Risky Bulletin Newsletter
November 11, 2026
Risky Bulletin: France blames Iran for the October supermarket fridge hacks
Written by
News Editor
This newsletter is brought to you by application allow-listing software maker Airlock Digital. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.
French officials on Monday accused an Iranian military cyber unit of hacking refrigerators at French supermarkets last month, in a major incident that caused tens of millions of euros in losses.
In a joint report authored by five agencies, officials named the Shahid Kaveh military unit inside the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) of carrying out the attack.
The hack hit 700 retail stores across France, but also a few butchers, food factories, and even a slaughterhouse.
While the Intermarché group was heavily hit, the attacks also crippled fridges at supermarket chains such as Casino, Leclerc, Coopérative U, Metro, and Carrefour.
The hacked fridges were set to super high temperatures that defrosted and spoiled food, but in 15 locations, the fridges overheated and also triggered fires.
The attacks mainly targeted the web panels of Danfoss refrigeration controllers, which allow store IT teams and employees to control the temperatures of their fridges from centralized panels or over the internet.
The hack took place on the night of Sunday, October 11, to Monday, October 12.
The report does not mention a second fridge hacking wave that took place at the start of November, which remains without attribution.
The French supermarket fridge hacks weren't the first time refrigerators got hacked this year either. A first wave of hacks hit US military bases in August, leading to food getting spoiled. After the supermarket hacks took place, the US sent a team of investigators to France to work together on that investigation.
In an NYT piece yesterday, sources from US intelligence appear to have been surprised with France linking the hack to Iran, which they only had at a "low confidence" level of attribution. This also surprised several security researchers who RiskyBiz has kept in touch, all having Iran on the same "low confidence" level of attribution, and another main suspect in mind.
But, alas!
As for the name Shahid Kaveh, this has been mentioned before in previous reports on Iranian hacking operations, with the unit being identified as the operators of CyberAveng3rs, an anti-Israeli and anti-West hacktivist group.
A DomainTools report last year said the unit operates at the intersection of IRGC-CEC and the Quds Force, the IRGC's elite force.
French officials also announced a criminal investigation into Hamid Reza Lashgarian, the head of the IRGC-CEC, and Mahdi Lashgarian and Reza Salarvand, two commanders in Shahid Kaveh.
In August 2024, the US State Department also identified the first two as being involved in the CyberAveng3rs group and a campaign that hacked several water utilities across the US.
Risky Business Podcasts
In this episode of Risky Business Features, Patrick Gray and The Grugq chat to Nazar Tymoshyk about Russia’s use of AI in recent state-back cyberattacks against Ukraine.
Breaches, hacks, and security incidents
Hackers steal $6m from Keplr Wallet owners: Hackers have stolen over $6 million worth of crypto-assets from the users of Keplr cryptocurrency wallets. The attackers exploited a vulnerability in Web3Auth, a third-party component that allows users to log into wallets with Apple or Google accounts. Keplr says the attackers drained funds from more than 44,000 wallets. Web3Auth also exploited the same flaw to move $5.6 million of Keplr wallet funds to new secure locations. [Keplr // Web3Auth]
Hackers target LNBits wallets: Crypto-wallet service LNBits has told customers to take down self-hosted wallets due to an ongoing attack. The attackers are stealing funds from servers that have the Paywall extension enabled. The company said on Sunday it was working on a security patch. [LNBits #1 // LNBits #2 // CryptoSlate]
Ethereum Swarm hit by supply chain attack: The Ethereum Swarm project fell victim to a supply chain attack on Monday. Attackers breached the project and added malicious code to the Swarm Desktop app and the Bee-js library. The code stole crypto-wallet seed phrases and configuration files for Bee blockchain nodes. The Ethereum Swarm team told users to move funds before they're stolen. [Ethereum Swarm // Socket Security // SafeDep]
Hackers encrypt ESTT cloud provider: Hackers have breached and encrypted the servers of ESTT, a Russian VPS and cloud provider. The hack took place over the weekend. ESTT said it restored around 90% of infrastructure by Monday. ESTT is the third Russian cloud provider hacked over the past month after FirstVDS and Beget. [ESTT statement #1 // ESTT statement #2]
Security incident at Fireworks AI platform: Hackers breached AI training platform Fireworks and stole secrets and tokens customers stored in their accounts. The breach took place last month. Fireworks linked the intrusion to an e-crime group "selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways." Multiple cloud platforms reported similar breaches and stolen tokens. Fireworks is one of the nine AI-related platforms that got hacked in October alone. [Fireworks]
Notion comes out as first Fireworks victim: AI platform Notion also disclosed a security breach caused by the Fireworks hack. Some of the stolen data includes chat conversations. [Notion]
NEAR AI also hacked: And speaking of AI platforms getting hacked, private AI inference company NEAR AI has also disclosed a security breach. The company says hackers breached one of its SGLang servers and then pivoted to the rest of its network. The hackers stole data from around 100 user accounts. Only two of them had API keys stolen. [NEAR AI]
Hackers breach Qubole, spread to customer environments: A threat actor has breached the Qubole data lake platform in a security breach that lasted almost a month. According to security firms Sentra and Wiz, the attackers compromised Qubole's main AWS account and then pivoted to customer environments. Once inside, the attackers enumerated resources and then stole secrets and configuration files. [Wiz // Sentra]
Philippines SEC data breach: The Philippines Securities and Exchange Commission is notifying taxpayers of a data breach that exposed their data. The agency confirmed the breach on Monday after hackers posted its data online last week. The hackers claimed to have stolen the data of 10 million Philippines citizens. Stolen data includes full names, email addresses, mobile numbers, dates of birth, genders, home addresses, and tax identification numbers. [PH SEC // FinTechNews.ph]
Ransomware gang hits Vanderbilt University: Vanderbilt University told students and staff on Monday to turn off university-issued devices and disconnect from its WiFi network. The university said it was dealing with a cyberattack and was rebuilding its IT systems. A ransomware group named BYOD took credit for the attack in a post on their dark web portal. It is the third US university the group has hit in the past month after Michigan State University and the University of New Mexico. [DysruptionHub // Vanderbilt University]
Wyndham leak: Wyndham hotels left a password inside its Android app that could have allowed threat actors to connect to its backend and retrieve all kinds of customer data. [TechCrunch]
Who Gives A Crap data breach: Who Gives a Crap, an Australian company that makes toilet paper and towels from recycled paper, has disclosed a data breach caused by a security incident at an unnamed US-based software provider. [CyberDaily]
Hackers breach Japan's disaster alert service: Hackers have breached Japan's disaster alert system to send phishing emails. The attackers breached Arcadia's email servers, stole over 3 million email addresses, and sent more than 1.4 million spam messages. Arcadia shut down systems for weeks to investigate and evict the hackers. The system is used by almost 900 public bodies, police departments, fire departments, schools, and private companies to send disaster alerts to those who sign up. [Nikkei // Cybernews]
General tech and privacy
Twitter lives up to its reputation under Trump: Musk's new-age Twitter fought a Canadian woman in court and won in a case where she tried to have the platform delete non-consensual intimate images from the site. The company chose to geoblock Canadians from viewing the woman's photos and let the image online for everyone else. Because shame apparently works based on a GPS radius now. The moral high-grounds this company chooses to fight for are just mind-boggling. [CTV News] [h/t Alex Rudolph]
Meta expands age-estimation tech globally: Social media giant Meta has expanded its age-estimation technology to all of its Instagram users. The technology uses AI algorithms to find users suspected of being teens and places them in a special Teen Account with enhanced protections. The age-estimation technology was initially tested in Australia. [Meta]
Firefox 160: Mozilla has released Firefox 160. New features and security fixes are included. The biggest features in this release are extra controls for the picture-in-picture floating player and the ability to drag entries from the History section to the tab bar or the page itself.
Huawei launches first desktop PC entirely made in China: Huawei launched last week the first desktop PC model that was made with components entirely made in China. The Qingyun HM650 model uses Kirin CPUs and runs Huawei's own HarmonyOS. The PC is priced from $1,000 to $1,500. [NotebookCheck // Gagadget]
Government, politics, and policy
White House nominates the Palantir CISO for CISA top job: The Trump administration has nominated Palantir chief information security officer Michael LoSapio for the CISA Director job. The agency has been without a director since Jen Easterly resigned ahead of Trump taking office in January 2025. The Trump administration nominated Sean Plankey to head the agency last year but his nomination never made it through the Senate. [CyberScoop]
FBI unifies cyber squads: The FBI has established a dedicated Cyber Branch where it unified all offensive and defensive cyber units. In a NextGov op-ed, FBI Director Kash Patel said this eliminates redundant work and technical risk. The Bureau also introduced a Microsoft Copilot-powered chat AI assistant to help employees with administrative tasks. [Kash Patel on NextGov]
Australia sets up AI safety regulator: The Australian government will establish an AI safety regulator to manage risks posed by AI frontier labs. The new office will be set up via Australia's upcoming AI standards legislation. The new law will also require AI companies to report any security breaches caused by their agents. [Australian government #1 // Australian government #2]
Sponsor section
In this Risky Business sponsor interview, Tom Uren talks to Airlock Digital’s CTO and CSO Peter Baussmann about how the Essential Eight is evolving into ASD’s Essentials framework.
Arrests, cybercrime, and threat intel
SMS blaster detained in Tokyo: Japanese authorities have arrested a Chinese national for driving across Tokyo with an SMS blaster device in his car. Authorities identified the individual after the device disrupted the mobile network of a local telecom operator. The SMS blaster sent out Chinese-language smishing messages. It targeted tourists and tried to lure them to phishing pages using fake credit card suspension messages. [CommsRisk // Ministry of Internal Affairs]
Qilin member gets doxxed: GangExposed, the same group behind some ransomware leaks over the past years, has doxed Haise, the public face of the Qilin ransomware gang. They identified him as Alexey Mikhailovich Yakovtsev, 36, from St. Petersburg, Russia. [JustPasteIt]
Scamwich campaign: Security researchers have spotted more than 820 restaurant domains impersonating major US chains, most likely used for various forms of fraud and scams. [InfoHawk]
One in 195 stores is hacked: A research project that scanned almost 2.4 million online stores found that one in every 195 online stores has been hacked. While some hacked shops collected payment card data, most sent users to scam pages or ClickFix portals. Security firm Guardio repeated the scan a month later and 62% of the 12,200 hacked stores were still infected. [Guardio]
DoppelCart campaign doubles: Recorded Future has found 261,700 domains that appear to host fake online shops designed to defraud buyers. The number has more than doubled compared to an initial Nebty report from September. [Recorded Future // Nebty]
KongTuke spreads SystemBC: The KongTuke e-crime group is now running a ClickFix campaign targeting Canadian audiences. [Ohey]
BluePhishing technique: Proofpoint researchers have developed a new phishing technique. Named BluePhishing, the technique abuses blueprint consent, a process through which Microsoft creates Entra AI agents. If approved, the attacker can create malicious agents that can access an organization's Microsoft365 tenant. [Proofpoint]
Malware technical reports
GhostFrame framework: Recorded Future researchers look at GhostFrame, a post-exploitation framework used by the Settra ransomware in attacks against VMware ESXi environments. [Recorded Future]
Sponsor section
In this product demo of the Airlock Digital application control and allowlisting solution, Patrick Gray speaks with Airlock Digital co-founders David Cottingham and Daniel Schell.
APTs, cyber-espionage, and info-ops
CopperDragon’s Sparrow framework: Check Point looks at the Sparrow Framework, a hacking toolkit developed by CopperDragon, a maker of malware for Chinese APTs. [Check Point]
APT-C-36 (Blind Eagle): There's new activity from the APT-C-36 (Blind Eagle) group, active in its usual territory of LATAM. [Zenox]
New Turla tool sniffs for NATO and EU messages: Russian state sponsored hackers are using a special tool designed to intercept and steal messages from NATO and EU email addresses. The Turla APT used the tool at the end of last year in attacks against the Romanian government. It then also deployed it against the Kazakhstan government this year. Named Cereal, the tool is designed to work inside the memory of Microsoft Exchange servers. [ESET]
Vulnerabilities, security research, and bug bounty
Patch Tuesday: Yesterday was the November 2026 Patch Tuesday. We had security updates from Adobe, AMD, Apple, Arista Networks, ASUS, Atlassian, AWS, Chrome, Cisco, Citrix, cPanel, D-Link, Dell, Firefox, Fortinet, Gigabyte, Git, GitHub Enterprise, GrapheneOS, HP, HPE, IBM, Intel, Ivanti, Kubernetes, Microsoft, Moodle, Moxa, Red Hat, Rockwell Automation, Roundcube, SAP, Schneider Electric, Siemens, SonicWall, Supermicro, SUSE, Synology, Tor Browser, WatchGuard, Ubuntu, and Zoom. Other projects and companies released security updates earlier this month, including 7-Zip, ABB, Android, Apache Axis, Apache OFBiz, Axis, Barracuda, Debian, Django, Drupal, Gitea, Google Pixel, Huawei, JetBrains, MikroTik, OpenSSH, Qualcomm, Ruby on Rails, Samsung, TP-Link, Zyxel.
Microsoft patches an Outlook zero-day: Microsoft's Patch Tuesday this month fixed 1,094 vulnerabilities, including an actively exploited zero-day. The zero-day is CVE-2026-124194, an Outlook vulnerability that can send NTLM credentials to a remote server. [Microsoft CVE-2026-124194]
N-able takes down cloud platform after zero-day dump: Software company N-able has taken down its SaaS platform after a security researcher published details on 33 vulnerabilities. The dump, codenamed Able2Shell, includes proof-of-concept exploits. The researcher, Sean Bales, says he published the vulnerabilities without notifying N-able after the company failed to patch previously reported bugs. [N-Able status // Sean Bales on LinkedIn // GitHub POCs // BleepingComputer]
🚨 N-able is responding to the public disclosure of multiple alleged critical vulnerabilities in its N-central remote monitoring and management platform. Censys identified 1,728 exposed hosts. The claims remain unvalidated. N-able advises taking servers offline. https://bit.ly/4BKq9Jc
— Censys (@censys.bsky.social) November 9, 2026 at 11:11 PM
[image or embed]
Another Chrome zero-day: Google has released a security update to patch an actively exploited Chrome zero-day. Tracked as CVE-2026-125350, the zero-day is a memory management bug in Chrome's XML component. It is the eight Chrome zero-day Google patched this year. [Google Chrome]
Xen Orchestra zero-day: Vates has released a security update to patch an actively exploited zero-day in the Xen Orchestra virtualization stack. The zero-day can allow an adversary to bypass authentication and perform admin-level actions. The attacks were discovered and reported by Danish ISP TDC NET. [Vates]
Barracuda bugs exploited in the wild: Threat actors are exploiting two vulnerabilities in Barracuda Networks appliances to access corporate email servers. Tracked as CVE-2026-116606 and CVE-2026-111560, the vulnerabilities allow attackers to bypass authentication and inject commands on the device. Barracuda patched the issues last week. In-the-wild exploitation was confirmed on Monday. [Barracuda]
KEV update: CISA has updated its KEV database with four vulnerabilities that are currently exploited in the wild. All are 2026 bugs, such as a recent bug in the GPUStack GPU cluster platform, IBM Aspera servers, SignalWire FreeSwitch telephony servers, and the SSHhole vulnerability.
Office Party vulnerability: Air Security researchers have found a vulnerability in Anthropic's DOCX, PPTX, and XLSX skills that allows attackers to execute malicious code on a user’s Linux machine. [Air Security]
Binance warns of iOS flaw: Cryptocurrency exchange Binance has told customers to uninstall shady iOS apps from their devices because of an iOS vulnerability that lets malicious apps read another app's data, which could put Binance wallet seed phrases at risk. [Binance]
ICM2SHELL and PROXYGATE: Onapsis researchers have published write-ups on ICM2SHELL and PROXYGATE, two pre-auth RCEs in SAP's NetWeaver platform. Both were patched in this month's SAP Patch Tuesday update train. [ICM2SHELL // PROXYGATE // SAP patches overview]
Infosec industry
Threat/trend reports: Azul, Black Kite, iVerify, Kaspersky, Project Discovery and WatchGuard have recently published reports and summaries covering various emerging threats and industry trends.
New tool—Silverseal: Ido Veltzman has released Silverseal, an open-source Linux bootkit research framework written in Rust.
RomHack conference suspended: The organizers of the RomHack security conference have suspended the event indefinitely after failing to secure enough funding. The conference was established and managed by the Cyber Saiyan group since 2018. It took place in Rome and was one of Italy's largest cybersecurity events. [RomHack]
Risky Business podcasts
In this edition of Between Two Nerds, Tom Uren and The Grugq discuss CISO's expectations and priorities regarding budgets and what they will spend their money on. AI features heavily in 2027 priorities, but what will it deliver?