November 8, 2026
- Coldframe emulates exposed supermarket refrigeration controllers. The single-file GitHub honeypot recreates Danfoss AK-SM 800A and Dixell XWEB interfaces to study current industrial targeting. Its author reports that Shodan classified both emulations as real devices rather than honeypots. (discussion) · New Tools & Releases
- New telemetry expands the scope of Europe’s refrigeration attacks. Unit 42 puts the October 11–12 wave at roughly 700 French supermarkets and the November 1–2 wave at 100–115 locations across at least ten additional countries. NCSC–CERT-SE says Swedish food stores were affected. Unit 42 also found more than 5,000 exposed devices from named manufacturers on November 5–6. Initial access remains unconfirmed, and hacktivist attribution claims remain unverified (earlier coverage). · Threat Activity & Operations
in Keyeroo Turns Legacy NTLM Into Signed LDAP Relay on Patched DCs