcare, financial services, or government sectors given the stated targeting pattern.
Leader — Act: A US/South Korea joint advisory naming specific critical-infrastructure sectors—healthcare, financial, government—warrants same-week action: confirm whether Fortinet or Schneider Electric products are in your estate and brief leadership before this appears in industry news.

Hackers Breach Polish CHP Plant via Private Cellular APN, Shut Turbine

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Learn: The attack entered through a private cellular APN used for remote OT equipment access — a network path often assumed to be isolated. Any org running OT/SCADA with cellular-based remote access should audit that network segment for authentication controls and lateral-movement barriers, but no patch or CVE applies here.
SOC/IR — Learn: No IOCs, no ATT&CK-mapped TTPs, and no detection signatures are available from this item. The incident pattern — cellular APN pivot to industrial control systems — is worth noting for OT-aware threat models, but there is no actionable hunt or detection to write from current reporting.
Leader — Learn: A confirmed OT attack that disrupted heat for 50,000 residents is a strong board-level illustration of critical-infrastructure risk via unconventional network paths. Leaders at energy or utilities firms should review whether similar remote-access architectures exist in their estate; for general enterprise CISOs, this is useful context for OT risk conversations.

Polish energy plant breached via private APN into OT network

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Learn: Illustrates how cellular private APN links can serve as overlooked OT ingress points — engineers managing hybrid IT/OT environments should review whether any private APN or cellular uplink bypasses standard network segmentation controls.
SOC/IR — Learn: No published IOCs, TTPs, or actor attribution are available from this incident, and it occurred over a year ago; useful context for understanding OT detection blind spots but yields no immediate hunt or detection work.
Leader — Skip

US & South Korea warn of Gunra ransomware targeting govt/critical infra

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Plan: A joint government advisory signals active ransomware targeting critical infrastructure; review backup integrity, network segmentation, and endpoint hardening against ransomware TTPs this quarter.
SOC/IR — Act: Joint advisory from US agencies and South Korea’s NPA indicates active Gunra ransomware campaign — hunt for associated TTPs and IOCs once the full advisory is reviewed, and ensure ransomware-stage detections (lateral movement, mass encryption) are tuned.
Leader — Plan: A US government warning about ransomware targeting critical infrastructure warrants briefing leadership and confirming your sector’s exposure; add Gunra to the risk register and verify incident response plans cover ransomware scenarios.

North Carolina Ports Authority confirms disruptive cyberattack

Sun, 09 Aug 2026 11:41:42 +0000

Engineer — Skip
SOC/IR — Learn: Active attack against maritime critical infrastructure with operational impact, but no IOCs, TTPs, or attribution have been published yet — monitor for follow-up reporting before initiating a hunt.
Leader — Learn: A confirmed attack disrupting multi-site port operations illustrates supply-chain and critical-infrastructure risk; useful context for board risk discussions but no vendor exposure to verify or immediate action required at this stage.

4,400+ Rockwell PLCs Exposed Online; 22 Near Water Utility Attack Sites

Fri, 07 Aug 2026 00:21:58 +0000

Engineer — Plan: If your organization runs Rockwell Automation PLCs, verify none are internet-facing — Forescout’s scan found 2,844 exposed in the US alone. No exploitation confirmed, but the attack surface is substantial; audit firewall rules and mobile-carrier connections to any OT assets this quarter.
SOC/IR — Learn: The correlation of 22 internet-exposed Rockwell PLCs in water utility attack cities is noteworthy context, but no IOCs, TTPs, or detection opportunities are surfaced — file as threat-landscape awareness for critical infrastructure hunting programs.
Leader — Plan: The pattern of water utility cyberattacks combined with thousands of internet-exposed industrial controllers warrants adding OT/ICS internet exposure to your next risk review; if your organization operates critical infrastructure or uses Rockwell equipment, request an exposure audit before this becomes a board question.

CISA/Australia guidance on isolating OT systems during cyberattacks

Wed, 29 Jul 2026 13:07:14 +0000

Engineer — Plan: Review the guidance and map your OT/IT network segmentation against CISA’s isolation playbook; identify which systems have manual fallback modes and document runbooks for emergency isolation this quarter.
SOC/IR — Plan: Use this guidance to pressure-test your IR playbooks for OT environments — specifically, ensure you have documented procedures for triggering OT isolation and know who owns that call.
Leader — Learn: Joint US/Australian guidance signals regulatory direction for critical infrastructure operators; useful context for board-level resilience discussions but no immediate action required absent a specific deadline or incident.

US and allies warn of Russian state hackers targeting routers

Mon, 13 Jul 2026 13:18:50 +0000

Engineer — Plan: The advisory targets vulnerable and misconfigured routers — audit your edge router configurations against the joint advisory’s hardening guidance and prioritize patching any unmanaged or end-of-life devices on the network perimeter this quarter.
SOC/IR — Plan: A nine-nation joint advisory signals a documented campaign with TTPs worth operationalizing; pull the full advisory for any ATT&CK mappings and IOCs and build or tune detections for lateral movement originating from router-adjacent network segments.
Leader — Plan: A coordinated advisory from nine countries on Russian state targeting of critical infrastructure raises the threat posture for the quarter — assess whether your sector is named in the advisory and prepare a brief for leadership on edge-device exposure and any vendor dependencies in that space.