Ransomware Attack Hits Coca-Cola Subsidiary Fairlife, Temporarily Halting US Production Systems
Fairlife, a subsidiary owned by Coca-Cola, has temporarily halted production at its United States facilities following the discovery of unauthorized access to its systems in a ransomware incident.
The company publicly disclosed the event on July 16, 2026. According to the statement, the affected systems include environments tied directly to production operations, leading to a suspension of activities while investigation and recovery procedures advance.
Fairlife produces milk, protein drinks, and other dairy products distributed throughout the North American market. Because the compromised systems are connected to industrial operations, the attack could affect product availability, supply chain logistics, and internal business processes.
The organization immediately activated its incident response and business continuity protocols. External cybersecurity experts and consultants were brought in to support containment, forensic investigation, and the restoration of affected systems.
At this stage, Coca-Cola has not provided details on whether data was exfiltrated, files were encrypted, or a ransom demand was received. The full extent of the incident is still being evaluated.
Law enforcement agencies have been notified about the attack. Operations at Fairlife facilities in Canada remain unaffected, according to information released after the incident.
Related articles
Cl0p Exploits Critical Windchill Vulnerability CVE-2026-12569 to Steal Industrial Designs
The Cl0p extortion group is actively targeting internet-exposed PTC Windchill and FlexPLM servers to exfiltrate engineering projects, technical specifications, and other sensitive data. The campaign focuses on organizations in the industrial, automotive, aerospace, defense, and retail sectors. Attackers leverage the critical remote code execution vulnerability CVE-2026-12569, which stems from unsafe deserialization and carries a CVSS score of 9.8, allowing unauthenticated exploitation over the network. The intrusion chain also combines a WSDL endpoint information disclosure in FlexPLM with a login mechanism weakness in Windchill to gain initial access and execute commands without valid credentials. After compromise, operators deploy JSP web shells to maintain persistence, explore files, and prepare data for exfiltration. Affected systems often contain unreleased product designs, engineering drawings, and strategic manufacturing documents. The activity began in early June 2026, with extortion emails sent to hundreds of employees starting July 20 to increase internal pressure ahead of potential data leaks.
Chaos Ransomware Group Uses msaRAT Trojan to Hide C2 Traffic Through Invisible Chrome and Edge Browsers
The Chaos ransomware group has adopted a new Rust-based trojan called msaRAT to conceal its command-and-control communications inside legitimate browser sessions. The malware launches Chrome or Edge in invisible mode and controls it via the Chrome DevTools Protocol, keeping all outbound traffic restricted to localhost. It then injects JavaScript to negotiate a WebRTC connection through Cloudflare Workers before routing data over Twilio TURN servers, preventing the attackers' real infrastructure from appearing in network logs. Commands are executed through cmd.exe, and the implant includes queuing mechanisms that support reliable transfer of files, screenshots, and larger data volumes. In the analyzed incident, operators delivered the malware via an MSI installer disguised as a Windows update that loaded the msaRAT DLL directly into memory. The technique does not exploit any vulnerabilities in Chrome or Edge and is designed to blend malicious traffic with normal corporate browser activity.
Qilin Ransomware Operators Exploit Palo Alto PAN-OS VPN Flaw CVE-2026-0257
Operators linked to the Qilin ransomware group have been actively exploiting an authentication bypass vulnerability in Palo Alto Networks PAN-OS to gain initial access to corporate networks. The attacks, observed in June 2026, targeted the GlobalProtect VPN service running on Palo Alto firewalls and were tracked under CVE-2026-0257. Attackers used specially crafted authentication cookies to establish unauthorized VPN sessions, after which they harvested credentials from Windows LSASS processes and Active Directory NTDS databases. Lateral movement relied heavily on PsExec and administrative shares, supplemented by tools such as AnyDesk, Ngrok, LogMeIn, and NetExec. Before deploying the ransomware binary stored as win.exe in C:\PerfLogs\, the threat actors disabled Microsoft Defender real-time protection and cleared event logs. The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2, and 12.1 as well as certain Prisma Access editions, while Panorama and Cloud NGFW remain unaffected.
Six Weeks of Inactivity and 37 Years of History Lost: Cyberattack Forces German Textile Firm ZEGO into Bankruptcy
A prolonged cyberattack that halted operations for nearly six weeks has driven the Bavarian textile company ZEGO Textilveredelungszentrum into insolvency proceedings, ending 37 years of business activity. The firm, which specialized in fabric finishing and processing for the automotive sector, workwear producers, and technical textiles, was unable to recover from the severe financial strain caused by the production standstill that began after the incident on 29 March 2026. Managing Director Johannes Zenglein described the decision to seek creditor protection as one of the most difficult in the company’s history, noting that the financial burden had become insurmountable. Although the company has not disclosed whether ransomware was involved or whether attackers accessed customer or employee data, it confirmed that the operational shutdown alone pushed the business to the brink of collapse. ZEGO now hopes to continue limited production while insolvency administrators explore restructuring options to preserve jobs and relationships with clients and suppliers. The case echoes other high-profile incidents, such as the bankruptcy of British logistics company KNP Logistics after 158 years of operation following a ransomware attack that encrypted its systems.