DuckButTurttle

Threat Intelligence - CPS/OT focused. Healthcare and Critical Infrastructure = ♥

[DuckButTurttle @DuckButTurttle]

NoName057(16) claims DDoS on Italian transport/port sites and https://t.co/io2O72001q (with CyberTroll Team); RipperSec claims DDoS on https://t.co/6UdqL8ec1I. No new OT/HMI claims in this window. CyberAsia (https://t.co/1rnqydUCAJ)

[DuckButTurttle @DuckButTurttle]

Middleby (US commercial kitchen / food-processing equipment maker) listed by iah6477; Cinder also claims a ~134 GiB M365 archive (unverified). https://t.co/Rkk510Hhqg (https://t.co/kQDPGzC1qy)

[DuckButTurttle @DuckButTurttle]

Unit 42 details PEERSTITCH, an in-memory FortiGate implant (miglogd/iked) by CL-STA-0954 after a telecom MSP FortiManager breach via CVE-2024-47575, then FortiOS CVE-2025-61624; 500+ managed FortiGate configs exposed. Cyber Security News (https://t.co/KuWekbSJYb) #CVE

[DuckButTurttle @DuckButTurttle]

Copeland acknowledges a vulnerability tied to the supermarket refrigeration attacks and is working with customers; French Danfoss exposure fell ~1,800 → 537 hosts by Oct 14 (unplugged, not patched). Still no claim. SecurityWeek (https://t.co/j7ZzReQJHm) #OT #ICS

[DuckButTurttle @DuckButTurttle]

NoName057(16) claims Italian water-treatment HMI control (UF/RO; "emergency state") and a small French hydro Weintek HMI (manual mode + alarms); unverified. CyberAsia (https://t.co/DUHbfBGYDj)

[DuckButTurttle @DuckButTurttle]

(actively exploited): Palo Alto PAN-OS CVE-2026-0322 (CVSS 8.6) — authenticated management-interface RCE as root; CISA KEV (due Oct 17). Palo Alto advisory (https://t.co/8Q49s6WshJ) #CVE

[DuckButTurttle @DuckButTurttle]

(actively exploited): Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8) — unauth root via crafted AMP attachment; added to CISA KEV (due Oct 17). Second SEG zero-day this month. BleepingComputer (https://t.co/TApXVJeSQ3) #CVE

[DuckButTurttle @DuckButTurttle]

CERT-FR ALE-012 still warns campaigns against Danfoss/Copeland/Dixell refrigeration controllers are ongoing. New analysis covers date-derived logins and defrost abuse; thousands of supermarket fridges remain exposed. Pen Test Partners (https://t.co/XIAirUh7L0) #OT #ICS

[DuckButTurttle @DuckButTurttle]

NoName057(16) claims full access to an irrigation control system at a French greenhouse facility, including valves, zones and routes; the claim is unverified. CyberPulse (https://t.co/CJ66zBHxQC)

[CyberPulse @CyberPulse56]

‼️🇫🇷 FRANCE — GREENHOUSE IRRIGATION SYSTEM ALLEGEDLY COMPROMISED

Pro-Russian group NoName057(16) claims to have gained full access to an irrigation control system at a large French greenhouse facility.

⚠️ Claimed access includes valves, irrigation zones, speeds, routes, and manual controls for automated carts.

Motive: Political retaliation over France’s support for Ukraine.

STATUS: UNVERIFIED — Potential risks to greenhouse operations and crop watering remain unclear.

#France #NoName05716 #CyberSecurity #ICS #OTSecurity #OpFrance

[DuckButTurttle @DuckButTurttle]

Unauthenticated OS command injection in Nextcloud's Collabora Built-in CODE Server (richdocumentscode < 26.4.303), CVE-2026-110447, CVSS 9.2, with reports of webshells being planted (actively exploited). Upgrade or remove it. #vulnerability https://t.co/rDKFRVjZUv

[DuckButTurttle @DuckButTurttle]

Japan's Arcadia confirmed unauthorized access to its SpeeCAN RAIDEN municipal disaster-alert service (up to ~3.14M emails, ~105k phone numbers) and NET119 emergency-call services (~13k users). Some municipal alert emails are paused. #databreach https://t.co/MlZ3BPRpFh

[DuckButTurttle @DuckButTurttle]

CERT-FR (CERTFR-2026-ALE-012) confirms numerous compromises of internet-exposed Danfoss AK-SM/AK-SC, Copeland xweb and Dixell xweb refrigeration controllers in France; campaigns are probably still ongoing. Remove public management access. #OTsecurity https://t.co/YFmWfmBbat

[DuckButTurttle @DuckButTurttle]

@peritumAI Right, a leak-site post is a claim, not a confirmed breach. Utilities should verify claims like this through the published sample and any disclosure, without overreacting or dismissing it.

[DuckButTurttle @DuckButTurttle]

Redact claims ransomware compromise of US utility Eversource Energy. TMRansomMon (https://t.co/cv7aQO8buW) #ransomware

[ThreatMon Ransomware Monitoring @TMRansomMon]

Actor: #Redact
Victim: Eversource Energy
Date: 2026-10-12 09:29:41 UTC+3

According to #DarkWeb #Ransomware activity detected by the ThreatMon Threat Intelligence Team. The “#Redact” Ransomware group has added Eversource Energy to its victims.

[DuckButTurttle @DuckButTurttle]

@MarcoPorro Exactly. Older internet-facing services keep giving state-linked actors access to energy, airports and healthcare. Patching beats chasing zero-days: find what's exposed, patch or isolate KEV-listed flaws first, and retire old boxes.

[DuckButTurttle @DuckButTurttle]

(Actively exploited) CISA added 5 Flax Typhoon-linked flaws to KEV: ProFTPD CVE-2015-3306, ONLYOFFICE CVE-2021-3199, Strapi CVE-2023-22894, Struts CVE-2016-3081 & ISC BIND. FBI/DOJ seized 7 domains used vs. energy, airports & healthcare. #ICS https://t.co/V5VJusjU0p

[DuckButTurttle @DuckButTurttle]

@DegeroMenR Agreed, BMS is OT. Building controllers are often run by facilities teams or integrators, so they slip out of OT patch tracking. Track Desigo/APOGEE panels in the same asset inventory as PLCs, keep them off the internet and segmented from IT, and patch with the vendor.

[DuckButTurttle @DuckButTurttle]

Siemens October advisories: SIMATIC S7-1500 web server CVE-2026-63350–63357 (CVSS 9.6, no fix yet); APOGEE/TALON/Desigo PXC and WinCC RCE also listed. Siemens (https://t.co/DB02kEocF4) #OT #ICS

[DuckButTurttle @DuckButTurttle]

(actively exploited): Ivanti Connect Secure zero-day CVE-2026-104935 added to CISA KEV; exploited since Oct 3 for root on fully patched VPNs. CISA (https://t.co/W2ud0qxdUA) #CVE

[DuckButTurttle @DuckButTurttle]

French refrigeration OT attack update: ~700 of ~10,000 French food retail sites hit; Spain, Portugal, Poland, Germany and Belgium also affected. ~4,500 Danfoss interfaces on Shodan; no claim. Reuters (https://t.co/J9mLB268o6) #OT #ICS

[DuckButTurttle @DuckButTurttle]

(actively exploited) Critical SonicWall vulnerability exploited shortly after disclosure (same theme as NHS CC-4863 / CVE-2026-102255). #CyberSecurity
https://t.co/TkIRzfe9Ah

[DuckButTurttle @DuckButTurttle]

(actively exploited) CISA updated its Citrix NetScaler ADC/Gateway alert for CVE-2026-88779 (KEV) and CVE-2026-107406. Separate reporting ties NetScaler 0-days to Platypus RAT / pre-auth RCE (CVE-2026-88771). #CyberSecurity
https://t.co/4ImfnODThK