Research and knowledge

Field notes from the work.

What we see in tests, labs and projects: the threat landscape, regulation and technical analysis. The posts themselves are in German.

Rehearsed in the lab, then run on the plant: the same procedure twice, first where it is allowed to fail.

Yekta IT wins a European research project for OT penetration testing

Yekta IT is the only German company selected in Open Call 3 of the EU programme CYSSDE. The project is called OT-REX, runs for 18 months and covers plants in energy, rail and water.

Read the post

OT security · Ali Recai Yekta

Attacks on critical infrastructure: US water utilities in the crosshairs

At the end of July 2026 the FBI and the EPA issued a public warning (PSA I-073026). Since 27 July, water and wastewater utilities in at least seven US states have reported attacks, in some cases with operational effects. The targets were Rockwell/Allen-Bradley MicroLogix 1100 and 1400 controllers that were openly reachable from the internet. In parallel, more than 30 municipal water systems in Minnesota were attacked.

Read the post

Pragmatism in the OT SOC: how plant monitoring works in practice

OT security · Ali Recai Yekta

OT Security Made Simple podcast: pragmatism in the OT SOC

On "OT Security Made Simple" I talked to Klaus Mochalski about building OT SOCs. One point from it is worth repeating here. In OT security monitoring, the tools above all create visibility. On that basis the security team and the OT team take the decisions together.

Read the post

Sectors and critical infrastructure

Cybersecurity in smart cities

At the Allianz Smart City meetup in Dortmund, current projects were presented: a climate sensor network, smart waste management, digital pillars. Each of these systems collects data to run the city better, from air quality to bin collection. Ali Recai Yekta spoke about the cybersecurity of smart cities and how their digital resilience can be raised. Every sensor is a device on a network, and can be attacked.

Read the post

Yekta IT at the Nationale Konferenz IT-Sicherheitsforschung 2025

Sectors and critical infrastructure

Three and a half years of research into cybersecurity for road and rail

A rail vehicle runs for 30 to 40 years. The fleet that has to be secured is long since in service, and it cannot be swapped for secure new vehicles. Cars and trains today run software, are connected, and tie in external services. Attacks therefore have to be detected in the vehicles that exist, during operation, and without disturbing the safety-critical technology.

Read the post

Research and projects · Ali Recai Yekta

Applied OT security research: field experience from KRITIS sectors in rail and energy

A look back at the Forschungstag Cybersicherheit NRW: which results from our work in rail and energy environments we showed there, and what holds up in practice.

Read the post

OT malware against water supply: ZionSiphon

OT security · Ali Recai Yekta

ZionSiphon: OT malware against Israeli water supply

On 16 April 2026 Darktrace published an analysis of malware called ZionSiphon, aimed at Israeli water and desalination plants. Dragos had examined the sample in March and reads ZionSiphon as an immature attempt at OT malware, possibly written with the help of an LLM. As a single sample it is not threatening. What it says about the threat landscape is worth reading anyway.

Read the post

The path from an open VPN into the control system

OT security · Ali Recai Yekta

Coordinated cyber attacks on Poland's energy sector

On 29 December 2025 a wave of coordinated attacks hit at least 30 wind and solar farms, a combined heat and power plant and a manufacturing company in Poland. The CERT.pl report on it is worth reading closely. The attacks were not about extorting money; they were sabotage of critical infrastructure.

Read the post

Conferences and events

YekCity at IT-Sicherheitstag NRW 2025 in Dortmund

The second public outing for YekCity, this time at the Kokerei Hansa: more than 500 attendees, mostly mid-sized companies from the region, and different questions from the ones we heard at it-sa.

Read the post

Conferences and events

Yekta IT at SECURWARE 2025 in Barcelona

A paper, a training session and a panel. From 26 to 30 October 2025 we were at SECURWARE, the Nineteenth International Conference on Emerging Security Information, Systems and Technologies, in Barcelona.

Read the post

CRITIS 2025, vehicle security monitoring for critical infrastructure

Conferences and events

Vehicle security monitoring for critical infrastructure (CRITIS 2025)

From 21 to 23 October 2025 we presented our current research at CRITIS 2025, the 20th International Conference on Critical Information Infrastructures Security, at Jönköping University in Sweden.

Read the post

Conferences and events

YekCity premiere at it-sa 2025 in Nuremberg

Nine months of development, then the first public demonstration at the largest IT security trade fair in Europe. What operators of critical infrastructure, municipal utilities and energy suppliers wanted to know about YekCity.

Read the post

Conferences and events

Yekta IT presents UDS paper at CPS-Sec 2025 in Avignon

At the 10th IEEE International Workshop on Cyber-Physical Systems Security (CPS-Sec 2025), part of the IEEE Conference on Communications and Network Security (CNS) 2025 in Avignon, we presented our latest work on the security of vehicle diagnostic protocols.

Read the post

Sectors and critical infrastructure

Yekta IT at the Advanced Train Lab: cybersecurity for rail vehicles

Modern rail vehicles are connected systems with complex communication structures. That connectivity brings efficiency, and it opens new ways in. In the FINESSE project we work on this, and recently ran a workshop with test runs at the Advanced Train Lab (aTL) in Schreibenberg.

Read the post

Sectors and critical infrastructure

Automotive cybersecurity: our demonstrator for hands-on vehicle security

The automotive industry has changed fundamentally: purely mechanical machines have become complex, connected computing platforms on wheels. An average new vehicle holds up to 150 electronic control units and more than 100 million lines of code, more than a modern airliner. Connectivity over CAN, Ethernet, Bluetooth, RFID, Wi-Fi and mobile networks opens up a great many new ways in.

Read the post

Conferences and events

Yekta IT at the Nationale Konferenz IT-Sicherheitsforschung 2025

Cybersecurity for the mobility of the future. From 17 to 19 March 2025 we were at the Nationale Konferenz IT-Sicherheitsforschung in Berlin, where around 450 people from research, industry and politics came together under the heading "Cybersecurity and democracy".

Read the post

OT security · Ali Recai Yekta

OT security for SMEs: the risk nobody sees in industry

A talk from IT-Sicherheitstag NRW 2024 on the growing threats to industrial control systems. Ali Recai Yekta took apart a dangerous assumption: a successful attack on industrial systems does not require OT specialists.

Read the post

Sectors and critical infrastructure

YekTrain, probably the smallest hackable train in the world

OT security in rail: the YekTrain as a research platform. Rail is becoming more digital and more connected, which puts OT security at the centre of the work. Modern trains are complex networks in which mechanical components, electronic control and digital systems interact.

Read the post

IT security · Max Randhahn

The risks of AWS Cognito: a security analysis

One cross-site scripting flaw is enough to take over a user account in AWS Cognito. How the attack works, what it achieves and what prevents it.

Read the post

Conferences and events · Ali Recai Yekta

VATT&EK framework presented at the ACM CSCS conference

VATT&EK. Intelligent transport systems in automotive and rail face a growing number of cyber threats.

Read the post

FINESSE, automotive and railway security, Yekta IT

Research and projects · Ali Recai Yekta

The FINESSE research project: our contribution to vehicle security

What Yekta IT contributes to the FINESSE consortium: attack detection for road and rail, from the sensor in the vehicle to the security operations centre of the operator.

Read the post

IT security

The rise of IoT and what it means for security

From the voice assistant to the connected coffee machine: what connected devices do to the attack surface at home and at work, and where their security falls down.

Read the post

Sectors and critical infrastructure · Marco Gren

Cybersecurity in automotive: the new threats

Automotive technology has moved a long way in recent years, from autonomous driving functions through to integration with the Internet of Things. That has changed driving, and it has brought new cybersecurity problems with it. This article looks at the current threats in the automotive industry.

Read the post

IT security

The human factor in cybersecurity: strengths and weaknesses

The IBM Cyber Security Intelligence Index attributes 95 percent of successful attacks to human error. What that means concretely for phishing, ransomware and the role of the people in an organisation.

Read the post

Next step

Questions about a topic?

Our consultants will place what is relevant to your situation.

Get in touch

Telephone

0231 39814905

Mon–Fri · 9am–5pm CET

info@yekta-it.de

Location

Dortmund

Ruhrallee 9 · 44139