Weekly Security Roundup: Supermarket Attacks, Ransomware and Major Patches
Summary
This roundup covers supermarket cyberattacks, a ransomware disruption at a Japanese logistics provider, malware targeting AI coding credentials and Android banking apps, major Microsoft and Palo Alto patches, and law-enforcement actions.
Key points
- French authorities expanded warnings about refrigeration controllers after an attack disrupted systems at hundreds of supermarkets; the method and responsible party remain unknown.
- Ahold Delhaize said Albert Heijn deliveries resumed after a cybersecurity incident disrupted logistics; the company said it had no indication customer data was stolen.
- A ransomware attack on cloud provider IDC Frontier disrupted operations at Nissui Logistics’ 17 facilities. Nissui said affected servers held no personal or customer information managed by the group.
- Symantec reported that the Aoki infostealer targets credentials and session files for AI coding assistants, alongside data from browsers, wallets and other applications.
- Researchers said the Hirudo Android banking trojan targets eight Indonesian banking apps and can steal credentials and remotely control infected devices.
- Microsoft issued updates for 1,413 vulnerabilities, including an actively exploited Windows Shell flaw; Palo Alto Networks also patched an actively targeted PAN-OS flaw.
- Authorities announced actions against alleged North Korean remote-worker schemes and arrested a suspect accused of operating the OLVX cybercrime marketplace.
Article Details
- Event Type
- Weekly roundup of cybersecurity incidents, breaches, active exploitation, malware activity, law-enforcement actions, and security updates.
- Impact
- Incidents disrupted supermarket refrigeration and grocery logistics, halted cold-chain shipments, and affected businesses and government networks. Reported threats also included theft of credentials and personal data, ransomware, spyware abuse, and actively exploited vulnerabilities. Some financial and operational impacts remain undisclosed or uncertain.
MITRE ATT&CK
CVE
CVE-2026-0322The remote code execution vulnerability, assigned CVE-2026-0322 "enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall," Palo Alto said.CVE-2026-108398CVE-2026-108398 affects the .NET Framework and could allow an authenticated attacker to bypass Windows Defender Application Control restrictions and execute unauthorized code within a protected process.CVE-2026-92707CVE-2026-92707 is a denial-of-service vulnerability in MessagePack-CSharp.CVE-2026-96951The actively exploited vulnerability, tracked as CVE-2026-96951, carries a CVSS score of 8.8.
People
Brigid O GormanSymantec senior intelligence analyst who said researchers had not observed downstream activity from Aoki and lacked insight into the number of victims.Claudia PlattnerPresident of Germany's Federal Office for Information Security; warned that similar attacks could happen in any country.Donald TuskPolish Prime Minister who said documents confirmed the previous government illegally used Pegasus against individuals including political opponents and journalists.E.A.Initials used by authorities for the 20-year-old accused of operating the OLVX cybercrime marketplace.Kevin BeaumontCybersecurity researcher and former Microsoft employee who commented on Microsoft's vulnerability disclosures and investment in remediation.Krzysztof BrejzaPolish opposition politician targeted by Pegasus in 2019, according to the Senate commission investigation.Roland LescureFrench Finance Minister who described the supermarket attack as a wake-up call and said it posed no immediate risk to national food supplies.
Threat Actors
Malware
Aokirestored deliveries, a North Korean IT worker crackdown, a Japanese seafood logistics ransomware attack, Aoki infostealer targeted coding assistant credentials, Hirudo banking Trojan, Palo Alto patch,AokigaharaThe newest version of the Aoki or Aokigahara infostealer targets Anthropic's Claude, OpenAI's Codex, Anysphere's Cursor, Windsurf's Codeium and Google's Gemini, said security firm Symantec.Hirudoa Japanese seafood logistics ransomware attack, Aoki infostealer targeted coding assistant credentials, Hirudo banking Trojan, Palo Alto patch, Kazakhstan-linked hackers targeted a Russian oil refinery, PolandPegasusTrojan, Palo Alto patch, Kazakhstan-linked hackers targeted a Russian oil refinery, Poland investigated Pegasus and a suspected cybercrime marketplace admin arrested in North Macedonia.
Vendors
Copelandcyberattack that disrupted refrigeration systems at hundreds of supermarkets, adding controllers made by Copeland and its Dixell brand to the equipment under scrutiny.DanfossThe French agency ANSSI's expanded warning covers Copeland XWEB and Dixell XWEB refrigeration controllers, in addition to systems from Danish manufacturer Danfoss.IDC Frontier7 after a third party gained unauthorized access to a data center run by IDC Frontier, a cloud and data center provider owned by SoftBank Corp.MicrosoftMicrosoft Patches Record 1,413 VulnerabilitiesPalo Alto NetworksPalo Alto Networks published a fix for a zero-day flaw being actively targeted by attackers in the PAN-OS software that runs its firewalls and security appliances.SymantecThe newest version of the Aoki or Aokigahara infostealer targets Anthropic's Claude, OpenAI's Codex, Anysphere's Cursor, Windsurf's Codeium and Google's Gemini, said security firm Symantec.ThreatFabricDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.
Products
.NET FrameworkCVE-2026-108398 affects the .NET Framework and could allow an authenticated attacker to bypass Windows Defender Application Control restrictions and execute unauthorized code within a protected process.Copeland XWEBThe French agency ANSSI's expanded warning covers Copeland XWEB and Dixell XWEB refrigeration controllers, in addition to systems from Danish manufacturer Danfoss.Danfoss StoreViewInternet intelligence firm Censys identified 2,991 internet-exposed Danfoss StoreView control panels on Sunday, including 1,825 in France.Dixell XWEBThe French agency ANSSI's expanded warning covers Copeland XWEB and Dixell XWEB refrigeration controllers, in addition to systems from Danish manufacturer Danfoss.MessagePack-CSharpCVE-2026-92707 is a denial-of-service vulnerability in MessagePack-CSharp.PA-SeriesThe vulnerable PAN-OS software runs on Palo Alto's PA-Series and VM-Series firewalls as well as on its Panorama virtual and M-Series devices.PAN-OSPalo Alto Networks published a fix for a zero-day flaw being actively targeted by attackers in the PAN-OS software that runs its firewalls and security appliances.PanoramaThe vulnerable PAN-OS software runs on Palo Alto's PA-Series and VM-Series firewalls as well as on its Panorama virtual and M-Series devices.VM-SeriesThe vulnerable PAN-OS software runs on Palo Alto's PA-Series and VM-Series firewalls as well as on its Panorama virtual and M-Series devices.Windows Defender Application ControlCVE-2026-108398 affects the .NET Framework and could allow an authenticated attacker to bypass Windows Defender Application Control restrictions and execute unauthorized code within a protected process.Windows ShellMicrosoft released security updates addressing a record 1,413 vulnerabilities across its software portfolio, including a Windows Shell flaw that the company said is being actively exploited.
Tools
Countries
BelarusA Belarusian government agency was also apparently compromised ahead of an April meeting between diplomats from Belarus and Kazakhstan.ChinaThe other defendants include China-based individuals.FranceFrance's cybersecurity agency has expanded its warning over a cyberattack that disrupted refrigeration systems at hundreds of supermarkets, adding controllers made by Copeland and its Dixell brand to the equipment underGermanyGermany's Federal Office for Information Security warned of potential copycat attacks, BSI President Claudia Plattner said the incident could happen in any country.IndiaDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.IndonesiaDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.JapanIDC Frontier separately disclosed that it underwent a ransomware attack by a third party on its IDCF Cloud East Japan Region 1.Kazakhstanattack, Aoki infostealer targeted coding assistant credentials, Hirudo banking Trojan, Palo Alto patch, Kazakhstan-linked hackers targeted a Russian oil refinery, Poland investigated Pegasus and a suspected cybercrimeMexicoDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.MoroccoDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.North Macedoniaoil refinery, Poland investigated Pegasus and a suspected cybercrime marketplace admin arrested in North Macedonia.PolandHirudo banking Trojan, Palo Alto patch, Kazakhstan-linked hackers targeted a Russian oil refinery, Poland investigated Pegasus and a suspected cybercrime marketplace admin arrested in North Macedonia.RussiaThe group, dubbed Silent Lynx, targeted the Orsk Oil Refinery in southern Russia and the government network of Nizhny Novgorod, a city about 425 kilometers east of Moscow, researchers from Cisco and cybersecurity firmTajikistanThey found evidence of a compromise at a Tajik government agency during Kazakhstan's ratification of a treaty with Tajikistan in early 2026.ThailandDutch mobile security firm ThreatFabric identified Hirudo targeting eight Indonesian banking apps, with credential theft operations spanning Indonesia, China, India, Mexico, Morocco and Thailand.
Industries
communicationsProsecutors said the scam affected employers in healthcare, communications, cybersecurity support, retail and manufacturing sectors across Ohio, 16 other states and the District of Columbia.Food processingA cyberattack on a Japanese cloud provider halted inbound and outbound shipments at all 17 facilities operated by Nissui Logistics, the cold-chain subsidiary of Tokyo-based seafood and food processing giant Nissui Corp.HealthcareProsecutors said the scam affected employers in healthcare, communications, cybersecurity support, retail and manufacturing sectors across Ohio, 16 other states and the District of Columbia.logisticsattack, Ahold Delhaize restored deliveries, a North Korean IT worker crackdown, a Japanese seafood logistics ransomware attack, Aoki infostealer targeted coding assistant credentials, Hirudo banking Trojan, PaloManufacturingProsecutors said the scam affected employers in healthcare, communications, cybersecurity support, retail and manufacturing sectors across Ohio, 16 other states and the District of Columbia.RetailProsecutors said the scam affected employers in healthcare, communications, cybersecurity support, retail and manufacturing sectors across Ohio, 16 other states and the District of Columbia.