Research and knowledge

Field notes from the work.

What we see in tests, labs and projects: the threat landscape, regulation and technical analysis. The posts themselves are in German.

Cyber attack on water supply, USA

OT-Sicherheit · Ali Recai Yekta

Attacks on critical infrastructure: US water utilities in the crosshairs

At the end of July 2026 the FBI and the EPA issued a public warning (PSA I-073026). Since 27 July, water and wastewater utilities in at least seven US states have reported attacks, in some cases with operational effects. The targets were Rockwell/Allen-Bradley MicroLogix 1100 and 1400 controllers that were openly reachable from the internet. In parallel, more than 30 municipal water systems in Minnesota were attacked.

Pragmatism in the OT SOC: how plant monitoring works in practice

OT-Sicherheit · Ali Recai Yekta

OT Security Made Simple podcast: pragmatism in the OT SOC

On "OT Security Made Simple" I talked to Klaus Mochalski about building OT SOCs. One point from it is worth repeating here. In OT security monitoring, the tools above all create visibility. On that basis the security team and the OT team take the decisions together.

Cybersecurity in smart cities, Ali Yekta, Yekta IT

Branchen & Kritische Infrastruktur

Cybersecurity in smart cities

At the Allianz Smart City meetup in Dortmund, current projects were presented: a climate sensor network, smart waste management, digital pillars. Each of these systems collects data to run the city better, from air quality to bin collection. Ali Recai Yekta spoke about the cybersecurity of smart cities and how their digital resilience can be raised. Every sensor is a device on a network, and can be attacked.

Yekta IT at the Nationale Konferenz IT-Sicherheitsforschung 2025

Branchen & Kritische Infrastruktur

Three and a half years of research into cybersecurity for road and rail

A rail vehicle runs for 30 to 40 years. The fleet that has to be secured is long since in service, and it cannot be swapped for secure new vehicles. Cars and trains today run software, are connected, and tie in external services. Attacks therefore have to be detected in the vehicles that exist, during operation, and without disturbing the safety-critical technology.

Railway security

Forschung & Projekte · Ali Recai Yekta

Applied OT security research: field experience from KRITIS sectors in rail and energy

A look back at the Forschungstag Cybersicherheit NRW: which results from our work in rail and energy environments we showed there, and what holds up in practice.

OT malware against water supply: ZionSiphon

OT-Sicherheit · Ali Recai Yekta

ZionSiphon: OT malware against Israeli water supply

On 16 April 2026 Darktrace published an analysis of malware called ZionSiphon, aimed at Israeli water and desalination plants. Dragos had examined the sample in March and reads ZionSiphon as an immature attempt at OT malware, possibly written with the help of an LLM. As a single sample it is not threatening. What it says about the threat landscape is worth reading anyway.

The path from an open VPN into the control system

OT-Sicherheit · Ali Recai Yekta

Coordinated cyber attacks on Poland's energy sector

On 29 December 2025 a wave of coordinated attacks hit at least 30 wind and solar farms, a combined heat and power plant and a manufacturing company in Poland. The CERT.pl report on it is worth reading closely. The attacks were not about extorting money; they were sabotage of critical infrastructure.

YekCity

Konferenzen & Events

YekCity at IT-Sicherheitstag NRW 2025 in Dortmund

The second public outing for YekCity, this time at the Kokerei Hansa: more than 500 attendees, mostly mid-sized companies from the region, and different questions from the ones we heard at it-sa.

Yekta IT at SECURWARE 2025 in Barcelona

Konferenzen & Events

Yekta IT at SECURWARE 2025 in Barcelona

A paper, a training session and a panel. From 26 to 30 October 2025 we were at SECURWARE, the Nineteenth International Conference on Emerging Security Information, Systems and Technologies, in Barcelona.

CRITIS 2025, vehicle security monitoring for critical infrastructure

Konferenzen & Events

Vehicle security monitoring for critical infrastructure (CRITIS 2025)

From 21 to 23 October 2025 we presented our current research at CRITIS 2025, the 20th International Conference on Critical Information Infrastructures Security, at Jönköping University in Sweden.

YekCity at it-sa 2025

Konferenzen & Events

YekCity premiere at it-sa 2025 in Nuremberg

Nine months of development, then the first public demonstration at the largest IT security trade fair in Europe. What operators of critical infrastructure, municipal utilities and energy suppliers wanted to know about YekCity.

Yekta IT at CPS-Sec 2025 in Avignon

Konferenzen & Events

Yekta IT presents UDS paper at CPS-Sec 2025 in Avignon

At the 10th IEEE International Workshop on Cyber-Physical Systems Security (CPS-Sec 2025), part of the IEEE Conference on Communications and Network Security (CNS) 2025 in Avignon, we presented our latest work on the security of vehicle diagnostic protocols.

Yekta IT at the Advanced Train Lab: cybersecurity for rail vehicles

Branchen & Kritische Infrastruktur

Yekta IT at the Advanced Train Lab: cybersecurity for rail vehicles

Modern rail vehicles are connected systems with complex communication structures. That connectivity brings efficiency, and it opens new ways in. In the FINESSE project we work on this, and recently ran a workshop with test runs at the Advanced Train Lab (aTL) in Schreibenberg.

Overlay Img

Branchen & Kritische Infrastruktur

Automotive cybersecurity: our demonstrator for hands-on vehicle security

The automotive industry has changed fundamentally: purely mechanical machines have become complex, connected computing platforms on wheels. An average new vehicle holds up to 150 electronic control units and more than 100 million lines of code, more than a modern airliner. Connectivity over CAN, Ethernet, Bluetooth, RFID, Wi-Fi and mobile networks opens up a great many new ways in.

Yekta IT at the Nationale Konferenz IT-Sicherheitsforschung 2025

Konferenzen & Events

Yekta IT at the Nationale Konferenz IT-Sicherheitsforschung 2025

Cybersecurity for the mobility of the future. From 17 to 19 March 2025 we were at the Nationale Konferenz IT-Sicherheitsforschung in Berlin, where around 450 people from research, industry and politics came together under the heading "Cybersecurity and democracy".

Overlay Img

OT-Sicherheit · Ali Recai Yekta

OT security for SMEs: the risk nobody sees in industry

A talk from IT-Sicherheitstag NRW 2024 on the growing threats to industrial control systems. Ali Recai Yekta took apart a dangerous assumption: a successful attack on industrial systems does not require OT specialists.

YekTrain, rail security by Yekta IT

Branchen & Kritische Infrastruktur

YekTrain, probably the smallest hackable train in the world

OT security in rail: the YekTrain as a research platform. Rail is becoming more digital and more connected, which puts OT security at the centre of the work. Modern trains are complex networks in which mechanical components, electronic control and digital systems interact.

AWS Cognito security | Yekta IT

IT-Sicherheit · Max Randhahn

The risks of AWS Cognito: a security analysis

One cross-site scripting flaw is enough to take over a user account in AWS Cognito. How the attack works, what it achieves and what prevents it.

VATT&EK framework presented at the ACM CSCS conference

Konferenzen & Events · Ali Recai Yekta

VATT&EK framework presented at the ACM CSCS conference

VATT&EK. Intelligent transport systems in automotive and rail face a growing number of cyber threats.

FINESSE, automotive and railway security, Yekta IT

Forschung & Projekte · Ali Recai Yekta

The FINESSE research project: our contribution to vehicle security

What Yekta IT contributes to the FINESSE consortium: attack detection for road and rail, from the sensor in the vehicle to the security operations centre of the operator.

Smart home IoT

The rise of IoT and what it means for security

From the voice assistant to the connected coffee machine: what connected devices do to the attack surface at home and at work, and where their security falls down.

Automotive cybersecurity, Yekta IT

Branchen & Kritische Infrastruktur · Marco Gren

Cybersecurity in automotive: the new threats

Automotive technology has moved a long way in recent years, from autonomous driving functions through to integration with the Internet of Things. That has changed driving, and it has brought new cybersecurity problems with it. This article looks at the current threats in the automotive industry.

Strengths and weaknesses | Yekta IT

The human factor in cybersecurity: strengths and weaknesses

The IBM Cyber Security Intelligence Index attributes 95 percent of successful attacks to human error. What that means concretely for phishing, ransomware and the role of the people in an organisation.

CAN bus

Branchen & Kritische Infrastruktur · Marco Gren

An introduction to the CAN bus: the basics and how it works

The Controller Area Network (CAN bus) is a message-based protocol built so that the electronic control units in a vehicle, and in other equipment, can communicate reliably and by priority. It lets a large number of control units talk to each other without a central computer and without wiring each one to every other. Bosch developed it in 1983, and it is still central today.

Next step

Questions about a topic?

Our consultants will place what is relevant to your situation.

Telephone

0231 39814905

Mon–Fri · 9am–5pm CET

Email

info@yekta-it.de

PGP key available

Location

Dortmund

Ruhrallee 9 · 44139