Signal Acquired: Cybersecurity Weekly Brief

This week's strongest signal is speed at the edge. Attackers are exploiting remote-access gateways, bypassing Windows trust warnings, scaling operations with AI agents and manipulating internet-connected control systems before many organizations can recognize that ordinary infrastructure has become operationally critical.

1. Ivanti Connect Secure zero-day demands immediate action

Ivanti disclosed CVE-2026–104935 on October 13 after observing exploitation in the wild. The authentication-bypass vulnerability allows an unauthenticated remote attacker to execute commands on affected Connect Secure VPN appliances.

Affected releases include:

• ICS 25.1.1.1 and earlier
• ICS 25.1.2.2 and earlier
• ICS 22.8R2.4 and earlier

Vendor-designated unaffected releases include 25.1.3.0 or later and 22.8R2.5. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and directed federal agencies to remediate it by October 16. CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure | CISA, NVD-CVE-2026–104935, A Vulnerability in Ivanti Connect Secure Could Allow for Arbitrary Code Execution

Confirmed: The vulnerability is being actively exploited and enables unauthenticated command execution.

Not yet confirmed publicly: Ivanti has not provided a complete accounting of the affected victims or attributed the attacks to a named threat actor.

Why it matters: Connect Secure sits directly on the perimeter while providing trusted access to internal networks. Appliance compromise can expose credentials, sessions and traffic while evading conventional endpoint monitoring.

Immediate follow-up:

1. Upgrade every appliance to a vendor-confirmed unaffected release.
2. Include standby, disaster-recovery and recently decommissioned appliances.
3. Run Ivanti's integrity-checking tools and preserve results before rebuilding.
4. Examine configuration changes, administrators, authentication logs, scheduled activity and outbound traffic.
5. Revoke active sessions and rotate credentials, API secrets and certificates accessible to the appliance.
6. If compromise indicators appear, rebuild from known-clean media; patching does not remove established persistence.
7. Verify acquired companies and migration environments for forgotten Pulse Secure or Ivanti gateways.

2. Microsoft patches an actively exploited Windows trust-control bypass

Microsoft's October 13 security release fixes CVE-2026–96951, a Windows Shell command-injection vulnerability that allows a crafted file to bypass a security feature associated with Mark of the Web.

CISA added the vulnerability to KEV the same day. Microsoft describes it as actively exploited, but neither Microsoft nor CISA has publicly identified the attackers or disclosed the complete attack chain. The October release covers more than 1,400 vulnerabilities; precise totals vary according to how product and component entries are counted. Known Exploited Vulnerabilities Catalog | CISA, October 2026 Security Updates — Release Notes — Security Update Guide — Microsoft, Microsoft Patches More Than 1,400 Security Flaws — Krebs on Security

Why it matters: Mark of the Web helps Windows, Office and security products recognize files obtained from untrusted locations. Bypassing it can suppress warnings or weaken protective handling of malicious files delivered through email, messaging or downloaded archives.

This is primarily an initial-execution enabler — not necessarily a complete compromise by itself. An attacker may still need to persuade the user to open the file or combine it with another vulnerability.

Suggested follow-up:

• Expedite October Windows updates on endpoints, jump hosts and administrative workstations.
• Confirm that Windows 10 devices have either Extended Security Updates or have moved to a supported platform.
• Require installation verification and reboots — not merely successful deployment status.
• Prioritize systems used by privileged administrators, developers and migration teams.
• Hunt for archive or document execution followed by unexpected PowerShell, cmd.exe, script interpreters or child processes.
• Preserve attachment, browser and endpoint telemetry so analysts can reconstruct how the malicious file arrived.

3. AI agents helped one attacker target multiple South Korean banks

At least nine South Korean banks have disclosed or reportedly experienced cyberattacks since late September. Shinhan Bank said information belonging to approximately 25,000 customers was compromised; KB Kookmin reported exposure involving 119 customers.

CrowdStrike assesses with moderate confidence that the attacker was a financially motivated Chinese speaker who used the open-source ARTEX penetration-testing agent with Anthropic's Claude Code. Investigators reportedly recovered Chinese-language prompts and operational sessions linked to the campaign. South Korean banks were likely hacked by a China-based actor with an AI agent, CrowdStrike says | Reuters

Confirmed:

• Multiple banks were attacked.
• Customer information was exposed at two named institutions.
• Infrastructure associated with the attacks contained ARTEX and LLM-assisted activity.

Assessment — not established fact:

• The attacker was a specific 26-year-old person in Guangdong.
• The actor's nationality, location and financial motive remain CrowdStrike assessments.
• This was human-directed, AI-assisted intrusion — not proof of an entirely autonomous attacker.

Why it matters: AI agents allow one operator to run reconnaissance, revise code and attack several organizations concurrently. The important change is operational scale: low-volume indicators from one compromised host may be part of a coordinated campaign moving at machine-assisted speed.

Suggested follow-up:

• Correlate WAF, API, identity, endpoint and cloud telemetry across multiple applications.
• Alert on rapid sequences of reconnaissance, failed authentication and exploit attempts.
• Detect payloads that change superficially while retaining the same behavior.
• Rate-limit sensitive APIs by identity, device and behavioral pattern — not only source IP.
• Establish faster approval paths for revoking sessions, disabling accounts and blocking infrastructure.
• Test whether the SOC can distinguish legitimate internal security agents from unauthorized agentic tooling.

4. Attackers manipulated refrigeration at hundreds of supermarkets

Attackers seized control of refrigeration systems at at least 350 French supermarkets, manually overriding temperatures and causing stores to discard spoiled food. Affected retailers included Carrefour, Monoprix, Intermarché and Cooperative U.

France's cybersecurity agency said affected equipment used systems from Danfoss, Copeland and Dixell. Many Danfoss units were reportedly end-of-life or running outdated firmware. Reuters found at least 4,500 Danfoss interfaces still visible online on October 13, although it could not determine how many remained vulnerable. Investigators hunt French supermarket fridge hackers, no claim of responsibility | Reuters

Not confirmed: Investigators have not identified the attackers, established their motive or connected the attack to the separate disruption affecting Ahold Delhaize.

Why it matters: This is a clear example of cyber compromise producing immediate physical and financial consequences without targeting a conventional industrial plant. Building controls, refrigeration, HVAC, lighting and environmental systems increasingly qualify as operational technology.

Suggested follow-up:

• Scan externally for every building-management and refrigeration interface.
• Remove direct internet administration and require managed VPN or zero-trust access.
• Replace end-of-life controllers that can no longer receive security updates.
• Inventory vendor and maintenance accounts, including shared credentials.
• Log temperature changes and remote commands outside the controller itself.
• Configure safety limits and local overrides that cannot be disabled remotely.
• Add stores, warehouses and smaller acquired facilities to the OT inventory.

5. U.S. authorities disrupt infrastructure linked to Flax Typhoon

On October 8, the Justice Department and FBI seized domains supporting two tools operated by China-based Integrity Technology Group:

• Microscan: A scanning platform containing more than 1,300 exploitation scripts.
• FishHub: Infrastructure used for spear phishing, malware delivery and remote access.

DOJ says the infrastructure targeted critical infrastructure, airports, energy companies, universities and other organizations. A multinational advisory describes password spraying against Microsoft Exchange, SoftEther VPN persistence, DCSync activity and automated Microsoft 365 email collection. Office of Public Affairs | Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers | United States Department of Justice, Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

Confirmed: The domains were seized under court authorization, and investigators recovered infrastructure, tools and victim evidence.

Attribution qualification: Integrity Tech's relationship with Chinese state-directed operations is the assessment and allegation of U.S. and allied governments. China denies sponsoring malicious hacking.

Why it matters: This illustrates how state-aligned operations combine commodity tools, old vulnerabilities, large botnets and hands-on intrusion. Sophistication lies in scale and organization — not necessarily in exclusive zero-days.

Suggested follow-up:

• Import the advisory's STIX indicators and hunt against historical logs.
• Search for unauthorized SoftEther installations and services.
• Review PowerShell, curl and wget activity that introduced remote-access tools.
• Alert on DCSync from anything other than authorized domain controllers.
• Examine Exchange and Microsoft 365 for password spraying and unusual mailbox collection.
• Patch the older CVEs listed in the advisory; attackers actively search for organizations that retained legacy systems.
• Apply these checks to acquired domains and infrastructure before establishing trust relationships.

On the radar

• ASOS identity compromise: ASOS says an attacker impersonated a trusted contact, obtained an employee's credentials and accessed customer information through third-party platforms. Payment-card details and passwords were reportedly unaffected. This reinforces the need to verify unusual requests through a separate channel and apply conditional access to SaaS platforms. UK's ASOS says cyber hack accessed customers' personal data | Reuters
• Global cyber-fraud framework: The IMF and World Bank launched the Bangkok Blueprint for Fraud-Resilient Financial Services on October 14. It is a voluntary framework — not formal policy guidance — but reflects growing recognition that fraud prevention requires cooperation among banks, telecom providers, technology platforms and governments. IMF, World Bank launch 'Bangkok Blueprint' to fight cyber fraud | Reuters
• AI-sector insider risk: DOJ charged an OpenAI employee with allegedly placing a covert recording device in an executive conference room. The allegation has not been adjudicated, and OpenAI says it found no evidence of classified-data exfiltration. The case nevertheless demonstrates that AI security programs must integrate physical, personnel and cyber controls. FBI arrests Saudi OpenAI engineer over covert recording device, DOJ says | Reuters

Priority queue

1. Patch, investigate and potentially rebuild vulnerable Ivanti Connect Secure appliances.
2. Deploy October Windows updates, beginning with privileged and internet-facing populations.
3. Find and remove publicly accessible building-control and refrigeration interfaces.
4. Hunt for Integrity Tech indicators, unauthorized SoftEther and abnormal DCSync activity.
5. Tune detection for machine-speed reconnaissance and rapidly changing payloads.
6. Strengthen identity verification for employees and third-party SaaS access.

Bottom line: The decisive security boundary is no longer simply "inside versus outside." VPN appliances, trusted files, AI agents, building controls and vendor platforms can all cross that boundary while appearing legitimate. Defenders need controls that continually validate behavior after access has been granted — not merely at the moment of authentication.

That's the signal. Everything else is noise. 👊🏼

Rick Gregson is an enterprise IT consultant specializing in complex infrastructure transformations, mergers and acquisitions, and enterprise identity modernization. He writes about biohacking, the paranormal, technology, cybersecurity, artificial intelligence, and the systems quietly shaping our world.

THANK YOU so much for your time!

If you enjoyed the article, please feel welcome to clap, share, or drop in some comments — We welcome all and besides, engagement really helps with the algorithm.

We also invite you to consider subscribing to the channel. Medium members join for free and, email notifications on or off, the subs really help to grow the readership.

📚 Additional Reading

🎯 For the Weekly Briefs, click here 🎯 For the Giggity Bytes series, click here 🎯 For Technology, click here 🎯 For Entrepreneurship or Leadership, click here 🎯 For Health, click here 🎯 For Biohacking, click here 🎯 For the MyNotes series, click here 🎯 Explore all articles by Rick Gregson, click here