Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 14/Government / Water utilities/12 September 2026

Controllers on the public internet, still holding the password they shipped with

CISA Advisory AA26-097A, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Iranian-affiliated actors have been reaching programmable logic controllers directly over the internet at US water and wastewater utilities, energy organisations and local municipalities, and changing what those controllers do. CISA names Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 and Siemens S7-1200, and says other manufacturers are likely in scope. There is no exploit to write about. The devices were exposed, they still held their default authentication keys and passwords, and from there the actors altered project files, manipulated what the operator saw on the HMI and SCADA displays, and disabled shutdown and alarm logic.

What worked

The advisory does not say. It is written as a hardening document rather than an incident narrative and names no detection or control that limited the activity at any victim.

What failed

Everything in front of the controller. CISA’s own account of the exposure is that these were "internet-exposed PLCs" on "devices that lacked sufficient network and/or hardening security controls", still carrying "default authentication keys and passwords".

The more interesting failure is the one that came after. Disabling shutdown and alarm logic while editing what the operator’s screen displays takes out the loop that keeps a plant safe and the loop that tells a person something is wrong, at the same time. The physical process and the picture of the physical process are then free to drift apart with nobody in a position to notice, which is a different category of problem from data theft and does not resolve itself when the intrusion is evicted.

And the pattern is not new. CISA cites the 2023 CyberAv3ngers campaign against US Unitronics devices as the precedent, and the exposure that made that possible is the exposure being used now.

The number

75 devices

compromised in the 2023 CyberAv3ngers campaign against US Unitronics controllers, which CISA cites here as the same exposure being exploited again three years later.

What to do instead

Take them off the internet. Everything else on CISA’s list is secondary to that and the advisory puts it first: put the controller behind a secure gateway, and if it reaches the world through a cellular modem, secure that modem with strong authentication and turn its logging on. That modem is a second internet connection, and it is usually missing from the asset inventory because nobody in IT provisioned it.

Then the two physical steps, which cost nothing and are the ones most often skipped. Put the mode switch in run position. Enable programming protection in the configuration software. A controller sitting in remote-programmable mode with no programming password is a controller that anybody who can reach it can rewrite, and no firewall rule compensates for that.

Then verify the logic rather than the device. If you were exposed, the question is not whether the PLC is patched but whether its project file still says what your engineers wrote. Use the vendor’s integrity tooling to compare against a known-good copy, and check specifically that the shutdown and alarm logic is present and enabled. The manipulated display is precisely why you cannot answer this from the control room.

Then the rest of the list: change the default passwords, add multi-factor authentication where the platform supports it, block Telnet, FTP, RDP, VNC and any web service you are not using, and keep offline backups of the project files that somebody has actually restored from at least once.

Sources
NO. 10/Cross-sector/11 September 2026

Reverse Engineering the Six Stages of MacSync Stealer and RAT

Huntress, 29 July 2026

Huntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. MacSync is a six-stage kill chain, not a smash-and-grab.

What worked

Huntress does not name a control that held here. Read that as a finding in itself: these write-ups are built from what responders actually found, and one with no successes in it is usually describing a network that had none.

What failed

The victim went looking for Claude. Their browser history opens with a Google search for how to install Claude Code on a Mac and, two clicks later, lands on a page that appears to show the answer. In between was an ad, and the ad is the whole trick. The result they clicked was not the organic anthropic.com listing but a paid Google Ads placement. This is malvertising in its current, least exotic form. The term was originally used to describe a booby-trapped banner that launched an exploit when loaded. What it means

The number

2 minutes

Their prefixes are still in the config strings /tmp/openssl-arm64/ and /tmp/openssl-x86_64/, and there are two compile banners rather than one, stamped about 2 minutes apart.

What to do instead

Start with what not to chase. The file hashes and the per-delivery 8-hex identifiers change every build, so they're low-value on their own. Anchor on the behaviours, which don't change: curl -k with a Base64-decoded URL piped into zsh, the loader's execution and its ~/.zshrc persistence.

Sources
NO. 07/Cross-sector / Mid-market/4 September 2026

Still RDP, still brute force, still working

CISA Advisory AA24-060A, #StopRansomware: Phobos

Phobos operators scan the internet for exposed Remote Desktop with off-the-shelf tools such as Angry IP Scanner, brute force whatever they find, and walk in on valid credentials. From there it is SmokeLoader, Cobalt Strike, Bloodhound and Mimikatz, then exfiltration through WinSCP and Mega before the encryption anyone eventually notices.

What worked

Nothing novel had to be defended against, and that is the useful part. Every stage of this uses public tooling that mature detection catches: Mimikatz touching LSASS, Bloodhound enumerating the directory, Cobalt Strike beaconing. Organisations with an EDR that somebody watches routinely stop Phobos at the second or third step. The playbook is entirely known, which means the outcome is a function of whether the controls were deployed, not of whether the adversary was clever.

What failed

The front door. RDP published straight to the internet with password authentication and no MFA, no lockout worth the name, and no rate limiting, on estates too small to have anyone watching the authentication logs. This is not a sophisticated intrusion and it has not needed to be for a decade; it persists because the exposure persists. Backups are usually the second failure: reachable from the same domain with the same credentials, and encrypted alongside everything else.

The number

67%

of Rapid7's Q3 2024 incident responses involved valid accounts with missing or weakly enforced MFA on remote access.

What to do instead

Scan your own perimeter from outside and find the RDP you do not know about, because there almost always is some: a vendor's jump box, a forgotten test server, an acquisition nobody folded in. Put remote access behind a VPN or a gateway with phishing-resistant MFA and take 3389 off the internet entirely. Then fix the backups properly: offline or immutable, and restorable by an account that domain compromise cannot reach. Test a restore this quarter. An untested backup is a belief, and this is the family that finds out.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.