Cyber Brief: AI threats, OT flaws, and supply chain risk

Today's stories share a common thread that UK security and business leaders would do well to sit with: the gap between the security posture organisations have and the one they actually need is widening. The NCSC is warning that AI is accelerating the exploitation of longstanding weaknesses, a patched vulnerability in Synology NAS devices is being actively used to deliver ransomware, a max-severity flaw in an operational technology programming tool is being exploited in the wild, and a second wave of cyberattacks on European supermarket refrigeration systems is raising serious questions about internet-exposed industrial controls. Across all four stories, the pattern is consistent — known risks, delayed action, and real-world consequences.

NCSC warns AI will power attacks on UK critical infrastructure within two years

The National Cyber Security Centre has published a significant assessment warning that the UK faces AI-enabled attacks on critical national infrastructure within two years. Reported directly by the NCSC, the assessment describes how AI is lowering the barrier for threat actors to discover and exploit longstanding security weaknesses — what the NCSC characterises as the legacy of 'tech on the cheap'. The report projects the threat landscape through to 2028 and identifies AI-assisted cyber intrusion as a growing and credible risk, not a distant theoretical concern. The NCSC is calling for urgent investment in resilience across both public and private sector organisations.

For UK businesses, this assessment carries real weight. The NCSC is not describing a new class of attack technique so much as warning that existing weaknesses — unpatched systems, poor network segmentation, inadequate access controls — are becoming far easier for adversaries to find and exploit at scale with AI assistance. Organisations that have deferred investment in security fundamentals are now facing a narrowing window to address those gaps before AI-powered tooling makes them routine targets. This is particularly relevant for sectors that underpin UK critical infrastructure, including energy, water, transport, healthcare and financial services, but the implications extend to any organisation with ageing technology or unresolved technical debt.

Why it matters

For UK businesses, this is a prompt to honestly assess where security investment has been deferred and what the realistic exposure looks like. Organisations should review their vulnerability management programmes, network architecture and resilience planning with the understanding that the time available to address known weaknesses is shortening. Boards and senior leadership teams should treat this NCSC assessment as a strategic signal, not a technical advisory.

Source: NCSC UK

Max-severity flaw in OT programming tool exploited to deliver Linux malware

A maximum-severity vulnerability in a widely used operational technology programming tool is being actively exploited to deliver Linux malware, according to reporting by The Register. The flaw affects software used to programme industrial IoT gateways and OT devices, and attackers are using it to gain a foothold on systems that are, in some cases, directly exposed to the internet. The Register's coverage highlights the uncomfortable reality that many industrial control environments were not designed with internet exposure in mind, yet have ended up connected in ways that create significant risk.

This story matters for any UK organisation operating industrial environments, manufacturing facilities, building management systems or critical infrastructure. OT security has historically lagged behind IT security, with patching cycles that are slower, change windows that are narrower, and a tendency to prioritise operational continuity over security updates. The combination of a max-severity vulnerability and active exploitation means that organisations relying on this type of software need to act promptly. More broadly, the story reinforces a pattern that the security community has been highlighting for years: internet-exposed OT and industrial IoT devices represent a significant and underappreciated attack surface, and the consequences of a successful compromise in these environments can extend well beyond data loss.

Why it matters

For organisations operating OT environments or industrial IoT infrastructure, this is a prompt to audit what is internet-exposed, apply available patches, and review network segmentation between IT and OT systems. If your organisation uses industrial programming tools or IoT gateways, confirming whether affected software versions are in use should be an immediate priority for your operations and security teams.

Source: The Register

Supermarket refrigeration cyberattacks spread across Europe in second wave

A second wave of cyberattacks targeting supermarket refrigeration systems has affected over 100 stores across at least seven European countries, including Ireland, Belgium, Estonia, Finland, Sweden and Luxembourg, according to reporting by SecurityWeek and The Guardian. Attackers remotely altered the settings on internet-exposed refrigeration controllers, causing temperatures in fridges and freezers to rise to as high as 50°C overnight. The attacks mirror an incident last month that caused millions of euros of damage in France, and Danish refrigeration controls manufacturer Danfoss has been identified as a common factor in the affected systems. Stores were forced to discard chilled and frozen food, and some had to close affected sections entirely.

While this incident directly affects the retail and food supply sector, the broader lesson is relevant to any UK organisation that relies on internet-connected operational technology or building management systems. The refrigeration controllers targeted in these attacks are a form of industrial IoT — devices that manage physical processes and that, when compromised, cause tangible real-world harm. The fact that this is the second wave of attacks in a month suggests a deliberate and sustained campaign rather than opportunistic activity. For UK retailers, food manufacturers, logistics operators and facilities managers, this is a clear signal to review what operational technology is internet-facing and whether appropriate access controls and monitoring are in place.

Why it matters

For UK organisations in retail, food supply, logistics or facilities management, this is a prompt to audit internet-exposed operational technology and building management systems. Reviewing whether refrigeration controls, HVAC systems or similar devices are directly accessible from the internet — and ensuring default credentials have been changed and access is properly restricted — should be a near-term priority for both IT and facilities teams.

Source: SecurityWeek

Synology NAS devices targeted in ransomware attacks exploiting patched flaw

Synology is urging customers to update their DiskStation Manager (DSM) software after threat actors were observed exploiting a vulnerability patched in December 2024 to deliver ransomware, according to The Hacker News. The attacks target Synology NAS devices running outdated versions of DSM, with the goal of encrypting stored data and demanding a ransom payment. Synology confirmed the activity in a public statement, making clear that the vulnerability is known, the patch is available, and the exploitation is active. The risk is entirely avoidable for organisations that have kept their devices up to date.

Synology NAS devices are widely used across UK businesses of all sizes for file storage, backup, and data management. Many organisations rely on them as part of their backup infrastructure, which makes them a particularly attractive ransomware target — encrypting a backup device can significantly undermine an organisation's ability to recover from a broader attack. The fact that the vulnerability was patched nearly a year ago and is still being successfully exploited reflects a persistent challenge: patch management for network-attached storage and similar devices is often overlooked compared to servers and endpoints. For organisations using Synology devices, the action required is straightforward, but the window to act before exploitation reaches them is narrowing.

Why it matters

For any organisation using Synology NAS devices, checking the current DSM version and applying available updates should be treated as an immediate task. This is also a useful prompt to review whether NAS devices are included in your standard patch management processes and whether backup devices are adequately segmented from the rest of your network to limit the impact of a ransomware attack.

Source: The Hacker News

Today's Key Actions

• Review the NCSC's AI and cyber intrusion assessment and use it as a basis for a board-level conversation about where security investment has been deferred and what the realistic exposure looks like over the next two years.
• If your organisation operates OT environments, industrial IoT gateways or uses industrial programming software, audit what is internet-exposed, apply available patches for the affected tool, and review IT/OT network segmentation as a priority.
• If your organisation operates in retail, food supply, logistics or facilities management, audit internet-exposed operational technology and building management systems, confirm default credentials have been changed, and ensure remote access to these systems is appropriately restricted.
• Identify all Synology NAS devices in your environment, confirm they are running a patched version of DSM, and verify that NAS devices — particularly those used for backup — are properly segmented from the wider network.
• Confirm that clear ownership exists across your organisation for patch management of non-standard devices, including NAS appliances, OT systems, building management controls and industrial IoT, so that these do not fall outside your standard security processes.

Secarma Insight

What today's stories collectively illustrate is that the most significant cyber risks facing UK organisations are rarely novel or exotic — they are familiar weaknesses that have not been addressed in time. AI is not creating new vulnerabilities; it is making existing ones easier to find and exploit at scale. Patched flaws are being used to deliver ransomware because devices have not been updated. Industrial systems are being compromised because they were connected to the internet without adequate controls. The organisations that weather these pressures best are not necessarily those with the most sophisticated security programmes — they are the ones that have maintained consistent discipline around the basics: patching, network segmentation, asset visibility and clear ownership of security responsibilities. Those foundations, built and maintained before an incident occurs, are what make the difference.