-
Sandworm Doesn’t Need Zero-Days: Russia’s Most Dangerous Cyber Unit Exploits Already-Compromised Industrial Environments
Nozomi Networks’ analysis of 5.5 million alerts from 10 industrial customers reveals that Sandworm (APT44) systematically exploits already-compromised OT environments. Every infected system gave an average of 43 days of advance warning. After detection, Sandworm escalates — targeting PLCs, HMIs, and engineering workstations directly.
-
Backdooring PLCs at Scale: How Three CODESYS Vulnerabilities Let Attackers Own Industrial Control
Three CODESYS vulnerabilities (CVE-2025-41658/59/60) let attackers backdoor Soft PLCs from hundreds of manufacturers. Full attack chain analysis and defensive playbook for OT security teams.