OT News.

Wiz reported an actor whose activity overlaps with Storm-0940 using the AI penetration-testing tool ARTEX against multiple IT and software vendors. Attempts focused on Okta, Entra and Cognito identity services and Microsoft 365 integrations, including API discovery and attempts to access other customers' data. Most attempts failed. The findings concern vendors' identity and tenant-isolation controls; they do not demonstrate a compromise of an OT control system.

A joint FBI, CISA and partner advisory reports at least 600 SafePay victims since August 2024, spanning businesses and multiple critical infrastructure sectors. Initial access involves stolen or guessed passwords, VPN accounts and known vulnerabilities. Alongside stealing and encrypting data, the group obstructs recovery by stopping the shadow-copy service and resetting NAS devices holding backups to factory settings. The advisory prioritises patching exposed systems, MFA and offline backups.

Symantec disclosed APT28 espionage activity targeting a naval shipbuilder, an aircraft-engine manufacturer and a law-enforcement agency in two NATO countries. At the shipbuilder, an email attachment led to credential theft and a persistent tunnel into the internal network. Researchers found evidence spanning at least two months. The findings describe espionage in defence organisations' corporate networks and do not establish an impact on production controls or shipboard systems.

Siemens confirmed active exploitation of a DLL-loading vulnerability in Software Center. Attackers placed their own DLLs beside the genuine, validly signed program, which loaded them when it started. Siemens says its systems and update channels were not breached. Version 4.0.9.8 fixes the flaw, and existing installations update on their next launch. Investigations need to examine the files loaded and their folders as well as the program's signature.

BeyondTrust confirmed exploitation of CVE-2026-102764 in Remote Support by an espionage actor. Its 16 October update reported two affected customers. SaaS environments have been patched; self-hosted installations without automatic updates need the BT26-05 patch. Versions older than 24.3.1 require an upgrade first. Where remote support reaches a facility network, the platform's security also determines the security of that maintenance connection.

Team82 used an AI coding agent to reproduce previously disclosed Danfoss AK-SM 800A vulnerabilities. Starting with public firmware and CVE information, the experiment reached root access on a lab device in about 28 minutes for roughly $6. A researcher corrected the agent's faulty analysis and supplied tools and guidance. The work measures how quickly known vulnerabilities can be reproduced; it does not establish how the attacks in France were carried out.

Attackers changed supermarket refrigeration settings in France, causing food spoilage. CERT-FR reported numerous compromises involving Danfoss AK-SM and AK-SC and Copeland/Dixell XWEB systems; reporting put the impact at about 300 Intermarché and Netto stores alone. The initial access method and exploited vulnerabilities remain unconfirmed. The agency calls for removing management interfaces from the internet, checking the entire configuration including defrost schedules, and restoring maintenance access through a protected connection.

The US Justice Department and FBI seized seven domains used by the Microscan and FishHub tools linked to Integrity Technology Group. Court documents describe scanning supported by a Mirai-derived botnet against a US power company, airports in Japan and Poland, and gas and power companies in Taiwan. Being scanned does not establish that each organisation was compromised. A joint advisory published the same day describes how the actors combine automated reconnaissance with hands-on intrusions.

Researchers from Modat and the Dutch NCSC-NL identified 8,547 internet-facing systems across 35 countries (7,942 solar, 605 wind). Most are login or admin pages; the researchers estimate full control may have been possible at around 181 sites. No actual attack was reported, and the counts are conservative.

A CISA advisory (ICSA-26-279-06) lists six vulnerabilities in end-of-life RTU500 CMU firmware, one a sixteen-year-old VxWorks debug service (CVE-2010-2965, UDP 17185). The fix is not a patch to the old version but a major version jump.

NSA, CISA, FBI, DOE and EPA reported that internet-exposed S7 PLCs are searched via Censys/ZoomEye, read over S7comm, and prepared for write operations. Not a new vulnerability, but known flaws, weak passwords and unnecessary internet exposure, with one of the first official references to AI-generated scripts.