Weekly Situation Report — 10/19/26

• A cyberattack on networked Danfoss refrigeration equipment caused food spoilage and operational disruption at France and EU supermarkets.

• Cisco released a patch for a newly exploited zero-day vulnerability in its Secure Email Gateway product that is exploited in the wild.

• Ivanti products are being actively exploited in the wild, with an imminent threat extending to other technologies Zimbra and Switchvox.

• A newly emerging malware family called CloudHaze is targeting the healthcare and energy sectors with stealer and RAT-like functionality.

1. Cyberattack against Danfoss Fridges Result in Food Spoilage and Disruption at Supermarkets

Summary

Cyberattacks on supermarket refrigeration systems in France exploited vulnerabilities in Danfoss controllers. The attacks caused significant food spoilage and operational disruptions across multiple major supermarket chains.

Category: Major Breaches

Industry: Agriculture and Food, Retail

Analyst comments

Cyberattacks on supermarket refrigeration systems pushed temperatures as high as 50°C, affecting numerous stores in France and leading to food spoilage and waste. Major supermarkets, including Carrefour and Monoprix, were affected by the attacks exploiting vulnerabilities in Danfoss refrigeration controllers. The affected stores were reportedly running outdated firmware. The vulnerabilities were easily exploitable, allowing unauthorized access and the potential to manipulate refrigeration temperatures. CERT-FR issued an alert on the compromises and advised disconnection or restricted network access for the affected controllers.

An update to the French advisory also includes Dixell and Copeland devices with XWEB interfaces that have also been targeted and exploited. According to Shodan, a majority of XWEB interfaces exposed to the internet include high concentrations in Italy, Greece, and Israel with over 7k exposed. By contrast, over 4.5k Danfoss devices are exposed primarily in France and South Africa. The compromise is primarily due to not only the exposure of the devices over the public internet, but also because of poor password hygiene and outdated nature of the firmware on the devices. Currently, it is unknown what specific exploitation vectors were taken advantage of against XWEB enabled Dixell and Copeland devices. However, Danfoss devices (AK-SM 800 and AK-SC 355) were compromised with vulnerabilities that are over a year old and passwords that were poorly configured (such as using the current date) and default admin credentials such as admin:admin.

Many organizations rely on third-parties to manage refrigeration systems, often requiring internet exposure for remote access. These providers may prioritize availability over security, increasing the risk of compromise. This highlights the need for greater security of third-party access and security practices for these and similar devices.

While the threat actor is unknown, they are likely a lone individual or hacktivist. Hacktivists are known to opportunistically compromise IoT/OT devices and claim credit via Telegram. Of note, the Russian hacktivist group NoName claimed access to a French grocery store camera on October 7th via their Telegram channel. However, there is low confidence that these events are related.

Around the same time, Ahold Delhaize, the owner of several large grocery and food retail chains, also reported a major breach. However, no clear link exists between the two events, and there is insufficient evidence to assert a common threat actor. No IOCs have been released publicly. Based on current reporting on the Danfoss compromise, threat actors likely did not deploy persistent malware on the devices.

Actionable guidance

Technical recommendations include the following:

• Ensure devices are up to date with the latest firmware available.
• Ensure default passwords are replaced with strong unique passwords of at least 12 characters that include uppercase and lowercase, numbers, and special characters.
• Rotate passwords every 90 days.
• Restrict network access to prevent exposure of vulnerable devices to the public internet.

Given that these devices are typically managed by third-party providers, the following strategic recommendations apply:

• Vet how third-party providers will access devices and what security controls are in place to prevent compromise and unauthorized entry.
• Require regular security audits for vendors under partnership contracts, reviewing how contractors access devices for maintenance.
• Require VPN solutions for contractors to access remote resources, preventing direct exposure of devices to the public internet.

2. Cisco patches new Secure Email Gateway zero-day exploited in attacks

Summary

Cisco has patched CVE-2026-76519, a zero-day flaw in its Secure Email Gateway’s Advanced Malware Protection (AMP) feature. This allows remote, unauthenticated attackers to execute commands with root privileges by sending malicious email attachments. It affects instances where the File Reputation service is enabled and Content Scanner Tools version is earlier than 25.3.0.5525.

Category: Critical Vulnerabilities

Industry: Multiple

Analyst comments

Cisco has patched CVE-2026-76519, a zero-day flaw in its Secure Email Gateway (SEG) that allows remote, unauthenticated attackers to execute commands with root privileges due to a relative path traversal weakness in the AMP feature. This vulnerability can be exploited through maliciously crafted email attachments, affecting SEG instances where the File Reputation service is enabled and Content Scanner Tools version is below 25.3.0.5525.

In practice, an exploitation scenario involves sending a phishing-related email with a malicious attachment to a target user. When the email is received and AMP is triggered, scanning the attachment results in a file write to the file system followed by execution of embedded OS-level commands. No public PoC is currently available.

Given the absence of a public PoC or additional research, exploitation is likely limited to one or a few threat groups. Access to the necessary Cisco software and patches may require active subscriptions or other means of acquisition. This suggests that the groups exploiting this vulnerability are likely well resourced, potentially including ransomware operators or nation-state actors who purchased a private PoC or developed one through internal research.

Actionable guidance

Administrators should upgrade to a fixed release to remediate this vulnerability. If a patch cannot be applied immediately, temporarily disabling the File Reputation service and relying on other external security monitoring tools is recommended until a patch can be applied. Alternatively, updating the Content Scanner Tool to version 25.3.0.5525 or later will remediate this issue and prevent exploitation. The known exploitation indicator is a sequence in System Security logs: a scan activation alert followed by a scanner failure or similar error, then a “no compromise indicator found” message.

3. IVANTI Exploitation in the Wild with Imminent Threat to Other Technologies

Summary

An Ivanti authentication bypass vulnerability (CVE-2026-104935) is being actively exploited in the wild, as confirmed by honeypot traffic and external researchers. The exploitation also aligns with the timing of dark web postings.

Category: Critical Vulnerabilities

Industry: Multiple

Analyst comments

An Ivanti authentication bypass vulnerability (CVE-2026-104935) is under active exploitation, a trend that aligns with dark web forum posts from the first week of October. Observed exploitation activity corroborates the Ivanti compromises, beginning around the time of the forum post.

Researchers have attributed the exploitation to UTA0576 with low confidence, based on victimology analysis. Although victim details have not been publicly disclosed, we have no current reason to disagree with this assessment. However, external reporting has previously linked UNC5221, a suspected China-nexus espionage actor, to the exploitation of Ivanti devices using both Python and Perl scripts. Based on the tactics, post-exploitation activities primarily include collecting credentials and establishing access, which aligns with threat actors operating as initial access brokers (IABs).

Actionable guidance

A patch is available for the Ivanti vulnerability (CVE-2026-104935) that enables initial access and should be applied as soon as possible. If compromise is suspected, defenders should look for repeated requests to /dana-na/auth/url_default/welcome.cgi with the header X-Dscgi-Path: /home/webserver/htdocs/dana/fb/smb/wu.cgi. Additionally, if strong indicators of compromise are found, such as network requests to known exploited endpoints or connections from IP addresses associated with datacenter or VPS providers, the /tmp directory of potentially compromised devices should be examined for additional artifacts. If a patch cannot be applied, vulnerable devices should not be exposed to the public internet.

Ivanti Connect Secure affected versions            Resolved versions
25.1.1.1 and prior in the applicable code line       25.1.1.2
25.1.2.2 and prior in the applicable code line       25.1.3.0, 25.1.3.1
22.8R2.4 and prior in the applicable code line       22.8R2.5

4. Emerging CloudHaze Malware Targeting Healthcare and Energy Sectors

Summary

According to social media discussions and threat intelligence reports, an emerging malware strain known as CloudHaze is targeting the healthcare and energy sectors. The malware is Rust-based and uses scheduled tasks for persistence. While potential links to nation-state activity have been suggested, no formal attribution has been confirmed.

Category: Emerging Threats

Industry: Energy, Healthcare

Analyst comments

This is a newly identified malware family with extremely limited public reporting, known currently as CloudHaze. Victimology reported through company threat briefs and trusted social media sources indicates targeting of both the healthcare and energy sectors. Attribution to any specific group or origin remains unconfirmed based on available details. The malware evaded detection by a majority of AV vendors as of October 15th, 2026. The source indicated that the malware was found at an oil and gas company in Europe of strategic importance to Ukraine, suggesting possible alignment with Russian state interests. Healthcare victimology was derived from an external threat brief published by a small cybersecurity firm. The report detailed an intrusion involving the malware deployed at a US-based healthcare organization due to malvertising, however the report also noted a targeting nature which may also indicate potential initial contact through phishing or other social engineering means. The reports associate the intrusion to UNC7072, however we are unable to verify this information or attribution at this time definitively due to minimal public documents related to the threat group. Based on the information available to us, initial contact is likely via phishing which may redirect to fake software download sites for targeted intrusions. Watering holes tactics or malvertising is also possible, from users’ claims from social media discussion.

The malware is Rust-based and is obfuscated, encrypted, and uses multiple anti-forensics and anti-sandboxing techniques to hide its activities. Execution in the malware samples analyzed opened a realistic-looking PDF viewer application while malicious actions were being taken in the background.

Payload execution engages in stealer-like activity, looking for Chrome-related data, creating and updating profiles, and then attempting to steal browser history, passwords, and other sensitive browser data. C2 beaconing primarily uses Cloudflare domains with themed algorithmic paths.

Samples have been observed submitted to public sandboxes as early as late August 2026, with most samples appearing between September and October 2026. This indicates a recent and emerging campaign. The C2 domains are likely to change frequently, although the C2 paths may retain the naming patterns observed in previous samples.

Actionable guidance

Organizations in the energy and healthcare sectors in the US and Europe should be wary of unprompted third-party emails, especially those attempting to persuade recipients to download a PDF viewer named QuartzLine, Pagestone, PaperLine, or similarly branded software. Additionally, if watering hole tactics are suspected, users should download software only from official websites and verify authenticity before installation. Keep installed software and Windows up to date to reduce exposure to privilege escalation and spoofing vulnerabilities that might be used during the attack chain.

If compromise is suspected, look for rogue scheduled tasks with --update-check within the execution string. Additionally, look for regular check-ins and communications to Cloudflare resources using HTTPS URL paths with a themed two-folder structure (/themed object_name/themed_related_object e.g. /quarry/bedrock/) transmitting Base64-encoded content via POST. The malware will write files to the local user data folder for both staging and execution that can also be examined for forensic artifacts.

Major Breaches

Ahold Delhaizehttps://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/

Assessment: Resulting in disruption to associated brands and consumer-facing portals. The incident has also affected employee controls and supply-chain-related technology. No claimed groups.

Sector: Food, Retail | Region: EU, US

Danish CPR (Civil Registry System)https://cphpost.dk/2026-10-10/news/round-up/123456-password-used-in-massive-danish-cpr-data-breach/

Assessment: Poor password hygiene resulted in a breach of the Danish CPR through managed IT provider Pays ApS. Passwords were set to “123456,” including administrator accounts. No claimed credit by groups.

Sector: Government, Technology | Region: EU

Meta (Source Code Disclosure and Employee Data)https://www.securityweek.com/meta-says-hackers-took-code-personal-data-of-1500-in-github-breach/

Assessment: The breach includes mostly employee data, in addition to some source code theft. No claims or further information are available.

Sector: Technology | Region: US

ASOS UK and Downstream Fashion Brandshttps://www.reuters.com/business/retail-consumer/uks-asos-says-breach-exposed-some-customer-personal-data-2026-10-08/https://therecord.media/foschini-group-south-africa-cyberhttps://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/https://www.theregister.com/cyber-crime/2026-10-13/owner-of-fashion-brands-hobbs-and-whistles-joins-autumn-pwned-collection/5302752

Assessment: No clear link has been established between the attacks; however, the timing suggests some level of coordination, with rumors indicating the activity was extensive and involved employee compromise and social engineering by the ShinyHunters extortion group. Most attacks affect UK brands, though Swedish brands such as H&M and South African brands have also reported attacks and breaches.

Sector: Clothing, Retail | Region: US, EU, South Africa