Daily Briefing for 08.11.26

Top stories.

1. Poland’s CERT describes winter cyberattack against heat-and-power plant.
2. US and South Korea warn of "Gunra" ransomware gang with North Korean ties.
3. Chinese IP connections spark security review in UK Navy drones.

Poland’s CERT describes winter cyberattack against heat-and-power plant.

Poland’s Computer Emergency Response Team has disclosed that hackers breached a Polish combined heat-and-power plant by exploiting a misconfigured private Access Point Name (APN) network, BleepingComputer reports. The attackers initially compromised a wind farm's firewall, then tunneled into the shared APN to locate an exposed controller at the power plant, secured only by default credentials. They used this access to get into the plant's OT network, temporarily shutting down a steam turbine and water treatment system. Polish authorities quickly restored the systems before there was any impact to the public, but said this marks the first known real-world cyberattack using a private APN for lateral movement into an OT network.

The attack took place on December 29th, 2025, the same day that hackers tied to Russia’s Electrum APT targeted dozens of heat and power facilities across Poland. Though the attacks failed to cause significant disruptions, experts emphasized that the hackers tried to cut off heat from civilian populations in the dead of winter.

US and South Korea warn of "Gunra" ransomware gang with North Korean ties.

US and South Korean cybersecurity agencies have issued a joint alert regarding “Gunra,” an expanding ransomware-as-a-service group targeting critical infrastructure sectors globally. Built on leaked Conti ransomware code, Gunra has been recruiting ethical hackers and penetration testers to serve as initial access brokers in exchange for a cut of the ransom profits.

Notably, researchers have found overlaps between Gunra's operations and those of North Korean state-sponsored hackers, suggesting collaboration or shared infrastructure between the cybercriminal gang and nation-state actors.

Chinese IP connections spark security review in UK Navy drones.

A UK cybersecurity assessment found that cameras aboard Royal Navy drone boats were contacting Chinese IP addresses, the Register reports. The issues were discovered in cameras on Kraken Unmanned Surface Vessel sub-systems, and involved non-sensitive "heartbeat communications" rather than operational imagery or sensitive intelligence.

The UK’s Ministry of Defence disconnected the cameras from the internet, and emphasized that no classified systems were breached. Still, the discovery has heightened ongoing security concerns about Chinese-made components embedded in Western military hardware.