Front Page

Operational Technology

The Fridges Were the Attack Surface: Hundreds of French Supermarkets Lose the Cold Chain to Controllers Nobody Was Still Patching

Overnight on October 11–12, attackers remotely drove refrigeration setpoints at hundreds of French supermarkets as high as 50°C. Intermarché reported up to 200 stores affected, Coopérative U nearly 100, Carrefour 80 and Monoprix around 30, with Netto, E.Leclerc and Auchan also named in reporting. Affected Intermarché stores were told to discard all fresh and frozen stock, and the Paris prosecutor's office — which has opened an investigation — attributes fires to the incident. The Prime Minister asked ANSSI to examine it; no actor has claimed responsibility.

Danfoss has confirmed its AK-SM800 and AK-SC355 controllers among the affected equipment, describing most of it as legacy hardware no longer receiving software or security updates, with one AK-SM800 found running outdated firmware. The initial access path is not officially established, though the controllers are widely reported as internet-reachable and Danfoss's own guidance is to remove direct internet access. Forensic priority: this evidence spoils faster than the stock. Capture controller configuration, setpoint-change history and alarm logs before swapping hardware out, because replacement destroys the only record of what was commanded and when. Treat the temperature logs as the proof of harm, and reconcile each setpoint change against an authorised maintenance action — and note that Claroty-reported flaws in the newer AK-SM 800A, fixed in 2025, have not been linked to this attack.

Vulnerability Management

Eleven Years Late: CISA Flags Five Legacy Flaws as Actively Exploited, the Oldest Disclosed in 2015

On October 8 the Known Exploited Vulnerabilities catalogue took five additions in a single batch, and not one of them is new: CVE-2015-5477 in ISC BIND, CVE-2015-3306 in ProFTPD, CVE-2016-3081 in Apache Struts, CVE-2021-3199 in ONLYOFFICE Docs and CVE-2023-22894 in Strapi, with a remediation due date of October 11. Fixes for the oldest two have existed for eleven years.

A 2015 flaw exploited in 2026 is rarely a patching failure; it is an inventory failure. Software that old is generally not sitting on a tracked server — it is embedded in an appliance, bundled inside a vendor-managed box, or running on a host that no longer appears in anyone's asset register, which is precisely the condition that put unsupported refrigeration controllers in this week's other story. Forensic priority: pivot from "are we patched" to "do we know this is here." Hunt for these components by service fingerprint and file artefact rather than by asset list, since the systems most likely to be running them are the ones your inventory has already lost track of, and treat an unexplained BIND, ProFTPD or Struts instance as a scoping question rather than a closed finding.

Threat Bulletin

Active Exploit

CVE-2026-104286 — Fortinet FortiMail. A path traversal (CWE-22) combined with improper NULL-byte handling (CWE-158) lets an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests, reportedly via the webmail IBE component. CVSS 9.8, disclosed as an exploited zero-day in FG-IR-26-175 on October 1 with no fix then available; CISA KEV due October 4. Forensic Note: Interim guidance is to disable IBE where unused and restrict interface access — then hunt for files written outside expected directories, since arbitrary write is the foothold.

Critical

CVE-2026-89111 / CVE-2026-89107 — SAP, October 13 Patch Day. The first is an unauthenticated SSRF in SAP Cloud SDK for Python (CVSS 10.0): an attacker controlling a tenant subdomain value can redirect OAuth2 token requests to their own server and capture client credentials. The second is ABAP code injection in S/4HANA (CVSS 9.9). No in-the-wild exploitation reported yet. Forensic Note: Credential capture leaves no failed authentication, so audit OAuth2 token endpoints for requests resolved to unexpected hosts and rotate any client secrets issued to multi-tenant BTP apps.

Malware Spotlight

MATCHBOIL / MATCHWOK — The Downloader That Moved From Ministries to the Power Grid

ESET research published this week tracks Russia-aligned UAC-0099's continued refinement of MATCHBOIL, a C# downloader whose usual payload is the MATCHWOK backdoor. Delivery runs through phishing impersonating Ukrainian court summonses, carrying an archive with a script inside; command-and-control sits on BitLaunch VPS hosts partly screened behind Cloudflare, and some operations also deploy the DRAGSTARE stealer. The notable shift is targeting: ESET now sees transport, manufacturing and energy victims rather than the usual government, financial and media set. Forensic Note: Sandbox evasion and heavy .NET obfuscation make dynamic triage unreliable, so anchor hunting on the archive-plus-script delivery pattern and on egress to VPS ranges behind a CDN.