A French blood bank’s refrigeration systems were compromised this week - not by a sophisticated zero-day, but by default credentials on internet-exposed controllers. FBI and CISA issued a joint advisory marking the third wave of cold-chain OT attacks in Europe. The same day, an OpenSSH authentication bypass surfaced that lets attackers log into key-only accounts with nothing more than an oversized password, and Microsoft published research on an AI framework that autonomously loots GitHub for secrets and pivots into cloud tenants in minutes. Three different attack surfaces. One common thread: assumptions that were never validated.

In the News

FBI and CISA Warn of Active Attacks on Cold-Chain Refrigeration Systems

FBI and CISA published a joint advisory warning that threat actors are actively compromising internet-exposed industrial refrigeration controllers across Europe. The attacks have hit pharmaceutical cold storage, food logistics, and - most critically - a French blood bank where temperature-controlled storage is a patient safety requirement.

The attack vector is not novel. Threat actors are scanning for refrigeration controllers exposed directly to the internet, authenticating with default or weak credentials, and modifying temperature setpoints. No malware deployment is required - the controllers accept unauthenticated commands or ship with factory-default passwords that operators never changed. This is the third confirmed wave of cold-chain targeting this week, following incidents in Germany and the Netherlands.

The operational risk here extends beyond data confidentiality. Compromised refrigeration controllers can spoil blood supplies, vaccines, and pharmaceuticals. This is a physical safety threat enabled by flat network architecture - OT devices sitting on the same network segment as corporate IT with no segmentation, no monitoring, and no credential rotation.

What defenders should do: Inventory all internet-exposed OT and IoT devices, starting with HVAC and refrigeration controllers. Enforce network segmentation between IT and OT zones. Rotate all default credentials on industrial controllers. Deploy OT-aware network monitoring to detect unauthorized command execution on industrial protocols. MITRE ATT&CK: T1200 (Hardware Additions), T0855 (Unauthorized Command Message).

OpenSSH Authentication Bypass - 257-Character Password Defeats Key-Only Access

A flaw in OpenSSH allows attackers to authenticate to accounts explicitly configured for public-key-only access by sending a password string longer than 256 characters. The bug affects OpenSSH builds where password authentication is compiled in but administratively disabled - a configuration that is the default on Alpine Linux and OpenWRT.

The mechanism is straightforward. When OpenSSH receives a password exceeding 256 characters, the authentication path that should reject the attempt fails to do so, falling through to a successful login. No exploit chain, no memory corruption, no privilege escalation required - a single crafted SSH request grants shell access to any account that relies on the assumption that password authentication is disabled.

Alpine Linux is the base image for a significant percentage of enterprise containers. OpenWRT runs on edge routers, firewalls, and IoT gateways. Both ship configurations where this bypass works out of the box. OpenSSH 10.6p2 patches the flaw; Alpine and OpenWRT have released updated packages.

What defenders should do: Patch to OpenSSH 10.6p2. For Alpine-based containers, rebuild images with the updated openssh package. For OpenWRT devices, apply the firmware update. As a compensating control, explicitly set PasswordAuthentication no AND KbdInteractiveAuthentication no in sshd_config - the bypass requires at least one of these to be compiled in and not explicitly disabled at the configuration level. Audit SSH access logs for authentication attempts with unusually long password fields.

Microsoft Exposes ARTEX AI Framework Hunting GitHub Secrets

Microsoft’s security team published detailed research on ARTEX, an agentic AI framework that threat actors are using to autonomously scan GitHub repositories for exposed API keys, OAuth tokens, service account credentials, and cloud configuration files. Once secrets are identified, ARTEX automatically pivots - registering OAuth applications, requesting consent grants, and establishing persistent access to Microsoft 365 tenants and cloud environments.

This is not theoretical. ARTEX was linked to the Chainalysis breach disclosed this week, where all user credentials, password hashes, and live session tokens were exposed. Chainalysis’s Reactor and Data Solutions platforms - used by law enforcement for blockchain forensic investigations - remain offline. The speed of the attack is the differentiator: ARTEX moves from secret discovery to tenant compromise in minutes, not days.

The defensive challenge is twofold. First, secrets in public repositories are discovered and exploited faster than human-driven processes can detect and rotate them. Second, OAuth consent grant abuse creates persistent access that survives password resets. Defenders need automated secret scanning in CI/CD pipelines, real-time OAuth app consent monitoring, and conditional access policies that restrict app registrations to approved identities.

What defenders should do: Implement pre-commit secret scanning hooks in all repositories. Monitor Azure AD / Entra ID audit logs for new OAuth app consent grants - Event ID Consent to application. Enforce conditional access policies requiring admin approval for OAuth app registrations. Rotate any credentials that have ever been committed to a public repository, even if subsequently removed - Git history preserves them. MITRE ATT&CK: T1528 (Steal Application Access Token), T1552.004 (Unsecured Credentials: Private Keys).

APT29 Watering Holes Deliver Zero-Click Mobile Exploits Across 99 Countries

Russian state-sponsored threat group APT29 (Cozy Bear) compromised third-party analytics providers to inject exploit chains into legitimate websites visited by targets across 99 countries. The exploits are zero-click - visiting a compromised page on iOS or Android is sufficient for full device compromise. No user interaction beyond normal browsing is required.

The campaign’s scale is notable. Thousands of mobile devices are confirmed compromised, with heavy targeting of organizations in the United States, Europe, and Ukraine. By poisoning analytics providers rather than individual websites, APT29 achieved broad distribution through a single supply-chain compromise - every site loading the compromised analytics script became a watering hole.

What defenders should do: Deploy DNS-layer protection on all mobile devices, including BYOD. Enforce device posture checks at the network access layer - compromised devices should be denied access to corporate resources regardless of user credentials. Monitor for connections to known APT29 infrastructure published in the SecurityWeek advisory. For iOS, ensure Lockdown Mode is enabled on high-value targets. MITRE ATT&CK: T1189 (Drive-by Compromise), T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain).

Defender Action Items

  • OT/IoT segmentation: Inventory all internet-exposed industrial controllers. Segment OT from IT. Rotate default credentials on refrigeration, HVAC, and building management systems immediately.
  • OpenSSH patching: Update to OpenSSH 10.6p2. Rebuild Alpine container images. Patch OpenWRT devices. Audit sshd_config for explicit PasswordAuthentication no and KbdInteractiveAuthentication no directives.
  • Secret rotation and OAuth monitoring: Scan all repositories for committed secrets. Monitor Entra ID for new OAuth consent grants (Event ID: Consent to application). Enforce admin-approval policies for OAuth app registrations.
  • Mobile device posture: Deploy DNS-layer protection and device posture validation on all mobile devices. Block network access from devices that fail posture checks. Enable iOS Lockdown Mode for high-risk personnel.
  • Zyxel GS1900 switches: Do not trust firmware v2.90 - update to v2.91. CVE-2026-107441 remains actively exploited.
  • Barracuda ESG: Apply patches for CVE-2026-116606. Full exploit chain to root is public - treat unpatched appliances as compromised.

Detection Queries

SSH authentication attempts with oversized passwords are a high-fidelity indicator for the OpenSSH bypass. The following Splunk SPL query detects SSH login attempts where the password field length exceeds 256 characters, which should never occur in legitimate authentication:

index=linux sourcetype=syslog process=sshd "password" 
| rex field=_raw "password\s+(?<password_attempt>.{257,})" 
| where isnotnull(password_attempt) 
| stats count by host, src_ip, user 
| where count > 0 
| sort -count

For environments using KQL (Microsoft Sentinel), monitor for anomalous SSH authentication patterns on Linux hosts:

Syslog
| where ProcessName == "sshd"
| where SyslogMessage has "password"
| where strlen(SyslogMessage) > 512
| summarize AttemptCount=count() by HostName, SrcIP=extract(@"from\s+(\d+\.\d+\.\d+\.\d+)", 1, SyslogMessage)
| where AttemptCount > 0
| sort by AttemptCount desc

False positive rate is near zero - no legitimate SSH client sends passwords exceeding 256 characters.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.