ZeroFox Daily Intelligence Brief - November 4, 2026
ZeroFox Daily Intelligence Brief - November 4, 2026
ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.
Brief Highlights
- UK School Network Compromised in 3AM Ransomware Attack
- EMPERADOR RaaS Group Targets Swiss Building Materials Giant Holcim
- Cyberattack Targets French Blood Storage Facilities
UK School Network Compromised in 3AM Ransomware Attack
What we know: A 3AM ransomware affiliate has reportedly compromised a UK school network, using an unmanaged host to access nearly 50 machines and successfully encrypt approximately 37 of them. The affiliate reportedly used a modified PowerShell tool to extract credentials from three backup servers, copied a database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools.
Context: The affiliate is suspected to have used AI-generated commands and an automated agentic loop to conduct parts of the operation. The 3AM ransomware operation reportedly emerged in 2023 and has previously been linked to the Conti and Royal ransomware groups. Its affiliates have also used email bombing and spoofed IT support calls to gain network access.
Analyst note: School networks are likely to provide access to shared administrative systems, centralized IT infrastructure, and access to third-party education platforms, increasing the scope of the compromise by extending beyond an individual school. The affiliate's reported extraction of credentials from three backup servers suggests that ransomware operators are likely prioritizing backup infrastructure to weaken an organization's recovery options. School closures are also likely to follow.
EMPERADOR RaaS Group Targets Swiss Building Materials Giant Holcim
Source: https://cloud.zerofox.com/intelligence/advanced_dark_web/113853
What we know: On November 3, 2026, ZeroFox observed ransomware-as-a-service (RaaS) group EMPERADOR claiming to have breached Holcim, a Switzerland-based multinational building materials company operating in 45 countries, on its data leak site. Holcim has reportedly confirmed limited unauthorized access and data theft, with no disruption to operations.
Context: The stolen data allegedly includes regional tax, finance, and human resources (HR) records, predominantly from Holcim’s Philippine operations, with other HR datasets from France and Belgium. ZeroFox first observed EMPERADOR on August 13, 2026; the group has since claimed at least 80 victims, with Europe and South America being the most targeted regions and retail and technology being the most targeted industries. The group reportedly uses a Rust-based encryptor for Windows and Linux.
- EMPERADOR has also claimed to have targeted several government entities, including the City Government of Baguio in the Philippines, which confirmed a temporary suspension of its BUILDPass permit portal following the incident.
Analyst note: Holcim employees in the Philippines, France, and Belgium are likely at risk of payroll-diversion and phishing lures. Finance teams should verify any out-of-band changes to bank details. Customers and suppliers of upstream building-materials firms are likely to be targeted in invoice-fraud attempts that spoof Holcim.
Cyberattack Targets French Blood Storage Facilities
Source: https://databreaches.net/2026/11/03/french-blood-storage-units-targeted-in-cyberattack/
What we know: A cyberattack reportedly targeted refrigeration systems used by the French Blood Establishment (EFS) and run by service provider Coolworld, affecting blood samples and frozen plasma intended for transfusion. The incident comes amid a second wave of cyberattacks targeting supermarket refrigeration systems across Europe, and October 11–12, 2026 attack on hundreds of French supermarkets, which ZeroFox assessed as consistent with pro-Russian cyber tactics.
Context: Attackers reportedly reprogrammed storage units of EFS to reach 110 degrees Celsius (230 degrees Fahrenheit) instead of normally maintained minus 30 degrees Celsius (minus 22 degree Fahrenheit). France's Health Ministry reportedly said the incident caused no operational disruption. Separately, on November 3, 2026, seven passenger flights in Poland, Spain, Bulgaria, and Italy were inspected following separate suspected bomb threats.
Analyst note: Healthcare, blood banks, laboratories, biobanks, and cold-chain operators across Europe that rely on industrial refrigeration systems are likely at risk, particularly where their Operational Technology (OT) controllers are internet-exposed or running outdated firmware. No evidence links the refrigeration attacks to the aviation bomb threats. However, taken together, they are likely to strain emergency response and raise public anxiety amid France’s unrest and European government warnings about Russian hybrid operations. The overlap in timing and sector breadth in both incidents is consistent with a strategy of imposing cumulative economic and psychological cost as part of hybrid warfare tactics, and testing government response times, below the threshold that would trigger a collective NATO response.
Recommendations: ZeroFox recommends organizations to audit remotely managed refrigeration supervisory controllers, mainly Danfoss’s End-of-life models such as the AK-SM 800 and AK-SC 355, controller configurations, including setpoints and defrost schedules.
- Operators using legacy Danfoss AK-SM or AK-SC controllers should follow CERT-FR guidance to disconnect them or strictly filter access.
- Organizations should deploy independent temperature sensors and alerting systems to detect unauthorized temperature changes if central controller alarms fail or are delayed.
DATA BREACHES INTELLIGENCE
Amadeus breach: Singapore Airlines is the latest carrier to confirm impact from the Amadeus reservation system breach, disclosing that approximately 46,000 booking records were affected. The breach has affected booking records across multiple Asia-Pacific carriers after an unauthorized party accessed its systems between August 2023 and September 2026.
DEEP AND DARK WEB INTELLIGENCE
XSS user LongNight: Untested threat actor "LongNight" has advertised an alleged AI-powered penetration testing Telegram bot named "Pentest2Bot" on dark web forum XSS. The bot allegedly automates a broad range of offensive security techniques including SQL injection, SSRF, XSS, IDOR attacks, authentication flow testing, exposed secret detection, and subdomain takeover, generating novice-accessible reports with commands, server responses, and reproduction steps. The advertisement of AI-driven penetration testing tooling for threat actor use comes as another AI-enabled offensive framework, ARTEX AI, has been used in multiple confirmed intrusions, including the recent WorkOS breach. Such tools automate reconnaissance and exploitation, and are likely to enable less-skilled actors to scale operations at higher speeds.
VULNERABILITY AND EXPLOIT INTELLIGENCE
CVE-2026-58115: This is a missing authentication vulnerability in Siemens SIMATIC IoT2050 Advanced devices, now actively exploited in the wild. The flaw enables an unauthenticated remote attacker to create malicious Node-RED flows and execute arbitrary code on the underlying server with maximum privileges. Observed exploitation includes multi-stage attacks that deploy malicious flows to download and execute Linux botnet binaries from attacker-controlled servers, as well as persistent HTTP backdoors.
Affected products: Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED