ZeroFox Daily Intelligence Brief - October 13, 2026
|by Alpha Team
ZeroFox Daily Intelligence Brief - October 13, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- French Supermarket Cyberattack Triggers Fires and Spoils Food
- Ledger Confirms Spy Chip in Hardware Wallets Enabling Crypto Theft
- AI-Assisted CyberXero Campaign Steals 628,000 Ukrainian Records
French Supermarket Cyberattack Triggers Fires and Spoils Food
What we know: Hundreds of French supermarkets were hit by a cyberattack targeting internet-connected refrigeration systems. Attackers reportedly raised temperatures to as high as 122°F (50°C), causing fires, destroying food stocks, and forcing some refrigeration equipment to be taken offline.
Context: The attack was suspected to have been enabled by vulnerabilities in Danfoss AK-SM 800A refrigeration controllers. Similar disruptions were reported at U.S. military commissaries in late August. Separately, the Danish company Danfoss was targeted in an alleged distributed denial-of-service (DDoS) attack by pro-Russian actors over Denmark’s support for Ukraine.
Analyst note: The concentration of affected retailers in France, despite Danfoss having global customers, likely indicates deliberate geographic targeting rather than indiscriminate exploitation. The disruption of refrigeration systems caused direct food and financial losses without evidence of data theft, which is likely consistent with a hacktivist disruption objective, although attribution remains unconfirmed. Threat actors are likely to target other organizations across different countries, operating unpatched vulnerable Danfoss systems.
Ledger Confirms Spy Chip in Hardware Wallets Enabling Crypto Theft
What we know: Ledger has confirmed that hardware wallets sold through its Malaysia-based reseller CryptoBilis were compromised with unauthorized hardware implants designed to steal users' cryptocurrency seed phrases. Reported losses exceeded USD 86 million across affected users in Southeast Asia.
Context: The implant captured display output and button presses to identify the user's seed phrase, then transmitted it to the attacker over an LTE connection using an embedded eSIM. CryptoBilis has ceased all hardware wallet sales pending investigation, and Ledger has advised users who purchased from the reseller in the past 90 days to migrate assets to a new wallet.
Analyst note: The operation likely exploited gaps in physical hardware verification, demonstrating that cryptographic authenticity checks alone are insufficient to detect unauthorized modifications. Further victims and distribution channels may emerge as investigations progress, while asset recovery is likely to be challenging due to the irreversible nature of blockchain transactions.
AI-Assisted CyberXero Campaign Steals 628,000 Ukrainian Records
Source: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html
What we know: An AI-augmented initial access broker (IAB) codenamed, CyberXero, has reportedly exfiltrated over 628,000 records of Ukrainian individuals from WordPress sites, e-commerce platforms, and critical infrastructure entities.
Context: The threat actor reportedly operates automated attacks against WordPress and e-commerce platforms worldwide, while conducting manual intrusions against Ukrainian energy and critical infrastructure. The threat actor reportedly used 51 Claude Code agents to mass-exploit WordPress flaws tracked as CVE-2026-63030, CVE-2026-60137 and SQL injection vulnerability CVE-2026-4815.
Analyst note: CyberXero’s dual targeting approach likely indicates a financially-motivated access-brokering operation. Global exploitation of Wordpress and e-commerce sites likely enables scalable access sales and payment information theft. On the other hand, access to Ukrainian energy infrastructure network will likely provide high-value operational data for resale, attracting state-aligned actors.
DEEP AND DARK WEB INTELLIGENCE
PwnForums user 2019: A moderately credible threat actor "2019" has advertised more than 31,300 documents allegedly linked to Australian cancer care provider The Icon Oncology Group. The healthcare provider has confirmed a data breach involving its Australian network, resulting in unauthorised access to patient information held on a supplier’s system. The stolen data includes names, dates of birth, contact details, addresses, medical record numbers, Medicare and health insurance details, and clinical records. Threat actors are likely to leverage the data to target exposed patients and their care-givers in financially-motivated scams. Furthermore, they are likely to carry out insurance fraud through identity theft.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2026-97229: GitLab has patched a critical integer overflow vulnerability in its CI/CD Regular Expression Compiler. The flaw can reportedly enable an unauthenticated remote attacker to execute arbitrary code on the GitLab server via a specially crafted regular expression, due to insufficient regular expression validation.
Affected products: The affected products are listed in this advisory.
Tags: DIB, tlp:green