Cyber Threat Brief — November 2 2026
⚠️ This report is AI-generated. Always validate findings.
1. European refrigeration controllers — second wave
TL;DR: Overnight on 1–2 November, retailers in six European countries reported refrigeration units switched into defrost in a suspected cyberattack. Take Danfoss, Copeland, and Dixell controller management off the public internet, then check each defrost schedule.
What’s New:
- Retailers and refrigeration vendors reported failures in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, and Estonia.
- Sabcobel chief executive Stephan Moelans told Belga that evaporators were switched to defrost mode, and the company then disconnected the affected units.
- Politico says it is not confirmed that this wave used the same software flaws as the October attacks in France.
- CERT-FR alert CERTFR-2026-ALE-012, last updated 16 October, still names Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB, and Dixell XWEB, and it has no update for this wave.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Danfoss AK-SM series management interface on a public IP | Exposure | T1190 | Perimeter firewall / external attack-surface scan | Remove every Danfoss AK-SM management interface from public IPs. CERT-FR names this series in CERTFR-2026-ALE-012. |
| Danfoss AK-SC series management interface on a public IP | Exposure | T1190 | Perimeter firewall / external attack-surface scan | Remove every Danfoss AK-SC management interface from public IPs. CERT-FR names this series in the same alert. |
| Copeland XWEB management interface on a public IP | Exposure | T1190 | Perimeter firewall / external attack-surface scan | Remove every Copeland XWEB management interface from public IPs. |
| Dixell XWEB management interface on a public IP | Exposure | T1190 | Perimeter firewall / external attack-surface scan | Remove every Dixell XWEB management interface from public IPs. |
| security level Strict | Config | T1078 | Danfoss controller security settings | On Danfoss units, set the security level to Strict. |
| Danfoss default password | Config | T1078 | Danfoss controller account inventory | Replace any Danfoss default password. CERT-FR pairs this check with the Strict setting. |
| defrost schedule | Config change | T0836 | Controller configuration / audit log | Read the defrost schedule on each unit. Investigate a change overnight on 1–2 November. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No controller web-UI or defrost analytic. |
| Elastic | None — verified | No AK-SM, XWEB, or defrost rule. |
| Sigma | None — verified | No SigmaHQ rule; community rules cover only the October CVE paths. |
Detection index: ESCU f4bf16c (2026-11-02) · elastic detection-rules f591809 (2026-11-02) · SigmaHQ ccbb036 (2026-11-02).
Hunt hint: Inventory Danfoss AK-SM, Danfoss AK-SC, Copeland XWEB, and Dixell XWEB. Remove any management page reachable from the internet. Check each defrost schedule for an overnight change on 1–2 November. On Danfoss, set security level Strict and replace a default password. If a unit was exposed, rebuild it from a known-good config over VPN.
Sources: BBC · Politico · Al Jazeera / Reuters · The Guardian · CERT-FR CERTFR-2026-ALE-012 · 13 October brief · 15 October brief
2. Synology DSM — C3RB3R ransomware
TL;DR: Synology says attackers are encrypting outdated DSM with a flaw patched in December 2024. Install the Synology-SA-24:20 build for that branch, and block the management interface from the internet.
What’s New:
- Synology’s 29 October notice says the flaw was patched in December 2024 and points to Synology-SA-24:20, which covers CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445. Synology has not said which one.
- 360’s anti-ransomware team names the ransomware C3RB3R and says entry was CVE-2026-13639 and CVE-2026-13684, fixed on 18 September in Synology-SA-26:13.
- Encrypted files end in .L0CK3D, and each folder gets a ransom note named read-me3.txt.
- None of the CVEs named in those two advisories is in the CISA KEV catalog.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| DSM 7.2.2-72806-1 | Fixed build | T1190 | DSM Control Panel, Update and Restore | On the 7.2.2 branch, install 7.2.2-72806-1 or later. That is the Synology-SA-24:20 floor. |
| DSM 7.2.1-69057-6 | Fixed build | T1190 | DSM Control Panel, Update and Restore | On the 7.2.1 branch, install 7.2.1-69057-6 or later. That is the Synology-SA-24:20 floor. |
| DSM 7.2-64570-4 | Fixed build | T1190 | DSM Control Panel, Update and Restore | On the 7.2 branch, install 7.2-64570-4 or later. That is the Synology-SA-24:20 floor. |
| DSM 7.1.1-42962-7 | Fixed build | T1190 | DSM Control Panel, Update and Restore | On the 7.1 branch, install 7.1.1-42962-7 or later. That is the Synology-SA-24:20 floor. |
| DSM 6.2.4-25556-8 | Fixed build | T1190 | DSM Control Panel, Update and Restore | On the 6.2 branch, install 6.2.4-25556-8 or later. That is the Synology-SA-24:20 floor. |
| .L0CK3D | File extension | T1486 | NAS shared-folder listing | Search every shared folder for names ending in .L0CK3D. If you find one, disconnect the NAS and keep a sample file. |
| read-me3.txt | Ransom note | T1486 | NAS shared-folder listing | Search every shared folder for read-me3.txt. Keep the note. Do not install a decryptor named in the note. |
| TCP 5000 | Exposure | T1190 | Perimeter firewall | Block inbound internet access to TCP 5000. Synology documents 5000 as DSM HTTP. |
| TCP 5001 | Exposure | T1190 | Perimeter firewall | Block inbound internet access to TCP 5001. Synology documents 5001 as DSM HTTPS. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Lookups omit .L0CK3D and read-me3.txt. |
| Elastic | None — verified | SMB note rule requires Windows PID 4. |
| Sigma | None — verified | No NAS rule for .L0CK3D or read-me3.txt. |
Hunt hint: In Control Panel, read the DSM version on every unit. Install the Synology-SA-24:20 build for that branch from the table. Block internet access to TCP 5000 and TCP 5001. Search shared folders for .L0CK3D and for read-me3.txt. If you find either name, disconnect the NAS and keep the note plus one encrypted file.
Sources: Synology notice, 29 October · Synology-SA-24:20 · Synology-SA-26:13 · 360 anti-ransomware notice · HKCERT, 2 November · BleepingComputer · Synology port list
Status Updates
- CVE-2026-111357 (Ivanti Connect Secure): KEV is due today, 2 November 2026. Keep the 1 November correction: move 25.1.2.2-and-prior nodes to the fixed 25.1.3.x release in Ivanti’s advisory, not to 25.1.1.3 or 22.8R2.6. 31 October brief. 1 November brief.
- CVE-2026-97229 (GitLab): KEV was due 1 November 2026 and is now overdue. Shadowserver counts more than 1,000 vulnerable instances among about 39,000 GitLab servers it sees daily. 30 October brief. Shadowserver.
- Ruby-Onigmo-2026-10-23: KEV was due 1 November 2026 and is now overdue. A GitLab host that uses its own Ruby still needs 3.3.13, 3.4.12, or 4.0.9. 30 October brief.
- CVE-2026-110264 (GitLab): Shadowserver counts more than 11,300 vulnerable instances in that same daily set of about 39,000. Not in KEV. Fixed builds are unchanged. 22 October brief. Shadowserver.
- CVE-2026-76418 (Cisco ASA/FTD): KEV was due 1 November 2026 and is now overdue. No new fixed release or IOC. 30 October brief.
- PHP2Shell (Synology packages): Synology-SA-26:14 revision 4, dated 31 October, adds Calendar and Mail Station fixes for DSM 6.2, 7.0, and 7.1. HKCERT says Synology has not tied those packages to the DSM ransomware. 28 October brief. Synology-SA-26:14.
- Retired from watch: CVE-2026-110447, CVE-2026-114625 (last update 2026-10-24); GhostAction-2026-10 (last update 2026-10-19). No new report or IOC set. 24 October brief. 19 October brief.
- Watching (no change): CVE-2026-46300 (10-29, retire-eligible 2026-11-07); CVE-2026-102764 (11-01); CVE-2026-112816 (11-01); Plex2Shell-CVE-2026-96652 (10-21, KEV due 2026-11-03); Siemens-Software-Center-CVE-2026-110936 (10-21, KEV due 2026-11-03, fixed 4.0.9.8); LiteLLM-1.107.0-2026-10 (10-22); CVE-2026-105192 (10-22); UpdraftCentral-2026-10 (10-19); OVHcloud-CLI-2026-10 (10-20, retirement eligible 2026-11-03); RankMath-SEO-Pro-3.0.123 (10-20, retirement eligible 2026-11-03); ConnectWise-CloudBackup-SkyKick-2026-10 (10-22, original 10-17); eMudhra-CVE-2026-111943 (10-27); CVE-2026-111497 (10-28, KEV due 2026-11-10); Tailworm-Tailscale-SSH-2026-10 (10-28); CVE-2026-48356 (10-28, KEV due 2026-11-10); CVE-2026-41709 (10-29); CVE-2026-20127 (10-29); Cursor-Claude-Code-2.1.313-2026-10 (10-31).