Weekly Cyber Update: 6 November 2026

The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indicators, curated by our CISO, Nick Harris. Here’s our pick of the top stories, and why you should care

---

One we didn’t need to patch and one we really should have

Two recent incidents have shown the patching problem from opposite ends. PHP2Shell is hard to exploit, yet the NCSC sent a warning message and there was a media frenzy. On the other hand, the freezer attacks are easy to exploit, yet devices were still exposed weeks after the first victims emerged.

PHP2Shell: hard to exploit, patched in a panic

Tenable found every working exploit had to be tuned to its target’s PHP build and configuration. In late October, CrowdStrike had seen no successful exploitation and no exploit capable of working widely. Confirmed successes since then came from honeypots deliberately set up in a favourable single-worker configuration. Despite this, teams still felt obliged to act fast with the media assuming the risk before teams could do their own, more informed, risk analysis which might well have suggested less urgency.

Freezers: easy to exploit, still exposed

The first confirmed wave hit around 700 French supermarkets on 11 to 12 October. Danfoss told customers on 13 October to disconnect from the internet; most did, a small number did not. On 2 November, more than 100 stores across six countries saw fridges and freezers heat up overnight. Healthcare followed with incidents at three French Blood Establishment (EFS) sites, where plasma cold-storage temperature and defrost thresholds were pushed to extreme levels. Fortunately, alarms caught it and no blood products were lost. Crucially, the attackers never entered EFS systems; they compromised the supervision platform of the contractor that rents and controls the cold rooms.

The campaign may be older than Europe’s. At least six US military commissaries suffered refrigeration failures in late August, and Army CID is investigating with French law enforcement. Despite hundreds of real-world victims, many more organisations remain exposed. Censys estimates only 41% of French controllers still online are patched, with the figure even lower (37%) in the Netherlands.

The comparison

PHP2Shell, possibly driven by AI media and misinformed threats, arguably caused a huge knee-jerk reaction, while the easy-to-exploit and easy-to-patch freezers remain vulnerable. The lesson is this: accurately risk assess what needs patching and then have the ability to do it yourself or enforce it down the supply chain.

---

Extortion group Whitearmor names Unilever and others

A new extortion group, Whitearmor, listed London-headquartered Unilever on its leak site on 4 November, demanding $15m. Unilever has not confirmed a breach. The group’s first fortnight of claims, against Whirlpool, Hisense, J.B. Hunt, Ryder and others, puts Whitearmor on the map, so let’s try and find out more.

The claims

Unliever: Whitearmor claims to have obtained 665,000 contacts, 5500 “OTM” accounts with roles and logins, 14 million locations, 3.8 million shipments, 229 million status records, 13,800 invoices and 838,000 distributor loyalty profiles, totalling 79GB. That profile reads like a transport management system rather than Unilever’s core corporate network according to RansomLook.

Whirlpool (21 Oct): 4577 employee records across three plants, 374 corporate emails and around 22,000 SAP invoice records, with a $140,000 demand. No confirmation found.

Disney (21 Oct): 2800 employee records from a staff directory.

J.B. Hunt (23 Oct): 140,838 employee records, 1.7 million carrier contacts, 38.2 million invoices and 973 Microsoft 365 mailboxes, with a $5m demand. J.B. Hunt has not confirmed an incident, but at least four class actions had been filed in federal court by 29 October.

Hisense (25 Oct): a claimed 19GB, including Malaysia and Singapore warranty records, invoices, contracts and supplier data. Hisense has not confirmed it; some posts suggest the demand rose from $500,000 to $5m.

Ryder, Echo Global Logistics (28 Oct): further logistics names, with Ryder’s listing claiming 18.75 million rows including driver PII, cleartext API keys and FTP/telematics configurations, and a $20m demand.

Wagyu.xyz: the one clear confirmation. The crypto swap service confirmed a leak after refusing to pay a $5m demand.

Gamdom: a claimed full user database and $15m demand, which Gamdom’s founder disputes. gambling

Other listings: Brazil’s Partido Liberal, furniture retailer LoveSac and an Indonesian shipyard. Logistics is the clearest cluster: J.B. Hunt, Echo, Ryder and now Unilever’s shipment data.

Whitearmor TTPs

Data theft, not encryption (yet). The group describes itself as focused on data-theft extortion, intending to expand into ransomware, and says its encryptor is nearly complete.

Claimed entry points. The group has volunteered methods: a JWT authentication bypass in a gateway for its debut leak, and for Gamdom, a years-old machine account with admin reach that was never rotated. J.B. Hunt’s claimed mailboxes and permission records, and Ryder’s API keys, point to identity and secrets abuse.

Buying access and insiders. On 3 November, its “Project Trojan Horse” post offered to buy access to Okta, Azure, IAM root, CRM tools, Jenkins and VPNs from Fortinet, Cisco AnyConnect, Citrix and SonicWall. It is also recruiting insiders in sectors including insurance, retail, finance, transportation and logistics.

Affiliate model. It recruits penetration testers, web exploitation specialists and zero-day researchers, taking a 5% fee and leaving the rest to affiliates.

Pressure tactics. Countdowns, data samples, escalating demands and public attacks on victims who stay silent. With Gamdom and Wagyu it went further, publishing allegations of victim misconduct alongside the data.

Pricing. Demands range from $140,000 to $20m, suggesting they are set by perceived ability to pay.

The protections include cycling credentials, strong access controls, data loss alerts and validating third parties. If they aim to recruit insiders, treat security as “assumed compromise” and set controls and alerts accordingly.

---

UK Government: the NCSC review and the CSRB’s final lap

The NCSC’s Annual Review 2026 this week showed a sharp drop in nationally significant incidents, while its chief warned of an unprecedented rise ahead. In the same week, the Cyber Security and Resilience Bill finally cleared the House of Lords.

The report

Between September 2025 and August 2026, the NCSC received 1831 attack reports, up from 1727. It gave hands-on support in 337 cases, down from 429, and it classed 80 as nationally significant, against 204 a year earlier. Unfortunately, no one defines “nationally significant” nor says whether its method changed. Some headlines include:

• For large organisations, 88% of incidents came from four vectors: exploiting public-facing applications, phishing, misuse of valid accounts and exploiting external remote services
• About 8500 organisations were notified of suspected compromises through the Early Warning service, and more than 110,000 notifications and alerts went out after PHP2Shell. It’s worth signing up if you have not already
• The review repeats a £14.7bn annual cost estimate for malicious cyber activity in the UK

The warning

Richard Horne warned of an unprecedented rise in incidents; not because AI has invented new attacks, but because long-tolerated vulnerabilities can now be found and exploited at unimaginable scale. He said that for decades “we have collectively got away with tech on the cheap”. The review also judges that AI-powered ransomware could target UK critical infrastructure by 2028.

The CSRB

The Lords completed the third reading on 2 November, and the bill now returns to the Commons to consider Lords amendments. “Regulated person” now explicitly includes operators of essential services, digital service providers, managed service providers and critical suppliers.

Peers added requirements to review the NIS regime within 12 months and maintain a register of state actors threatening UK cyber security; an amendment on reporting frontier AI incidents was defeated. Both additions were government defeats, so some back-and-forth with the Commons is likely. Royal Assent is expected between late 2026 and spring 2027.

---

3AM at the school gates: a human-AI ransomware attack, step by step

A 3AM ransomware affiliate spent nine days inside an unnamed UK school estate in September, stole finance data and encrypted around 37 machines, according to a detailed Bitdefender investigation. The playbook was standard ransomware. What makes it notable is evidence that parts of the hands-on work were run by an AI model, with a human making the decisions. The report gives an interesting insight into how the kill chain played out:

The target

The estate had 47 systems, including around 21 servers and eight domain controllers, 10 workstations on Windows 10 (out of support since October 2025) and one domain controller on Windows Server 2012 R2. It began as several separate Active Directory domains with no connection between them.

What happened

Before September: Initial access is unknown. Bitdefender also found Restricted Admin mode enabled on four machines in January and a hand-typed session in June, but cannot say whether either is related.

10 to 11 September, backups first: A modified public script read stored credentials from the Veeam databases on three backup servers and decrypted them, and a Chrome saved-password file was copied from a terminal server.

12 to 13 September, reconnaissance: The attacker tested connections, tried to add a Defender exclusion, downloaded Mimikatz from its public GitHub release, and confirmed its domain admin rights. It searched shared login folders for the names and subnets of other schools.

14 September, credentials and backdoors: Registry hives holding credentials were saved, Mimikatz ran disguised as sysmon64.exe, and two backdoor domain admin accounts were created, named “library” and “svc_bkpmon” to blend in.

15 September, exfiltration: Forty finance files were staged inside registry values, copied to an unmanaged machine, zipped and uploaded to the attacker’s command-and-control page. Using the registry as a transport channel is unusual and worth hunting for.

18 September, joining the schools: In about three hours the attacker linked three separate domains with two-way trusts and pushed the backdoor account’s access across the estate.

19 September, impact: Attempts to remove Sophos and Bitdefender were blocked by anti-tampering controls. The 3AM encryptor then ran from 05:07 to 05:33 UTC, taking 12 to 13 seconds per machine and deleting system-state backups as it went.

Where AI comes in

Bitdefender makes three claims:

• The commands contain errors typical of writing from memory. A call to the Veeam interface used port 9392 with basic authentication, when Veeam’s documentation uses port 9419 and OAuth2 tokens. A credential-dumping one-liner had a parsing bug that passed garbage instead of a process ID, and Unix shell habits appeared in Windows commands on three separate days.
• Retries came every 40 to 101 seconds (not fast) regardless of how big the change was, while moving to a new task took minutes. That fits a human picking the goal and a model handling the retries. But a person copying and pasting between a terminal and a chat window cannot be excluded.
• Every attacker action came from an unmanaged machine outside Bitdefender’s visibility, so the model, and how it was used, is unknown.

Lessons learnt

Sophos explores the TTPs in a video, while a blog makes reference to Teams and QuickAssist and including a link to the IOCs. Additionally:

• Backups are the first target, not just the fallback. The attacker hit backup credentials on day one and deleted system-state backups at the end. Scope backup accounts per domain, isolate backup servers and keep immutable copies no domain account can delete
• Never hold privileged credentials for several domains in one place. The backup servers gave the attacker what it needed to create admin accounts across domains, then build trusts between them
• Alert on new domain trusts. A new trust between domains is rare, high-privilege and cheap to alert on. The same goes for new domain admin accounts
• Restrict remote execution. WMI, remote registry, scheduled tasks and admin shares were the attacker’s highways. Limit them to known management hosts
• Cover every machine. The unmanaged host ran the whole operation. Anything without an endpoint agent is a blind spot an attacker will find
• Prevent rather than race. AI loops are noisy: repeated commands, numbered scripts, test files left on disc. That makes them detectable, but controls that block an action the first time beat detection that must keep pace with retries every minute