Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
Switzerland's Bundesamt für Cybersicherheit (BACS) published Halbjahresbericht 2026/I — its semi-annual report on the cyber threat landscape in Switzerland and internationally — on 2026-08-24 (BACS, 2026-08-24). Two numbers frame it. Voluntary reports fell to 27,128 for January–June 2026 against 35,727 in H1 2025, with fraud (10,759), phishing (8,877) and spam (3,965) the most-registered categories. Separately, 200 mandatory reports were processed under the critical-infrastructure notification duty in force since 1 April 2025 — and their sector split is the finding this constituency should read first: the public sector and IT/telecommunications continue to be the most frequent reporters, at 19.4% and 18.6% respectively — BACS's own word is "weiterhin", continuing, so this is a persistent ranking rather than a new development. Among those mandatory reports, unauthorised system access (hacking) is the most-reported attack type at just under 26%, which BACS says consists largely of email accounts compromised through successful phishing and then reused to run further phishing and fraud against others; credential theft follows at 13.5%, with DDoS and data exfiltration tied at 12.7% each, and ransomware in roughly 8% of cases.
Three categories fell sharply, and exactly one of them is given a cause. Reports of fraudulent threatening calls made in the name of authorities fell 64% year on year to 3,817, and BACS credits the tightening of the telecommunications services ordinance against call spoofing — noting the measures likely took effect before they formally came into force. Advertising for online investment fraud fell 89% to 387 and CEO fraud 57% to 258; the report records those two as declines without attributing either to a cause, so neither should be read as evidence that a control worked. Set against that, BACS records attackers using AI systematically to produce tailored, personalised content credibly, including one CEO-fraud case in the period that used a cloned voice of the target's superior to push staff toward fraudulent transfers, and romance-scam identities built with AI-generated images, imitated voices and increasingly deepfake-supported video calls.
On initial access BACS reports no Switzerland-specific tradecraft, only global patterns — and three of them are worth a hunt. Malware by email remains a principal vector with fake invoices the commonest pretext; ClickFix, where the victim is induced to run the malicious command themselves, remains widespread, as does the fake-software-update variant, illustrated by a campaign that told targets to install a Zoom update to join a meeting. In the reporting period BACS identified at least 191 Swiss WordPress sites that attackers had compromised and seeded with malicious JavaScript, which makes a visitor's browser fetch further malicious code automatically — with blockchains increasingly used to host and distribute that code. And in a multi-stage case BACS describes, an employee's business mailbox was buried under email bombing, after which the attackers contacted the victim over Microsoft Teams posing as IT help-desk staff, talked them into granting remote access, and installed malware disguised as an update, citing Unit 42's write-up of the pattern. That is the same delivery chain this pipeline covers today from Expel's SynkLoader case, which is worth noting because a Swiss authority independently placing the pattern in its own caseload raises it from one vendor's incident to an expected local vector. BACS also records several large software-supply-chain compromises with global reach in the period, in which the compromise of widely used open-source projects spread credential-stealing software broadly and Swiss organisations were among those affected — citing the Trivy tag compromise, ground this store already holds. Elsewhere it notes attackers defeating multi-factor authentication through intercepted session tokens, device-code phishing and reverse proxies, and an international shift away from technical complexity toward the principle "log in, not break in": rather than intruding without authorisation, attackers increasingly try to obtain legitimate credentials and use them.
The Poland case study — where basic controls, not advanced defence, were the missing layer. The report's second chapter is a full anatomy of the coordinated wave of 29 December 2025 against Polish energy assets, an incident this store tracks. The Polish CERT's public attribution is of the attack infrastructure to Static Tundra, a suspected Russian state actor previously linked to energy-sector espionage — infrastructure, not the operation itself — and BACS then extends that with its own hedge, recording the Poland incident as the first publicly documented sabotage operation in which the group was apparently involved. Targets ran from 30 wind and photovoltaic parks through a large combined heat and power plant supplying heat to around 500,000 people, to a manufacturing company. The attackers went for the distributed control systems used to operate infrastructure remotely rather than the turbines and generators themselves, and at the renewables sites concentrated on the grid connection point — effectively the operator's digital control room for steering and remote monitoring.
How they got in is the part that should change a Swiss operator's priorities. Alongside exploitation of known unpatched vulnerabilities, remote-access points were exposed directly to the internet without multi-factor authentication, the same passwords were reused across multiple devices, and in several cases devices still carried the manufacturer's factory default passwords ("auf den Geräten noch die werkseitigen Standardpasswörter des Herstellers eingestellt" — in several cases the devices still had the manufacturer's factory default passwords set). Firewalls, servers and a range of OT devices were affected: controllers, remote terminal units reached over SSH, intelligent electronic devices such as protection and control relays, and Windows-based HMI workstations running a SCADA suite. Some of those systems handed the attackers system-administrator rights and so unrestricted control. Destruction was then achieved several ways: corrupting controller firmware so devices hung in an endless reboot loop, deleting operating-system files so they could not boot, and resetting other components to factory settings while changing their network configuration so they became unreachable — with wiper malware additionally deployed on the Windows control machines.
The heat plant was hit entirely through the office IT network without touching its industrial control systems, via the perimeter firewall using accounts again unprotected by MFA. There the actors took their time: over roughly a month they mapped which systems could reach the plant's industrial controls — enumerating processes, network connections, routing tables and the ARP cache, and probing file systems on machines whose names contained "scada" — then quietly stole credentials to impersonate legitimate users, including an attempt to dump the LSASS process, a forged Kerberos ticket built with a public tool, and a dump of the entire Active Directory database via ntds.dit. On 29 December they pushed the DynoWiper malware to workstations using Group Policy Objects, the same mechanism administrators use to deploy software centrally — and an endpoint detection and response product caught and blocked it before it did broad damage. A slightly modified build failed too, as did direct overwriting of server disks and manipulation of the storage system's RAID configuration. At the third victim, a manufacturer that appears to have been chosen opportunistically, the attackers did not have to defeat the perimeter firewall at all: its configuration including passwords had been stolen in an earlier, unrelated incident and was freely available on a criminal forum. Once in, they established durable access by planting automated routines on the firewall that periodically retrieved valid credentials and weakened account security settings — including disabling MFA — piping the output to a Slack channel for convenience, then moved laterally over an SSL VPN tunnel using penetration-testing tooling and deployed a second wiper, LazyWiper, again through Group Policy from a network share. In all three cases stolen credentials drove lateral movement, and — the detail most worth carrying — the same credentials were used to reach the victims' on-premises and cloud services including Exchange, Teams and SharePoint, where the actors searched specifically for files and mail concerning technical operations and ICS, OT and SCADA systems. BACS notes the campaign required substantial manual effort rather than the AI and automation the wider trend points to, and reads the timing as an opportunistic capability demonstration — signalling — rather than a strategically chosen moment, precisely because the exploited weaknesses were so basic. Its conclusion is explicit: basic cybersecurity measures, not advanced defensive technology, would have been the key to preventing these attacks — strong unique passwords, consistent MFA, network segmentation and timely patching.
For Switzerland specifically, BACS argues the exposure is not symmetrical. Large grid connection points here are for the most part better isolated than Poland's, but that assessment excludes the large number of smaller private feed-in installations, which are permanently connected to the internet and to the manufacturer's cloud — and it cites the National Test Institute for Cybersecurity's study of energy-management systems for private photovoltaic installations as establishing the resulting dependencies and broad attack surface. It also draws a supply-chain lesson from a March 2026 case in which Iran-linked attackers claimed to have wiped all reachable devices of a US medical-device manufacturer by factory reset: the victim was not the most strategically relevant target available, but the attack carried a public message — and Swiss business customers of that manufacturer were affected downstream, unable to place their next order through established channels.
The Dream Job playbook, measured in Swiss cases. The third chapter documents crypto theft run through a staged recruitment process against Swiss individuals and companies in the crypto, blockchain and Web3 sectors, which BACS assesses resembles patterns other authorities have attributed to actors operating on behalf of the DPRK — the campaigns tracked publicly as Operation Dream Job and, in its newer variant, Contagious Interview. The actors first identify people in key positions with privileged access to systems and funds — an independent software developer, or the founder of a crypto organisation — then profile the target's preferred technology stack, personal interests, investment intentions, access to company funds and wallet size. The approach comes on LinkedIn from a well-connected, polished headhunter with an offer that is hard to refuse: to earn a generous six-figure salary a developer need only run a test application and fix its bugs, which means fetching code from a repository that silently compromises their system. For less technical targets the lure is tailored differently — a venture capitalist hunting the next unicorn, or a well-paid operations-manager role for a back-office employee — and runs through a video interview on genuine conferencing software where the connection appears to drop, the interviewer persuasively proposes a quick hotfix to repair the tool, and the "fix" pulls trojanised software dependencies or downloads a second-stage payload named OtterCookie or BeaverTail. Those payloads execute only in memory, harvest credentials, tokens and wallet keys to the operators' infrastructure, and often lead to a bespoke DPRK backdoor for persistence; BACS notes no case has been reported of any other known actor using those specific samples. The attackers then attempt lateral movement into the victim's employer network to steal further assets.
In Switzerland such reports have risen steadily over five years to more than 20 confirmed cases, with victims often connected to the crypto industry in roles from engineer to executive, and losses running "von einigen Tausend bis hin zu rund 60 Millionen Schweizer Franken" (from a few thousand up to around 60 million Swiss francs). BACS is contacted weekly by targets who spot the approach in time — and received just as many reports from victims who realised only afterwards. It expects the true figure to be considerably higher, and names the reason as a structural one rather than a technical one: shame, information asymmetry and lack of awareness. The asymmetry it stresses is between employee and employer. Staff have little incentive to tell their employer about a security breach arising from a job search, which buys the attackers time to work laterally — and BACS has seen cases where several employees of the same company were approached, on the reasonable assumption that they would not compare notes with each other.
Triage: for the Dream Job chain the discriminator is sequence and endpoint role, not the sample. A developer workstation fetching and building an unfamiliar external repository is routine; the same host doing so shortly after an inbound recruiter contact, followed by an in-memory payload reaching out to previously unseen infrastructure and then authenticating to internal systems, is the chain. For the conferencing variant, the tell is a user-run "hotfix" during or just after a video call on legitimate software — a genuine conferencing client updates itself through its own updater and does not ask a user to paste or execute a repair command. BACS's own reporting-behaviour finding is the operational corollary: because the initial compromise arrives through a private job search, the employer usually learns late or not at all, so make it explicitly safe and expected for staff to report a suspicious recruitment approach without implying fault — the report's evidence is that several employees at one company were approached and none compared notes.
auf den Geräten noch die werkseitigen Standardpasswörter des Herstellers eingestellt.
Höhe von einigen Tausend bis hin zu rund 60 Millionen Schweizer Franken.
Statt unautorisiert in ein System einzudringen, versuchen die Angreifer zunehmend,
ATT&CK mapping
23 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
T1189Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
T1566Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
T1566.003Phishing: Spearphishing via Service
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
Execution TA0002
T1204.004User Execution: Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1484.001Domain or Tenant Policy Modification: Group Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Defense Impairment TA0112
T1484.001Domain or Tenant Policy Modification: Group Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Credential Access TA0006
T1003.001OS Credential Dumping: LSASS Memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.
T1003.003OS Credential Dumping: NTDS
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.
T1556.006Modify Authentication Process: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
T1558Steal or Forge Kerberos Tickets
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
Lateral Movement TA0008
T1021.002Remote Services: SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
T1570Lateral Tool Transfer
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
Collection TA0009
T1114.002Email Collection: Remote Email Collection
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.
T1213.002Data from Information Repositories: Sharepoint
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Impact TA0040
T1485Data Destruction
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
T1495Firmware Corruption
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system. Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.
T1561Disk Wipe
Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.