The overall threat level for OT in the DACH region (Germany, Austria, Switzerland) is high this week (reporting period 15 to 23 October 2026). Remote access and Edge Devices are in focus again: a BeyondTrust Remote Support Zero-Day was exploited before it was disclosed. On the plant floor, new vulnerabilities hit the web server of Siemens SIMATIC S7-1500 and ET 200SP.
Key developments this week
1. BeyondTrust Remote Support: Zero-Day exploited before disclosure (CVE-2026-102764), SANS ICS Control: CC4 Secure Remote Access
BeyondTrust dates the two known compromises to 29 August. The vulnerability was published on 15 October and added to the KEV catalog on 16 October. According to Rapid7, Mandiant attributes the activity to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage actor. Patch self-hosted appliances immediately; versions before 24.3.1 need an upgrade first. Rapid7 recommends checking for compromise even after patching. According to Rapid7, Mandiant advises preserving evidence before making changes, isolating suspicious appliances and rebuilding them from a clean, patched image if compromise is confirmed or cannot be ruled out. Rotate stored credentials for OT systems and hunt with the IoCs from Mandiant (as listed by Rapid7).
Source: Rapid7
2. Siemens SIMATIC S7-1500 and ET 200SP: vulnerabilities in the web server (ICSA-26-295-14), SANS ICS Control: CC2 Defensible Architecture
Attackers can execute PLC operations within the rights of the logged-in user. Numerous products are affected. Siemens is preparing fixes and recommends countermeasures until they ship. Use your asset inventory to find CPUs with the web server enabled and disable it where it isn't needed. Otherwise, restrict access to the web server to engineering networks with a firewall, and tell your team to upload only trusted trace files.
Source: CISA ICSA-26-295-14
3. Joint advisory on SafePay ransomware (AA26-293A), SANS ICS Control: CC5 Risk-Based Vulnerability Management
The group has hit organizations across several critical infrastructure sectors. Check the patch level of the CVEs named in the advisory on firewalls, VPN and Veeam servers. Enforce MFA on every VPN account, and keep an offline backup of OT-relevant systems that you have already tested restoring.
Source: CISA AA26-293A
4. Siemens Software Center abused for ClickFix Malware, SANS ICS Control: CC3 ICS Network Visibility & Monitoring
According to The Hacker News, the attackers bring their own genuine, signed older copy of the software together with archive.dll, delivered as an MSI through a ClickFix lure. Systems are at risk when someone runs the ClickFix lure. Keep the Software Center on the latest version. Hunt on Windows and engineering PCs for ClickFix and MSI executions, and for SiemensSoftwareCenter.exe in AppData\Local\Programs started by msiexec.exe. Check IoCs against the vendor's original advisory before blocking them on your firewall and proxy.
Source: The Hacker News
5. Attacks on refrigeration controls in France, SANS ICS Control: CC4 Secure Remote Access
AP reported on 16 October on the attacks on refrigeration controls in France.
Source: Insurance Journal / AP
What it means per sector
Food & beverage production (threat level: elevated). The week was shaped by the aftermath of the refrigeration control attacks in France. We are not aware of a confirmed case in Germany. The risk lies with older, unmaintained or internet-exposed remote maintenance modules of refrigeration systems. In our assessment, this can also affect cold stores, frozen-food warehouses, dairies and breweries. Ask your refrigeration service provider in writing which controllers are reachable from the internet. Close direct access paths and replace them with VPN plus MFA. On Danfoss systems, enable Strict Security Mode and change default passwords, and plan replacements for legacy devices that no longer get updates. The Siemens S7-1500/ET 200SP advisory is the most important item for production. Import trace files only from your own verified sources, and that includes files from service technicians on USB. Your Incident Response plan should define how orders are handled manually and fresh goods are rerouted if a major retail customer goes down. Keep contact channels to the customer's purchasing team that don't depend on email or the portal. Also test the offline backup of recipe and MES data. Full report (German)
Machine builders (threat level: high). This week the most important news for machine and plant builders concerns vulnerabilities in their own products. Check your installed base for S7-1500/ET 200SP CPUs with the web server enabled, disable it where it isn't needed, instruct service technicians to upload only trusted trace files and send customers a short security notice. If you run self-hosted BeyondTrust appliances for remote maintenance, patch them, check them for compromise, rotate every stored credential for customer plants and inform affected customers. Bring your own Siemens Software Center installations to the latest version. Check whether your own ticket and CRM systems contain stored passwords and rotate them. Use personal, time-limited accounts with 2FA for service work instead of shared admin passwords. Full report (German)
What to do now
- Immediately: Patch BeyondTrust Remote Support (upgrade first if older than 24.3.1), check for compromise even after the patch, rotate stored OT and customer credentials and hunt with the Mandiant IoCs (as listed by Rapid7). (CC4)
- Immediately: Disable the web server on S7-1500/ET 200SP CPUs or restrict access to it to engineering networks with a firewall until Siemens delivers fixes, and accept trusted trace files only. (CC2)
-
Immediately: Hunt on Windows and engineering PCs for ClickFix/MSI executions and
SiemensSoftwareCenter.exestarted bymsiexec.exe, block verified IoCs and update the Software Center to the latest version. (CC3) - Immediately: Inventory remote access to refrigeration systems, close direct internet access and route it through VPN with MFA. (CC4)
- 0 to 3 months: Check your VPN and Edge Device inventory against the CVEs in AA26-293A, enforce MFA for all remote access and test restoring an offline backup. (CC5)
Full sector reports (German)
- All sectors (DACH overview)
- Power & grids
- Utilities (water, wastewater, municipal)
- Food & beverage production
- Machine builders (CRA)
- All sectors at a glance
Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).
Top comments (0)