The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure Resilience
Researchers at Nozomi Networks Labs have recently discovered 20 distinct vulnerabilities in Advantech EKI wireless access points. These access points are known for their resilience in challenging environments and are thus used in diverse sectors, including the water sector.
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure Resilience & OT Vulnerability Management
The 2024 State of the Internet Report from Censys reveals data of over 145,000 internet-exposed ICS devices globally, with more than one-third located in the U.S. alone.
As artificial intelligence (AI) tools continue to proliferate among nearly all sectors and organizations, risks associated with their use will also continue to multiply. OWASP – the Open Worldwide Application Security Project – recently updated its list of the top dangers facing large language models (LLMs). The “OWASP Top 10 for LLM Applications 2025” explores the latest risks, vulnerabilities, and mitigations for developing and securing generative AI and LLMs across the development, deployment, and management lifecycle.
The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS security advisories, along with additional alerts, updates, and bulletins:
ICS Advisories:
The following posts are useful for general awareness of current cyber threats, vulnerabilities, guidance, and other cyber-related news or updates. These resources have been curated by the WaterISAC analyst team as items of broad relevance and benefit that do not need supplemental analysis at this time.
Critical Infrastructure Resilience & OT Vulnerability Management
Yesterday, CISA, the FBI, and the Australian Signal’s Australian Cyber Security Centre (ASD’s ACSC) released updates to their advisory #StopRansomware: BianLian Ransomware Group on observed tactics, techniques, and procedures (TTPs) and indicators of compromise attributed to data extortion group, BianLian.
Today, CISA released an advisory detailing the results of a red team assessment (RTA) conducted at the request of an unnamed critical infrastructure organization. The assessment and resulting advisory include the red team’s activity, tactics, techniques, and procedures (TTPs), and network defense activity, as well as lessons learned and key findings.
The Homeland Security Systems Engineering and Development Institute, sponsored by CISA and operated by MITRE, has released the 2024 CWE Top 25 Most Dangerous Software Weaknesses list. The Top 25 uses data from the National Vulnerability Database (NVD) to compile the most frequent and critical errors that can lead to serious vulnerabilities in software. CISA encourages users and administrators to review the Top 25 list and evaluate recommended mitigations to determine those most suitable to adopt.
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
