Threat Analysis: APT29 Mobile Watering Holes, the Refrigerator Botnet, and What Q3 2026's Email Numbers Mean for UK SMBs
This is your Daily Threat Analysis for the 6th of November 2026.
Three items today. The first involves a nation-state actor running active mobile exploitation infrastructure that has a confirmed UK footprint. The second involves internet-exposed industrial refrigeration equipment being conscripted into spam botnets, which sounds absurd until you think about who operates that equipment and what network it sits on. The third is Microsoft’s Q3 2026 email threat landscape report, which should be required reading for anyone who last reviewed their email filtering before the summer.
None of these are theoretical. All three are active.
APT29 Is Running Mobile Watering Holes, and One of the Lures Was a UK Hotel Site
Sekoia’s Threat Detection and Research team has published analysis of a large-scale watering hole campaign they attribute to APT29, the threat actor widely assessed to be Russia’s Foreign Intelligence Service operating in the cyber domain. The campaign, which Sekoia has named Poisoned Source, employs three distinct infection vectors.
The first is straightforward compromise of legitimate websites. The second involves adversary-in-the-middle-style impersonation of high-profile domains. The third, and the one that matters most from a supply chain and UK relevance perspective, is a compromise of the Plerdy analytics service, a Ukrainian provider whose tracking scripts appear on a significant number of websites. When you compromise the analytics provider, you get code execution on every site running their script. You do not need to compromise each target individually.
The injected JavaScript profiles the browser and device before doing anything else. If you are not on a mobile device running iOS or Android, you get nothing. If you are, you receive platform-specific exploit chains targeting n-day vulnerabilities. The iOS chain references CVE-2025-14174, CVE-2025-24201, CVE-2025-27038, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700, and CVE-2026-3910 among others. The Android chain is comparable in scope.
The phrase “n-day” is doing a lot of work here. These are not zero-days. They are vulnerabilities for which patches exist. The campaign is betting, correctly, based on observed patch rates, that a substantial proportion of devices have not been updated. If you have not enforced mobile device management policies that require current OS versions, you are in that category.
The UK relevance is not implied. Ars Technica’s coverage of the same campaign, drawing on research that overlaps with the Sekoia analysis, notes that one of the impersonated sites was a luxury UK hotel website near sensitive government institutions, a site that was visited by Ukrainian President Zelenskyy. That is a specific, deliberate targeting decision. The attackers are not running broad spray campaigns; they are identifying locations of interest, impersonating or compromising the digital presence of those locations, and waiting for high-value visitors to browse from their phones.
The operational implication for UK SMBs is not that your staff are going to be confused with Ukrainian heads of state. It is that watering hole infrastructure does not discriminate cleanly. If a compromised or impersonated site is in the browsing habits of your staff, a hotel, a supplier’s website, a local news outlet, the exploit chain will probe their device regardless of who they are. And if CVE-2025-27038 or CVE-2026-3910 is unpatched on their work phone, it will find purchase.
What to do:
- Enforce current iOS and Android versions across all devices with access to business systems. If you do not have mobile device management in place, this is the moment to evaluate it.
- Treat mobile browsers as an equivalent attack surface to desktop browsers. They are not safer by default.
- If your business uses a web analytics provider, ask your IT support who that provider is and whether there have been any supply chain security notices from them recently.
Supermarket Refrigerators Are Running Spam Infrastructure. This Is Not a Joke.
SecurityScorecard’s STRIKE Team has published research on what they are calling the Refrigerator Botnet, nine IP addresses operating as SMTP botnet nodes, three of which have been confirmed as Dixell/Copeland XWEB PRO refrigeration controllers. These are the management panels used for commercial refrigeration systems in supermarkets and cold storage facilities.
The vulnerability being exploited is CVE-2026-25085. The devices are internet-facing, unpatched, and apparently have been for long enough that someone has set them up as abuse infrastructure. The STRIKE Team also references CVE-2026-109618 and CVE-2026-109619 in connection with this campaign.
Let me be clear about what is happening here. A threat actor has identified industrial control systems that are exposed to the internet, exploited known vulnerabilities in those systems, and is now routing spam through them. The refrigerators are sending email on someone else’s behalf. The operators of those facilities almost certainly do not know.
The immediate question is whether this affects you directly. If you operate supermarket or cold storage facilities with Dixell or Copeland XWEB PRO systems, the answer is potentially yes, check whether those panels have internet exposure and when they were last patched. If you do not operate such facilities, the question becomes one of supply chain: who provides your cold storage, your food suppliers’ cold storage, the facilities your managed service provider might share? In every case, the network that hosts an unpatched refrigeration controller is a network that has been accessed by a threat actor. The refrigerators are not the ceiling of their ambition.
There is a broader point here about operational technology and internet exposure. The NCSC has published guidance on securing internet-facing industrial control systems. The fact that in November 2026 we have refrigeration controllers being used as spam nodes tells you everything you need to know about how seriously that guidance has been applied by the businesses responsible for these systems.
This is also not an isolated phenomenon. The ClingSTUN Linux backdoor campaign, also active currently, exploits a broad range of CVEs in internet-facing IoT and embedded devices to build proxy botnet infrastructure. The pattern is consistent: exposed devices, known vulnerabilities, opportunistic exploitation, and conscription into abuse infrastructure. The device type is almost incidental.
What to do:
- If your business operates any internet-facing industrial or operational technology, HVAC, refrigeration, access control, building management systems, treat those as security assets requiring the same patch discipline as your servers and workstations. They are not.
- Ask your facilities manager or property team what management systems are internet-facing. They will often not know. The answer matters.
- If you are an MSP or IT provider for businesses in food retail, cold storage, or facilities management, this is a conversation you need to initiate with your clients.
Q3 2026 Email Threat Landscape: 7.3 Billion Threats, and SVG Attachments Are the New Delivery Vehicle
Microsoft published its Q3 2026 email threat landscape report on the 5th of November. The headline figure is 7.3 billion email-based phishing threats detected across July, August, and September 2026. September alone accounted for nearly 3 billion, a 41% increase from August.
That is the volume number. The technique numbers are what matter operationally.
QR code phishing, which dominated the threat landscape through much of 2025 and into early 2026, has declined sharply. The working hypothesis is that email filtering vendors have caught up with QR code detection. What has replaced it is CAPTCHA-gated attacks delivered via SVG attachments. SVG files, Scalable Vector Graphics, an XML-based image format, can embed JavaScript. When a victim opens an SVG attachment in a browser, that JavaScript can execute and redirect to a phishing page, often with a CAPTCHA prompt to add perceived legitimacy and evade automated scanning.
Most email filtering solutions were not configured to treat SVG files as potentially executable content. The attackers found that gap and have been driving through it since mid-2026. The Microsoft report notes this as a significant trend across the quarter.
The report also covers domain spoofing affecting a substantial number of organisations, Microsoft Teams-based social engineering, and persistent Agent Tesla campaigns. The Teams-based social engineering is worth noting separately: it involves threat actors contacting targets through Teams from external or compromised accounts, impersonating IT support or vendors. If your Teams environment allows external messaging without restriction, that is a configuration choice worth reviewing.
The XLoader campaign documented by Morphisec today fits squarely into this landscape. The attack chain begins with a business-themed email, order confirmation or payment request, containing a RAR archive. The archive holds an obfuscated JScript file. When executed, it deploys an x86 LuaJIT interpreter and a Lua loader, which then decodes and injects a payload. It is a layered chain specifically designed to avoid detection at the email gateway and at endpoint. The business-themed lure is deliberate: the volume of legitimate order confirmations and payment requests that pass through UK SMB email accounts every day provides effective cover.
What to do:
- If your email gateway does not currently block or sandbox SVG attachments, raise that with your IT provider today. It should be.
- Review your Microsoft Teams external communication settings. If you do not have a business need for unrestricted external messaging, disable it or require explicit approval.
- Train staff that RAR and ZIP archives arriving with business-themed lures, invoices, order confirmations, payment requests, are a current delivery mechanism for malware. The lure is designed to look routine.
- If your email filtering configuration has not been reviewed since before Q2 2026, it has not been reviewed since the SVG attachment technique became prevalent. That review is overdue.
A Note on DigiCert
DigiCert has disclosed a 16-month security lapse in which a botched server migration left customer information exposed and accessible. The breach was not discovered for 16 months. DigiCert is one of the world’s largest certificate authorities. If your business uses TLS certificates issued by DigiCert, or if your hosting or managed service provider does, you should be reading the DigiCert disclosure and asking whether your certificate data or customer information was within scope.
The specific details of what was exposed are still emerging. What is not ambiguous is the gap: 16 months between the door being left open and the discovery that someone had walked through it. That is not unusual. It is, in fact, consistent with the median dwell time figures that breach investigations have been reporting for years. Organisations find out they have been compromised long after the fact. The question is what your contracts and your SLAs require your providers to tell you, and when.
If the Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it on to someone who could use the heads-up. The people who most need this information are usually the ones not looking for it.