# Industrial Remote Access Credential Exposure in Infostealer Logs (601 OT Session Addresses, Cellular Router and Tunnel Platforms)

> Flare research recovered 601 distinct industrial remote access session addresses from commodity infostealer logs across four platforms (cellular router management, industrial gateway portal, hosted tunnel server, industrial router reverse proxy). 73.2% of tunnel addresses on the largest platform were stored alongside device credentials, and 96.1% of recovered usernames were administrative accounts.

- **Published:** 2026-10-24T02:01:39Z
- **Last reviewed:** 2026-10-24T02:01:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4329
- **ID:** TL-2026-4329
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Flare analyst Adrian Cheek published research on 2026-10-21 describing industrial remote access material found in commodity infostealer logs. Five Flare platform exports run on 2026-10-13 covered the hosted tunnel platform domains talk2m.com and ewon.biz, the industrial router platform domains portal.ixon.cloud and ixon.cloud, and eight combined platform terms. The data set comprised 15,101 credential entries from 2,005 distinct collection events, 375 identified infected machines, 909 normalized platform URLs and 601 session addresses that each identify an individual remote device. Only 1,279 of the 15,101 entries (8.5%) carried an attributed stealer family, and the source names no specific family or actor. Feeds included stealer-log, sample, private and live feeds across 30 distinct Flare source feeds.

The core weakness is that remote access routes are embedded in URLs as bearer-style identifiers: 511 distinct 32-character hexadecimal labels, 59 thirty-character alphanumeric labels, 20 pairs of 8-character hexadecimal components, and 3 forty-character labels. Where a session address is stored by a browser, it is stolen together with the login: 374 of 511 tunnel addresses were associated with a stored credential for the device interface, and 1,952 of 2,032 usernames (96.1%) were administrative accounts. URL paths also leak the customer account name, machine name, forwarded protocol and port (38 distinct), and in 76 entries the private (RFC 1918) address of the target inside the plant, with 7 distinct internal addresses. Flare also found 55 account-level tokens in URL paths: 45 invitation-acceptance tokens, 3 password-reset tokens on one platform, 6 reset tokens on the cellular router platform, 7 router configurator identifiers and 1 Android mobile application token.

Persistence and concentration: 464 addresses were seen on multiple collection dates with a median interval of 51 days (mean 56, maximum 1,005); 46 exceeded 90 days, 10 exceeded 180 days and 2 exceeded one year. Exposure concentrates on contractor and integrator machines: 46 machines held one address, 41 held 2-9, 40 held 10-49, and 3 machines held 167 addresses each (South America, July-September 2026). Account sectors by Flare's interpretive attribution: manufacturing (28 accounts), food, beverage and cold chain (9), energy and power (8), water and wastewater (5), vendor/integrator demo (2). Machines were located in South America, Western, Southern and Central Europe, North America and East Asia.

Relationship to the October 2026 French refrigeration incident: 24 collection events held both remote access artifacts and refrigeration vendor credentials (20 distinct refrigeration vendor hosts; Danfoss, Copeland and Dixell referenced). One machine held 10 cellular router tunnel addresses and credentials for three separate supermarket refrigeration control platforms; one related infection dates to June 2026. CERT-FR alert CERTFR-2026-ALE-012 (2026-10-12/13) concerned targeted refrigeration controllers (Copeland xweb, Danfoss AK-SC, Danfoss AK-SM, Dixell xweb) with no CVE, firmware version or initial access route disclosed. Flare rates any contribution of this material to that attack as LOW confidence; it states it does not name any targeted organization.

Limitations stated by the source: every count is a floor; address validity was not tested; no platform was logged into, no tunnel opened, no token tested and no industrial device contacted; sector attribution is interpretive; infection dates come from unverified stealer-log data; platform coverage reflects infection patterns rather than comparative exposure. No IOCs were published (withheld per Flare's disclosure methodology), so IOCs in this record are platform-level and structural patterns only. BeaconBeagle correlation was not applicable because no IP addresses were published. The report carries no CVE or CVSS; severity is analyst-assigned.

## MITRE ATT&CK

- T1589.001 Credentials
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1078 Valid Accounts
- T1133 External Remote Services
- T1021 Remote Services
- T0859 Valid Accounts

## Sources

- [Industrial Remote Access Credential Exposure in Stealer Logs (Flare, Adrian Cheek)](https://flare.io/learn/resources/blog/industrial-remote-access-credential-exposure)
- [CERT Polska Energy Sector Incident Report 2025](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf)
- [CERT Polska: Incident report, energy sector 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [CERT Polska Energy Sector Incident Follow up Report 2025](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025.pdf)
- [CERT Polska: Incident follow-up report, energy sector 2025](https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/)
- [BleepingComputer: Hackers breached a small Polish energy plant via private APN](https://bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year)
- [2025 cyberattack on Polish power grid (Wikipedia)](https://en.wikipedia.org/wiki/2025_cyberattack_on_Polish_power_grid)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4329