OT attacks and cyber breaches, APT and cyberspionage campaigns, AI frameworks and emerging threats

Cyberattacks and compromises: from industrial systems to digital platforms

Between 1 and 2 November 2026, a series of cyberattacks affected refrigeration systems at supermarkets and commercial businesses in several European countries, causing temperature fluctuations, food spoilage and service disruptions. Following the compromises recorded in France in October, the incidents involved Belgium, Luxembourg, Sweden, Estonia, Ireland, the Netherlands, Italy, Portugal, the United Kingdom and Poland, with possible attacks also occurring in Greece. The intrusions affected remote monitoring and control systems and Danfoss, Copeland and Dixell XWEB devices, allowing refrigeration parameters to be modified remotely. In Italy, attacks were confirmed against Coop, Conad and Viro supermarkets, as well as six cold storage units belonging to the Tuscan company SIAF; in Portugal, seven Intermarché stores were affected by an attack potentially linked to the compromise of an external supplier. On 4 November, the pro-Russian hacktivist collectives NoName057(16) and Z-Pentest claimed responsibility for the attacks as part of Operation Chronicle: Danfoss, stating that they had manipulated the controllers without using malware. NoName057(16) also claimed a DDoS attack against Danfoss’s official website and possession of employee and customer credentials. Copeland documented several vulnerabilities in XWEB controllers, including CVE-2026-21718, CVE-2026-24663 and CVE-2026-25085, without confirming their exploitation in the incidents. On 5 November, CISA, the FBI and other US departments issued a joint alert concerning threats to industrial refrigeration and the global cold chain, while the European Commission, ENISA and Europol intensified investigative coordination. Regarding information manipulation, between 1 and 2 November, public alert applications in Ukraine and Russia were affected by separate cyberattacks that resulted in the dissemination of false warnings. In Ukraine, Air Alert transmitted fraudulent notifications about alleged radiological and chemical hazards, fighting in Kyiv and the arrival of an Oreshnik missile, prompting operators to temporarily suspend the service. In Russia, an attack on the administrative panel of the Ministry of Emergency Situations (MChS) application enabled a false warning to be sent to 33 federal subjects. General alert systems remained operational, and no verified links between the incidents have emerged. On 4 November, the English-language Ukrainian news outlet The Kyiv Independent also suffered a compromise of its CMS and a newsletter service, which were used to publish false news and send four fraudulent emails concerning alleged nuclear attacks and assassination attempts against Volodymyr Zelensky. The editorial team considers a Russian origin possible based on the content of the messages; it also clarified that the banking information of members and donors was not at risk. On 30 October, Chainalysis reported an intrusion into its internal systems using agentic offensive techniques. Subsequent investigations established the exposure of users’ names, usernames, password hashes and active tokens, as well as the compromise of some passwords through a Man-in-the-Middle (MitM) attack. Possible unauthorized access to KYT accounts was also detected, prompting the company to suspend several services as a precaution and begin the gradual restoration of KYT and Address Screening on 6 November. There is no evidence of access to investigation data or alterations to blockchain attribution information. In the tourism sector, Austrian tourism technology provider Feratel Media Technologies detected unauthorized access to booking data through Deskline credentials belonging to an integration partner, presumably stolen through a third-party system. The acquired information was used in WhatsApp phishing campaigns against guests of accommodation facilities in Austria, with reports also emerging in Trentino, without evidence of credit card data theft. Also in the travel and tourism industry, Spanish booking, ticketing and check-in systems provider Amadeus IT Group confirmed a vulnerability in a booking display environment, while several airlines, including Japan Airlines, ANA, Cathay Pacific, Korean Air, Asiana Airlines and Singapore Airlines, reported unauthorized access to data including names, PNR codes, flight details and, in some cases, travel documents. It has not been established that all unauthorized access resulted from the identified vulnerability; Amadeus stated that it had fixed the flaw, with no evidence of payment data exposure.

APT and espionage: international attacks and possible spyware operations

Starting on 17 October 2026, the China-linked group VAPOR PANDA conducted a global cyberspionage campaign using ARTEX, an offensive framework based on AI agents. Over 11 days, more than 200 organizations in at least 14 countries were targeted, with confirmed post-compromise activity at nine entities. Targets included foreign ministries, government institutions, telecommunications operators and US organizations in the pharmaceutical, semiconductor, defence, nuclear and financial sectors. ARTEX, primarily based on DeepSeek, coordinated intrusions through XXE vulnerabilities, unsigned SAML assertions, web shells and stolen credentials, enabling privileged access and lateral movement. At two ministries in the Middle East and Latin America, the BLOODALCHEMY backdoor was also deployed through DLL Side-Loading. Remaining in China, since 1 July the APT group SlippyNunchucks has conducted a campaign against Chinese-speaking organizations and individuals in Asia and the Middle East, exploiting unprotected HTTP communications of Sogou Input Method. Through DNS hijacking and DLL Side-Loading, the adversary distributed the modular .NET backdoor FDMTP (DarkVigil), equipped with more than 20 plugins for command execution and payload management. The group is considered aligned with Chinese interests, without sufficient evidence to associate it with Mustang Panda. On the Russian-Ukrainian front, growing convergence between Belarusian operations and Moscow’s strategic interests has been highlighted. In particular, in May Ghostwriter carried out the first documented destructive attack attributed to a Belarusian APT against a Ukrainian manufacturing company, using Chisel, UltraVNC and Cobalt Strike before deploying a VBScript wiper through Group Policy. Since March, the same group had also orchestrated spear-phishing campaigns against Ukrainian government entities, impersonating Ukrtelecom to distribute PicassoLoader and Cobalt Strike beacons. In parallel, Gamaredon Group, Sofacy and Void Blizzard were among the most active Russian adversaries, while Lazarus Group resumed Operation DreamJob against technologies and supply chains supporting Ukrainian unmanned aerial systems, without evidence of direct cyber coordination between Moscow and Pyongyang. Also in Ukraine, an adversary believed to be aligned with Russian interests, named Gorbag and active since at least February 2025, targeted judicial bodies, law enforcement agencies, local administrations, defence organizations and a logistics hub for foreign military aid. After using malicious Excel documents and the PowerShell tool Prime ReverseShell, from early 2026 the group exploited CVE-2025-8088 in WinRAR to distribute BeautyStealer, designed to steal credentials, cookies, OpenVPN configurations, KeePass databases and sensitive documents, exfiltrated through Telegram or FastAPI servers. Moving to South Asia, the Indian state-sponsored group Bitter conducted a cyberspionage campaign through three infection chains based on LNK files, VHDX images, RAR archives and WebDAV, deploying a custom RAT called PapRAT and, in one of the three chains, the WmRAT malware. PapRAT enables command execution, file management and screenshot capture; a more recent version developed in Rust introduces HTTPS communications and additional features. Also in relation to Pakistan, a 48-file cyberspionage toolkit exposed online was identified, containing reverse shells, reconnaissance tools, credential harvesting utilities and lateral movement tools. References to PAEC, Chashma, KANUPP, SCADA, Modbus and OGDCL suggest an interest in Pakistani nuclear, energy and industrial infrastructure. Some correlations indicate a possible link to the Indian APT Dropping Elephant, without definitive attribution or confirmed compromises. On the Russian front, in mid-October a watering-hole campaign was identified and attributed with moderate-to-high confidence to APT29, associated with Russia’s Foreign Intelligence Service (SVR). The campaign exploited compromised or counterfeit websites and the Ukrainian Plerdy service to distribute exploits targeting unpatched iOS and Android devices. Following a fingerprinting phase using UltimateFingerprinter, the infrastructure selected three chains: Class A, combining CVE-2025-43529 and CVE-2024-27834 (added to CISA’s KEV catalog on 4 November) to steal cookies on iOS 16.7; Class B, based on the DarkSword exploit kit and five vulnerabilities (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520) to collect messages, credentials and other data from iOS 18.5; and Class C, exploiting CVE-2026-3910 and CVE-2025-27038 to deploy AndroSnitch on Android. All vulnerabilities had already been patched. Focusing on Apple, on 30 October the Cupertino-based company sent new notifications concerning possible mercenary spyware attacks to users in 99 countries. In Germany, recipients included members of the Bundestag and the Federal Government, including Franziska Brantner and Andreas Bovenschulte; international recipients included Lebanese journalist Radwan Mortada, previously targeted with Pegasus spyware developed by Israel’s NSO Group. Finally, turning to North Korea, on 29 October Binance suffered the theft of approximately $6.3 billion in cryptocurrency across ten blockchains, officially attributed by the FBI to the state-sponsored Lazarus Group on 31 October. The operation, prepared since June through tampered installers, fake job interviews and compromised DevOps endpoints, also exploited an internal AI tool to gain access to wallet infrastructure. The attacker compromised signing processes and used EIP-7702 delegations on Ethereum to continue transfers after withdrawals were suspended. Approximately $2.85–3 billion had been frozen or seized, while Binance stated that it had replenished 95% of the affected assets using corporate resources and the SAFU fund, initiating the gradual restoration of services.

Cybercrime: new malicious campaigns, AI usage and ransomware operations

In the first half of 2026, a compromise attributed to NetamLoader was identified. This previously unknown .NET malicious framework targeted an Asian system running a version of Windows 10 reserved for government entities. The infection chain exploits legitimate Patch My PC components to execute XAML payloads through AppDomainManager injection, bypass AMSI and ETW, and deploy the .NET 2 Plugin module in memory, equipped with reconnaissance, C2 communication and additional payload execution capabilities. The initial vector remains unknown, although a software supply chain compromise has been hypothesized. On the artificial intelligence front, security researchers documented the use of the open-source CyberStrikeAI framework against educational organizations in Africa and Latin America. The tool, based on an LLM orchestrator, automated reconnaissance, privilege escalation, lateral movement and data exfiltration, enabling the complete compromise of Active Directory domains, including through the use of Mimikatz, DCSync and Golden Ticket. Also in the AI domain, on 4 November the Indian authorities I4C and CERT-In reported an escalation in the operations of an adversary named CRAFTY FALCON against fintech companies, financial institutions, digital lending platforms and cryptocurrency exchanges. The adversary uses frameworks such as ARTEX, PentAGI, Cairn and CyberStrikeAI to automate intrusions through exposed APIs, application vulnerabilities and stolen credentials, compromising production systems and payment services. Operations include the theft of banking API credentials, preliminary one-rupee transactions and fraudulent transfers to mule accounts, as well as repeated attacks against organizations that have undergone incomplete remediation. In parallel, LLMJacking attacks were tracked against cloud infrastructure belonging to financial, technology, retail and transport organizations across several regions, resulting in fraudulent charges exceeding $100,000 in a single day and reaching up to $1 million for some victims. The intrusions exploit exposed credentials and tokens, accessible LLM endpoints and vulnerabilities such as CVE-2026-40217 in LiteLLM, monetizing resources through massive API calls and LLM Mixer platforms, including Jet Night, associated with more than 500,000 requests in less than eight hours. Another criminal use of AI was observed in VOLTA (VOLTA-AUTODOXER), a Windows infostealer that steals credentials, cookies, tokens, payment data and cryptocurrency wallet information, enriching the collected data through authenticated sessions on Gmail, Discord and commercial services. The malware uses Claude Opus 4.6, Kimi K2 and Gemini 2.5 Flash through OpenRouter to produce dossiers and classify victims according to their financial potential, exfiltrating the results through Telegram. On the botnet front, on 2 November Google announced an operation with Japan’s National Police Agency against XCPE, a backdoor preinstalled in the firmware of more than 1.3 million Android set-top boxes. According to Google, Chinese manufacturer Videostrong Technology allegedly deliberately integrated the malware to monetize devices through residential proxies, advertising fraud and the distribution of additional payloads. The operation disabled the C2 infrastructure, with expected effects on access to at least another 10 million devices compromised by affiliated malware, without automatically removing infections. In addition, the Fake Download campaign was identified, distributing trojanized Inno Setup installers disguised as pirated software and utilities to install WorldProxyPool, CharityEngine, BOINC and adware components, exploiting the connectivity and computing power of Windows systems. In the supply chain domain, on 29 October manipulated versions of the anthropic.claude-code extension, distributed for approximately eleven hours on the Cursor marketplace, introduced malicious code designed to collect information and install a persistent SSH backdoor. Cursor removed the compromised packages, while Anthropic’s systems and the Microsoft Visual Studio marketplace do not appear to have been affected. During the first nine months of 2026, a Russian-speaking cybercriminal group named VasyGrek conducted more than 100 attempted attacks against organizations in Russia, Belarus and Kazakhstan through spear phishing, Golang backdoors, PureRAT, PowerLoader and ransomware Pay2Key. On 2 November, the Russian Ministry of Internal Affairs announced the dismantling of the group’s infrastructure, with seizures and restrictive measures against three alleged members, without confirmation that its activities had been permanently disrupted. Finally, in the ransomware landscape, on 29 October Synology confirmed attacks against NAS devices running outdated versions of DiskStation Manager, linked by technical analyses to Cerber (C3RB3R). The manufacturer referenced vulnerabilities in advisory Synology-SA-24:20, including CVE-2024-10441, while a separate analysis identified CVE-2026-13639 and CVE-2026-13684 as initial attack vectors. Data exfiltration, the number of victims and the identity of the adversaries have not been confirmed. Finally, in October 2026, a US organization was targeted by ANUBIS ransomware through the use of the new Lindnor backdoor, detected on two Microsoft SQL Server systems. The attackers deployed at least 13 tools to disable security solutions and five vulnerable drivers exploitable through the Bring Your Own Vulnerable Driver (BYOVD) technique, as well as installing AnyDesk and preparing it for use in Safe Mode. The ransomware, also equipped with wiper capabilities, was blocked before execution, with no evidence of data encryption or exfiltration.

Weekly Threats Report is Telsy‘s weekly update covering the main developments in cyberattacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team consists of security analysts and researchers with technical and investigative expertise and internationally recognized experience.

Through the continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with actionable intelligence to anticipate attacks and understand their impact, while relying on a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.