Week 45 2026 Threat Roundup: OT Refrigeration Disruptions, AD CS Domain Hijacking, and the Limits of Password-Based Recovery
Executive Summary
Executive Summary Week 45 of 2026 surfaced a convergence of four distinct threat clusters. European authorities dismantled a crime-as-a-service investment fraud infrastructure and arrested VasyGrek members, while a U.S. grand jury indicted two Canadians for cryptojacking university supercomputers between 2016 and 2019. Concurrently, threat actors impersonated IT help-desk staff on Microsoft Teams, abused Active Directory Certificate Services ESC1 and ESC8 misconfigurations to obtain persistent Kerberos tickets, and exfiltrated corporate data via Rclone. A second wave of hacktivist OT attacks raised refrigeration temperatures to 50°C across retail and healthcare facilities in six European countries, threatening blood-supply cold storage at French Blood Establishment sites.
These incidents collectively illustrate the accelerating convergence of social-engineering-led identity compromise, misconfigured PKI infrastructure, and hacktivist operational-technology disruption. The targeting of healthcare cold-storage and university high-performance compute reflects adversaries deliberately selecting high-consequence, under-hardened environments where recovery costs and public-safety stakes amplify extortion leverage.
Why This Matters Now
Why This Matters NowOT refrigeration attacks have now struck six European nations within three weeks, extending from retail into blood-supply infrastructure. Simultaneously, AD CS abuse via ESC1/ESC8 is being weaponized at scale without requiring any software zero-day, meaning organizations with unaudited certificate templates face persistent domain-level compromise that survives password resets—a posture that legacy perimeter controls cannot address.
Attack Path Analysis
Attack Path AnalysisAcross the three threat clusters reported this week, attackers exploited a combination of social engineering via Microsoft Teams impersonation, AD CS misconfigurations (ESC1/ESC8), and internet-exposed OT/ICS refrigeration control interfaces with weak default credentials to gain initial footholds. From there, they escalated privileges via fraudulent certificate issuance for privileged domain identities, moved laterally to domain controllers, executed DCSync credential dumping, and exfiltrated corporate files via Rclone to external servers — while a parallel OT disruption campaign altered critical refrigeration setpoints across retail and healthcare facilities in six European countries, threatening blood supply integrity.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers gained initial access via three documented vectors: (1) Microsoft Teams impersonation of IT help desk staff tricking employees into granting Quick Assist remote desktop control; (2) exploitation of publicly accessible Danfoss/Copeland Dixell refrigeration controller administration interfaces protected only by weak default credentials — no novel CVE required; (3) Canadian nationals used virtual private servers to deliver malware to university networks for cryptojacking. Social engineering, exposed management interfaces, and phishing-delivered malware attachments (VasyGrek) were all leveraged as entry points.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesPhishing: Spearphishing Attachment
Valid Accounts
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Steal or Forge Authentication Certificates
OS Credential Dumping: DCSync
Remote Access Software
Resource Hijacking
Data Manipulation: Stored Data Manipulation
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Identity Verification and Least Privilege Enforcement
Control ID: Identity Pillar — Attribute-Based Access Control & Continuous Validation
NIS2 Directive (EU) 2022/2555 – OT and Critical Infrastructure Hardening
Control ID: Article 21 — Cybersecurity Risk Management Measures
DORA (EU) 2022/2554 — Digital Operational Resilience Act – ICT Asset Hardening and Resilience Testing
Control ID: Article 9 — ICT Security Policies, Procedures, Protocols and Tools
NYDFS 23 NYCRR Part 500 – Privileged Access Controls and MFA Enforcement
Control ID: Section 500.7 — Access Privileges; Section 500.12 — Multi-Factor Authentication
GDPR — General Data Protection Regulation (EU) 2016/679 – Data Protection by Design and Breach Notification
Control ID: Article 32 — Security of Processing; Article 33 — Notification of Personal Data Breach
PCI DSS v4.0 – Authentication Governance and Incident Response Readiness
Control ID: Requirement 8.2 — User Identification and Authentication; Requirement 12.10 — Incident Response
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
OT disruption of cold-storage refrigeration at blood establishments exposes critical inventory loss risk; lateral movement and exfiltration vectors threaten HIPAA-regulated patient data and life-critical supply chains.
Retail Industry
Hacktivist OT attacks on internet-exposed Danfoss and Copeland Dixell refrigeration controllers across Belgium, Estonia, Ireland, and Sweden signal systemic credential theft and egress policy gaps in retail building management systems.
Higher Education/Acadamia
Cryptojacking indictment targeting U.S. university supercomputers confirms credential theft and unauthorized lateral movement through academic networks, requiring zero trust segmentation and east-west traffic enforcement per NIST.800-53.SC-7.
Financial Services
VasyGrek phishing campaigns deploying RATs against finance sector firms and investment fraud CaaS infrastructure across 50 countries highlight critical egress security, encrypted traffic, and AD CS privilege escalation exposure.
Sources
Sources- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-45-8Verified
- Certified Pre-Owned: Abusing Active Directory Certificate Services (ESC1, ESC8 Attack Paths)https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdfVerified
- CERT-FR Alert: Cyberattacks Targeting Industrial Refrigeration Systems (ANSSI)https://www.cert.ssi.gouv.fr/alerte/CERTFR-2025-ALE-005/Verified
- CISA Advisory: Defending OT and ICS Assets Against Cyber Threatshttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074aVerified
- Microsoft Security Blog: Threat Actors Abuse Quick Assist in Social Engineering Campaignshttps://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misuse-quick-assist-to-deploy-ransomware/Verified
- Europol: Investment Fraud Networks Dismantled Across Europehttps://www.europol.europa.eu/media-press/newsroom/news/investment-fraudVerified
- NVD Detail: CVE-2021-36942 Windows LSA Spoofing Vulnerability (PetitPotam LSARPC vector reference)https://nvd.nist.gov/vuln/detail/CVE-2021-36942Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers exploited exposed management interfaces, misconfigured AD CS, and uncontrolled lateral paths to achieve domain-level compromise and OT disruption. Enforcing identity-aware segmentation and controlled egress would likely have reduced the attacker's reachability across workloads, domain infrastructure, and internet-bound exfiltration channels.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Wrapping internet-exposed OT management interfaces and remote access entry points within a Zero Trust fabric would likely reduce the reachable attack surface available to unauthenticated or weakly authenticated external actors, constraining opportunistic exploitation of default-credential interfaces before a foothold is established.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of network paths available between a compromised workstation and Active Directory Certificate Services infrastructure, reducing the reachability of NTLM relay targets and limiting which endpoints could initiate certificate enrollment requests against privileged AD CS templates.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the reachability between compromised workstations and domain controllers, constraining the attacker's ability to pivot using pass-the-ticket or fraudulent certificate authentication and limiting how broadly DCSync operations could target credential stores across the environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility across workload traffic flows would likely surface anomalous outbound connection patterns — including unexpected runtime process communications and direct OT panel interactions — and could enable policy enforcement that constrains which workloads are permitted to initiate or receive external control sessions.
Control: Egress Security & Policy Enforcement
Mitigation: Enforced egress security policies would likely constrain outbound data transfers to approved destinations, reducing the viability of Rclone-based file staging to arbitrary external servers and limiting the outbound paths available for bulk credential and institutional data exfiltration.
Had prior Zero Trust segmentation and egress controls reduced attacker reachability across OT interfaces and domain infrastructure, the residual impact would likely be constrained to a smaller set of affected facilities and workloads — reducing the geographic scope of refrigeration disruption and limiting the number of domain accounts available for follow-on ransomware staging.
Impact at a Glance
Affected Business Functions
- Cold-Chain Inventory Management and Blood Product Storage (Healthcare/Retail OT)
- Corporate Identity and Access Management (Active Directory Certificate Services)
- University High-Performance Computing and Research Infrastructure
- Financial Services and Investment Platform Integrity
Estimated downtime: 7 days
Estimated loss: N/A
Multiple exposure categories are confirmed or highly probable across the three incident clusters: (1) AD CS ESC1/ESC8 intrusions resulted in DCSync credential dumping yielding all Active Directory account hashes, Kerberos ticket-granting tickets for domain controllers, and exfiltration of internal corporate files to an external server via Rclone — scope of exfiltrated data unquantified but likely includes sensitive business documents, employee credentials, and potentially regulated PII. (2) Refrigeration OT disruptions at retail and healthcare facilities in Belgium, Estonia, Ireland, Luxembourg, Netherlands, and Sweden created life-safety risk through temperature manipulation; at EFS blood storage facilities, automated alarms allowed staff to relocate blood products before inventory loss — no confirmed data exfiltration, but operational systems were fully compromised. (3) Canadian cryptojacking defendants stole university user login credentials and research data across at least four U.S. states over 3.5 years; high-performance supercomputer resources were hijacked for unauthorized compute use and vulnerability research. (4) Investment fraud CaaS infrastructure affected victims in at least 50 countries, with financial losses to individuals through fake cryptocurrency and foreign currency trading schemes.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation (microsegmentation) to contain lateral movement from compromised workstations to domain controllers — identity-based policy enforcement and least-privilege SmartGroups would have prevented certificate-armed attackers from reaching domain controller assets even after AD CS abuse, directly limiting the ESC1/ESC8 escalation paths documented in this week's intrusions.
- • Enforce Egress Security and FQDN-based policy enforcement on all outbound cloud and on-premises traffic — Rclone-based exfiltration and VasyGrek fund transfers to unauthorized external destinations would have been blocked or alerted by egress filtering controls that restrict application-to-internet flows to known, approved destinations, preventing silent data loss.
- • Apply Encrypted Traffic controls (MACsec/IPsec) across all internal and hybrid network segments — unencrypted east-west traffic between workstations, domain controllers, and data stores enabled credential harvesting via DCSync and packet-level visibility for attackers; line-rate encryption of private circuits eliminates this exposure for hybrid and campus environments.
- • Leverage East-West Traffic Security and Multicloud Visibility to detect and baseline inter-workload communication anomalies — DCSync replication requests from non-DC sources, Quick Assist session traffic, and anomalous workload-to-workload connections to OT supervisory interfaces should trigger automated detection; centralized traffic observability enables SOC teams to identify lateral movement before exfiltration occurs.
- • Harden internet-exposed OT/ICS management interfaces using Cloud Firewall (ACF) egress and ingress controls with Inline IPS (Suricata) signature enforcement — refrigeration controller attacks exploited publicly accessible administration interfaces with default credentials; blocking inbound access to Danfoss and Copeland Dixell supervisory platforms via cloud-native firewall policy and deploying IPS signatures against known OT exploit traffic patterns would have prevented temperature manipulation and protected critical healthcare and food supply infrastructure.
