One Vulnerability, 700 Stores: How Europe's Freezer Hacks Exposed the Hidden Risk of Shared OT Infrastructure
One Vulnerability, 700 Stores: How Europe's Freezer Hacks Exposed the Hidden Risk of Shared OT Infrastructure
On the night of October 11, 2026, an unknown threat actor compromised refrigeration control systems—specifically Danfoss AK-SM/AK-SC controllers and Copeland/Dixell XWEB systems—used by hundreds of French supermarkets, triggering extended defrost cycles that spoiled food, damaged equipment, and reportedly started fires across roughly 700 stores. The attack exploited internet-accessible OT devices running default credentials and unpatched legacy firmware, enabling the same technique to be replicated across borders into Belgium, Estonia, Germany, Ireland, Luxembourg, the Netherlands, Poland, Portugal, Spain, and Sweden within weeks. Total damages ran into the millions of euros and a near-simultaneous attack targeted French blood-bank refrigeration units, narrowly avoiding destruction of blood plasma.
This incident underscores a maturing attacker playbook targeting shared OT infrastructure: when dozens of retailers deploy the same controller model, same remote-access pattern, and same default credentials, a single reconnaissance sweep yields hundreds of targets. CERT-FR's post-incident advisory and parallel EU grocery-sector warnings signal growing regulatory and sector-level pressure to treat food-cold-chain OT as critical infrastructure.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
When Hackers Target Blood: The 2026 EFS Refrigeration Cyberattack and the OT Supply-Chain Crisis
On November 2, 2026, France's national blood service (Établissement français du sang, EFS) suffered an indirect cyberattack when threat actors exploited a vulnerability in third-party remote monitoring software used by refrigeration supplier Coolworld Rentals. The attackers manipulated temperature and defrost settings across cold-storage chambers at three EFS facilities, threatening plasma bags and biological samples. EFS monitoring systems detected the anomaly rapidly, enabling staff to transfer or secure all products; no blood loss or health impact was reported. ANSSI and the French Ministry of Health are actively investigating. This incident is part of a documented wave of ICS/OT attacks targeting refrigeration controllers across Europe—including more than 465 retail cold-chain sites struck in October–November 2026—exploiting Danfoss and Dixell XWEB remote management interfaces (CVE-2025-41450, CVE-2025-41451). The pattern confirms that OT supply-chain compromise via internet-exposed third-party remote monitoring components is an escalating, cross-sector threat with direct life-safety consequences.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Cold-Chain Under Attack: How Two Waves of ICS/OT Sabotage Exposed Europe's Refrigeration Security Gap
In October and November 2026, an unknown threat actor executed two successive waves of cyberattacks against Internet-connected commercial refrigeration controllers at hundreds of European supermarkets across France, Belgium, Germany, the Netherlands, Portugal, Poland, Spain, Luxembourg, Estonia, Ireland, Sweden, and Finland. Attackers exploited unpatched firmware vulnerabilities and default credentials in controllers manufactured by Danfoss, Dixell, and Copeland—forcing systems into defrost mode at 50°C (122°F) and triggering widespread food spoilage. The first wave impacted over 700 stores; the second struck dozens more. No group has claimed responsibility, and European authorities are actively investigating.
These incidents underscore a worsening pattern of ICS/OT sabotage targeting Internet-exposed operational technology with poor security hygiene. As threat actors increasingly leverage automated scanning, credential stuffing, and known CVEs against legacy OT devices, the attack surface extends far beyond retail—threatening pharmaceutical cold storage, food distribution, and industrial temperature-control systems globally.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
When Allies Become Attackers: Belarus APT FrostyNeighbor Deploys Wiper Against Ukrainian Critical Infrastructure
In Q2–Q3 2026, ESET researchers documented the first confirmed destructive cyberattack by a Belarus-aligned advanced persistent threat group, tracked as FrostyNeighbor (also known as UNC1151), against a Ukrainian manufacturing company critical to the country's transportation sector. The threat actor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript-based wiper distributed via Group Policy Objects, combining espionage-grade remote access tooling with destructive payload delivery. This escalation marks a strategic shift: a historically espionage-focused actor has crossed into destructive operations, acting as a force multiplier for Russian cyber objectives across the European theater.
This incident signals a broader geopolitical realignment in offensive cyber operations. Belarus-linked groups are no longer operating as peripheral actors—they are increasingly executing campaigns that mirror Russian intelligence priorities, expanding the threat surface for NATO-adjacent nations, transportation networks, defense supply chains, and critical infrastructure operators across Europe.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
In July 2025, Russian-aligned threat actor UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company via a spear-phishing email deploying the MATCHWOK backdoor. A day later, the group introduced a previously undocumented implant called MythicRatatoskr, which routed command-and-control traffic through the Yggdrasil peer-to-peer mesh network to evade detection. Over two months later, on September 17, 2025, UAC-0099 handed off access to Sandworm, which executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy—destroying operational data across the compromised environment.
This incident marks the first documented abuse of the Yggdrasil mesh network by a state-aligned threat actor for C2 infrastructure, signaling a new evasion frontier. The coordinated handoff between UAC-0099 and Sandworm reflects a maturing division-of-labor model among Russian APT groups, raising the operational risk bar for critical infrastructure defenders globally.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
The Paper Unicorn Attack: How Adversaries Exploit Hybrid IT/OT Warehouse Environments
A detailed threat investigation published by Kaspersky's Securelist in 2025 exposed the full attack surface of modern automated warehouses, tracing how adversaries can chain vulnerabilities across hybrid IT/OT environments to disrupt order fulfillment at scale. Researchers demonstrated how initial access through Wi-Fi misconfigurations, kiosk-escape on Android PDTs, Bluetooth-exploitable thermal printers (e.g., Zebra ZQ630), and barcode-injection attacks against Honeywell scanners (CVE-2026-4272) could pivot to warehouse management systems, ultimately corrupting inventory records, fabricating shipment documents, and halting conveyor operations via compromised PLCs. Real-world incidents at Morrisons, UNFI, and CEVA Logistics illustrate the billion-dollar operational consequences when warehouse digitalization outpaces security architecture.
This research arrives as logistics and retail operators accelerate automation adoption while threat actors increasingly target OT-adjacent environments. The disclosure of CVE-2026-70774 in Oracle Warehouse Management and the CEVA Logistics breach underscore that WMS platforms are now primary ransomware and supply-chain attack targets, demanding zero-trust segmentation and IT/OT convergence security strategies.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Microsoft Disrupts Billion-Message Storm-2990 Chinese Phishing Empire
In early 2025, Microsoft collaborated with Japanese authorities and cybersecurity partners to dismantle a massive Chinese-language phishing kit ecosystem tracked as Storm-2990. The operation involved interconnected services including YAM Store, CoGUI, and Iron Man that delivered over 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. The cybercriminal network primarily targeted healthcare, financial services, logistics, and IT sectors in the United States and Japan, selling customized phishing kits that enabled credential theft, financial fraud, and device code authentication abuse.
This incident highlights the growing sophistication of transnational cybercriminal operations and the increasing threat of supply-chain style cybercrime services. The emergence of organized phishing-as-a-service ecosystems represents a significant shift in threat landscape maturity, where criminal groups operate like legitimate businesses with specialized roles and infrastructure.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Major Cyberattack Forces Ahold Delhaize to Take Systems Offline Across Global Retail Operations
In October 2026, multinational retail giant Ahold Delhaize experienced a significant cyberattack that forced the company to take critical systems offline as a precautionary measure. The incident impacted operations across multiple brands including Stop & Shop, Albert Heijn, Food Lion, and Delhaize, affecting employee access to scheduling systems and customer-facing platforms including websites, mobile apps, and online ordering services. While stores remained open for in-person shopping, the attack disrupted digital services for millions of customers across Europe and the United States, highlighting vulnerabilities in retail supply chain infrastructure.
This incident underscores the escalating threat landscape targeting critical retail infrastructure, particularly as cybercriminals increasingly focus on high-impact sectors during peak operational periods. The attack represents a growing trend of sophisticated threat actors targeting multinational corporations with complex hybrid cloud environments and extensive digital ecosystems.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Russia's UAC-0099 Evolves with ASHVEIN RAT and Anti-AI Evasion Tactics
The Russia-aligned threat actor UAC-0099, tracked as Earth Sirrush, has deployed a previously undocumented .NET infostealer and RAT called ASHVEIN (internally named TelemetryBrowser) in targeted attacks against Ukrainian government personnel since October 2025. The malware features credential theft capabilities for Chrome and Firefox browsers, screenshot capture, file enumeration, PowerShell remote shell execution, and encrypted command-and-control communications that hide tasking inside invisible HTML elements. UAC-0099 has been actively targeting Ukrainian government, defense, border guard, and logistics entities since mid-2022 following Russia's invasion, serving as an initial access broker for the destructive Sandworm APT group.
This incident demonstrates the continued evolution of state-sponsored cyber espionage capabilities targeting critical infrastructure during ongoing geopolitical conflicts. The threat actor's shift from PowerShell-based tools to sophisticated .NET malware with anti-analysis features, including GuardBreaker techniques designed to fool AI-assisted security analysis, represents a significant advancement in evasion tactics that security teams worldwide must prepare to counter.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
In September 2026, CISA disclosed critical vulnerabilities in Viidure's Dashcam Android Application affecting versions up to 3.3.1.260403. Two severe flaws were identified: CVE-2026-94204, a cloud storage misconfiguration with public-read permissions exposing all user data and system files globally, and CVE-2026-96587, hardcoded credentials embedded in the application code providing full platform access. The vulnerabilities achieved CVSS scores of 7.5 and 10.0 respectively, with potential for complete platform compromise including unauthorized access to live dashcam footage, user records, firmware files, and critical system operations. Viidure failed to respond to CISA's coordination attempts, leaving users without vendor-provided remediation.
This incident highlights the growing threat of cloud misconfigurations in IoT ecosystems, particularly as connected vehicle technologies proliferate across transportation infrastructure. The combination of exposed cloud storage and embedded credentials represents a concerning pattern in mobile application security that threatens critical infrastructure sectors.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Russia Escalates Hybrid Cyber-Physical War Against European NATO Members
Russia has intensified its hybrid warfare campaign across Europe throughout 2026, targeting NATO members and Ukraine supporters through coordinated cyber sabotage, disinformation operations, and physical drone attacks. The campaign has specifically targeted critical infrastructure including water and wastewater systems in Norway and Poland, energy infrastructure, and offshore gas projects in the Black Sea. Russian operations have employed AI-generated content through the CopyCop disinformation network, territorial violations using drones near NATO borders, and cyberattacks against Internet-facing firewalls and VPN infrastructure. The attacks have successfully disrupted services and tested NATO response protocols while maintaining plausible deniability below the threshold of kinetic warfare.
This escalation represents a critical shift in modern warfare tactics as state actors increasingly blend cyber operations with physical sabotage to achieve strategic objectives. Intelligence assessments indicate Russia may coalesce these tactics into a full-scale New Generation Warfare campaign over the next two years, particularly following the 2028 US Presidential elections.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover
CISA published advisory ICSA-26-267-01 detailing 13 critical vulnerabilities in Botslab G980H dashcams affecting two firmware versions worldwide. The vulnerabilities include authentication bypass, session hijacking, predictable session identifiers, hard-coded credentials, unencrypted communications, and path traversal flaws with CVSS scores up to 8.8. Attackers with adjacent network access can gain unauthorized device control, access sensitive recordings and location data, intercept WiFi credentials, and potentially install malicious firmware. Botslab has not responded to CISA's coordination efforts, leaving users without official patches or remediation guidance.
This incident highlights the growing security risks in IoT devices within transportation infrastructure, as dashcams increasingly capture sensitive location data and connect to corporate networks through fleet management systems.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
