Weekly situation report: 11/9/26

• Operational security failure by the emerging N0n ransomware group has exposed details of its infrastructure, tactics, and attack procedures.

• The “*SSHOLE” OpenSSH authorization bypass vulnerability is being exploited in the wild following its public disclosure.

• A cyberattack targeting Danfoss refrigeration systems disrupted supermarket operations and caused food spoilage due to loss of refrigeration.

• Attackers are actively exploiting a critical vulnerability in Node-RED to compromise affected environments.

• A newly identified attack technique allows Microsoft Paint to be exploited remotely over a network, expanding the potential attack surface of the application.

• A proof-of-concept exploit has been publicly disclosed for an authentication bypass vulnerability affecting Barracuda Email Security Gateway (ESG) appliances.

1. Emerging N0n Ransomware Group OPSEC Failure Gives Insight into Threat Actor’s Playbook

Summary

A n0n ransomware operator used a combination of AI and stolen credentials to breach 23 organizations across 14 countries. However, the operator exposed their own server, revealing their methods and highlighting a significant gap between their operational ambition and security discipline.

Category: Threat Actor Activities

Industry: Multiple

Analyst comments

A n0n ransomware operator exposed their server, revealing their methods in recent attacks. The operator used a mix of AI and stolen credentials to steal, encrypt, and sometimes delete data, including backups, preventing victims from recovering their information. Despite the attention surrounding AI-assisted breaches, most documented compromises relied on weak or stolen credentials. External reporting also suggests the exploitation of vulnerabilities affecting edge computing devices. However, these claims remain unverified, and this item will be updated as additional information becomes available.

The operator used the AI coding agent OpenCode to write and debug scripts, incurring over $7,216 in AI usage costs by October 22. The n0n group’s operations were exposed through a publicly accessible Python HTTP file server. The server contained attack scripts, ransomware source code, and AI coding environments, highlighting a significant gap between their ambitious operations and basic security practices.

The n0n group is an emerging threat actor, with statistics from September to the present placing it among the top three ransomware operators, alongside more established groups such as The Gentlemen and Qilin. As of November 4th, the group has compromised an estimated 189 victims since mid-September. Many victim names remain undisclosed, with the group threatening to release stolen data if ransom demands are not met. While the group targets victims across multiple regions, its primary geographic focus is the US and South Korea. Its most frequently targeted sectors, in descending order, are logistics and shipping, technology, retail, healthcare, manufacturing, and finance.

Persistence tactics are non-novel and take advantage of Windows scheduled tasks with sync naming convention, rogue administrator accounts with svc_ naming convention, and SSH authorized keys on cloud hosts. Initial access is primarily through credential stuffing targeting Fortinet, RDP, and WinRM. Credentials for these three items have been regularly sold on underground dark web forums in the last three months or longer. The recent Fortinet bruteforcing campaign (dubbed Fortibleed) has likely directly fueled exploitation. Further evidence is that organizations known to have been affected by the initial Fortibleed campaign were still vulnerable months later.

Actionable guidance

Consider restricting PowerShell, Python, and other advanced scripting options for a majority of users not working in IT or Technology departments. Implement behavioral monitoring of user logins and tune alerts to identify logins from unusual or unexpected locations. Ensure that external-facing Fortinet devices are up to date, as threat actors may exploit known vulnerabilities in addition to credential replay attacks. Restrict access to servers from locations outside the organization’s operating regions through measures such as geoblocking.Threat actors have previously used Russian related IPs and datacenter IPs unrelated to business operations. As credential abuse is the primary initial entry point in most known cases, regular rotation and invalidation of sessions is recommended to reduce the time that an attacker may be able to take advantage of a stolen credential or session.

For signs of compromise, look for unknown logins attempting to access Fortinet devices, AWS cloud instances, and WinRM or RDP. A high signal of exploitation attempts may see failed login attempts either on multiple users in a short period of time, or a high volume of requests to a single endpoint. Network requests to FortiGate endpoint /remote/logincheck with header cookie value APBSID=n0n are high signal of attack by the group. Having alerts tuned to catch behavior in the initial stages of the attack will help prevent further part of the post-exploitation and ransomware attack chain. Monitor for changes in scheduled tasks or registry Run keys and alert on changes without administrator approval. A high signal of potential attack in progress is the creation of the folder C:\Users\Public\n0n and files with .n0n extensions. Unusual traffic over WinRM and RDP from internal locations that break normal behavior may also signal lateral movement of this attack chain. Unattributable additions to administrator user groups or cloud tenants, rogue scheduled tasks creation using variations of *sync, *audit, exfil, netassist, and chromedbg are persistence artifacts that can be hunted for. Firewall tampering, especially against FMC devices, with rogue authorized keys, block rules, and tokens from unusual network locations are additional forensic artifacts.

2. “*ssHOLE” OpenSSH Authorization Bypass Exploited in the Wild After Disclosure

Summary

An OpenSSH authorization bypass impacts musl-configured Linux hosts such as Alpine, OpenWrt, Buildroot, and Yocto. The bug is trivial to exploit, requiring only the submission of a long password string when attempting to authenticate as a user account configured without a password.

Category: Known Exploited Vulnerabilities

Industry: Multiple (exploitation will focus on Cloud-related assets)

Analyst comments

On November 5th, a security researcher disclosed an authorization bypass in OpenSSH deployments on systems such as Alpine Linux, OpenWrt, Buildroot, and Yocto. The vulnerability allows authentication to be bypassed when PAM is not used and PasswordAuthentication is enabled. Exploitation occurs when an attacker submits a password longer than 256 characters when attempting to log into SSH as a user with no password set. This includes users such as alpine and root, which is typical for cloud containers. We have received reports of active exploitation attempts following the disclosure of this vulnerability. We have also confirmed the vulnerability in our lab environments, primarily affecting OpenSSH 10.* versions bundled with Alpine Linux.

The root cause of the “sshole” vulnerability stems from an interaction mismatch between the musl C library and OpenSSH (sshd) on Linux systems that do not use Pluggable Authentication Modules (PAM). Since an architectural change in August 2012, musl’s crypt() function returns an unmatchable hash string () on failure instead of NULL. OpenSSH did not account for musl returning * on failure rather than NULL when verifying passwords. Under specific conditions, OpenSSH may misinterpret an authentication failure response and permit unauthorized access to user accounts, including those configured for key only authentication or with password authentication disabled. Exploitation requires password authentication to be enabled at the server level, PAM to be disabled or unavailable, and the submission of a password between 257 and 1,024 bytes.

Anecdotal reports on social media suggest that the vulnerability is being exploited in the wild, with attackers reportedly deploying cryptocurrency miners. However, these reports remain unverified, and further research is needed to confirm the activity. Honeypot data also confirms attempts to exploit this issue by supplying 256+ “A” characters seen in logs. Cloud containers are at greatest risk, as targeting primarily focuses on containerized deployments rather than on-premises hosts.

Actionable guidance

Apply the patches for OpenSSH or migrate OS versions to the latest available. Temporary workarounds include disabling PasswordAuthentication in SSHD configuration files. Evidence of compromise will include log files such as the following:

Accepted password for <user with no password set such as alpine or root> from <ip_address> port <port number> ssh2

Additionally, if external monitoring is enabled on containers, look for network traffic to SSH ports with large blocks of single characters to passwordless accounts. Given how trivial it is to exploit vulnerable hosts, this should be prioritized for immediate remediation. SSH configuration below to temporarily mitigate impact until a patch can be applied:

# Workaround to apply to /etc/ssh/sshd_config
PasswordAuthentication no

The bug is fixed in versions of Alpine Linux released November 5th and OpenSSH version 10.6p2.

3. Cyberattack against Danfoss Fridges Result in Food Spoilage and Disruption at Supermarkets (UPDATED)

Summary

Cyberattacks on supermarket refrigeration systems in France exploited vulnerabilities in Danfoss controllers. The attacks caused significant food spoilage and operational disruptions across multiple major supermarket chains. A second wave of attacks is currently ongoing. Claims of responsibility from Russian groups NoName057(16) and Z-Pentest are likely disinformation, as no verification has been provided.

Category: Major Breaches

Industry: Agriculture and Food, Retail, Healthcare

Analyst comments

A second wave of attacks has been ongoing since November 2nd, affecting several supermarkets across Europe. The attacks have also expanded into the healthcare sector, specifically targeting blood collection and storage facilities in France. This is a similar attack style to the first wave, targeting refrigeration suppliers and exploiting Danfoss-related flaws in vulnerable refrigeration units. The TTPs for the vulnerabilities currently known remain the same.

The attacks were claimed by Russian threat actor groups NoName057(16) and Z-Pentest via their Telegram channels. However, attribution remains dubious, as neither group has shared proof of exploitation, and the claims emerged only after analysts had publicly suggested their involvement. No further data is available to verify their claims. Therefore, these claims are more likely disinformation, amplified by public analyst speculation. Cyberattacks on supermarket refrigeration systems pushed temperatures as high as 50°C, affecting numerous stores in France and leading to food spoilage and waste. Major supermarkets, including Carrefour and Monoprix, were affected by the attacks exploiting vulnerabilities in Danfoss refrigeration controllers. The affected stores were reportedly running outdated firmware. The vulnerabilities were easily exploitable, allowing unauthorized access and the potential to manipulate refrigeration temperatures. CERT-FR issued an alert on the compromises and advised disconnection or restricted network access for the affected controllers. Attacks remain ongoing as of this report.

Actionable guidance

Technical recommendations include the following:

• Ensure devices are up to date with the latest firmware available.
• Ensure default passwords are replaced with strong unique passwords of at least 12 characters that include uppercase and lowercase, numbers, and special characters.
• Rotate passwords every 90 days.
• Restrict network access to prevent exposure of vulnerable devices to the public internet.

Given that these devices are typically managed by third-party providers, the following strategic recommendations apply:

• Vet how third-party providers will access devices and what security controls are in place to prevent compromise and unauthorized entry.
• Require regular security audits for vendors under partnership contracts, reviewing how contractors access devices for maintenance.
• Require VPN solutions for contractors to access remote resources, preventing direct exposure of devices to the public internet.

4. Critical Node-RED Flaw Exploited in Attacks

Summary

Hackers are exploiting a critical authentication flaw in Node-RED (CVE-2026-58115) to deploy malicious payloads, including bots and webshells. Organizations should immediately assess potentially affected instances and apply available security updates.

Category: Known Exploited Vulnerabilities

Industry: Manufacturing

Analyst comments

A critical-severity vulnerability (CVE-2026-58115) in Node-RED, a flow-based programming tool, is being actively exploited to deploy various payloads. This vulnerability involves a missing authentication issue on the Node-RED HTTP interface that allows unauthenticated remote attackers to create malicious flows and execute arbitrary code with maximum privileges. Initially disclosed by Siemens on August 11 in relation to their SIMATIC IoT2050 Advanced devices, patches are available from version 4.3.4.1 onward. Researchers observed successful exploitation on October 30, involving a complex attack sequence that included deployment of a Linux bot and persistent webshells.

Examination of requests in honeypots to the /flows endpoint shows a notable spike between August and September. This coincides with the initial disclosure of the vulnerability, and we have observed IP addresses linked to exploitation attempts during that period. This indicates exploitation attempts occurred earlier than the external report from researchers suggests. Analysis of known network IoCs identified several open web directories linking the activity to malware named nyx_bot. Based on submitter attributions in public malware and IoC repositories, nyx_bot is believed to be DDoS malware written in Go. No current vendor report exists for the botnet.

The Base64-encoded command contains a dropper to download the malware onto the targeted device. The binary is saved in /dev/shm/.b, which is a RAM-based temporary filesystem, so that the payload executes primarily in memory without touching the disk. Additional variants also use /tmp/.s as a save location. Based on open web directory results, the dropper and malware are made to support multiple architectures. Further threat hunting also revealed that the threat actors set up FUXA infrastructure, an open-source, web-based SCADA/HMI and dashboard platform for visualizing automation and OT/IoT hosts.

Actionable guidance

Apply the patch released by Siemens to address this vulnerability. If exploitation is suspected, look for POST requests to /flows and JSON content with Base64-encoded command strings being executed.

5. MS PAINT can be Exploited over the Network

Summary

Tracked as CVE-2026-83844, a high-severity remote code execution vulnerability in Microsoft Windows Paint allows an unauthenticated attacker to run arbitrary code on Windows 11 systems. Exploitation involves triggering an out-of-bounds read flaw when processing a crafted image file.

Category: Critical Vulnerabilities

Industry: Multiple

Analyst comments

CVE-2026-83844 is a security flaw in Microsoft Paint that allows attackers to execute arbitrary code on a target Windows 11 system. The issue is triggered by an out-of-bounds read error, which occurs when the application mismanages memory while parsing a specially crafted image file. If a user opens one of these malicious images, the attacker can execute arbitrary code with the user’s privileges. A patch is available, but user reports indicate that the application must be updated through the Microsoft Store rather than through standard WSUS/Microsoft Update channels.

There are no known indications of exploitation in the wild, and no public PoC code or research is currently available. Additionally, the advisory notes that the attack complexity vector is high, noting that specific information is required to fully exploit the vulnerability. It is not specified what requirements are needed to fully exploit this vulnerability. However, as it is memory-related, it likely requires knowledge of specific memory offsets of the currently running Windows OS, though this cannot be confirmed at this time. This makes exploitation less likely in the near term depending on the complexity required for successful exploitation. The bug was introduced in recent feature updates to the Windows 11 version of the application in 2026. Versions 11.0.0.0 up to, but not including, 11.2605.91.0 are vulnerable.

MS Paint does not act as a server nor is user interaction necessary for execution to take place. An example scenario includes a threat actor sending an image attachment to a user’s inbox in Windows. MS Paint runs in the background to render an image preview. As the crafted image file is processed, it could trigger an out-of-bounds memory write, potentially allowing arbitrary code execution in the context of the current user. While this is a plausible attack scenario, details regarding the exact network attack vectors and affected versions of Windows 11 and MS Paint remain unknown and are not publicly documented. It is possible that newer AI features communicating with Microsoft endpoints could introduce additional attack vectors, allowing attackers to tamper with communications and deliver malicious images that trigger the vulnerability.

Actionable guidance

Update MS Paint via the Microsoft Store. Alternatively, if the application is not needed, it may be uninstalled or blocked via AppLocker or Group Policy. Crashes of the mspaint.exe application or unknown processes spawning from the application may indicate abuse.

6. Barracuda ESG Bypass PoC Disclosed

Summary

Barracuda has released patches for two critical vulnerabilities: a pre-authentication bypass (CVE-2026-116606) and a command injection flaw (CVE-2026-111560). The flaw affects its Email Security Gateway and potentially allows attackers to gain root access, with the latter impacting five other Barracuda products.

Category: Critical Vulnerabilities

Industry: Multiple

Analyst comments

Barracuda has released patches for two critical vulnerabilities affecting its Email Security Gateway (ESG) appliances. These include an authentication bypass (CVE-2026-116606) and a command injection issue (CVE-2026-111560), with the latter also impacting five other Barracuda products. The authentication bypass vulnerability allows an unauthenticated attacker to modify the appliance’s configuration by importing a crafted backup archive. The command injection flaw, present in the timezone configuration setting, enables an attacker with administrator privileges to execute OS commands as root. Both vulnerabilities could be exploited in combination to gain root access to the device. They require attackers to access the appliance’s admin interface, which should be restricted to trusted internal networks.

PoCs for both vulnerabilities have recently been disclosed by researchers. Both of the issues can be triggered with a single request to gain remote code execution. An attacker can abuse the backup functionality for the Spam_Config component and execute the command injection via the system_timezone field in the MySQL dump contents required by the component. Additionally, a checksum must be generated as an MD5 checksum with the contents of the MySQL dump and a hardcoded secret. The exploit is delivered via a single POST request to /cgi-mod/index.cgi.

Currently, we have not observed definitive exploitation attempts in the wild. However, traffic on public honeypots has spiked since the disclosure probing for the index.cgi endpoint. We have also captured several probes, with at least one address highly likely to be associated with malicious activity. This indicates a high likelihood of exploitation in the near term against vulnerable targets. There are currently 4,700+ Barracuda hosts exposed according to Shodan.io, with the largest attack surface concentrated in the United States.

Actionable guidance

Apply the vendor-released patch to address this vulnerability. If exploitation is suspected, check for unknown backups uploaded to the vulnerable host and inspect MySQL dumps submitted via the Spam_Config component for hex values that translate to operating system commands. This can reveal additional forensic artifacts. Additionally, check for configuration changes, rogue users, and files that may have been uploaded to /tmp folders or within rogue folders created. Monitor for probes to /cgi-mod/index.cgi from unknown source locations, particularly POST requests with weaponized backup files.