Articles
Purple-team notes and product updates from the Arsenal team.
LLM Mixers and Agent Frameworks: When Aggregation Itself Is the Attack Surface
Google's new LLMjacking research describes an underground resale tier that aggregates stolen enterprise AI access and rents it out, while a separate report ties an open-source multi-agent framework to automated attacks on 200-plus organisations. Both cases put the aggregation layer — not the model or the exploit — at the centre of the intrusion.
Read →
Supermarket freezers, NAS boxes and a poisoned update channel: the exposed management plane
A second wave of attacks on European supermarket refrigeration controls, C3RB3R ransomware on outdated Synology DSM builds and a hijacked cPGuard update channel share one property: everything the attacker needed was reachable, stale, or trusted by default.
Read →
Europe's Fridge Attacks Show the Cost of Internet-Exposed Controllers
A second wave of refrigeration attacks hit supermarkets across at least nine European countries, while attackers are also actively exploiting a 10.0-rated Siemens IoT gateway flaw and pushing C3RB3R ransomware onto outdated Synology NAS devices. The common thread is unmanaged, internet-reachable management interfaces.
Read →Europe's Freezer Attacks and the NAS Ransomware Wave Share One Root Cause
A second wave of attacks on supermarket refrigeration controllers hit at least ten European countries, while Synology battles C3RB3R ransomware on outdated NAS firmware. Both campaigns succeeded where internet exposure, default credentials and end-of-life firmware met thin telemetry.
Read →
Same Failure Mode, Three Victims: Internet-Exposed OT, Unpatched Firmware, and a Ransomware Crew
A second wave of refrigeration attacks hit European supermarkets, Siemens confirmed active exploitation of a CVSS 10.0 Node-RED flaw, and C3RB3R is encrypting Synology NAS boxes via a 2024 patch gap. All three trace back to internet-reachable devices running firmware nobody owns anymore.
Read →ENISA 2026: ransomware still pays—and supply chains multiply blast radius
ENISA’s 2026 landscape: financially motivated activity, ransomware, and supply-chain blast radius—with concrete purple scenarios for European operators.
Read →DORA’s first full year: 3,383 major ICT incidents across EU finance
ESAs’ 2025 aggregated report: 3,383 major ICT incidents, cross-border spillover, and third-party concentration—with a practical read on what financial purple teams should rehearse.
Read →NIS2 meets reality: why incident counts jumped in Belgium
CCB figures show 635 notifications in 2025—account takeover and phishing still dominate, with ransomware impact rising. This piece walks reporting drivers, sector patterns, and what to prove in purple runs.
Read →