Briefings ·
OTASEC Daily Briefing | 24-10-2026
The UK moves to toughen penalties for subsea cable sabotage, while a large edge-device campaign exposes more than 70,000 credentials. Forescout flags exposed refrigeration controls, and ESET adds detail on the Sandworm wiper attack in Ukraine.
1UK proposes 14-year prison terms for undersea cable sabotage
A White Paper from the Department for Digital, Culture, Media and Sport would update the Submarine Telegraph Act 1885, which caps fines at £1,000 and prison at five years for deliberate damage. The plans propose up to 14 years in prison and unlimited fines for ships, and would modernise laws protecting undersea cables and pipelines, some about 140 years old.
For asset owners: Operators of subsea cable and pipeline connections should follow the proposal and review how they monitor and report damage to these links.
2Campaign against FortiGate and GlobalProtect firewalls exposes over 70,000 credentials
Researchers disclosed a large-scale campaign targeting exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Artifacts indicate the operators gained access to numerous organizations worldwide and tried to compromise some victims further.
For asset owners: Check whether firewall and VPN gateways at the IT/OT boundary are exposed, rotate credentials where compromise is possible, and review logs for unexpected access.
3Update: ESET details Sandworm and UAC-0099 wiper attack on Ukrainian logistics firm
New in this report: ESET says UAC-0099 (aka Earth Sirrush) gained initial access on July 16, 2025 through a spear-phishing email with a malware-laced attachment. Sandworm then joined in for the destructive wiping attack, and the intrusion involved a new mesh network backdoor.
For asset owners: Strengthen email attachment filtering and make sure offline, tested backups exist for systems that support logistics and operations.
4Forescout finds internet-exposed refrigeration controls
Forescout's Vedere Labs identified 12,976 internet-exposed service observations tied to refrigeration control systems across 6,017 hosts or locations. The research warns these could enable attacks on food supply chains and hospitals.
For asset owners: Inventory refrigeration and building controllers, remove direct internet exposure and place remote access behind secured gateways.
5US Coast Guard issues NVIC 02-26 for maritime cybersecurity plans
The U.S. Coast Guard released Navigation and Vessel Inspection Circular (NVIC) 02-26 to help maritime organizations comply with cybersecurity requirements. It covers cybersecurity plans and IT and OT risk assessments.
For asset owners: Maritime operators with US exposure should compare their cybersecurity plans and OT risk assessments with the circular.
6Industry news: Indurex raises €7 million, NineTenths joins ISASecure
Indurex, which develops AI for cyber-physical systems security, raised €7 million to unify engineering intelligence, OT security and process safety. Separately, NineTenths Company joined ISASecure, announced by the International Society of Automation.
For asset owners: No action needed; note ISASecure membership as one input when assessing suppliers.