F5 Reports Persistent Access and Data Theft as Hosts Discuss OT Security and Forced Patching

Summary

The hosts discuss pro-Russia hackers who mistook a For Scout honeypot for a Dutch water facility, F5 Networks’ report of persistent access and exfiltrated source code and undisclosed-vulnerability information, and the risks of forced patching.

Key points

• A pro-Russia hacker group thought it had breached a Dutch water facility, but the hosts say it was a For Scout honeypot; the hackers defaced its login page and changed configurations.
• F5 Networks said a sophisticated, unnamed nation-state actor maintained persistent access and exfiltrated source code and information about undisclosed vulnerabilities.
• The hosts say an emergency directive urged government agencies to patch, but the transcript identifies the issuing organization as “CIS.”
• The hosts report that former Disney World employee Michael Shyer altered menu information, including allergen details, and launched DDoS attacks against employee accounts; they say he received a four-year jail sentence and describe the fines uncertainly.
• The DDoS segment contains conflicting figures: it calls 6 terabits per second a new record while also saying the previous record was 29.6 terabits per second.
• The hosts debate forced patching, distinguishing consumer software updates from updates to vehicles and other critical systems where a failed patch could cause disruption.

MITRE ATT&CK

Threat Actors

Vendors

Related Articles

• VulnCheck Reports PHP2Shell ASLR Bypass as Mirai Exploitation Attempts Emergesecurityweek.comT1498
• PHP2Shell Exploit Attempts Reach Millions, but No In-the-Wild RCE Reportedthehackernews.comT1498
• Armis 2026 Cyberwarfare Report Highlights Gaps Between Security Confidence and Readinessgithub.com/jacobdjwilsonT1498
• Dataminr’s 2026 Threat Report Highlights Identity Attacks and Larger Cyber Lossesgithub.com/jacobdjwilsonT1498
• ENISA Threat Landscape 2026: DDoS Dominates Recorded EU Cyber Incidentsgithub.com/jacobdjwilsonT1498