Free OT/ICS Cybersecurity Threat Intel You Can Use
Top threat: Tampering with internet-reachable refrigeration controllers; the 1–2 Nov wave hit stores in at least 11 countries; Copeland confirmed its xweb controllers were targeted.
Confirmed OT attack: Refrigeration: France in October, then about 11 countries on 1–2 Nov; claimed by pro-Russian groups on 5 Nov, unverified.
Also watching: PHP2Shell in grid and DCS products; Siemens IoT2050 Node-RED flaw now exploited; Volt Typhoon; Cisco and Ivanti KEV flaws.
What would raise it: Confirmed OT disruption in a second sector, or live nation-state hands-on OT activity.
Supermarket refrigeration attacks now reach at least 11 European countries, with Germany, Romania and the UK added, three weeks after France lost about 700 stores
Refrigeration at supermarkets across Europe was tampered with overnight on 1–2 November, about three weeks after roughly 700 French stores were hit. Officials count at least 11 countries, including Germany, Romania and the UK, and in Ireland 13 SuperValu stores pulled stock. Attackers reached internet-exposed controllers and switched them into defrost, pushing some units to 50°C. On 5 November the pro-Russian groups NoName057(16) and Z-Pentest claimed the attacks on Telegram and said they hold Danfoss credentials; that claim is unverified and the channels have since disappeared. Copeland confirmed its xweb controllers were targeted, and Belgian prosecutors are investigating. For defenders, web-managed refrigeration controllers and contractor remote access are being used to spoil stock, so every internet-reachable site is exposed.
PHP shipped its PHP2Shell fixes on 21 October; on 23–24 October a suspected China-nexus actor chained the flaws with Linux kernel bug CVE-2026-46300 to root about two dozen exposed PAN-OS devices, which Unit 42 verified on 29 October (see top story). In the same week CISA added a Cisco ASA/FTD remote-access VPN zero-day that reloads the firewall (29 October) and two more Ivanti Connect Secure flaws that chain to root (30 October) to KEV (see Critical Advisories). None of these devices runs a control loop, but each sits on a path vendors and operators use to reach one.
The Record (PHP2Shell intrusions)Between 28 and 30 October PHP2Shell moved from web servers into major OT vendors’ advisories: Siemens added web and monitoring components of its Spectrum Power grid-control systems, AMIS TS and Energy Engage (29 October), Schneider added a Foxboro DCS server (28 October), and ABB listed Netcontrol RTUs and ASPECT (no fix yet) and end-of-life Arctic gateways it will not fix (29–30 October). Hitachi Energy’s 27 October CoreTec advisory likewise carries a Linux kernel flaw with public exploit code, and the kernel bug used against the firewalls is also listed for Siemens’ S7-1500 MFP CPU. For bundled components the fix date is set by the OT vendor, not the upstream project, which is why several of these have no fix yet (editorial assessment).
Siemens SSA-166980 (PHP2Shell)Lumen’s 28 October “Silent Train” report says Volt Typhoon has used rotating single-use relay chains since November 2023 to exploit zero-days in SD-WAN, VeloCloud, N-able N-central, Versa and (likely) Quest KACE management platforms, with water, energy, rail, maritime and aviation among the victim sectors and no OT access described (see Threat Intelligence & Research). The suspected China-nexus PHP2Shell intruders likewise rooted firewall management servers (see top story). Management and orchestration platforms often hold trusted paths into plant networks (editorial assessment).
Lumen Black Lotus Labs (Silent Train)Overnight on 1–2 November, refrigeration at supermarkets in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and others was tampered with or failed, and on 4 November officials confirmed Germany, Romania and the UK as well, three weeks after about 700 French stores were hit (see top story). Bloomberg’s 27 October review documents Russia-aligned crews tampering with exposed water, food, HVAC and factory controls since 2024, including a Danish waterworks attack officially attributed to Z-Pentest (see Incidents & Attacks). On 29 October Reuters reported that the Pentagon is treating August freezer failures at no fewer than six US commissaries as a suspected cyberattack, and that investigators have spoken with French police about the 11–13 October supermarket attack; the US cause is unconfirmed. On 22 October Forescout counted 12,976 internet-exposed refrigeration management services in 99 countries. On 4 November a Le Canard enchaîné–sourced report said freezer setpoints at the French blood service were altered overnight on 1–2 November through its cooling contractor with no operational impact; this is unconfirmed and not linked to the supermarket cases.
The Next Web (Reuters, base freezers)On 3 November the UK NCSC’s State of the Cyber Nation report forecast AI-enabled ransomware against UK power, airports and hospitals by 2028 (see Regulation & Policy). On 27 October The Register reported that Causal Security’s agent found four EPICS Base flaws in under four hours (see Critical Advisories). On 29 October CrowdStrike reported that China-nexus VAPOR PANDA is running intrusions through ARTEX, an agentic-AI framework steered by a human operator, and confirmed post-exploitation at nine organisations; it describes no OT targeting. SOCRadar’s 20–23 October Phantom findings showed ransomware affiliates using a similar agent framework against edge devices (see Threat Intelligence & Research).
CrowdStrike (VAPOR PANDA)PHP2Shell attacks rooted about two dozen Palo Alto firewalls, and Siemens, Schneider and ABB now list grid-control, DCS and RTU products, several with no fix
Palo Alto’s Unit 42 verified on 29 October that a suspected China-nexus actor chained the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with Linux kernel bug CVE-2026-46300 to gain root on about two dozen internet-exposed PAN-OS firewalls on 23–24 October, then stole Active Directory credentials. Victims were in the US, Japan, Taiwan and South Korea. The OT exposure widened: Siemens now lists Spectrum Power grid-control systems and AMIS TS, Schneider lists a Foxboro DCS server, and ABB lists Netcontrol RTUs and ASPECT gateways, several with no fix yet. Attribution is suspected, not confirmed, and no Siemens, Schneider or ABB product is reported exploited. No OT operator has been named, so treat this as an IT-to-OT boundary warning.
Russia-aligned hackers have been manipulating exposed industrial controls across NATO countries since 2024, Bloomberg reports
Bloomberg’s 27 October investigation describes a loose network of pro-Russian hacktivist crews, chiefly CARR and Z-Pentest, tampering with internet-exposed industrial controls across NATO countries since 2024. The review is new, but most cases date from 2024 and 2025, with Spanish incidents running into summer 2026. The best-established is the December 2024 attack on the Tureby Alkestrup waterworks in Denmark, where pressure control was reset to zero and then surged, bursting pipes (the utility’s password was reportedly “1234”). Denmark’s Defence Intelligence Service publicly attributed that attack to Z-Pentest in December 2025; Danish officials put the impact at about 50 households without water for seven hours and about 450 for one hour, while Bloomberg says 450 homes. Bloomberg also reports a Texas public water system whose settings were changed in 2024, a Los Angeles-area meatpacker whose refrigeration was shut off, spoiling meat and causing an ammonia leak, and, in Spain, a crematorium, a transformer-factory fire and two wineries whose heating and ventilation were disrupted; who confirmed each case is not always stated. US charges and US and EU sanctions target members of these groups, and US authorities treat CARR as GRU-linked. The common thread is internet-exposed controllers with weak passwords, not sophisticated malware, so removing exposure and fixing passwords blocks most of it.
The Pentagon is treating August freezer failures at US military base stores as a suspected cyberattack, Reuters reports
Reuters reported on 29 October, citing four unnamed officials, that investigators are treating late-August refrigeration failures at no fewer than six US military commissaries, including Fort Huachuca and Fort Irwin, as a suspected cyberattack: refrigerators and freezers switched to defrost mode and warmed, spoiling food. Army and Air Force investigators, including an Army cybercrime unit, opened inquiries soon after, US Cyber Command has since joined, and one official said investigators have spoken with French police about the October supermarket attack. The Pentagon says it is working closely with interagency and law-enforcement partners and has not confirmed a cause. Reuters could not establish whether the stores used Danfoss equipment, though records for the commissary at Naval Air Facility El Centro list a Danfoss control system. Nextgov/FCW, citing two unnamed sources, reports officials suspect Iran-linked hackers; no agency has attributed it. The entry route and any responsible party are not established.
French supermarket refrigeration attack: about 700 stores hit, and Forescout counts nearly 13,000 exposed refrigeration controllers worldwide
Attackers forced web-managed refrigeration controllers into continuous defrost at French supermarkets on the nights of 11–13 October; France’s finance minister put the toll at about 700 stores, and the Paris prosecutor, working with ANSSI, says fires also resulted. CERT-FR names Danfoss AK-SC and AK-SM plus Copeland and Dixell XWEB controllers and judged on 16 October that the campaigns are probably still under way. On 22 October Forescout reported 12,976 internet-exposed refrigeration management services in 99 countries; most affected units are end-of-life. No actor, CVE or entry route has been named, and no new attack nights have been reported in France since 13 October, but a new wave hit stores in five other European countries on 1–2 November (see top story); CERT-FR’s alert was still at its third version (16 October) when re-checked on 2 November.
CISA, the FBI and partners warn that SafePay ransomware has hit at least 600 organizations since August 2024
Advisory AA26-293A, issued on 20 October by CISA, the FBI and the US Secret Service with Germany’s LKA Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit, says SafePay has hit at least 600 organizations from multiple critical-infrastructure sectors in North America, South America, Europe and Australia. Entry is usually through exposed or brute-forced credentials, phished accounts, VPN logins from Mullvad addresses and automated exploitation of edge-device flaws; the group then steals data, deletes shadow copies, resets network-attached storage that holds backups and moves with tools such as WinRM, PsExec and RDP. The advisory carries indicators and ATT&CK mappings for activity from November 2024 to August 2026. It names no victims, and reporting on it describes no OT, energy or water impact, so the OT risk here is the usual one: a ransomware crew reaching the IT network that plant systems depend on.
Ransomware crews are now using the PAN-OS GlobalProtect authentication bypass to get past MFA and into networks, including utilities, energy and manufacturers
Palo Alto Networks’ Unit 42 updated its brief on 19–20 October to report that ransomware operators are exploiting CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway, to start VPN sessions without valid credentials and bypass MFA. Unit 42 ties the activity to Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and public reporting also names Settra. Exploitation was first seen in June, after a proof of concept appeared on 29 May; the flaw was fixed in May and added to CISA’s KEV catalog on 29 May. Targeted sectors include utilities and energy, manufacturing, and transportation and logistics. After entry the crews use remote-management tools, move over RDP and SMB, and in one case pivoted to vCenter, disabled security controls on ESXi hosts and dumped credentials from a domain controller’s virtual disk. No OT impact is reported.
Volt Typhoon has used a rotating “Silent Train” relay network since 2023 to break into management platforms, with water, energy and transport among the victims, Lumen reports
Lumen’s Black Lotus Labs reported on 28 October that Volt Typhoon has used “Silent Train”, a covert network of rapidly rotating, single-use chains of compromised small-office routers, IoT and enterprise devices, since November 2023 to reach targets and keep access to management and control-plane systems. Lumen ties the group to four confirmed zero-day campaigns and one likely one: Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS v3.1 10.0, Cisco), VeloCloud Orchestrator (CVE-2026-16812), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Versa Director (no CVE given) and, with moderate confidence, Quest KACE (no CVE). These are older flaws, not the VeloCloud flaw CVE-2026-114625 that CISA added to KEV on 23 October. Victims include telecoms, government, defence contractors, IT firms and MSPs, and universities, and Lumen lists water, energy, transportation, maritime, rail, aviation and emergency services among the critical-infrastructure sectors hit; Hawaii, California and Texas recur as focal points (Zero Day). No victim is named and no OT or ICS intrusion is described. Lumen points defenders to CISA’s Volt Typhoon guidance (AA24-038A) and its advisory on China-nexus covert networks (AA26-113A). Management and orchestration platforms often hold trusted paths into plant networks, which makes them the asset to protect here (editorial assessment).
UBC researchers show a router-level attack that delays water-plant commands over encrypted cloud links without breaking encryption
University of British Columbia researchers describe “ICS-Sniper,” an attack on facilities that send monitoring and control traffic to cloud platforms over encrypted connections. An attacker who has already taken over a router on that path studies message timing and size to guess which messages carry critical commands, then drops a small share of them. On a water-treatment testbed the team delayed clean-water pumping by about 15 minutes and left a simulated valve open more than nine minutes too long. Defences are still in development. This is laboratory research, not an observed attack, and it needs a compromised router first, but it shows that encryption alone does not protect the timing of control traffic.
AI-agent ransomware toolkit “Phantom” used edge and remote-access flaws, with industrial and manufacturing firms the largest group of targets
SOCRadar researchers (report published 20 October, updated 23 October, and covered by The Hacker News on 23 October) found an exposed server showing affiliates of the INC and The Gentlemen ransomware groups running intrusions through an AI-agent framework called Phantom, with a human operator writing prompts and reviewing each step. According to the operator’s own records, entry came through internet-facing systems such as FortiClient EMS, SimpleHelp, cPanel and VPN gateways, and one reused password opened VPN, backup, remote-management and security platforms. SOCRadar lists 62 named target organisations, 36 of them in the US, with industrial and manufacturing firms the largest group (about 16%, roughly ten organisations); four appeared on leak sites. The activity is IT-side data theft and extortion; the report describes no access to controllers or SCADA, but the same edge entry points and reused credentials are what an attacker needs to reach OT-adjacent networks.
Siemens IoT2050 Node-RED flaw is now being exploited to plant botnet code and command backdoors
VulnCheck reports exploitation attempts against CVE-2026-58115, a maximum-severity missing-authentication flaw in the Node-RED web interface on SIMATIC IoT2050 Advanced gateways running Industrial OS with Node-RED installed. Siemens published the advisory (SSA-834709) on 11 August. An unauthenticated remote attacker can create malicious flows and run code with full privileges. Observed attempts, seen on VulnCheck’s honeypots through 30 October, first downloaded a Linux botnet binary, then used a two-stage loader, and some requests instead created an HTTP endpoint that lets the attacker run commands and survives a reboot. The fix is Node-RED 4.3.4.1 or later; Siemens says to uninstall Node-RED or harden it if you cannot update. Honeypot hits show internet scanning, not confirmed compromise of any plant.
Siemens: exploited Brotli flaw hits Industrial Edge management apps, and seven of them have no fix yet
On 30 October Siemens published SSA-443410 for CVE-2026-111497, the Brotli decoder flaw known as Node2Shell, which a remote, unauthenticated attacker can use to crash a service, leak memory or possibly run code. Siemens says its hosted Industrial Edge Hub and Industrial Edge Management cloud services were fixed on 28–29 October and need no customer action. Seven management apps — Cloud Connector Configurator, Common Configurator (on device and on IEM), Data Flow Monitoring, Databus Configurator, Edge OPC UA Server Configurator and Flow Creator Configurator — have no fix yet. Siemens’ interim advice is to uninstall most of them and put the IEM instance behind a firewall or WAF, and to stop the two on-device apps until a fix ships. Siemens separately lists RUGGEDCOM APE1808 units running PAN-OS as affected (SSA-898633), where Palo Alto says exposure needs Brotli inspection with TLS decryption enabled. CISA added the flaw to KEV on 27 October; whether any Siemens product has been attacked has not been reported.
Exploited VPN flaws: a Cisco ASA/FTD zero-day can knock firewalls offline, and two more Ivanti Connect Secure flaws that chain to root join CISA KEV
Cisco disclosed on 28 October that attackers were exploiting CVE-2026-76418 (CVSS v3.1 8.6, Cisco) in the Remote Access SSL VPN of Secure Firewall ASA and FTD software: when secondary authentication is configured on any tunnel group, including the default one, an unauthenticated remote attacker can make the firewall reload. There is no workaround; Cisco’s only mitigation, turning off secondary authentication, weakens VPN security, and the fixed ASA and FTD releases are listed in its advisory. CISA added the flaw to KEV on 29 October. Cisco has not said who is exploiting it or how widely. On 30 October CISA added two Ivanti Connect Secure flaws to KEV: CVE-2026-111357 (CVSS v3.1 7.0, MITRE), a privilege escalation to root whose CVE record has existed since 15 October, and CVE-2026-118527, which CISA lists as a predictable-identifier flaw. CISA says both chain with CVE-2026-104935, the authentication bypass it added to KEV on 13 October; Volexity tied exploitation of that flaw to a group it tracks as UTA0576, which went after Active Directory credentials, BitLocker recovery keys and LAPS data once it had root. These are IT-side boundary devices, but a firewall reload cuts vendor and operator remote access to plant networks, and a rooted VPN gateway hands an intruder credentials that often reach OT (editorial assessment).
Hitachi Energy TRO600 wireless routers can leak configuration and password files without a login, and CoreTec transformer-monitoring devices carry a command-injection flaw
CISA published advisories for two Hitachi Energy product lines on 27–29 October (ICSA-26-302-02 and -03), both tagged for the energy sector and based on Hitachi Energy’s own 27 October advisories. The TRO600 series, which Hitachi Energy sells as industrial wireless routers for utilities, oil and gas and mining networks, has an unauthenticated flaw (CVE-2026-106087; CVSS v3.1 7.5 per CISA, v4.0 8.7 per Hitachi Energy) that lets a remote attacker read or download any file on the device, including configuration and password data, plus an authenticated flaw (CVE-2026-10756; v3.1 7.5 per CISA, v4.0 7.7 per Hitachi Energy) that abuses port forwarding to reach services meant to be local only; firmware 9.2.2.1 fixes both. CoreTec 4 and 5, which power Hitachi Energy’s TXpert Hub for transformer monitoring and diagnostics, have a command-injection flaw (CVE-2026-13162; v3.1 7.5 per CISA, v4.0 7.7 in the CVE record) that lets an authenticated user with certain roles take full control of the device, and CoreTec5 also carries Linux kernel flaw CVE-2026-43284, which gives a local user root and has public exploit code (sources give different scores). CISA lists CoreTec5 5.0.0 as the fix; CoreTec4 has no fixed version, and the path is migrating to CoreTec5 5.0.0. Neither advisory reports exploitation, and none of these flaws is in KEV. Configuration and password data taken from a field router could help an attacker get onto the utility network behind it (editorial assessment).
EPICS Base control-system toolkit: four flaws, one rated critical, found by an AI agent in under four hours
CISA published an advisory on 27 October for EPICS Base through 7.0.10, the open-source control-system toolkit used at scientific facilities and some industrial sites. The Register reports that Causal Security’s autonomous agent “Cipher” found and validated all four flaws in 3 hours 49 minutes with one human instruction; the worst, an integer overflow leading to a heap write and possible code execution, is rated CVSS v3.1 9.8. The other three are out-of-bounds writes and reads, and a type confusion, that can crash services. Exploitation needs network reach to the vulnerable services, so flat or poorly segmented control networks carry the risk. The maintainers warn that older Channel Access clients may not work with 7.0.11.
October ICS fixes: critical ICONICS GENESIS64 flaws and a WAGO controller bug join Siemens, Rockwell and ABB, and some Siemens flaws still have no fix
On 22 October CISA republished Siemens’ 13 October advisories (ICSA-26-295-02 to -18): fixes are still pending for the S7 PLC web server, some S7-1500 MFP Linux-subsystem flaws and WinCC V7.5, and none is planned for APOGEE MBC/MEC. One Linux kernel flaw listed in Siemens’ S7-1500 MFP advisories, CVE-2026-46300, was added to CISA’s KEV catalog on 28 October after it was used to root firewalls (see top story); Siemens lists V3.1.7 as fixing it on V3.1.6 and no fix for V3.1.5, and it needs local access to the Linux subsystem. CISA’s 20 October batch covered WAGO controller firmware (CVE-2026-80466, CVSS v3.1 8.8: a low-privileged user can inject commands that run as root; fixed in 4.10.0/FW32) and Moxa’s AIG-302 edge gateway (hard-coded key CVE-2026-109813, v3.1 8.1 / v4.0 8.6; fixed in 1.4.1). Mitsubishi Electric’s 15 October advisory fixes an authentication bypass (CVE-2026-16436, CVSS v3.1 8.1) and over-permissive DCOM defaults (CVE-2026-16438, v3.1 9.1) across ICONICS GENESIS64, GENESIS, Hyper Historian and related products; MC Works64, GENESIS32 and BizViz get no fix, and Mitsubishi advises replacing them. CISA republished the advisory on 27 October as ICSA-26-300-02. Earlier in the month Rockwell fixed a critical 1732E ArmorBlock admin-takeover flaw and ABB a dynovaPRO password-reset flaw. No exploitation of any of these products is reported.
Siemens confirms a Software Center flaw is being exploited to deliver malware, and CISA adds it to the KEV catalog
Siemens first published CVE-2026-110936 on 15 October and on 19 October confirmed it is being exploited. Software Center, the tool engineers use to install and update Siemens software, did not restrict where it searches for helper DLLs, so attackers paired a genuine, validly signed copy with their own malicious libraries in an installer package. Siemens ties the activity to the “Romulus” multi-platform ClickFix campaign, which tricks users into running pasted commands, and names no final malware family. It says no Siemens system, product or update channel was breached, to its knowledge. Version 4.0.9.8 fixes the flaw, and installed copies update on next start. CISA added the flaw to KEV on 20 October with a 3 November deadline and has republished Siemens’ advisory as ICSA-26-295-03. Exploitation needs local access and a user who runs the lure, so engineering workstations running Siemens tooling are the exposure.
UK NCSC says AI-enabled ransomware is likely to reach UK power, airports and hospitals by 2028
At the 3 November 2026 launch of the NCSC’s annual State of the Cyber Nation report, chief executive Richard Horne warned that financially motivated criminals are highly likely to use AI-powered malware against UK critical infrastructure such as power stations, airports and hospitals by 2028, and that Russia and China will routinely use AI in state operations. Horne said AI is not inventing new attacks so much as exploiting long-tolerated weaknesses at scale, naming end-of-life systems, delayed upgrades, weak vendor security, excessive access and poor monitoring. He cited the PHP2Shell flaws, for which NCSC sent about 110,000 early-warning notifications. The forecast is NCSC’s assessment, not an observed OT incident.
Centrii warns low-impact grid sites to prove NERC CIP-003-9 vendor remote access controls before auditors ask
In a 26 October analysis, compliance firm Centrii says CIP-003-9, in effect since 1 April 2026, now requires owners of low-impact bulk electric system assets that allow vendor remote access to have three processes: identify vendor remote access, disable it, and detect known or suspected malicious communications tied to it. The standard does not define “vendor”, and ReliabilityFirst expects auditors to read it broadly, including staff augmentation. Centrii flags records as the weak spot: evidence must be kept for three calendar years, audits of low-impact requirements can reach back six, and the proof is often scattered across email, equipment-maker support portals and contractor systems. The owner stays accountable even when operations are outsourced. Centrii recommends one named person to approve each vendor access path, one to disable it and one place for records. This is a vendor’s compliance commentary, not a regulator statement.
UK NCSC publishes a Core Profile that sets a minimum cyber-resilience baseline for essential services and CNI operators
On 30 October 2026 the UK National Cyber Security Centre published a Core Profile built on CAF version 4.0. It sets the minimum level of cyber security and resilience expected of organisations that provide essential services or support critical national infrastructure, framed around moderately sophisticated adversaries and common threats such as ransomware, supply chain compromise and legacy technology. Each contributing outcome is rated “Partially achieved” or “Achieved”, and most require “Achieved”; a handful, including supply chain (A4), data security (B3), design for resilience (B5.b), security culture (B6.a), alert triage (C1.d) and threat hunting (C2.a), need only “Partially achieved”. NCSC says the profile is meant to support the Cyber Security and Resilience Bill, and that regulators may set higher expectations. It is guidance, not law, and applies to UK-regulated operators.