Today’s digest is about the paths defenders don’t watch: a mobile network nobody thought to segment, a Kubernetes permission boundary that turns out not to be one, and a ransomware crew that goes after your event logs before it goes after your files. Here’s what changed since yesterday’s digest.
OT/ICS watch: A private cellular network gave attackers a second route into a Polish energy facility
CERT Polska published a follow-up report confirming that the December 2025 attack on a Polish combined heat and power (CHP) plant used a previously undocumented path into operational technology: a private APN, a dedicated mobile network a distribution system operator sets up with a carrier for grid equipment. Attackers first compromised a wind farm’s Fortinet VPN and firewall, then used a Teltonika cellular router to tunnel from that foothold into the DSO’s private APN — a network most security teams don’t think to monitor because it isn’t part of the corporate IP range at all. From there they reached the CHP plant’s OT network and a Wago PLC, shutting down a steam turbine and the water treatment system that produces process water for the plant’s cogeneration process, cutting heat to roughly 50,000 residents. CERT Polska says the private-APN configuration is common across Poland and likely elsewhere internationally. Help Net Security · SecurityWeek
If your OT environment connects to field equipment over a carrier-provided private APN, that link deserves the same scrutiny as any other WAN path into your network — inventory which cellular routers and gateways sit on it, confirm the Fortinet or other edge devices bridging to it are patched and MFA-enforced, and don’t assume “it’s not on the internet” means “it’s not reachable.”
Vulnerability watch: An unpatched Red Hat ACM flaw lets a namespace editor become cluster-admin across your entire fleet
CVE-2026-10090 (CVSS 9.9), disclosed by Red Hat on August 5, is an authorization gap in the Application Subscription controller of Red Hat Advanced Cluster Management for Kubernetes. A user who holds only namespace-scoped “edit” permissions in an ACM hub namespace can create a Channel object pointing at an attacker-controlled Helm repository; the vulnerable controller then fetches and deploys that chart using its own elevated permissions, handing the low-privilege user full cluster-admin rights across every cluster the hub manages. Red Hat has stated no mitigation currently meets its product-security bar, so this is an open exposure, not a delayed patch. Cybersecurity News · GitHub Advisory
If you run ACM to manage a multi-cluster fleet, audit who holds namespace-edit permissions in hub namespaces today — that scope is your real admin boundary until a fix ships — and alert on unexpected Channel object creation pointing at Helm repositories outside your approved registry list.
Ransomware watch: CISA details how Gunra ransomware turns an unpatched VPN into full network compromise
CISA and the FBI published a joint #StopRansomware advisory on Gunra, a ransomware-as-a-service operation believed built on leaked Conti source code that matured into a full RaaS model by early 2026 and has hit government and critical infrastructure targets. The advisory says Gunra affiliates get in through exposed edge infrastructure — VPN gateways, firewall appliances, and RDP-accessible systems — including known Fortinet VPN flaws that let them bypass MFA, then move laterally to steal cloud data before encrypting. CISA’s central recommendation is to treat network segmentation as a containment control, not a compliance checkbox: separate user workstations, VDI, identity services, backup platforms, management networks, and production workloads behind tightly enforced access paths, and maintain offline, immutable, tested backups. CISA Advisory AA26-222A · Cybersecurity News
Pull your VPN and RDP-exposed inventory and confirm every gateway is patched and behind MFA that Gunra’s known bypass techniques can’t defeat — then check that segmentation actually stops lateral movement from a compromised workstation into backup or identity infrastructure, since that’s the control the advisory is built around.
Detection engineering watch: DeadLock ransomware disables Defender, deletes backups, and scrubs event logs before it encrypts
Microsoft’s threat intelligence team published a technical breakdown of DeadLock, a Rust-based ransomware operation active since mid-2025 that pairs double extortion with an unusually thorough anti-forensics routine. A PowerShell stage stops Windows Defender and backup-related services, deletes all volume shadow copies to block restoration, and then walks the Event Log API to clear the Security, System, Application, and PowerShell channels — it also edits the WINEVT Channels registry tree directly, setting Enabled to zero and replacing ChannelAccess permissions with a restrictive SDDL descriptor so the channels can’t easily be turned back on. A separate loader uses a vulnerable signed driver (BYOVD) to blind EDR before the ransomware payload runs. Microsoft Security Blog · Talos Intelligence
The registry edit is the detection opportunity: alert on writes to HKLM\SYSTEM\CurrentControlSet\Services\EventLog\*\Enabled and on ChannelAccess SDDL changes under that same tree, and ship logs off-host in near-real-time so a cleared local channel doesn’t erase your only copy of the evidence.
Also noted: A new modular RAT gives attackers hidden remote-desktop control inside your own browser
Zscaler ThreatLabz documented Abyssos, a C++ remote-access trojan first seen in late June that combines credential theft, clipboard interception, file exfiltration, and hidden VNC in one framework. Its browser-hijacking module launches a hidden Chrome instance with the remote-debugging port open, connects to it over the DevTools protocol, and injects the victim’s stolen session cookies directly into that instance — giving the operator an already-authenticated browser session without ever touching the victim’s password. Cyberpress
Final thought
Three of today’s stories share the same shape: a boundary everyone assumed would hold — a namespace permission, a cellular network nobody monitors, a local event log — turned out not to. The fix in each case isn’t a single patch, it’s confirming the control is doing what you think it’s doing. If you want help auditing where your own assumed boundaries might not hold, see our how-to guides or book a discovery call.