Security Research for the Community

Between October and November 2026, attackers manipulated refrigeration controllers at hundreds of supermarkets in France and across Europe, spoiling food and even targeting blood-service cold storage. This assessment examines how default credentials and internet-exposed Danfoss and Dixell systems made the attacks possible. It also weighs the competing attribution claims, from NoName057(16) and Z-Pentest to France’s formal attribution to Iran’s IRGC Shahid Kaveh unit, and lists the defenses operators should apply now.

A network of online personas operating as MrHex has grown from a small stolen-data marketplace into an Iran-aligned hack-and-leak operation that openly calls Handala its “brothers.” Our analysis traces the group’s infrastructure from JokerData to mrhex[.]sbs, maps the roles of MrDarkRoot, Darku3er, and @Mr8ex, and assesses its September 2026 claims of attacks on US industrial facilities. Video evidence points to real access to at least one petroleum HMI, but the group’s claims of explosions and contamination remain unverified.

A darknet data leak from the Russian research institute Spetsvuzavtomatika (SVA) has exposed an extensive cyber development ecosystem serving Russia’s Foreign Intelligence Service (SVR). The leaked Git repositories, project specs, and technical reports reveal a sophisticated, modular research and development model focused on automating key phases of espionage—from cloud-agent command-and-control (Initiative-24) and automated target reconnaissance (Felix-23, HAD) to internal domain exploitation (Putnik) and anonymous infrastructure procurement (Chain-24).