Week 45 2026 Threat Roundup: OT Refrigeration Disruptions, AD CS Domain Hijacking, and the Limits of Password-Based Recovery
Week 45 of 2026 surfaced a convergence of four distinct threat clusters. European authorities dismantled a crime-as-a-service investment fraud infrastructure and arrested VasyGrek members, while a U.S. grand jury indicted two Canadians for cryptojacking university supercomputers between 2016 and 2019. Concurrently, threat actors impersonated IT help-desk staff on Microsoft Teams, abused Active Directory Certificate Services ESC1 and ESC8 misconfigurations to obtain persistent Kerberos tickets, and exfiltrated corporate data via Rclone. A second wave of hacktivist OT attacks raised refrigeration temperatures to 50°C across retail and healthcare facilities in six European countries, threatening blood-supply cold storage at French Blood Establishment sites. These incidents collectively illustrate the accelerating convergence of social-engineering-led identity compromise, misconfigured PKI infrastructure, and hacktivist operational-technology disruption. The targeting of healthcare cold-storage and university high-performance compute reflects adversaries deliberately selecting high-consequence, under-hardened environments where recovery costs and public-safety stakes amplify extortion leverage.
Kill Chain
