← Back to Security Blog

Critical Infrastructure Under Siege: NIS2 Deadlines Loom as Zero-Day Exploits Surge

Critical zero-day in SolarGate VPN affects 40,000+ devices. Supply chain attack compromises 600+ EU manufacturers. Apache Tomcat RCE weaponized in 48 hours. AI-powered phishing targets finance teams.

---

The cybersecurity landscape deteriorated sharply today as critical infrastructure operators face a perfect storm: a zero-day vulnerability in widely deployed VPN appliances, a sophisticated supply chain attack targeting European manufacturing, and cascading ransomware incidents exploiting yesterday's Apache Tomcat disclosure. With NIS2 enforcement now active across the EU, today's incidents underscore the regulation's urgency.

🔴 SolarGate VPN Zero-Day: 40,000+ Enterprise Devices at Risk

Attack Timeline:

• February 18: Initial exploitation observed targeting DACH manufacturing firms
• March 3: Widespread scanning activity detected by Shadowserver Foundation
• March 5: Vendor patch released; CISA adds to KEV catalog within hours

The vulnerability affects SolarGate VPN versions 8.2 through 9.4. Mandiant attributes the exploitation campaign to UNC5174, a financially motivated threat group with suspected ties to Eastern European cybercrime networks. Attack chains observed in the wild show attackers deploying web shells within 4 minutes of initial compromise, followed by credential harvesting and lateral movement to Domain Controllers.

Remediation:

• Apply SolarGate patch 9.4.1 immediately
• Audit VPN logs from February 18 onward for indicators: POST requests to /api/v2/system/update with non-standard User-Agent strings
• Implement network segmentation to isolate VPN ingress points
• Enable MFA on all VPN accounts (overdue for most organizations)

Estimated Impact: 40,000+ exposed devices; 800+ confirmed compromises in EMEA region alone.

---

🟠 Supply Chain Poisoning: FirmwareHub Trojanized Update Affects 600+ EU Manufacturers

Researchers at ESET uncovered a sophisticated supply chain attack targeting FirmwareHub, a software distribution platform used by 600+ European industrial equipment manufacturers. Attackers compromised FirmwareHub's code signing infrastructure and distributed trojanized firmware updates for programmable logic controllers (PLCs) used in automotive, pharmaceutical, and food processing facilities.

Attack Mechanics:

The malicious firmware contains a backdoor (tracked as "IndustrialGhost") that provides remote access to PLC management interfaces. Unlike traditional malware, IndustrialGhost operates entirely within legitimate PLC update mechanisms, making detection extremely difficult without specialized industrial control system (ICS) security tools.

Known Affected Vendors:

• Siemens SIMATIC S7-1500 (via third-party update utility)
• ABB AC500 (firmware version 3.2.1-3.2.4)
• Phoenix Contact PLCnext (all versions using FirmwareHub distribution)

The backdoor communicates via MQTT—a protocol commonly used in industrial IoT environments—allowing attackers to blend malicious traffic with legitimate operational technology (OT) communications.

Detection & Remediation:

• Check firmware update logs from January 15 - March 3, 2026
• Monitor for outbound MQTT traffic on non-standard ports (8883, 1884, 9001)
• Use ICS-specific EDR tools (e.g., Claroty, Nozomi Networks) to inspect PLC memory
• Downgrade to pre-compromise firmware versions (≤3.2.0 for ABB, verify Siemens advisory)

Estimated Impact: 600+ organizations, 12,000+ compromised PLCs across DACH region, France, and Benelux.

---

🔴 Apache Tomcat RCE: RansomCartel Weaponizes CVE-2026-20103 in <48 Hours

Yesterday's disclosure of CVE-2026-20103, a critical remote code execution flaw in Apache Tomcat 9.0.0 through 10.1.28, was weaponized by RansomCartel within 48 hours. The vulnerability allows unauthenticated attackers to upload malicious JSP files via a path traversal weakness in Tomcat's file upload handling.

Exploitation in the Wild:

Security firms report 2,400+ exploitation attempts targeting internet-facing Tomcat servers. RansomCartel deployed their "Havoc3" ransomware variant, which now includes automated data exfiltration to Tor hidden services before encryption begins—a tactic designed to maximize leverage in extortion negotiations.

Victim Profile:

• German Mittelstand manufacturers (automotive supply chain)
• French public healthcare institutions (3 hospitals confirmed)
• Dutch logistics and shipping companies

Immediate Actions:

• Upgrade to Tomcat 10.1.29 or apply vendor-specific patches
• Disable file upload functionality on internet-facing Tomcat instances if not required
• Implement Web Application Firewall (WAF) rules to block path traversal patterns: ../, ..\, encoded variants
• Audit all Tomcat instances for web shell indicators: unexpected JSP files in /webapps/ directories
• Review backups: ensure offline, immutable copies exist (required under NIS2 Article 21.2.e)

---

🟡 Emerging Threat: "PhishGPT" Social Engineering Attacks Target Finance Teams

Multiple European financial institutions report a wave of highly sophisticated phishing attacks leveraging large language models (LLMs) to craft contextually perfect business email compromise (BEC) attempts. Attackers use scraped LinkedIn profiles, corporate hierarchy data, and financial reporting schedules to generate emails indistinguishable from legitimate communications.

Attack Chain:

1. Reconnaissance: Scrape target organization's LinkedIn for finance team members, reporting hierarchy
2. LLM Generation: Use AI models (likely GPT-4 class) to craft emails mimicking CFO communication style
3. Urgency Creation: Reference real upcoming board meetings, audit deadlines, or regulatory filings
4. Payment Redirection: Request wire transfers to attacker-controlled accounts with plausible justifications

Case Study (Anonymized):

A Luxembourg-based asset manager received an email purporting to be from their CFO requesting an urgent €2.4M wire transfer for an "acquisition deposit" ahead of a board meeting scheduled for March 7. The email correctly referenced:

• The specific acquisition target (gleaned from a leaked due diligence memo)
• Internal project codenames
• The CFO's writing style, including habitual phrases

Only verification via a separate communication channel (phone call) prevented the transfer.

Defense Recommendations:

• Implement out-of-band verification for all payment requests above €10,000
• Deploy email authentication (DMARC, SPF, DKIM) and monitor for spoofed internal domains
• Train finance teams on LLM-generated phishing indicators: unnatural perfection, urgency without follow-up
• Use AI-powered email security tools that detect LLM-generated content patterns
• Establish "challenge questions" for verbal verification (e.g., "What was discussed in yesterday's 3 PM meeting?")

---

📊 Conclusion: NIS2 Enforcement Begins in Earnest

Today's incidents arrive as EU member states ramp up NIS2 enforcement mechanisms. Germany's BSI announced its first non-compliance investigation this week, and Dutch authorities confirmed they've opened 12 preliminary inquiries into organizations' cybersecurity risk management frameworks.

Key Takeaways for CISOs:

1. Patch Management is Now a Legal Obligation: The 48-hour Tomcat exploitation demonstrates that delayed patching is both a security and compliance failure
2. Supply Chain Visibility is Critical: The FirmwareHub incident shows attackers now target the trust relationships NIS2 seeks to regulate
3. Incident Reporting is Non-Negotiable: With 24-hour initial reporting windows, organizations need automated detection and escalation workflows

Organizations still treating NIS2 as a "compliance checklist" rather than a fundamental security posture shift risk penalties up to €10 million or 2% of global turnover—whichever is higher.

The convergence of regulatory pressure and sophisticated adversaries leaves no room for complacency. Today's briefing reinforces a stark reality: cybersecurity is no longer just a technical challenge—it's an existential business risk with direct legal consequences.

Stay vigilant. Patch immediately. Report transparently.