Overnight, between October 11 and October 12, shoppers at French supermarket chains walked into a strange and unsettling scene: refrigerated cabinets that should have been keeping dairy, meat, and frozen goods cold were blowing hot air instead. Attackers had remotely changed refrigeration settings at major retailers — including Coopérative U — pushing some chilled cabinets and freezers up toward 50°C and destroying food stock across entire regions. It is being called an unprecedented cyberattack on European food retail, and it is a preview of exactly what “cyber” can do when it reaches physical operations: no stolen files, no encrypted servers — just spoiled food, closed aisles, disrupted deliveries, and a CEO explaining to the public why stores could not operate.
This week, DefendEdge’s threat intelligence platform ingested and analyzed 902 attack records from the past seven days. Ransomware continued to dominate with 473 tracked incidents — more than half of all recorded activity — while critical-infrastructure stories like the French refrigeration attack reminded everyone that the blast radius of a cyberattack is not always measured in gigabytes. Sometimes it is measured in tons of destroyed inventory.
The French Supermarket Attack: When Hacking Spoils Food
The incident began overnight between Saturday, October 11 and Sunday, October 12, and hit French supermarket chains hard. Attackers reportedly gained access to refrigeration management systems and remotely modified temperature settings, causing chilled cabinets and freezers to heat instead of cool — with some units reported reaching around 50°C. Coopérative U’s CEO publicly confirmed that the cyberattack affected food stock in several stores, with impacts extending to delivery schedules and store pricing as the retailer scrambled to respond.
What makes this attack worth studying is not its sophistication — it is what it demonstrates about the security of operational technology (OT) that quietly runs everyday life. Refrigeration controllers, HVAC systems, building management platforms, and industrial control systems are increasingly internet-connected, remotely manageable, and defended like an afterthought. The French incident shows that an attacker does not need to encrypt a single file to cause material damage. Manipulating a cooling setpoint is enough to destroy physical inventory, force emergency closures, and generate national headlines.
Retail was the fourth most-attacked sector in our dataset this week with 29 incidents, but the French attack redefines what a “retail breach” can mean. It also lands in a broader European context: this same week, Canonical disclosed its second DDoS attack of the year against Ubuntu’s main websites — a reminder that even foundational internet infrastructure is in attackers’ crosshairs.
Ransomware Keeps Running Hot
Ransomware remained the engine of the threat landscape this week, accounting for 473 of the 902 incidents we tracked — roughly 52% of all recorded activity. Behind the headline number, several stories illustrate how the extortion economy keeps evolving:
- The ShinyHunters crackdown continues. The FBI arrested Canadian cybersecurity executive Edward Dubrovsky in Pennsylvania on October 8 as part of its investigation into the ShinyHunters hacking group — a striking case in which a professional who worked on ransomware response was charged in an alleged cyber extortion conspiracy. Director Kash Patel separately announced the arrest of another suspected ShinyHunters co-conspirator linked to the FBIJobs.gov breach, which affected a third-party-managed platform.
- Old vulnerabilities never die. ReliaQuest confirmed that the Qilin and Settra ransomware groups are still actively exploiting a Palo Alto Networks VPN vulnerability that was patched in May — months after the fix shipped. Unpatched edge devices remain the single most reliable front door for ransomware crews.
- Deadline pressure is part of the playbook. Japanese industrial firm KOIKE Sanso Kogyo appeared on a leak site this week with an extortion deadline of Tuesday, October 13, with attackers claiming possession of 5.8 TB of data including agreements, customer records, and engineering drawings.
Attackers Are Not Waiting for You to Patch
The gap between disclosure and exploitation has collapsed to almost nothing, and this week provided the proof. Two maximum-severity vulnerabilities were being exploited in the wild almost immediately after public disclosure:
- SonicWall SMA 1000 (CVE-2026-102255, CVSS 10.0): a pre-authenticated server-side request forgery flaw. Threat actors launched 135 exploitation attempts against vulnerable appliances within days of the patch’s release.
- Bricksforge WordPress plugin (CVE-2026-85097, CVSS 10.0): an unauthenticated remote code execution flaw in the popular WordPress plugin, under active exploitation per Patchstack.
GitLab also warned users to immediately patch a maximum-severity vulnerability in its CI/CD Regular Expression Compiler that could let remote attackers execute arbitrary code on targeted instances. And Huntress observed in-the-wild exploitation of two critical flaws in AhsayCBS backup servers — attackers used them to plant webshells and deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes, with five organizations targeted within the first day of observed activity.
The lesson is consistent across all of these cases: the question is no longer whether attackers will find your internet-facing weaknesses before you patch them. They will. The organizations that avoid becoming case studies are the ones that treat edge-device patching as an emergency workflow, not a quarterly project.
Identity Attacks: MFA Is Not a Magic Bullet
Phishing totaled 24 incidents this week, but the most technically interesting one attacked the assumption that multi-factor authentication solves credential theft. A Google account phishing kit uses live WebSocket connections to run adversary-in-the-middle (AitM) attacks — relaying a victim’s authentication session in real time and walking them through fake sign-in screens until the attacker holds an authenticated session token. MFA succeeds, and the attacker still gets in, because they were never breaking the security control — they were simply borrowing the victim’s browser session while the victim watched.
Related research published this week showed how new Unicode character combinations let attackers construct lookalike domains that still render as readable brand names in Chromium-based browsers — making phishing pages appear legitimate without triggering any visual warning. Combined with stealth banking trojans like Casbaneiro, which suppress their command-and-control traffic until an infected user visits a targeted banking site, the picture is clear: attackers are investing heavily in making their infrastructure look trustworthy and their activity look like nothing at all.
What BlackBeam Is Seeing
Our own platform data adds an actor-level lens on the week’s chaos. BlackBeam tracked a 116% week-over-week surge in attacks attributed to the ransomware operator “The Gentlemen” — up from 57 attributed attacks the previous week to 123 this week — with activity concentrated in Healthcare (14 incidents) and Finance (14 incidents), followed by Retail. BlackBeam’s extensive threat actor database ties this crew to a mix of ransomware deployments and command injection activity, with 22 tracked indicators of compromise, including phishing and exploitation infrastructure such as interactive debugging domains and an Onion leak-site address.
The Gentlemen were not alone in accelerating. NightSpire surged 560% week-over-week (5 → 33 attacks), SafePay jumped 767% (3 → 26), and STORM-2077 rose 280% (15 → 57) with a concentration of five Healthcare-sector attacks — a sector that absorbed 56 incidents overall this week. When multiple independent ransomware operators accelerate simultaneously and converge on the same sectors, that is rarely coincidence: it reflects shared initial-access brokers, reused exploitation tooling, and opportunistic targeting of industries perceived as soft and under pressure to restore operations quickly.
At the infrastructure level, BlackBeam’s wildcard-domain monitoring correlated 117,075 new wildcard-domain-to-IOC correlations in the last seven days — freshly observed lookalike and catch-all domain infrastructure tied to known attacker infrastructure in our tracked IOC corpus. Attack surface is not static; it is being actively manufactured, week after week, and most organizations never watch it change.
Practical Steps for Organizations This Week
The incidents from this week translate into a short, concrete to-do list for any organization with internet-facing systems or connected operational technology:
1. Inventory and segment your OT and building systems. The French supermarket attack succeeded because refrigeration controllers were remotely reachable. Identify every internet-connected HVAC, refrigeration, building-management, and industrial control system, and move it behind proper network segmentation so a compromised IT account cannot rewrite physical setpoints.
2. Patch edge devices on an emergency clock. The SonicWall SMA 1000 flaw saw 135 exploitation attempts within days of disclosure, and the months-old Palo Alto VPN bug is still feeding Qilin and Settra. VPNs, firewalls, and remote-access appliances need patch SLAs measured in hours, not weeks — and an asset list accurate enough that you know you own the vulnerable model in the first place.
3. Treat WordPress and CI/CD infrastructure as critical attack surface. The Bricksforge CVSS 10.0 flaw and the GitLab regex-compiler vulnerability both allow unauthenticated remote code execution on platforms organizations tend to consider “just the website” or “just the build server.” Audit plugin inventory, remove abandoned plugins, and restrict CI/CD systems from direct internet exposure.
4. Plan for MFA bypass — do not treat it as impossible. The WebSocket-based AitM phishing kit forwards authentication in real time and steals the session after MFA succeeds. Counter it with phishing-resistant authentication (FIDO2 hardware keys or passkeys), device trust checks, and session-anomaly monitoring that flags impossible logins rather than relying on the password prompt alone.
5. Monitor your domain perimeter for lookalikes. New Unicode tricks make homoglyph domains render convincingly in Chromium browsers, and this week alone BlackBeam correlated over 117,000 fresh wildcard-domain-to-IOC matches. Continuous brand-domain monitoring and proactive takedowns are now table stakes for phishing defense.
6. Watch backup infrastructure as closely as production. The AhsayCBS campaign explicitly targeted backup servers — planting webshells and miners on the systems organizations depend on for recovery. Backup consoles must be patched, hardened, isolated from domain credentials, and regularly tested, because attackers now treat them as the first objective, not the last.
The Bottom Line
This week’s data makes one thing obvious: the boundary between “cyberattack” and “physical incident” has fully dissolved. A refrigeration controller in a French supermarket, a VPN appliance on your network edge, a WordPress plugin on your marketing site, and a CI/CD pipeline in your engineering stack are all part of the same attack surface — and attackers are hitting all of it at once, with ransomware crews accelerating in coordinated waves. The 902 incidents we analyzed this week are a reminder that visibility across your entire internet presence, not just your corporate firewall, is what separates organizations that absorb attacks quietly from those that make the evening news.
To see the correlations yourself in BlackBeam, our Internet Intelligence Platform, visit https://www.defendedge.com/blackbeam/. The actor-level surge tracking and wildcard-domain correlation data described above are powered by iDNA, our threat intelligence engine — learn more at https://www.defendedge.com/idna-threat-intelligence-platform/. If you would like a US-based Security Operations Center watching your internet-facing attack surface around the clock, contact the DefendEdge team today.
Leave a Reply