EN NL

Briefings ·

OTASEC briefing – 20-10-2026

AI-assisted exploit development against Internet-facing OT leads today, alongside new detail on the PEERSTITCH intrusion and a cyberattack on building automation vendor LOXONE. Regulation and remote-access governance round out a quieter day.

1Claroty: AI rebuilt Danfoss AK-SM 800A exploits in 28 minutes

1 source

Claroty's Team82 reproduced three previously disclosed vulnerabilities in Danfoss AK-SM 800A refrigeration controllers using an AI tool. According to the report, the exploits were rebuilt in 28 minutes, which raises the risk for Internet-facing OT.

For asset owners: Check whether any refrigeration or other OT controllers are reachable from the Internet, and apply patches for known vulnerabilities sooner, since exploit development is getting faster.

Sources:

2Update: Unit 42 links PEERSTITCH to FortiOS flaw exploited after FortiManager compromise

1 source

New detail on the PEERSTITCH malware: Unit 42 traced a multistage intrusion against a telecommunications managed service provider. The FortiOS vulnerability was exploited after a FortiManager compromise.

For asset owners: Review the exposure and patch status of FortiOS and FortiManager, and check what access managed service providers have to your networks.

Sources:

3LOXONE hit by cyberattack; customer installations reported safe

1 source

Smart home and building automation specialist LOXONE was hit by a cyberattack on its internal company systems. According to the report, customer installations are safe and operational.

For asset owners: If you use LOXONE, watch for supplier communications and review which remote or cloud connections your installations have to the vendor.

Sources:

4India's CEA power sector cybersecurity deadline set for April 2027

1 source

Following the Central Electricity Authority's July notification of its cybersecurity regulations, Nozomi outlines IT and OT security priorities ahead of the April 2027 deadline.

For asset owners: Asset owners with power sector operations in India should map their compliance gaps against the CEA requirements now, ahead of the deadline.

Sources:

5Survey: frontline workers routinely work around MFA

1 source

A Sapio Research survey of 700 IT and security decision-makers found that 95% had seen frontline workers in sectors such as healthcare and manufacturing use workarounds in the past 12 months. These include staying signed in, sharing credentials and bypassing multifactor authentication.

For asset owners: Review whether login and MFA processes on the shop floor are practical enough that staff do not need to bypass them.

Sources:

6Dispel launches Zero Trust Engine for OEM remote service

1 source

Dispel announced Dispel Zero Trust Engine for OEMs, a solution built for OEMs and machine builders. It aims to secure remote industrial service, standardize access and strengthen compliance.

For asset owners: Ask your OEMs and machine builders how they access your equipment remotely and whether that access is standardized and controlled.

Sources:

7Calls for enforceable AI accountability and zero trust in critical infrastructure

1 source

Commentary says AI is introducing new cybersecurity risks, including AI-enabled cybercrime. It argues traditional frameworks must evolve, with enforceable AI accountability and zero-trust security for critical infrastructure.

For asset owners: Consider how AI-enabled threats change your risk assessments and whether your current security framework still covers them.

Sources: