Loading story…
The UK government has launched an investigation into whether over 2,500 Chinese-manufactured Yutong electric buses operating in the country could be remotely disabled by their manufacturer. This probe was initiated after authorities in Norway and Denmark discovered that similar Yutong buses in their countries had SIM-enabled telematics systems, which allowed for remote control of critical functions such as battery and power, raising concerns that the vehicles could be stopped or rendered inoperable from afar. The Department for Transport and the National Cyber Security Centre are leading the assessment to determine if UK buses are exposed to the same vulnerabilities.
The investigation follows reports that Norwegian and Danish authorities found remote diagnostic and control capabilities in these buses, potentially exposing vehicle controls to unauthorized access. The UK is now evaluating the risk that these remote-access features could pose to public safety and national infrastructure, particularly if exploited by a malicious actor or during geopolitical tensions. The findings could have significant implications for the security of critical transportation assets and the procurement of foreign-manufactured vehicles with embedded telematics technology.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
The UK government began investigating whether telematics vulnerabilities in more than 2,500 Chinese-made Yutong electric buses could allow them to be remotely disabled. The probe followed similar concerns previously raised in Norway and Denmark.
North Korean APT group Konni, also known as APT37, was reported to be using spear-phishing and KakaoTalk malware propagation to abuse Google's Find Hub feature and remotely wipe Android devices in South Korea. The disclosure added new technical detail on the group's tactics.
OWASP published an updated Top 10 list of web application risks that adds categories covering software supply chain failures and vulnerability disclosure failures. The revision reflects changing priorities in application security.
Microsoft released security updates for 63 vulnerabilities, including a critical zero-day tracked as CVE-2025-62215. The release highlighted ongoing patch-management risks for defenders.
Hyundai AutoEver America disclosed a breach that may have exposed the data of approximately 2.7 million individuals. The roundup cites the incident as a newly reported large-scale exposure.
Authorities in Norway and Denmark previously found vulnerabilities in Chinese-made Yutong electric buses that raised concerns they could be remotely disabled. These findings preceded the UK's review of similar risks.
Conduent disclosed that it experienced a breach in January 2025. The company later said the incident is expected to cost at least $50 million and has triggered lawsuits and regulatory investigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European public transport operators in the UK, Norway, and Denmark are investigating cybersecurity vulnerabilities in Chinese-made Yutong electric buses, following concerns that the manufacturer could remotely access and potentially disable vehicles. The UK government, in coordination with the National Cyber Security Centre, is assessing the risk after Norwegian operator Ruter identified that Yutong has direct digital access to each bus for software updates and diagnostics, including critical systems like battery and power management. Operators have implemented measures such as disconnecting buses from the internet to retain local control, while the UK Department for Transport has acknowledged the seriousness of the issue and is working with intelligence agencies to mitigate potential risks. Simultaneously, Danish and Norwegian transport providers are urgently probing the same security flaw, highlighting broader European fears about reliance on Chinese technology and the risk of remote tampering or control amid geopolitical tensions. Yutong, the world’s largest bus manufacturer, has stated that it complies with all safety and data privacy standards, storing EU vehicle data securely and requiring customer authorization for system access. The investigations underscore the potential for remote deactivation of connected vehicles and the need for robust cybersecurity measures in critical public infrastructure.
Jun 29, 2026
Dark Reading reported on several region-specific cyber-risk themes rather than a single discrete incident. The World Economic Forum’s *Global Cybersecurity Outlook 2026* found **Latin American and Caribbean organizations have the lowest confidence** in their countries’ ability to defend critical infrastructure (13% confident vs. 37% globally), citing under-resourced cyber-resilience and incident-response capabilities as digital infrastructure expands. Separately, a Dark Reading commentary described **growing European anxiety about overreliance on US technology and cybersecurity vendors**, framing it as a strategic and sovereignty concern rather than a specific breach or vulnerability disclosure. Australia also opened a national-security review into **Chinese-made Yutong electric buses** deployed in major cities, following researcher reporting that the vehicles’ connectivity and remote-management features could be abused and that a “kill switch” scenario is a perceived risk in a crisis (the article notes the reality is more complex than the headline framing). A ZDNET leadership piece echoed the broader theme that **technology and cybersecurity decisions are increasingly treated as national-security bets**, but it is largely strategic guidance and executive commentary rather than actionable threat intelligence.
Jun 29, 2026
Security researcher Dan Hreszczuk of Fortify Labs demonstrated remote access to a BYD Shark 6 through an allegedly unprotected, passwordless entry point. In a controlled test near Canberra, he manipulated door locks, headlights, windscreen wipers and washer, infotainment display, audio volume, and music while the vehicle was being driven; he also tracked its location and activated the cabin microphone. The vehicle’s brakes and cameras were not accessible in the demonstration. The test showed that captured in-cabin voice audio could be used to interact with Siri on an unlocked phone and obtain personal information. The exposure highlights privacy and safety risks in connected vehicles and has renewed attention on Australia’s lack of mandatory automotive cybersecurity standards, while the government consults on potential requirements.
Sep 23, 2026