This newsletter is brought to you by Sublime Security. You can subscribe to an audio version of this newsletter as a podcast by searching for “Risky Business” in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.
Hackers are taking over the master user accounts of Li Auto smart EV cars sold in Russia, locking owners out of their cars, and extorting them to regain control of their vehicles.The attacks have been confirmed to a Russian auto news portal by Alexander Rasfairy, the co-founder of a Li Auto car club. Rasfairy says at least 20 owners confirmed hacks, but the number of hijacked cars is likely much larger if considering non-members.Most of the owners who had cars hijacked used Chinese eSIMs provided by the eSender service and by car importers to register the master car accounts.The hackers are allegedly using Li Auto vehicle identification numbers (VINs) that are supposed to be private but have leaked online through various data breaches, searching for expired eSender eSIM numbers associated with the Li Auto accounts, re-registering the eSIMs, and re-registering the cars to new accounts, which then creates a new master digital key for interacting with the car.The attackers then lock doors and the engine to prevent the car from being used, and contact owners to demand a ransom to regain access over the cars and share the new digital key.This is the second time Li Auto cars have been hijacked this way, after a first wave also hit in July of last year.Rasfairy says hackers were demanding more than $3,000 to unlock cars last year, but have now lowered their demands to only around $500-$600.The company is aware of the attacks and allegedly working on a way to register the car master accounts using email addresses, and remove the need for a Chinese phone number for exported cars.Risky Business PodcastsIn this edition of Between Two Nerds, Tom Uren and The Grugq discuss CISO’s expectations and priorities regarding budgets and what they will spend their money on. AI features heavily in 2027 priorities, but what will it deliver?
Breaches, hacks, and security incidentsAnother wave of refrigerator hacks hits Europe: A threat actor hacked freezers and refrigerators at dozens of supermarkets across 12 European countries. Attackers raised temperatures to 50°C causing inventory to defrost and spoil. Supermarkets estimate tens of millions of US dollars in losses. Over 40 of the affected supermarkets are owned by Ahold Delhaize, which was scheduled to secure its refrigerators this week. This is the third refrigerator hacking wave after hackers also hit DOD commissaries and French supermarkets earlier this year. [The Record // Belga English // TV4 // Luxembourg Times // NLTimes // News.ro // Madeira Island News // ANSA // DR.dk]Ukraine hacks Russia’s alert system in revenge: Ukraine President Volodymyr Zelenskyy confirmed in an interview that its cyber forces hacked Russia’s emergency alert system. Ukrainian hackers sent fake alerts about nuclear strikes across 33 Russian regions on Sunday night. President Zelenskyy says Ukraine acted in response after Russian hackers breached its air raid alert app and sent similar alerts hours earlier. [PBS // Russia’s EMERCOM // TASS]Binance reopens after hack: Cryptocurrency platform Binance has restored operations after suffering a $6.3 billion hack last week. The company has covered 95% of all the stolen funds from its own reserves. Binance hopes to recover almost half of the stolen funds, which are currently frozen at other exchanges. Chainalysis and Elliptic expect North Korea to need months to launder the rest of the funds. Binance has also published a post-mortem report. It traced the hack to a combination of both a supply chain attack and a fake job interview. [Forbes // Financial Times // Binance IR report]Mercado Bitcoin hacked for $49m: Hackers have stolen $49 million worth of crypto assets from Mercado Bitcoin, Brazil’s largest cryptocurrency exchange. The hack took place on Monday. The company says it managed to freeze $11 million of the stolen funds. The company has promised to refund all affected users. [Mercado Bitcoin // Chainalysis]Hackers raid BTCPay servers: Threat actors are hacking BTCPay servers to steal customer funds. The servers are typically used by some merchants to accept cryptocurrency payments. According to BTCPay, the attackers are targeting servers that did not apply an August security patch. Losses have been estimated at just over $1.6 million. [BTCPay]Mysterious EU crypto-heist: Blockchain investigators believe a mysterious EU-based entity might have been hacked for more than $133 million worth of crypto. The funds have been stolen from multiple accounts and are now being laundered. [ZachXBT // CryptoPotato]Beget cloud provider breached: A cyberattack has crippled the network of Russian cloud hosting provider Beget on Monday. The attackers hit DNS, email, and backup servers. Beget couldn’t say when it would be back online again. [Beget on Telegram]Amadeus breach sprawls travel industry: A breach at the Amadeus travel reservation platform has exposed the passenger data from at least six airlines. Qantas, Japan Airlines, All Nippon Airlines, Cathay Pacific, Malaysia Airlines, and Korean Air have all disclosed breaches over the past weeks. The Amadeus intrusion took place in September. Other airlines were also likely affected. [News.com.au // Malaysia Airlines // Cathay Pacific // Japan Airlines]Michigan State University ransomware attack: The BYOD ransomware group claims to have breached Michigan State University and is now threatening to leak the PII data of one million current and former students. The university disclosed a breach last month. [The Record]AI platform hacks: Nine AI-related cloud platforms got hacked in October, such as Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16–17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28), and Northflank (Oct 30). [Wiz]cPGuard malicious updates: Web application firewall cPGuard says hackers breached its servers and delivered malware to customer networks. The incident took place on Monday and hijacked the app’s update mechanism. The malicious update collected password data, database config files, shell history, SSH authorization, and known-hosts files. [cPGuard]mSecure password manager discloses security incident: Password manager mSecure is investigating a potential security breach after discovering suspicious activity on its servers. The company has notified users and asked them to reset passwords and 2FA methods, and remove existing passkeys. Both current and former customers received notifications. [Brian Krebs on Mastodon // mSeven]
General tech and privacyAndroid 17 has 1% adoption rate: Four months after its release, Android 17, the latest version of the Android operating system, is installed on less than 1% of all Android devices. The previous version, Android 16, is currently the most widely used Android release with a 25% market share. More than half of all Android devices are running a recent and still supported release. [Android Authority]Edge disables notifications from malicious sites automatically: Microsoft Edge will now automatically disable browser notifications from websites caught sending fake virus and malware alerts. Once a domain is blocked, Edge will notify the user the next time they start their browser. The new feature shipped last week with Edge v156. [Windows]Government, politics, and policyKremlin forces data centers to host government services: Russian President Vladimir Putin signed a decree on Monday ordering data center operators to allocate 10% of their resources to hosting government services. The decree has already entered into effect on Monday and data centers must report to the FSB. The Kremlin signed the decree after Ukrainian drone strikes crippled major data centers over the past month. [TASS]German officials targeted with spyware: Germany’s cybersecurity agency BSI says that members of the German Parliament have been targeted with mercenary spyware. The agency learned of the attacks after Apple notified targets last week. Officials who received warnings include some of Chancellor Merz’ staff. [ZDF Heute // Der Spiegel]South Korea looks at a government-wide cybersecurity body: South Korean President Lee Jae Myung called on the creation of a government-wide cybersecurity body. [Reuters]US boots Acronis from government networks: The US government has ordered federal agencies to remove Acronis software products from their networks. A government investigation found the Swiss-based company was still controlled by Russian investors and Russian developers were still involved in managing its codebases. The investigation started years before and spanned multiple administrations. [NextGov // US Federal Register]
New: Products made by cybersecurity firm Acronis are on track to be banned from federal systems. It turns out scrutiny of the Swiss firm went back years to the first Trump administration, and focused largely on development ties to Russia, two sources familiar with the efforts say ⬇️— David DiMolfetta (@ddimolfetta.bsky.social) November 2, 2026 at 5:10 PM
In this Risky Business sponsor interview, Catalin Cimpanu talks with Luke Wescott, Threat Detection Engineer at Sublime Security. Luke goes over the recent rise of calendar-based phishing campaigns over the past year and the reasons behind it.
Arrests, cybercrime, and threat intelGoogle disrupts XCPE botnet: Google and industry partners dismantled the XCPE malware operation that created a massive botnet out of 1.3 million set-top boxes. Google linked the botnet to Videostrong Technology, an authorized Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM) for Android devices. The company deployed the XCPE backdoor on its devices and then rented access to criminal groups. The botnet was used for advertising fraud, proxy networks, DDoS attacks, and credential stuffing attacks. [Google // Synthient // Plume #1 // Plume #2 // Lumen // Trend Micro]Russia arrests VasyGrek hacking group: Russian authorities have arrested three members of the VasyGrek hacking group. Also known as Fluffy Wolf, the group that has been attacking Russian companies since at least 2020. The group operated by launching phishing campaigns and deploying malware rented from other operations, such as Pay2Key and PureCrypter. [Russian Interior Ministry // Kaspersky // F6 // F6 // Purpleshift]Europol disrupts scam supplier: Europol has disrupted a company that provided server infrastructure and fake trading websites to criminal groups. Authorities seized more than 100 servers and detained seven suspects during a raid on Tuesday. German authorities are seeking the suspects extradition in connection to investment scams. [Europol]PHP2Shell proxy networks: Qurium researchers look at the proxy networks helping disguise the recent PHP2Shell exploitation attacks. [Qurium]Scammers abandon Estonian phone scams: After Estonian telcos implemented phone spoofing checks, the number of phone-based scams dramatically decreased over the course of just a few months. [CommsRisk]Scammers swat uncooperative target: An online scammer swatted a Nova Scotia woman after she refused to comply with his orders in an attempted scam. [CBC] [h/t Alex Rudolph]Google’s LLMJacking warning: Google warns that threat actors who compromise cloud-based AI infrastructure in attacks known as LLMJacking can easily rack up costs for the compromised companies mounting up to $100,000/day. [Google]CyberStrikeAI abuse: Kaspersky joins the list of security firms reporting that threat actors have adopted CyberStrikeAI, a Chinese-made offensive AI toolkit for real-world operations. [Kaspersky // Trend Micro]Cybercrime oopsie: A hacking group who breached 245 websites to display ClickFix lures has apparently forgotten to modify the template PowerShell commands and are tricking users into running benign commands. [Ohey]BillBait campaign abuses phone auto-fill behaviors: Gen Digital researchers have found a cybercrime campaign that registers users to premium subscriptions. The novelty in this campaign is that the SMS lures were crafted in a way to lure users on auto-filling confirmation codes when signing up, reducing the time users are on the page and the chance to spot the scam. [Gen Digital]CartSiphon group: A suspected Chinese hacking group is using trojanized CMS plugins to take over online sites. The attackers deploy a backdoor through which they take over servers, steal the site’s data, and then deploy a cryptocurrency miner. Most of the attacks leverage trojanized OpenCart and WordPress plugins. [JUMPSEC]Malware technical reportsFake Microsoft support kit: PIXM researchers look at a Chinese-made kit for generating fake Microsoft tech support pages. Sites running the kits have been live since March. The group behind the pages seems to be based in Hubei, China. [PIXM]Astaroth: Malware researcher 0x0d4y looks at Astaroth, aka Guildma, a niche banking trojan designed to target Brazil’s very unique banking sector. [0x0d4y]EByte ransomware: The Ransomware Information Sharing and Analysis Center has published a report on the EByte ransomware, which they say is based on the old Prince ransomware code. [Ransom-ISAC]Storm ransomware: Check Point says that a ransomware operation named Storm launched in August and claimed to be using AI tools for its attacks. Within weeks, the group added over 50 victims on its leak sites, somewhat confirming the increased operational speed. [Check Point]In this sponsored product demo Sublime Security co-founder and CEO Josh Kamdjou joins Risky Business podcast host Patrick Gray to show off the company’s email security platform, including its latest agentic AI bells and whistles. APTs, cyber-espionage, and info-opsRussian APT targets Ukrainian frontline orgs: A suspected Russian espionage group is targeting Ukrainian organizations operating near the frontline. UAC-0226 has been active since February of last year and operations have targeted law enforcement, judicial entities, local administrations, the defense sector, and a major transportation hub for foreign military aid. The group’s main tool is a backdoor named Gorbag and an infostealer named BeautyStealer. [ESET]Donot leak: Indian APT group leaked some of its tools through an open directory, which a bunch of security firms are getting way much better at tracking, as of recently. [InfraHunter]BITTER’s PapRAT: Fortinet looks at PapRAT, a new remote access trojan used by Bitter, a suspected Indian APT group. [Fortinet]Vulnerabilities, security research, and bug bountySecurity updates: Android, Barracuda, Canonical, Debian, Landflow OSS, Kaspersky, Oracle, Red Hat, SUSE.Distros patch Linux kernel RCE: The biggest Linux distros, such as Debian, Red Hat, and SUSE, have released security fixes for a remote code execution attack in the Linux kernel TCP networking stack. AI company Anthropic found and disclosed the bug last month but patches only now started shipping out. The vulnerability impacts all kernel versions released over the past decade, dating back to v4.4. Canonical is still working on a fix for Ubuntu. [Anthropic // Atlasum // Red Hat // Ubuntu // Debian // CVE-2026-98432]ChatGPT account takeover: OpenAI has patched a bug that could have allowed threat actors to bypass an account’s ChatGPT user sandbox and take over other accounts. [Parameter Labs]Node-RED exploitation: Threat actors are trying to hack industrial devices by exploiting a vulnerability in a lightweight web server used for their web panels. Attacks against Node-RED were detected against canary servers last week. They are exploiting a bug patched in August. Patches are unlikely to be installed since most ICS devices rarely get firmware updates. [VulnCheck]Infosec industryThreat/trend reports: Armadin, BlueFlag Security, CyberFOX, DNSFilter, Firefox, Microsoft, and UK NCSC have recently published reports and summaries covering various emerging threats and industry trends.Acquisition news #1: Chipmaker Intel has acquired quantum software maker Classiq for a massive $2.3 billion price. [CTech]Acquisition news #2: CrowdStrike has acquired two AI security startups—Fiddler AI and Dreadnode—in a deal estimated at around $500 million. [WSJ]New tool—SpikeStrip: ArcanumSec has released SpikeStrip, a tool to add prompt decoys against AI automation tools.Risky Business podcastsIn this episode of Risky Business Features, James Wilson looks at the string of recent AI benchmark cheating escapades and how they’ve reshaped his thinking about LLMs and vulnerability research.
Click Here For The Original Source.
——————————————————–
