Cyber Brief: IoT Attacks, AI Fraud, SonicWall Flaw, ARTEX

This week's security landscape reflects a broadening of attack surfaces that many organisations may not yet have fully mapped. From internet-connected industrial equipment being tampered with remotely, to AI-generated impersonation fraud targeting finance teams, the common thread is that attackers are finding success in places where security ownership is unclear or controls are assumed rather than verified. Alongside these emerging threats, a known vulnerability in widely deployed VPN software is already being actively exploited, and a purpose-built AI offensive tool is spreading further than previously understood. Taken together, these stories are a useful prompt for UK organisations to review where their blind spots may lie.

Refrigeration System Attacks Highlight the Real Risk of Internet-Connected Industrial Equipment

US government agencies CISA and the FBI have issued an advisory warning that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally, including in Europe. Reporting from Wired, The Hacker News, and Palo Alto Networks Unit 42 details a pattern of attacks in which hackers exploit vulnerabilities or weaknesses in unpatched, internet-accessible controllers to remotely alter temperature settings, forcing units into continuous heating cycles. The consequences have included spoiled inventory, fire hazards, and significant operational disruption. One incident described by The Guardian involved a London-based fruit and vegetable wholesaler discovering refrigeration units reading 150°C during morning checks. Unit 42's analysis confirms that attackers are targeting European refrigeration infrastructure and outlines the specific attack techniques being used.

For UK businesses, this is a timely reminder that operational technology (OT) and internet of things (IoT) devices carry real security risk, particularly when they are internet-accessible and running default or outdated firmware. Cold storage is critical infrastructure for food retail, pharmaceuticals, healthcare, and logistics — sectors with significant UK presence. Many of these devices were deployed years ago with little consideration for network security, and they may sit outside the scope of standard IT security reviews. The attack method does not require sophisticated techniques; in many cases, publicly exposed controllers with weak or default credentials are sufficient for an attacker to gain access and cause harm.

Why it matters

For UK businesses operating or responsible for refrigeration, cold-chain, or other internet-connected industrial equipment, this is a prompt to audit which OT and IoT devices are accessible from the internet, confirm that default credentials have been changed, and ensure firmware is kept up to date. Organisations in food retail, healthcare, pharmaceuticals, and logistics should treat this as a priority review rather than a future consideration.

Source: Wired Security

AI Deepfake Fraud Trio Charged After $129 Million Stolen From Businesses

CyberScoop reports that authorities have charged three individuals with using AI-generated deepfakes to defraud businesses of $129 million. The group allegedly targeted accounting and finance staff at victim companies, impersonating CEOs and lawyers in video and audio calls to convince employees to authorise large wire transfers. The scheme relied on convincing real-time impersonation rather than phishing emails, making it significantly harder for staff to detect through standard awareness training alone. The case represents one of the largest confirmed instances of AI-enabled business email and voice compromise fraud to date.

This case matters for UK organisations because it demonstrates that AI-generated impersonation has moved well beyond experimental proof-of-concept into active, large-scale financial crime. Finance teams, accounts payable staff, and anyone with authority to approve payments are now potential targets for highly convincing real-time fraud. Traditional controls such as checking the sender's email address or recognising a colleague's voice are no longer sufficient when attackers can replicate both convincingly. The financial services sector, professional services firms, and any organisation with significant payment flows should treat this as a direct operational risk rather than a distant threat.

Why it matters

For UK businesses, this is a prompt to review payment authorisation controls and ensure that out-of-band verification — such as a separate phone call to a known number — is required for any significant or unusual transfer request, regardless of how convincing the initial communication appears. Staff awareness training should be updated to reflect the reality of AI-generated voice and video impersonation, and finance teams should be encouraged to feel empowered to pause and verify rather than act under perceived urgency.

Source: CyberScoop

SonicWall Patches Actively Exploited VPN Vulnerability That Weakens MFA

SonicWall has released a patch for CVE-2026-19868, a vulnerability in SonicOS SSLVPN that allows attackers holding credentials for a different authentication method to bypass SAML checks, including SAML-enforced multi-factor authentication. SecurityWeek reports that the flaw has been actively exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalogue, indicating confirmed real-world exploitation. The vulnerability is particularly significant because it undermines MFA — a control that many organisations rely on as a primary defence for remote access.

SonicWall VPN appliances are widely deployed by UK businesses and managed service providers as a remote access solution, making this vulnerability directly relevant to a large number of organisations. The fact that it can be used to bypass MFA is especially concerning, as many security teams and IT departments consider MFA sufficient protection for VPN access without additional controls. Active exploitation means that unpatched appliances are already being targeted, and the window between patch release and widespread attacker activity is typically very short for known VPN vulnerabilities. This is not a theoretical risk.

Why it matters

UK organisations using SonicWall SSLVPN should apply the available patch as a priority and confirm with their IT team or managed service provider that the update has been deployed. This is also a useful moment to review whether VPN access logs show any unusual authentication activity from the period before patching, and to consider whether additional access controls such as IP allowlisting or conditional access policies are in place alongside MFA.

Source: SecurityWeek

ARTEX AI Hacking Tool Spreading Further Than Reported, With Financial Sector Now Targeted

New research from Censys, reported by Infosecurity Magazine and TechCrunch, has found that hundreds of servers hosting the ARTEX AI-powered offensive security tool are publicly exposed to the internet, suggesting the tool's use by threat actors is significantly broader than previously documented campaigns indicated. Separately, Microsoft's Security Blog reports that financially motivated threat actor Storm-3358 began targeting financial sector organisations in October 2026 using ARTEX as part of its attack framework. ARTEX is an agentic AI tool originally designed for penetration testing that has been repurposed by criminal actors to automate elements of the attack lifecycle, including reconnaissance and exploitation.

The combination of widespread exposure and active financial sector targeting makes ARTEX a meaningful concern for UK organisations, particularly those in banking, insurance, asset management, and fintech. The tool's AI-driven automation means that attacks can be conducted at greater speed and scale than traditional manual techniques, and the barrier to entry for less sophisticated actors is lowered when capable tooling is freely accessible. The fact that hundreds of exposed instances exist suggests that the tool is being used opportunistically as well as in targeted campaigns, broadening the potential threat surface considerably.

Why it matters

For UK organisations in the financial sector and beyond, this is a prompt to review external attack surface exposure and ensure that internet-facing systems are not presenting unnecessary entry points. Security teams should consider whether their current detection capabilities would identify the reconnaissance and exploitation patterns associated with AI-driven tooling, and whether threat intelligence feeds are being used to track emerging offensive tools of this kind.

Source: Microsoft Security Blog

Today's Key Actions

• Audit all internet-accessible OT and IoT devices — particularly refrigeration controllers, building management systems, and industrial equipment — to confirm default credentials have been changed, firmware is current, and remote access is restricted to authorised sources only.
• Review payment authorisation procedures with finance and accounts payable teams, ensuring that any request to transfer funds — however convincing the communication — requires independent verification via a separately confirmed contact method before approval.
• Confirm that SonicWall SSLVPN appliances have been patched against CVE-2026-19868, review authentication logs for unusual activity, and verify that additional access controls complement MFA for all remote access routes.
• Review external attack surface exposure for internet-facing systems and assess whether current detection capabilities would identify AI-driven reconnaissance and exploitation activity consistent with tools such as ARTEX.
• Confirm that clear ownership exists across your organisation for each of these areas — OT and IoT security, financial fraud controls, VPN patching, and external attack surface management — so that review actions can be assigned and tracked effectively.

Secarma Insight

What connects today's stories is not the sophistication of the attacks themselves, but the consistency of the underlying conditions that make them possible: devices left internet-accessible without adequate controls, authentication mechanisms assumed to be sufficient without being tested, and processes that rely on trust rather than verification. The organisations best placed to manage these risks are not necessarily those with the largest security budgets, but those with clear ownership, documented controls, and the habit of reviewing assumptions before incidents force the issue. Good security practice is less about responding to the latest threat and more about maintaining the discipline to check that the fundamentals are in place — and that someone is accountable for each of them.