Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats. The post The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk appeared first on Unit 42.
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. The company's experiments showed that models could identify unfamiliar devices, connect them into a network, and prepare them to run an AI model. Although the researchers successfully distributed the Gemma4-26B-A4B model from Google DeepMind on 15 off-brand Android TV boxes, they did not demonstrate a fully autonomous, self-replicating AI worm running on real IoT hardware. However, they estimate that smaller models could achieve self-replication by the end of the year if they continue to improve at their historical rate. “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic warns.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected. “Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.” reads the advisory. “Ivanti has released updates for Ivanti Connect Secure (ICS) which addresses one high severity vulnerability. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands.” The company confirmed that the vulnerability was exploited in attacks in the wild. “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” continues the report. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 16, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. The company disclosed earlier today that several IT systems remain unavailable, although physical stores remain open for customers. According to the press release, the incident has not affected the group’s other brands, Inside Story and White Stuff, or its operations in Australia and Africa. TFG London is the UK subsidiary of South Africa’s The Foschini Group, which owns the aforementioned five fashion and homeware brands. As of mid-2026, the group operated 649 retail locations globally and reported annual sales of £488 million ($646M). The company said it detected the cyberattack on October 11 and immediately activated its incident response and business continuity plans, bringing in external cybersecurity experts to help contain the threat.
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions. Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires. The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out. “300 Intermarché and Netto stores, and fewer than 100 U stores, were affected on Monday, October 12, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss, according to the two retailers.” reports BFMTV. “Hackers reportedly remotely altered the temperatures of the systems, causing the destruction of stocks of fresh and frozen products.” The scale is still being counted. The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers. A specialist site reported that Carrefour Market and Monoprix stores were hit too, which those chains haven’t confirmed. The money follows. A sector source told BFM national losses could reach several million euros, and Intermarché said its affected stores had to throw out all the fresh and frozen products concerned. In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros. Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected. Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires. This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols. The full extent of the damage is still being calculated. The Mousquetaires group reported that 300 Intermarché and Netto stores were affected, while Coopérative U stated that fewer than 100 of its locations were hit. E.Leclerc also confirmed that cooling equipment in several stores was affected, though they did not provide specific figures. Meanwhile, a specialized news site reported that Carrefour Market and Monoprix stores were targeted as well, though these chains have not yet confirmed it. The financial impact is heavy. Industry sources told BFM that national losses could reach several million euros, and Intermarché confirmed that all affected stores had to throw out their fresh and frozen inventory. For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods. The damage isn’t limited to the east. In the Loire-Atlantique, the huge Leclerc Atlantis in Saint-Herblain took all its frozen products off its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins wasn’t expected to reopen its fresh aisle normally before Tuesday, October 13. Several U stores were hit as well, some only in the frozen aisle, and an Intermarché in the same area too. One photo from BFM shows an ice cream shelf reading 26 degrees, which is a fine temperature for a beach. Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented. His point is easy to see. Nobody was stealing data here, and the target was food. Je confirme qu’une cyberattaque touche depuis cette nuit les installations de production de froid de plusieurs magasins de notre réseau @CooperativeU. Nos équipes sont pleinement mobilisées, en lien avec les frigoristes, pour rétablir la situation au plus vite. Une enquête devra… — Dominique Schelcher (@schelcher) October 12, 2026 The authorities moved quickly. According to the Prime Minister’s office, the national cybersecurity agency ANSSI has identified a vulnerability in software supplied by Danfoss and contacted the company. ANSSI is also talking to its European counterparts because other countries may be affected, and it’s trying to find other French companies hit. Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware, specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates, while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected. Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires. This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols. Because these controllers are typically managed remotely and feature a built-in web server, an attacker who gains access can send direct commands to the connected cooling systems—such as forcing a manual defrost. Claroty’s research highlights that the product is widely deployed across supermarkets, cold-storage facilities, and logistics warehouses, with a Censys scan revealing 2,765 exposed management interfaces online. Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1. However, BFM notes that authorities have not officially confirmed whether hackers exploited this specific flaw in the recent attack. If it was the entry point, standard security disclosure practices were followed, as details were withheld until a patch was made available. For legacy, end-of-life units, no security patches exist, leaving disconnecting them from the public internet as the only viable defense. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, French supermarkets)
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware
A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion charges. Reuters reported the arrest, citing court documents, prison records and a person familiar with the case. The group has also stolen information about FBI employees. Court documents filed in the Eastern District of Pennsylvania, which includes Philadelphia, accuse the defendant of conspiring to threaten the confidentiality of information to extort money and of interfering with commerce. “A Canadian ransomware negotiator was arrested Thursday and faces unspecified extortion charges, according to court documents, prison records and a person familiar with the matter, as the FBI cracks down on a hacking group that stole information about its employees.” Reuters states. “Edward Dubrovsky faces charges of conspiracy to “threaten to impair the confidentiality of information with intent to extort money” and “interference with commerce,” according to court documents, opens new tab filed with the Eastern District of Pennsylvania, which covers Philadelphia.” Krebs on Security reports that the second charge involves threats. The main criminal complaint remains sealed, so the details of the defendant’s alleged role are not yet public. The records spell the last name two ways, Dobrovsky or Dobrosky, and they don’t list an age, a profession or an employer. A person briefed on the matter told Reuters the defendant is Edward Dubrovsky, a Canadian cybersecurity executive. Reuters couldn’t even settle the spelling, which tells you how early this is. “Federal court records show that on October 8, an Edward Dobrovsky (note the slight misspelling of the last name) was arrested in Pennsylvania on cyber extortion and conspiracy charges.” states the report. “Several of those documents — including the core complaint — are now sealed. But a handful of them were indexed at Courtlistener.com, including a summary of the complaint, which charges the defendant with “conspiracy to threaten to impair the confidentiality of information with the intent to extort money,” and “interference with commerce by threats.”” Federal prosecutors in Philadelphia didn’t return repeated messages about the discrepancies. Reuters also couldn’t reach Dubrovsky, his lawyers, or CyberSteward, the company named on his LinkedIn profile. According to Krebs, the available records showed no attorney yet. “An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer.” states Krebs. “According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky, who is now associated with another Canadian security firm and sponsor called CyberSteward. In a post to LinkedIn approximately one month ago, Dubrovsky said he had plans to attend the Cyber Risk Summit with the rest of the CyberSteward team.” CyberSteward advertises itself as a specialist in threat actor engagement, cyber extortions, complex negotiations and settlement facilitation. On LinkedIn, Dubrovsky presents himself as an expert in negotiating ransom payments with cybercriminals. SecurityWeek notes he’s also the author of a book on responding to cyber extortion. Politico and Krebs reported the arrest first. Krebs says he was in Philadelphia for a cyber insurance conference. Federal prison records show a man with his name detained at a federal detention center in the city. ShinyHunters is the backdrop. Last month the group claimed it had stolen information on nearly every FBI employee, and it said it got into the bureau’s jobs website and other systems in response to an FBI report earlier this year warning about its activity. FBI blamed the intrusion on a contractor’s failure to patch vulnerable Oracle PeopleSoft software. When Reuters asked about the arrest, the FBI pointed to a statement from Director Kash Patel and declined further comment. Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor. This is the latest arrest… — FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026 Patel described the arrest as the latest in a series of actions against ShinyHunters over just a few days. According to SecurityWeek, he said the FBI will continue working to disrupt the remaining network. This is the third suspected arrest linked to ShinyHunters in recent weeks, following one in the Netherlands on September 15 and another in Jordan on September 28. The case has also moved to another court. A notice filed on October 9 transferred it to the Eastern District of Texas, where sources told Krebs on Security the FBI’s ShinyHunters investigation is focused. However, authorities have not publicly explained what the defendant allegedly did. Reuters reports that the charges have not been specified, and the main complaint remains sealed. Krebs on Security also reports, citing sources, that executives at other ransomware negotiation firms could face charges. The FBI says ShinyHunters has extorted more than $70 million this year. The latest arrest brings the number of suspected ShinyHunters members detained in recent weeks to three. On September 15, authorities arrested a suspected member in the Netherlands. A second alleged key member was reportedly arrested in Jordan on September 28 and is said to be cooperating with the FBI. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ShinyHunters)
Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online. Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the attack on October 8 through a post on the Ubuntu Discourse forum. “Canonical’s websites are under a sustained distributed denial of service attack. Our team is working diligently to resolve the incident. Please refer to our status page for up-to-date information. Some services may be intermittently unavailable.” the company states. At this time, no cybercrime or hacktivist group has claimed responsibility The attack affected Canonical’s main public websites, including ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and the security advisory pages and API. Users may have been unable to access security advisories or read the blog during the attack. “It was recently revealed that Canonical’s web infrastructure and the Ubuntu ecosystem suffered a massive and sustained distributed denial-of-service (DDoS) attack that caused its main portals and services to crash and be intermittent for more than four hours.” states the company blog. “Regarding the attack, it is mentioned that it directly affected the most visible institutional domains, including canonical.com and ubuntu.com, as well as the official blog, the developer portal, assets.ubuntu.com, academy.canonical.com and sites linked to enterprise technologies such as jaas.ai and maas.io.” However, Launchpad and the Snap Store remained online throughout the incident. These services allow developers and system administrators to manage and install software. Canonical acknowledged the outage on its status page and Ubuntu Discourse while engineers worked to limit the impact. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, affecting tools used to check security advisories and apply kernel patches without restarting systems. However, Canonical’s distributed infrastructure helped contain the damage. Software repositories and mirror servers remained available, allowing users to install updates. Launchpad, the Snap Store, disk image servers and Ubuntu Single Sign-On also continued to work. As a result, users could continue downloading and installing packages even while Canonical’s public websites were disrupted. The overall outage lasted a little over four hours, causing real disruption. This attack differs from the April one, which caused greater disruption by taking down Launchpad and the Snap Store and preventing some users from installing Ubuntu updates. At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility. Canonical described the April incident as a sustained, cross-border attack, language that suggested distributed infrastructure spanning multiple countries. Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, DDoS)
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U, with French outlets reporting that the attack affected 250 to 350 stores, causing significant financial losses and food waste. The threat actors hijacked refrigeration controllers running older versions of Danfoss control software on Sunday night and used them to raise supermarket refrigerator temperatures by triggering a built-in automatic defrosting system. "Following a cyberattack reportedly affecting a service provider that manages refrigeration systems in stores, some fresh and frozen food display units are out of service," an Intermarché spokesperson told BleepingComputer when asked for more information on the incident. "Intermarché and Netto have taken all necessary precautions to remove the products from these units as quickly as possible. We don't have further information currently, nor a specific list of affected stores to share with you."
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login. Attackers could abuse it to make the appliance send requests and access internal functions, allowing unauthorized actions. “A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.” reads the advisory. “By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.” The vendor said it has found no evidence of exploitation, but recommends applying the fixes. The vulnerability affects the following product and versions: Affected ProductAffected Version(s)SMA1000 Models – 6210, 7210, 8200v 12.4.3-03526 (platform-hotfix) and older versions. 12.5.0-02952 (platform-hotfix) and older versions. The company pointed out that the flaws do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. The hotfix is available through the MySonicWall portal, the vendor pointed out that there is no workaround. Multiple researchers warn the vulnerability is now being actively exploited. Cybersecurity firm Defused has detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys since October 8, 2026. Defused alerted subscribers through its Radar service. Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate access path SSRF, CVSS 10.0) was disclosed earlier this week by SonicWall. We notified Defused subscribers of the anomalous traffic via our Radar… pic.twitter.com/h0w30YT0Y3 — Defused (@DefusedCyber) October 9, 2026 Cybersecurity firm Previdian also announced that its sensors have detected exploitation attempts targeting SonicWall SMA 1000 appliances, consistent with CVE-2026-102255. The reported attacker IP is 146.70.143[.]142. SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0). The vulnerability allows unauthenticated server-side request forgery (SSRF). Attacker IP: 146.70.143[.]142 Apply SonicWall's hotfix and… pic.twitter.com/YBovnuEkvD — Previdian (@PrevidianCyber) October 9, 2026 According to Previdian, researchers have recorded 135 attack attempts from two IP addresses in the United States. Researchers have recorded 135 attempts from two different IP addresses in the United States. SonicWall has not yet updated its security advisory to confirm that attackers are exploiting the flaw. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SonicWall)
Confirm this action.
Leaving now will discard your changes.