InfoSec Briefing - October 13, 2026

🎧 Audio Briefing

Playback Speed:

This is the BlueTeamSec briefing for Tuesday the 13th of October 2026, covering what's been shared on infosec.pub.

Researchers at Modat have found over 8,500 internet-exposed systems across European renewable energy infrastructure — admin panels and control interfaces for solar parks and wind farms that really shouldn't be publicly reachable. Some are running default credentials like root, and the fragmented nature of these assets means they're often unmonitored. Given how quickly automated scanning can map this sort of thing, it's worth flagging if you've got exposure in this sector.

Okta's published analysis of 6,000 social engineering events, showing that even AI-augmented attacks still lean on traditional identity weaknesses — passwords, MFA downgrade tactics, that sort of thing. Their data suggests phishing-resistant authentication blocks 88% of account takeover attempts, rising to 99.75% when enforced at sign-in. The remaining quarter percent? Account bootstrapping phases, which is where the residual risk sits.

Over at Bloo, there's a technical write-up on eBPF-based rootkits — malware that uses kernel extended packet filter functionality to hide files and processes by manipulating what the kernel returns. These pass kernel verification, making them more stable than traditional loadable modules. Defensive guidance includes restricting the bpf system call and implementing eBPF-specific auditing. We've seen related work on this recently, including Meta's eBPF-based access control tool earlier in the month.

And finally, a technical breakdown from Ryan Benson on Facebook's fbclid tracking parameter — what's encoded in it and how that metadata can be useful for digital forensics and incident response. If you're doing threat hunting or forensic work, it's a handy reference. There are also privacy considerations flagged around GDPR and CCPA compliance for organisations logging this sort of tracking data.

That's everything for today. Attribution sits with the original article authors — the analysis here was automated as always.

📰 Articles Covered

New speed, same tricks: Defend against AI threats with security fundamentals - www.okta.com

The article outlines how AI is acting as a force multiplier for traditional cyberattack methods, particularly identity-based attacks. Despite the increased speed and sophistication of these threats, the fundamental principles of defense remain unchanged and highly effective.

### What Happened
Okta analyzed approximately 6,000 real-world social engineering events to evaluate how AI-augmented attacks exploit traditional security weaknesses. The core finding is that while attackers are utilizing AI to scale their efforts, they are still relying on established techniques like phishing to gain unauthorized access. The article posits that organizations fail when they try to react to AI at "machine speed" rather than doubling down on foundational security architecture.

### Who Is Affected
Security leaders, IT administrators, and organizations responsible for managing identity infrastructure and protecting users from account takeover (ATO) attempts.

### Security Implications
Attempting to outrun AI-driven exploitation is described as a losing battle. The true vulnerability lies in reliance on weak authentication factors (passwords, OTPs, traditional push notifications). Attackers capitalize on these weaknesses through "MFA downgrade" attacks—manipulating users into bypassing stronger security protocols. The article emphasizes that security should not rely on user vigilance but rather on "security invariants"—automated, machine-enforceable policies that fundamentally shrink the attack surface.

### Technical Details
Okta’s analysis quantified the effectiveness of various security controls:

* **Phishing Resistance Performance:**
* Mandatory enrollment in phishing-resistant factors blocked **88%** of ATO attempts.
* Enforcing phishing resistance directly in application sign-in policies increased this effectiveness to **99.75%**.
* **The Bootstrapping Gap:** The remaining **0.25%** of successful compromises occurred during the account bootstrapping phase—when a user is first setting up or verifying their identity.
* **Account Management Policies (AMPs):** To bridge the gap and achieve near-total protection, phishing resistance must extend beyond standard login flows to Account Management Policies. Effective AMP controls include:
* Requiring phishing-resistant factors to authorize the addition of new authentication methods.
* Restricting changes to managed devices or trusted networks.
* Integrating third-party Identity Verification (IdV) services for sensitive account modifications.

### What Defenders Should Know
To effectively defend against AI-augmented threats, security teams should focus on the following strategic shifts:

* **Implement Security Invariants:** Shift the burden of security away from the end user by enforcing machine-based policies that eliminate dangerous authentication paths.
* **Tighten Account Management:** Lock down account management to prevent attackers from using an initial, compromised session to self-provision persistent, attacker-controlled authentication factors.
* **Architectural Defense:** Instead of trying to detect and respond to AI-driven speed, prioritize building robust, architectural barriers that render the speed of the attack irrelevant.
* **Mandatory Enforcement:** Ensure phishing-resistant authentication is required for both day-to-day application access and the critical administrative processes that govern account lifecycle management.
eBPF Rootkits: Analysis & Detection | Bloo - Bloo

The information provided effectively summarizes the core technical analysis of eBPF-based rootkits as described in the article. To supplement the previous precis, here are a few additional technical insights and defensive considerations mentioned in the source material:

### Additional Technical Nuances
* **The "Verified" Advantage:** Because eBPF programs pass through the kernel's internal verifier before execution, they are inherently "safe" from causing system crashes (e.g., infinite loops or null pointer dereferences). This stability makes them significantly more reliable for attackers than traditional LKMs, which, if poorly written, can easily trigger a Kernel Panic.
* **Contextual Manipulation:** Beyond simply hiding files or processes, these rootkits can manipulate the return values of functions in real-time. By hooking into functions like `getdents64`, the rootkit can filter entries out of directory listings *as the data is being passed from the kernel to userspace*, ensuring that standard administrative tools like `ls` or `ps` never see the malicious files or processes.

### Further Defensive Best Practices
In addition to the points already raised, defenders should be aware of the following:

* **Restricting Capabilities:** The most effective defense is reducing the attack surface by limiting access to the `bpf()` system call. In high-security environments, it is recommended to set the `kernel.unprivileged_bpf_disabled` sysctl to `1` (via `/etc/sysctl.conf`). This prevents unprivileged users from loading eBPF programs, forcing an attacker to first perform a privilege escalation to gain the required `CAP_BPF` or `CAP_SYS_ADMIN` capabilities.
* **Tracing and Observability:** Modern security observability tools are increasingly integrating eBPF-specific auditing. Defenders should look for tools that log the *intent* of loaded BPF programs—such as which kernel functions they are hooking and which helper functions they invoke—rather than just monitoring the existence of the programs themselves.
* **Automated Baseline Verification:** Since `bpftool` produces a static program "tag" (a SHA-1 hash of the bytecode) for every loaded program, enterprises should consider implementing automated scripts that compare these tags against a library of "known good" BPF programs used by the legitimate observability, networking, and security agents running on their servers. Any program with an unrecognized tag should be treated as suspicious.
Decoding Facebook's fbclid - Ryan Benson

The provided summary accurately encapsulates the key findings from the article regarding the `fbclid` parameter. Since you already have the essential details from the document, no further research is required.

To ensure you have a complete understanding, it is worth noting that while the `fbclid` contains valuable metadata for forensic analysis, defenders should also remain aware of privacy considerations. Because these parameters act as persistent tracking identifiers that follow users from social platforms to third-party websites, they may be subject to data privacy regulations (such as GDPR or CCPA). Organizations should assess whether logging and analyzing this data complies with their internal privacy policies and local legal requirements.
Research Shows More Than 8,500 Exposed Systems in Europe’s Wind and Solar Parks - Modat

This precis summarizes research conducted by Modat regarding the cybersecurity posture of renewable energy infrastructure in Europe.

### What Happened
Researchers from Modat identified at least 8,547 internet-facing systems associated with European solar parks and wind farms that should not be reachable from the public internet 【1】. Using machine-learning-based clustering techniques, they mapped these assets across 40 countries, finding vulnerable systems in 35 of them 【1】. This figure is considered a lower bound, as it only accounts for systems definitively linked to specific parks, excluding many other similar but currently unattributed devices 【1】.

### Who is Affected
The research covered the EU, EFTA, and candidate states. The geographical distribution of these exposed systems is as follows:
* **Solar:** 7,942 systems in 34 countries. Spain, Greece, Italy, and Germany account for 76% of these 【1】.
* **Wind:** 605 systems in 23 countries. Germany and Italy account for 67% of these 【1】.

Modat is not publicly disclosing specific names, operators, or IP addresses; instead, they are working through national Computer Emergency Response Teams (CERTs) to notify affected parties 【1】.

### Security Implications and Technical Details
The exposed systems include admin interfaces and web-based control panels. Researchers observed that some interfaces allow for direct operational control, including "Start," "Stop," and "Reset" functions, alongside live production data and geographical mapping of assets 【1】. Some login pages were found to clearly identify the wind park they protect, and in some cases, documentation explicitly noted the use of default credentials like "root" 【1】.

The primary implication is that the fragmented and often unmonitored nature of these assets creates a significant attack surface. Because researchers could identify these systems using automated, machine-learning-driven discovery in mere hours, malicious actors can exploit the same methods to rapidly map and target these energy assets 【1】.

### What Defenders Should Know
Modat emphasizes that visibility is the foundational requirement for security; one cannot defend what they cannot see 【1】. Their recommendations for operators include:

| Recommendation | Description |
| :--- | :--- |
| **Remove Exposure** | Immediately take administrative interfaces off the public internet 【1】. |
| **Assume Breach** | Plan and monitor internal environments under the assumption that an attacker has already gained access 【1】. |
| **Secure Connectivity** | Adopt recognized operational technology (OT) security principles for all connections 【1】. |
| **Maintain Visibility** | Build comprehensive inventories of assets, architectures, and access points—including those used by third-party suppliers 【1】. |
| **Operational Planning** | Adapt standard operating procedures to be dynamic, responding to specific threat levels or trigger events, and include plans for manual OT operations 【1】. |
| **Collaboration** | Prioritize information exchange regarding intelligence and experience across the sector, both nationally and at the European level 【1】. |