Hackers Are Targeting Your Refrigerators: FBI & CISA Sound the Alarm on ICS Cold-Chain Attacks
Hackers Are Targeting Your Refrigerators: FBI & CISA Sound the Alarm on ICS Cold-Chain Attacks
In November 2026, the FBI, CISA, HHS, USDA, and DOT issued a joint advisory warning that threat actors are actively exploiting unpatched or internet-exposed electronic temperature controllers and commercial refrigeration management systems across healthcare, food production, chemical, and transportation sectors. Attackers leverage authentication bypass vulnerabilities and arbitrary code injection flaws to remotely alter temperature settings, force continuous defrost cycles, and suppress operator visibility—causing food spoilage, equipment damage, fire hazards, and unsafe blood-product storage. The warning followed confirmed attacks on an estimated 250–350 French supermarkets and a French Blood Establishment facility where stored blood products were placed at risk.
This advisory reflects a broadening ICS/OT threat landscape where operationally critical but historically under-secured devices—such as refrigeration controllers—are now primary targets. The convergence of IT and OT networks, combined with internet-exposed legacy devices running default credentials, has lowered attacker barriers significantly, signaling an urgent need for OT-specific zero trust segmentation and network visibility strategies.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Gorbag: The Russia-Aligned APT Quietly Draining Ukrainian VPN Credentials One Pass at a Time
Beginning in February 2025, a Russia-aligned threat actor tracked as Gorbag launched a highly targeted espionage campaign against Ukrainian law enforcement, local administrations near the front line, and defense-sector entities. The group delivered its custom C++ infostealer, BeautyStealer, via spearphishing emails carrying malicious Excel macros, and later via weaponized RAR archives exploiting CVE-2025-8088, a WinRAR path traversal zero-day. BeautyStealer harvested browser credentials, OpenVPN configurations, and sensitive documents in a single pass before self-deleting, with stolen data exfiltrated over Telegram or a FastAPI-backed C2 server. Gorbag's tradecraft suggests it may function as an initial access broker feeding credentials to downstream Russia-aligned actors.
Gorbag illustrates a growing pattern of lean, single-pass infostealers designed for rapid intelligence collection rather than persistent implantation. The exploitation of a freshly disclosed WinRAR zero-day underscores how quickly Russia-aligned groups weaponize new CVEs, and the campaign's focus on VPN credentials and electronic signature keys signals a deliberate effort to enable follow-on network intrusions at scale.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
When Allies Become Attackers: Belarus APT FrostyNeighbor Deploys Wiper Against Ukrainian Critical Infrastructure
In Q2–Q3 2026, ESET researchers documented the first confirmed destructive cyberattack by a Belarus-aligned advanced persistent threat group, tracked as FrostyNeighbor (also known as UNC1151), against a Ukrainian manufacturing company critical to the country's transportation sector. The threat actor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript-based wiper distributed via Group Policy Objects, combining espionage-grade remote access tooling with destructive payload delivery. This escalation marks a strategic shift: a historically espionage-focused actor has crossed into destructive operations, acting as a force multiplier for Russian cyber objectives across the European theater.
This incident signals a broader geopolitical realignment in offensive cyber operations. Belarus-linked groups are no longer operating as peripheral actors—they are increasingly executing campaigns that mirror Russian intelligence priorities, expanding the threat surface for NATO-adjacent nations, transportation networks, defense supply chains, and critical infrastructure operators across Europe.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Inside Silent Train: How Volt Typhoon Built an Ephemeral Network That Rebuilds Itself in Under Two Minutes
Since late 2023, China-backed threat actor Volt Typhoon has operated a covert, rapidly rotating infrastructure campaign dubbed 'Silent Train' by Lumen Technologies' Black Lotus Labs. The operation chains compromised SOHO routers, IoT devices, and enterprise edge appliances into ephemeral relay networks that are assembled and dismantled in under two minutes, with individual sessions averaging roughly four hours. The group exploited zero-days in Versa Director, Cisco Catalyst SD-WAN, N-Able N-Central, and VeloCloud Orchestrator, and abused devices from Fortinet, Cisco, Ivanti, F5, Palo Alto Networks, and others to maintain persistent, stealthy access across telecom, defense, government, energy, water, transportation, and emergency-services sectors across the United States.
Silent Train illustrates a decisive evolution in nation-state tradecraft: attackers no longer maintain static botnets that can be seized or sinkholed. By rebuilding relay chains continuously and targeting centralized management and control-plane platforms, Volt Typhoon can pre-position inside critical infrastructure indefinitely—raising the urgency for network visibility, zero-trust segmentation, and encrypted east-west traffic controls that can detect anomalies even when the underlying infrastructure changes daily.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Volt Typhoon's Silent Train: How a Covert Relay Network Powered Four Zero-Day Campaigns Against U.S. Critical Infrastructure
Beginning in late 2023 and accelerating through 2026, the China-state-sponsored threat group Volt Typhoon operated a covert relay network called Silent Train to execute four confirmed zero-day exploitation campaigns against critical U.S. infrastructure. The group systematically targeted endpoint management platforms, SD-WAN orchestrators, and network control-plane technologies—including CVE-2026-20127 in Cisco Catalyst SD-WAN Controller and CVE-2026-16812 in Arista VeloCloud Orchestrator—routing malicious traffic through rotating chains of compromised SOHO, IoT, and enterprise devices across 27 device classes. Victims spanned telecommunications, defense contractors, satellite services, energy, transportation, and emergency services, with operations concentrated in Hawaii, California, and Texas.
Silent Train represents a structural evolution in nation-state tradecraft: ephemeral multi-hop relay infrastructure that self-destructs after each session, making attribution and disruption exceptionally difficult. As geopolitical tensions in the Indo-Pacific intensify, this campaign signals that critical infrastructure operators must treat control-plane technologies and management platforms as primary attack surfaces requiring zero trust segmentation and continuous east-west traffic inspection.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
In July 2025, Russian-aligned threat actor UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company via a spear-phishing email deploying the MATCHWOK backdoor. A day later, the group introduced a previously undocumented implant called MythicRatatoskr, which routed command-and-control traffic through the Yggdrasil peer-to-peer mesh network to evade detection. Over two months later, on September 17, 2025, UAC-0099 handed off access to Sandworm, which executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy—destroying operational data across the compromised environment.
This incident marks the first documented abuse of the Yggdrasil mesh network by a state-aligned threat actor for C2 infrastructure, signaling a new evasion frontier. The coordinated handoff between UAC-0099 and Sandworm reflects a maturing division-of-labor model among Russian APT groups, raising the operational risk bar for critical infrastructure defenders globally.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization.
This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available
In October 2026, CISA published ICS Advisory ICSA-26-288-02 disclosing three critical-to-medium severity vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera platform, affecting App versions ≤4.9.6 and Firmware versions ≤4.9.86.0 deployed worldwide across energy, communications, transportation, financial services, and government sectors. The most severe flaw, CVE-2026-107617 (CVSS 9.8), embeds hard-coded credentials that allow any remote, unauthenticated attacker to log in to EseeCloud devices at will. A second vulnerability, CVE-2026-97858, permits unauthorized device rebinding—stripping ownership from legitimate users and reassigning control to an attacker. A third flaw, CVE-2026-105664, exposes an enumeration oracle that lets token-holders discover every registered device serial ID at scale due to absent rate limiting. The vendor did not respond to CISA's coordination attempts, leaving no vendor patch available.
These findings arrive amid a documented surge in nation-state and criminal exploitation of consumer and industrial IoT devices as persistent footholds into critical infrastructure networks. Hard-coded credential abuse in embedded devices has become a primary initial-access vector, and the absence of encrypted traffic controls means camera feeds and command channels remain fully interceptable once an attacker gains network adjacency.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Six Kernel-Crash CVEs in HMS Networks PCAN Windows Drivers: What ICS Operators Must Do Now
In October 2026, CISA published ICS Advisory ICSA-26-293-01 disclosing six memory-safety vulnerabilities in HMS Networks PEAK-System PCAN Windows drivers (versions ≤5.1.2 / ≤5.1.2.1151). The flaws—spanning out-of-bounds writes, classic buffer overflows, improper array-index validation, untrusted pointer dereference, and length-parameter inconsistency—allow a local, low-privileged user to crash the Windows kernel, causing denial-of-service conditions on workstations and engineering stations running CAN-bus hardware. Affected sectors include Transportation, Healthcare, Energy, and Critical Manufacturing globally. HMS Networks released a fix in version 5.1.4 and recommends immediate upgrade.
Kernel-level driver vulnerabilities in OT/ICS environments are an accelerating trend: attackers increasingly target device drivers as a reliable path to system instability or privilege escalation on engineering workstations that are difficult to patch quickly. With six CVEs simultaneously disclosed across widely deployed industrial CAN-bus drivers, organizations should treat driver patch management as a first-class control within their ICS security programs.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor
In mid-2026, ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) began actively exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access, to establish unauthorized VPN sessions and circumvent multi-factor authentication controls. After gaining an initial foothold, attackers conducted internal reconnaissance using dual-use RMM tools, moved laterally via RDP and SMB, harvested credentials by targeting vCenter and ESXi hypervisors at the virtualization layer, and deployed ransomware alongside data-exfiltration tooling across sectors including healthcare, financial services, government, and education. Veeam backup infrastructure was also targeted using CVE-2023-27532 to maximize damage and eliminate recovery options.
This campaign underscores an accelerating trend of ransomware operators chaining perimeter authentication bypasses with deep virtualization-layer attacks to defeat endpoint detection, MFA, and backup resilience simultaneously. As CISA KEV listings shorten the window between disclosure and exploitation, organizations relying on gateway-centric security without east-west segmentation and encrypted-traffic visibility face compounding risk.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Critical Satel Netco Design Vulnerabilities Expose Global Telecommunications Infrastructure
In October 2026, CISA published advisory ICSA-26-281-03 detailing multiple critical vulnerabilities in Satel Netco Design network management software versions prior to v2.1.7. The Finnish telecommunications equipment vendor's platform suffered from four distinct security flaws including stored cross-site scripting (CVE-2026-105269), inefficient regular expression complexity causing denial of service (CVE-2026-104628), and two relative path traversal vulnerabilities (CVE-2026-105275, CVE-2026-101024). These vulnerabilities could allow authenticated attackers with minimal privileges to execute arbitrary scripts, consume system resources, enumerate files, and potentially achieve arbitrary code execution on affected systems deployed worldwide in critical communications infrastructure.
This incident highlights the growing security challenges in industrial control systems and network management platforms, particularly as telecommunications infrastructure becomes increasingly targeted by nation-state actors and ransomware groups seeking to disrupt critical communications services.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Russian Cyber-Espionage Group UAC-0099 Refines MatchBoil Malware for Enhanced Stealth
The Russia-affiliated cyber-espionage group UAC-0099 has been conducting a sophisticated campaign targeting Ukrainian organizations in transportation, manufacturing, and energy sectors using an evolved malware downloader called MatchBoil. Active since 2024, the group has continuously refined MatchBoil from a basic one-shot downloader into an advanced dropper with commercial-grade obfuscation, sandbox evasion, and persistent payload retrieval capabilities. The malware delivers MatchWok, a C# backdoor providing persistent system access, with attacks initiated through spear-phishing emails containing VBScript payloads. ESET researchers believe UAC-0099 likely serves as an initial access broker for Sandworm, Russia's military intelligence-linked threat group responsible for destructive attacks on Ukraine's critical infrastructure.
This incident highlights the accelerating sophistication of state-sponsored malware development, with threat actors rapidly adopting commercial obfuscation tools and advanced evasion techniques. As geopolitical tensions drive more aggressive cyber operations, organizations face increasingly stealthy and persistent threats targeting critical infrastructure sectors.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
