Weekly OT
OT / ICS threat intelligence
Threat intelligence for industrial control systems, operational technology, cyber-physical systems, and critical infrastructure.
Latest
CERT-FR added Copeland and Dixell to the fridge campaign. Siemens Patch Tuesday is Crossbow and an S7 web server with no fix.
9–16 October 2026. CERTFR-2026-ALE-012 revised 13 Oct — Danfoss AK-SM/AK-SC plus Copeland xweb and Dixell xweb, campaigns still running, factory-reset on EOL is not the close. Same week: Siemens Crossbow V6.0, S7-1500 web SSA-591731 9.6 with no firmware, Industrial Edge 9.1, WinCC 8.8. Rockwell ArmorBlock 3.013. Schneider Sage RTU C3414-500-S02L0; Pro-face STW6000 no patch. CISA: Ignition 8.1.55 / 8.3.9, Eclipse Milo 1.1.5, EseeCloud no vendor. Edge KEVs are Ivanti and PAN-OS, not a PLC.
Previous assessments
- CISA listed EOL Hitachi RTU500. Thursday’s 9.8 is openPDC. The campaign is Integrity Tech, not a PLC.
- CISA scored Toptech TMS7 a 10. Unauthenticated table export on a fuel terminal. The exploited box is a NetScaler.
- CISA scored lwIP MQTT 9.8. The fix is a git commit. The exploited device this week is a Zyxel, not a PLC.
- CISA scored Hitachi FACTS 9.9. The exploited device this week is still Cisco ISE, not a PLC.
- ICS Patch Tuesday hit M580 Safety and Reyrolle. The exploited device this week is a MikroTik, not a PLC.
- OT this week was a CISA ICS stack, not a new wiper — internet-facing controllers are still the incident
- Late August OT — a small UK generator went dark four days; S7 hunts do not pause for that
- AA26-231A — five U.S. agencies on Siemens S7, snap7, and AI-written S7comm scripts
- Mid-August OT was ICS Patch Tuesday, fifteen CISA notes, then a hospital HVAC — not Stage 2
- OT this week was still internet PLCs — FBI/EPA water, then firmware you extract with the vendor tool