This Week in Cyber: October 8-14, 2026
Chinese hacking infrastructure remains active two years after a major FBI takedown, while an attack on European supermarkets caused physical damage through industrial controllers. New research exposed persistent OT visibility gaps, and federal regulators advanced electric-grid monitoring requirements.
October 8 | FBI Disrupts Chinese Hacking Infrastructure
The FBI and Justice Department seized seven domains supporting Chinese state-linked hacking tools associated with Flax Typhoon. The tools supported vulnerability scanning, spear-phishing and malware deployment against critical infrastructure, including a U.S. power company.
Why it matters: The FBI dismantled Flax Typhoon’s 200,000-device botnet in 2024. Two years later, it’s still uncovering the group’s infrastructure, and further operations are likely. Put this alongside September’s FBI and CISA warning, which detailed attackers collecting customer SCADA information from an industrial integrator. The bigger picture is a sustained effort to map and penetrate critical infrastructure. Utilities protecting only their perimeter are missing the full attack surface. Vendor access, engineering documentation and exposed equipment need to be part of the same operating picture.
October 10 | Research Exposes Persistent OT Visibility Gaps
An industry survey of more than 1,600 critical infrastructure security leaders found that 68% lack complete, real-time visibility into OT-connected assets, while 74% have not fully integrated their IT and OT security operations. Organizations reported using an average of seven security tools despite persistent visibility and investigation challenges.
Why it matters: These findings reinforce September research showing that 88% of industrial organizations considered their OT security programs mature, while only 21% had a complete asset inventory. The industry is measuring security maturity by investment and tools rather than operational capability. Seven products mean little when teams cannot identify what’s connected, trace suspicious activity or determine which systems are affected. The priority should be a common operating picture across IT and OT, with evidence that existing tools can support an investigation from detection through impact assessment.
October 12 | Cyberattack Disrupts Supermarket Refrigeration
Hackers manipulated refrigeration systems across hundreds of French supermarkets, raising temperatures as high as 50°C, spoiling food and contributing to fires. At least 350 stores were affected, with outdated refrigeration controllers among the compromised equipment.
Why it matters: In August, researchers disclosed serious vulnerabilities in widely used refrigeration controllers,
including authentication bypass and remote code execution. Two months later, hundreds of stores suffered physical losses, while
Reuters identified at least 4,500 refrigeration management interfaces still exposed online. The consequences extend well beyond retail to food processing, pharmaceuticals and cold storage. Operators should treat exposed industrial management interfaces as a direct operational risk, not just another IT vulnerability. Know which controllers are reachable, which are unsupported and how to maintain safe operation if remote management is compromised.
October 13 | FERC Advances CIP-015-2 Implementation
FERC published an updated information-collection notice for NERC CIP-015-2, following its August approval of expanded internal network security monitoring requirements. The revision extends monitoring coverage to certain electronic and physical access control systems outside the electronic security perimeter.
Why it matters: This week’s Flax Typhoon disclosure and September’s warning about compromised ICS integrators highlight how attackers can identify pathways into protected operational networks. CIP-015-2 addresses a related blind spot by extending monitoring beyond the traditional security perimeter. FERC estimates 360 entities will face additional documentation requirements, totaling more than 30,000 hours annually. Utilities should be mapping these newly covered systems now, identifying where traffic can be observed and ensuring investigators can trace unauthorized activity across the network boundary.
That’s it for this week.
We’ll be back next Thursday with the next Weekly Roundup.
