Briefings ·
OTASEC Daily Briefing – 22-10-2026
Ransomware actors are exploiting a Palo Alto GlobalProtect flaw that reaches into the energy sector, and the SafePay warning gets a follow-up. Utility support funding, a Sandworm wiper case and PQC readiness round out the day.
1Update: Accenture, Dragos and SANS initiative targets up to 500 utilities with $10 million
Follow-up coverage of the foundation announced yesterday adds scope: the private-sector initiative is worth $10 million and will support up to 500 under-resourced utilities. Industrial Cyber and The Record both describe it as aimed at strengthening cyber defenses at US energy and water utilities.
For asset owners: If you run a small utility, check whether you qualify for support and use it to close basic OT security gaps.
2Ransomware gangs exploit Palo Alto GlobalProtect flaw CVE-2026-0257 since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect that was patched in May. The firewalls rely on cookies without detailed validation and integrity checking, allowing remote unauthenticated access. Victims span healthcare, education, government and energy.
For asset owners: Verify that all GlobalProtect gateways run the May patch or later, and review logs for unauthorized access since June.
3Update: SafePay advisory urges patching and network defenses
Further coverage of the joint advisory says CISA, the FBI and the U.S. Secret Service report that SafePay ransomware has compromised around 600 critical organizations worldwide. The advisory urges patching and stronger network defenses.
For asset owners: Compare your patching and network segmentation against the advisory's recommendations, especially for internet-facing systems.
4Sandworm teamed up with another actor to wipe data at Ukrainian grain firm
Researchers say the Russian state-linked group Sandworm collaborated with another threat actor in a destructive attack on a Ukrainian grain logistics company last year. The attack wiped data.
For asset owners: Make sure offline, tested backups and recovery plans exist for logistics and food-supply systems that wiper attacks could affect.
5Update: Claroty on industrial automation security in retail after French supermarket attacks
Following the attacks on French supermarket chains, Claroty published a blog on industrial automation cybersecurity in retail operations. It notes that internet-facing assets that are not securely connected or protected by strong authentication face higher risk of disruption or damage.
For asset owners: Inventory internet-facing controllers such as refrigeration and building systems and enforce strong authentication and secure connectivity.
6Post-quantum readiness: Forescout on healthcare, Black Kite on vendor assessment
Forescout's Vedere Labs examines healthcare security threats, including insecure specialized medical devices and the challenges of PQC migration. Separately, Black Kite released Quantum Readiness, a set of controls to assess post-quantum security across vendor ecosystems.
For asset owners: Include long-lived OT and device assets in your PQC migration planning and ask suppliers about their quantum-readiness roadmaps.
7Resilience: energy and utilities face rising cyber exposure from ransomware and vulnerable OT
Resilience analyzed cyber insurance claims in the energy and utilities sector and reports rising exposure from ransomware and vulnerable OT systems. Email compromise accounted for a notable share of the claims.
For asset owners: Review email security and the IT-to-OT access paths that could let a mailbox compromise reach operational systems.