Intelligence Brief: Poland Disconnects ePUAP, Police Seize 235 Servers, and United Blocks AI Agents

Poland disconnected a national government portal after stopping what its digital affairs minister calls preparation for a December attack on public administration. International police removed 235 criminal servers, United Airlines barred AI agents from acting for passengers, and fourteen governments endorsed spyware rules no vendor is obliged to follow. France blamed an Iranian state unit for supermarket sabotage claimed by Russian-aligned hacktivists. Elsewhere, old vulnerabilities reached storage devices, ransomware disabled a public library, and an emerging extortion operation discovered its own encryption was unreliable.

Poland Stops an Attack by Disconnecting ePUAP

Poland's ePUAP platform remained offline on November 13, three days after security teams detected and stopped a cyber attack. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski said the Central Information Technology Center's infrastructure remained secure. The government disconnected ePUAP as a precaution, and the Internal Security Agency (ABW) is investigating.

On November 12, Gawkowski went further. He said log analysis showed preparatory activity for an "administrative bomb" meant to paralyze public administration and its internal communication in December. He called the foreign origin confirmed, named no country or threat actor, and tied the incident to the December 2025 attack on Polish energy facilities. CERT Polska attributed that earlier attack to Static Tundra, an activity cluster linked to the FSB's Center 16, while ESET and Dragos assessed VOODOO BEAR (aka Sandworm) with moderate confidence. Two credible attributions for one incident remain unreconciled, a problem I examined in attribution as a confidence game.

The shutdown still removed a national public service. ePUAP mailboxes, embedded forms, and electronic signatures running through the platform are frozen, and administrative deadlines keep running. Poland accepted a known availability loss to deny a planned one. No telemetry has been published, so the public cannot yet measure what the intervention stopped.

Gawkowski's link to the energy attack is a claim, not published evidence. A minister has political reasons to frame a stopped intrusion as a foiled national attack, and disruption, espionage, hacktivism, and ransomware staging all fit "preparatory activity" in logs. The access method and the indicators behind the December assessment will decide which reading holds.

Operation Endgame Removes Three Routes Into Victim Networks

Operation Endgame seized or disabled 235 servers and 257 domains supporting Gootloader, CastleRAT, and StealC during actions announced on November 12. Police and private partners also cleaned Gootloader from 681 compromised web sites and recovered 6.4 million credentials belonging to more than 40,000 victims. Investigators are distributing victim data through Have I Been Pwned, Shadowserver, and national notification services. No arrests were announced, and Dutch police continue investigating Gootloader's main suspect.

Gootloader poisoned search results with fake legal documents hosted on compromised WordPress sites. The US Justice Department says it infected at least 25,000 computers since 2018 and supported ransomware attacks against at least 44 US victims, causing approximately US$28.8 million in losses. Its targets included the US Department of War and the defense industrial base. CastleRAT supplied remote control, while StealC harvested credentials and digital identities for resale and follow-on attacks.

The 681 remediated sites represent more than seized infrastructure. Each legitimate web site had become a distributor carrying criminal access into another organization. The 6.4 million credentials require separate remediation because taking a server does not invalidate what the server already collected. As I argued in an earlier analysis, police can seize the servers but not the business model.

StealC also appeared in Operation Endgame's June action and again in the late-October takedown of its hosting provider, showing how quickly the eCrime ecosystem rebuilds around surviving developers, customers, and distribution routes. Persistence will be visible in whether the malware families reappear, whether the Gootloader suspect reaches prosecution, and whether recovered credentials lead defenders to victims first.

United Airlines Rejects Authority Delegated to AI Agents

United Airlines announced restrictions on November 11 against unauthorized third-party personal AI agents booking travel through its platforms and through online travel agencies and aggregators. United identifies no incident behind the decision. It cites credential exposure, unintended account changes and MileagePlus redemptions, and federal rules requiring a person to confirm during check-in the absence of prohibited items in their baggage.

A passenger can voluntarily give an agent valid credentials without giving the agent authority United accepts. The resulting session may look legitimate to conventional identity controls because the customer supplied the password and requested the action, the same blind spot I examined when Denmark was logged into rather than hacked. United is moving the authorization boundary above authentication. Its policy asks whether the service recognizes the software acting through an account, even when the account owner invited it. Accountability for agents acting without a human criminal remains unsettled, and United is refusing to carry that risk.

Security and regulatory concerns coexist with commercial incentives. Chief executive Scott Kirby said he does not want "to create another middleman." Agentic comparison tools can weaken an airline's control over direct sales, ancillary purchases, customer data, and loyalty relationships. My investigation into the three-year Amadeus breach showed how much authority aviation has already delegated to infrastructure passengers never see. AI agents add another intermediary, this time selected by the traveler.

Fourteen Governments Ask Spyware Vendors to Police Themselves

Fourteen governments endorsed the Pall Mall Process Guidelines for Industry on November 11 at the third Pall Mall Process conference in Paris, where 43 countries were represented. The voluntary framework asks companies building, selling, and financing commercial cyber intrusion capabilities to vet customers, build safeguards against misuse, and halt sales when serious misuse is a credible risk. It creates no penalties and binds no vendor, complementing a separate Code of Practice for States. The endorsers include the United States, Japan, Germany, and Poland. Israel and India are absent, although the list does not show whether either rejected the text or simply declined to sign.

Voluntary rules can still shape a market when governments convert them into procurement requirements, export decisions, financing conditions, or contract language. The United Kingdom, France, and the United States also buy, develop, and export offensive capabilities. Their dual position gives them leverage over suppliers and creates an obvious credibility test. Standards applied only to vendors outside allied procurement systems would protect an existing market hierarchy more effectively than they protect targets.

My November 11 Intelligence Brief examined how commercial surveillance crosses into political targeting while governments preserve offensive relationships they consider useful. Pall Mall leaves the tension intact. Government tenders, export licenses, investor conditions, and vendor transparency reports will show whether the framework changes access to money and customers. Without those consequences, suppliers selling outside the fourteen endorsing states keep the same commercial incentive and gain a new vocabulary for describing themselves as responsible.

Hacktivist Claims Collide With France's Refrigeration Attribution

France attributed the October 11 and 12 sabotage of refrigeration controllers at about 700 French supermarkets to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, on November 9. France's interministerial Cyber Crisis Coordination Center cites Farsi in the attack infrastructure, Iranian IP addresses, Modbus reconnaissance of Schneider Electric equipment since April, and the unit's habitual use of the FOFA scanner. Paris prosecutors requested international arrest warrants, and Iran's foreign ministry rejected the accusation as baseless. The manipulated defrost cycles caused at least 15 fires, according to the coordination center.

Five days before the attribution, NoName057(16) and the Z-Pentest Alliance claimed the campaign in a video naming Danfoss and Dixell equipment. DomainTools assessed on November 13 the method as trivial, built on internet-exposed controllers running default passwords, and rated the hacktivist claims at low confidence because the video showed no hands-on-keyboard access. A second wave on November 1 and 2 reached retailers in at least seven more European countries, and no public evidence yet assigns it to either actor.

The French report says Shahid Kaveh operates mainly through hacktivist personas, including CyberAv3ngers and Soldiers of Solomon. A state unit posing as hacktivists and hacktivists claiming state-scale sabotage produce identical public claims, so a claim alone attributes nothing. France has published its conclusion without the forensic artifacts needed for independent verification. This builds on my earlier assessment of the refrigeration attacks, and the exposure behind them persists, with Flare identifying at least 2,667 public IP addresses exposing refrigeration management interfaces.

Queens Public Library Keeps Its Doors Open Through Ransomware

A ransomware attack disabled digital services across all 66 Queens Public Library branches beginning November 4. The branches remained physically open. By November 10, wifi and checkout machines had returned, and public computers were operating at seven locations. The web site, mobile app, digital media services, and most public computers remained unavailable. No ransomware-as-a-service operation has claimed the intrusion, and the library has disclosed no initial access method or confirmed data theft.

The physical continuity hides an unequal digital impact. Queens Public Library provides computers, printing, and internet access to people who may have no equivalent service at home. Closing those systems transfers the disruption to residents least equipped to work around it. A library can keep lending books while losing much of the infrastructure supporting employment, education, benefits, and communication.

The absence of a dedicated leak site claim leaves several possibilities, including private negotiation, encryption without data theft, or insufficient leverage beyond disruption. Patron and employee information remains an intelligence gap rather than a confirmed breach. Notification obligations, if they follow, will reveal whether the intrusion reached the people behind the library cards.

C3RB3R Turns Unpatched Storage Into the Point of Failure

Synology warned on October 29 of threat actors exploiting a vulnerability patched in December 2024 to encrypt data on devices running outdated DiskStation Manager software. The company pointed to advisory Synology-SA-24:20, which covers CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445. Synology has not identified which one supplied initial access. Assigning CVE-2024-10441 or either companion flaw as the confirmed route would exceed the public evidence.

The victims reached the same outcome regardless of the unresolved CVE. C3RB3R encrypted data stored on network-attached storage devices and demanded payment. A NAS often holds working files, shared folders, and backups inside the same management boundary. Compromising the appliance reaches the data and the recovery layer without lateral movement through every workstation, the failure I examined when Osaka's backups died in the same blast radius as its servers. Shadowserver tracks more than 380,000 internet-exposed Synology devices, an exposure figure rather than a victim count.

Under Synology's account, the campaign is easy to describe as a patching failure because fixes existed for nearly two years. The framing leaves out small offices and home users running storage appliances as unattended infrastructure. Some devices remain exposed long after their owners stop treating them as computers requiring active vulnerability management.

A competing account complicates the patching narrative. A Qihoo 360 incident report names CVE-2026-13639 and CVE-2026-13684, flaws Synology fixed in Synology-SA-26:13 only on September 18, 2026. If 360 is right, victims had weeks rather than two years to patch, and the patching-failure framing weakens considerably. Synology has not reconciled the two accounts, and neither source has published exploitation details. Defenders should treat both advisories as in scope until one route is confirmed.

HYFLOCK's Broken Encryption Can Destroy What Its Key Cannot Restore

Check Point traced four generations of HYFLOCK ransomware from April through October. The ransomware-as-a-service operation first promoted itself in underground forums on March 29 and recruited through May and June before posting eight claimed victims on October 13. Those victim listings remain unverified, and the full report found no dedicated data exfiltration workflow in any analyzed build, so any stolen-data claims would rest on separate tooling. The October 17 build encrypted files, registered a scheduled task, accessed network shares, and attempted to interfere with recovery during controlled analysis. Domain-wide propagation was not observed, and vulnerable-driver use against security tools remains unverified.

The encryption failed in two different directions. One October build could discard portions of a file, leaving complete recovery impossible even with the correct key. A later build encrypted only the first 4,096 bytes of larger files. Check Point recovered 73 valid internal components, including worksheet and shared-string data, from seven Office documents without a key, although it did not restore complete files or produce a general decryptor.

Weak ransomware does not guarantee a forgiving incident. Partial encryption can leave recoverable content, while destructive implementation errors remove data the threat actor cannot return after payment. Negotiators need the exact build and preserved samples before treating possession of a decryptor as proof of recoverability.

HYFLOCK's advertising ran ahead of its demonstrated capability. Its code still encrypted files and reached network resources, making the defects operationally dangerous rather than reassuring. A ransomware brand can exaggerate its reach and still cause permanent loss through software it has not engineered well enough to reverse.

Trellix Finds Fragmentation More Clearly Than Autonomous Crime

Trellix counted 5,505 victim posts across 124 ransomware operations between April and September, a record brand count in its data. Fifty-five operations posted victims for the first time and produced 22 percent of the total. Posts held flat against the previous six months, while the top five operations' share fell from 42.1 to 37.3 percent. The Gentlemen rose from 209 posts to 719 and overtook Qilin as the most active operation.

Trellix also describes a transition from AI assistance to delegation, the shift I tracked as cyber crime put AI on the payroll, and cites TITAN AI, a ransomware-as-a-service operation advertising automated analysis of stolen documents and regulatory exposure. The same section calls the technical framing grandiose. An underground advertisement demonstrates ambition and market positioning, and Trellix provides no incident telemetry confirming the advertised system processed victim data during an intrusion.

Trellix's architectural finding is better supported. Coding and operations agents routinely move credentials from protected stores into command lines, local files, and external model context. Those steps resemble normal work because the agent uses trusted tools. My analysis of the ARTEX breach at WorkOS documented the related problem from an incident, where an autonomous framework found a predictable credential and used it without a human directing the access.

The heaviest exploit detections still come from old internet-facing vulnerabilities, led by F5 BIG-IP CVE-2022-1388 with 1.2 million detections, echoing my finding that Microsoft's 2026 threat report is really about 2020. The eCrime ecosystem is adding faster decision systems while exploiting familiar weaknesses. I assess with high confidence fragmentation is already visible in the posting data, and with low confidence autonomous criminal execution is widespread, pending incident telemetry confirming the capabilities advertised in underground markets.

Analyst Note

These developments show different institutions exercising the control available to them. Poland removed access to a public platform. Police removed servers and domains. United withdrew permission from software acting through customer accounts. Synology shipped patches, while Queens Public Library kept physical services operating around a disabled network. The Pall Mall Process offers principles without an enforcement mechanism, and France answered a sabotage campaign with an attribution, arrest warrant requests, and a sanctions proposal.

Control remains strongest at concentrated intermediaries. Registrars can seize domains, hosting providers can remove servers, platforms can revoke credentials, and an airline can reject transactions at its own interface. The model weakens when authority disperses across unpatched appliances, independent spyware vendors, compromised web sites, and criminal brands able to replace infrastructure. Operation Endgame's repeated action against StealC captures both sides. Coordinated pressure removes capacity, while surviving participants rebuild it.

The record also separates speed from sophistication. HYFLOCK revised its ransomware quickly and still damaged files it could not restore. Trellix observed more brands and more claims of autonomy, while its strongest exploit telemetry remained concentrated on known vulnerabilities. Fast iteration lowers the cost of trying again without guaranteeing technical competence or strategic success.

Future collection should test consequences. The ePUAP access method and the evidence behind Poland's December assessment would change the first item's reading. So would any reappearance of Operation Endgame infrastructure, United's enforcement telemetry, Pall Mall procurement language, the forensic basis for France's attribution, and Queens data notifications. C3RB3R's confirmed entry vulnerability, HYFLOCK victim validation, and incident evidence for criminal autonomy remain equally valuable. Until those records emerge, the clearest advantage belongs to whoever controls the point where access can still be refused.