Attack on Critical Infrastructure Leverages Template Injection
Summary: Cisco Talos identified an email-based attack targeting the energy sector, including nuclear power, in which malicious DOCX attachments such as fake environmental reports and resumés/CVs contain no malicious code but instead use template injection to pull a template file from an attacker-controlled external SMB server over TCP 445, silently harvesting user credentials. Talos observed the attackers targeting critical infrastructure and energy companies primarily in Europe and the United States since at least May 2017, and the injected template's Relationship ID rId1337 matched that of the phishing tool Phishery, though Talos said there is no evidence to confirm whether this was coincidence, tool reuse, or deliberate analysis evasion.
Why it matters: The attack worked because outbound TCP 445 traffic to public hosts was not blocked, and with no credential prompt needed for the SMB variant, a single opened attachment can hand over a critical infrastructure employee's credentials; Talos also notes that if an attacker compromises a host and runs such a server internally, the situation becomes significantly more grave.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026