📰 Source : The Cyber Express | Date : 5 novembre 2026 | Contexte : Deuxième vague d'une campagne de cyberattaques visant des systèmes de contrôle frigorifiques à travers l'Europe. 🩸 Incident EFS (Établissement Français du Sang) L'EFS a confirmé que des seuils de température et de dégivrage ont été élevés à des niveaux très hauts dans trois de ses sites de stockage de produits sanguins.

Forescout identified tens of thousands of exposed Remote Desktop Protocol (RDP) and Virtual Network Computing (VNC) servers accessible via the internet, with some linked to Industrial Control Systems (ICS) and Operational Technology (OT) environments. The discovery highlights misconfigured or unsecured remote access services that could allow unauthorized entry into critical infrastructure. No specific industries, technical vulnerabilities (e.g., CVE IDs), or exact numbers of affected ICS/OT systems were disclosed in the report. The findings emphasize the risks of internet-facing remote access tools in sensitive operational networks. The exposure increases potential attack surfaces for threat actors targeting industrial sectors.

Indurex, a new company specializing in cybersecurity, has emerged from stealth mode to address a vulnerability in cyber-physical systems (ICS/OT). Founded by Jalal Bouhdada, former executive at Applied Risk—a firm focused on industrial cybersecurity—Indurex targets critical infrastructure. No specific founding date or technical details about its solutions have been disclosed. The article is limited to announcing its emergence and its positioning in the industrial and operational systems security market.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about two vulnerabilities in DELMIA Apriso software that can be exploited together to achieve privileged access and remote code execution (RCE). DELMIA Apriso is a manufacturing operations management software widely used in industrial control systems (ICS) and operational technology (OT) environments. The exploitation of these vulnerabilities could allow attackers to gain control over critical industrial systems, leading to potential operational disruptions, safety risks, and other severe consequences. The fact that CISA has highlighted these vulnerabilities suggests that they are being actively exploited in the wild. This is particularly concerning given the critical nature of ICS and OT systems in sectors such as manufacturing, energy, and utilities. The ability to execute arbitrary code remotely and gain privileged access could enable attackers to move laterally within a network, escalate privileges, and potentially compromise other interconnected systems. From a technical perspective, the combination of these vulnerabilities likely involves an initial access vector followed by privilege escalation to achieve RCE. While the specific technical details of the vulnerabilities are not disclosed in the article, the potential impact is significant. Organizations using DELMIA Apriso should immediately assess their exposure and apply any available patches or mitigations. Additionally, they should monitor their networks for signs of exploitation and implement compensatory controls if patches are not immediately available. The inclusion of these vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog underscores their severity and the urgency of addressing them. Cybersecurity professionals should prioritize remediation efforts and ensure that their incident response plans are updated to account for potential exploitation of these vulnerabilities. In the broader cybersecurity landscape, this warning highlights the ongoing risks to ICS and OT environments. These systems are often targeted due to their critical role in industrial processes and the potential for high-impact disruptions. The exploitation of vulnerabilities in software like DELMIA Apriso underscores the need for robust vulnerability management programs, regular patching, and continuous monitoring of industrial networks. Expert insights suggest that organizations should adopt a defense-in-depth approach, combining network segmentation, intrusion detection systems, and regular security assessments to mitigate the risk posed by such vulnerabilities. Additionally, collaboration with vendors and participation in information sharing forums can help organizations stay informed about emerging threats and effective mitigation strategies. In conclusion, the CISA warning about the exploited vulnerabilities in DELMIA Apriso serves as a critical reminder of the importance of securing ICS and OT environments. Organizations must act swiftly to address these vulnerabilities and enhance their overall security posture to protect against potential exploits.

Bitsight's recent report indicates a 12% increase in the exposure of Industrial Control Systems (ICS) and Operational Technology (OT) systems in 2024, leaving over 180,000 critical infrastructure systems vulnerable to cyberattacks. This trend underscores the growing risk to industries reliant on ICS/OT, such as energy, water, and manufacturing. The increased exposure is likely due to greater connectivity, poor security practices, legacy systems, and supply chain risks. The implications are severe, including potential cyberattacks leading to physical damage, operational disruptions, and safety hazards. New strains of malware targeting ICS/OT systems could exploit these vulnerabilities, leading to data breaches and regulatory compliance issues. The expanding attack surface highlights the need for specialized security solutions tailored to ICS/OT environments. Cybersecurity professionals must prioritize risk assessments, network segmentation, patch management, and employee training. Additionally, leveraging threat intelligence and having robust incident response plans are crucial for mitigating risks. The growing exposure of ICS/OT systems calls for increased awareness, investment, and collaboration within the industry to address these unique challenges effectively.

Admeritia has launched Cyber Decision Diagrams, a free tool designed to help organizations manage complex cybersecurity decisions related to industrial control systems and operational technologies (ICS/OT). This tool is intended for organizations that need to make critical cybersecurity decisions for their ICS/OT infrastructures. It aims to simplify the management of these decisions by providing clear and structured diagrams. For more information, see the article on SecurityWeek: https://www.securityweek.com/free-diagram-tool-aids-management-of-complex-ics-ot-cybersecurity-decisions/

MEA (Modbus Exposure Analyzer) is a Python-based tool I developed for assessing the exposure of Modbus devices in ICS/OT environments. It uses passive behavioral analysis, entropy measurements, and...