🔴 Gunra Ransomware Joint Advisory, 🎯 DeadLock Rust Encryptor Deep-Dive, 🎯 Abyssos RAT Emerges, ⚠️ Pass-the-Passkey MFA Bypass, 🛡️ Ghostjacking Turns Logs Into Attack Vectors, 📋 OpenAI Ships GPT-5.6-Cyber

The attack on the Polish CHP plant is the day's defining story. CERT Polska confirmed that attackers pivoted from a wind farm into the plant's OT network through a private cellular APN misconfigured to let any device reach any other, then sabotaged Siemens PLCs and shut down a steam turbine and the process-water treatment system. No malware was involved. The isolation depended entirely on client-to-client settings, and CERT Polska warns the misconfiguration is common.

The joint US-South Korea advisory on Gunra ransomware is the other headline. The operation chains FortiOS authentication bypasses to create persistent superuser accounts and bypass MFA on vulnerable Fortinet VPNs, and it has hit every sector across multiple continents. An unpatched Fortinet appliance is an initial-access chokepoint, not a network edge.

Two threads erode assumptions defenders rely on. SpecterOps published more than 20 pass-the-passkey techniques that impersonate privileged users without touching private keys, so phishing-resistant MFA is only as strong as the validation and logging around it. Separately, the water utility campaign keeps spreading, with New Jersey and Alabama joining a list that now spans at least seven states, all targeting internet-exposed PLCs.

Watchlist: private-APN client isolation hardening, Fortinet appliance patching, WebAuthn assertion validation, and any internet-facing ICS controller.