Provider of Attack Surface Discovery (ASD), Attack Surface Management (ASM) and CTI solutions. Scanning at Internet-scale since 2017 - contact at onyphe dot io

France
Joined March 2016
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
Je vais jouer les chagrins comme il se doit... @onyphe voit +6K systèmes Danfoss exposés sur Internet, donc la moitié en 🇫🇷 Danfoss revendique +50k installations 🌍 Ça suggère à minima que certains arrivent à éviter l'exposition directe en ligne, non ? 🤷‍♂️
Cyberattaque J+1 Au lendemain de la cyberattaque qui a touché les installations frigorifiques de plusieurs enseignes de la grande distribution, je souhaite revenir sur les faits et faire un premier point de situation concernant nos magasins @cooperativeu. 80 magasins de notre réseau ont été touchés, sur près de 2 000 points de vente. Dans la grande majorité des cas, la réactivité de nos équipes a permis de contrer l'attaque et d'éviter toute rupture de la chaîne du froid. Dans les magasins où cela n'a pas été possible, les produits concernés, ayant subi une rupture du froid, ont été immédiatement retirés de la vente et détruits. Notre priorité absolue reste la sécurité alimentaire de nos clients. Je tiens à saluer l'engagement exceptionnel de nos associés U, de nos collaborateurs et des professionnels du froid, mobilisés depuis les premières heures pour protéger nos clients et rétablir la situation. Je souhaite également rappeler un point important : nos installations frigorifiques sont connectées à Internet pour permettre une surveillance des températures à distance, de jour comme de nuit, et une intervention rapide en cas d'anomalie. C'est un dispositif essentiel à la bonne conservation des produits alimentaires. Une enquête devra permettre de faire toute la lumière sur les circonstances de cette cyberattaque. S'attaquer à des équipements essentiels à la conservation des produits frais, c'est s'attaquer à la chaîne d'approvisionnement alimentaire des Français. C'est inédit, gravissime et inacceptable. Nous restons pleinement mobilisés.
3
7
1
18
5,518
The ZA result is based on a single honeypot.
1
1
2
80
You should read our article below for some figures: blog.onyphe.io/en/refrigerat…
‼️ Attackers forced fridges into defrost at hundreds of French supermarkets. Some reached 50°C, and stores threw out food. » Danfoss refrigeration controllers compromised. » Intermarché, Carrefour and other French chains hit. » Initial access method remains unknown. Details → thehackernews.com/2026/10/at…
2
326
👀 Was the cyberattack against refrigeration systems at several French supermarket chains specifically targeting France? 💥 On more than 6,000 exposed @Danfoss instances, nearly 50% were located in France. Cc @IntCyberDigest 👉 Read our full analysis: blog.onyphe.io/en/refrigerat…
1
1
156
👀 La cyberattaque ayant privé de systèmes de réfrigération @CooperativeU et @intermarche était-elle une attaque ciblée sur la France ? 💥 Sur plus de 6 000 instances @Danfoss exposées, près de 50% sont situées en France. 👉 Notre analyse complète : blog.onyphe.io/frigo-dimport…
1
15
30
2,628
Issue is now fixed, all data is available again.
As part of a "scheduled maintenance", @ovh_support_fr completely turned off a bay without alerting their customers beforehand. Therefore, we have an availability incident, some data may not be available. Issue should be fixed in a few hours. Thank you for your understanding.
1
208
As part of a "scheduled maintenance", @ovh_support_fr completely turned off a bay without alerting their customers beforehand. Therefore, we have an availability incident, some data may not be available. Issue should be fixed in a few hours. Thank you for your understanding.
1
1
3
523
Replying to @onyphe
Hello there, We apologize for any slowdowns. We are experiencing Orange-OVHcloud network disruptions. You can track the progress of the resolution here: network.status-ovhcloud.com/… The teams do everything they can to restore quickly. ^HomS xitter.cf/messages/compose?recip…
2
1
119
Seems a connectivity issue between @ovh_support_fr and @orange
We are experiencing an availability incident. We are investigating and will let you know when we know more. Thanks for your patience.
1
1
2
301
We are experiencing an availability incident. We are investigating and will let you know when we know more. Thanks for your patience.
1
1
1
444
Great, thank you for your feedback.
1
52
💥More than 113k instances of #Plex Media Server vulnerable out of 350k exposed instances. #CVE #ASM #NoCveYet Vendor advisory: forums.plex.tv/t/important-s… Cc @BleepinComputer @TheHackersNews
2
1
213
Replying to @Shadowserver
@Shadowserver we have different numbers: >100k IPs vulnerable out of >300k exposed. We are counting all versions <1.43.3.10861 as vulnerable. Most exposed vulnerable port: 32400/tcp. We are willing to cooperate on that matter if you want. Cc @BleepinComputer
Replying to @Shadowserver
No CVEs have been issued meaning the vulnerabilities are essentially invisible to the security community limiting an effective response. We tag the raw IP data shared 'vulnerable-plex' in Vulnerable HTTP reporting: shadowserver.org/what-we-do/… Tracker: dashboard.shadowserver.org/s…
1
2
2
435
😍And here we are: 👉5,000 ports scanned with a weekly refresh
📣 ANNOUNCEMENT: we have reached the 2,100+ scanned ports milestone, at Internet scale with a weekly refresh rate. Next step: 5,000+ ports, weekly refresh. Then 10,000 by end of next year. We will be the competitor number 1 to @censysio in 2026. #ASM #CTI #ASD
4
9
832
📣 Our brand new Web site has been published. And other news will follow. Stay tuned. 👉 onyphe.io/
4
1
2
319
This might be what's missing from your recon workflow. Uncover will search for hosts using Shodan, Censys, FOFA, Hunter, Quake, ZoomEye, Netlas, CriminalIP, PublicWWW, HunterHow, Google, Onyphe, Driftnet and NerdyData. Then it drops the results straight into your terminal, ready for chaining with other tools. github.com/projectdiscovery/…
5
41
224
12,539
@onyphe.io retweeted
If your network security automation stops at alerts, the issue is not visibility. It’s integration depth. Search results, firewall rules, proxy scans, external exposure data. They sit in different systems. When integrations are shallow, automation ends at investigation. You can see the signal. You can’t enforce the control. Network security only scales when searches, rule updates, scans, and threat intel queries are fully executable through APIs. Full read and write coverage. Not dashboards. Not manual rule changes. @Trellix MVISION Searches · @pfsense · @Anomali ThreatStream · @onyphe
1
2
96
Well, at the roots, Internet was built decentralized. All these points are about centralization. Who knows what a #SPOF is in 2026?
software engineering in 2026: - your package manager is compromised - your cloud provider blocks your account - github itself is hacked software is solved
1
2
324
Very nice talk by @WeynsMaarten at this year's @Botconf about #DDoS for hire infrastructures exploiting weaknesses in monitoring solutions. Number of exposed #Netdata or #Prometheus instances is quite crazy. Happy to share our data with TUDelft, like we already did in the past.
2
336
We're thrilled to announce that we'll be at the @Botconf in Reims starting tomorrow until April 17th. And we're very proud to be one of its gold sponsors 😊 Looking forward to seeing you there!
2
198