Cyber, in brief

Google and six partners took apart a botnet of more than 1.3 million Android TV boxes, Google said on Monday. [2]

A botnet is a crowd of hijacked machines that one group steers from its own control servers. [2]

Google says the boxes' maker, Videostrong, a Chinese firm, built the malware into them on purpose. [2][3]

The owners never knew strangers were using their internet connection. [3]

Many such boxes sell through social media stars who promise hundreds of pirated pay-TV channels for one fee. [1]

Network security calls this a residential proxy: a stranger's web traffic sent out through someone's home connection. [1]

A website then sees an ordinary home, not the real sender. [1] Krebs on Security, a news site, says such traffic helps break into online accounts. [1]

It is like posting a letter from a friend's house, so the postmark shows their town, not yours.

The malware is still on the boxes, and it reinstalls itself from a protected part of the box if deleted. [2]

BleepingComputer says owners must load clean firmware or unplug the box from the internet to stop it. [2]

Charley Snyder, who leads Google's takedown work, would not say when Google first learned of the botnet. [3]

Sources disagree on its spread: TrendAI counted more than 170 countries, and The Register reports more than 200. [3][5]

The takedown should also cut off at least 10 million more infected devices, such as karaoke machines and health devices. [1][2]

How spy agencies say how sure they are

An analyst has to judge something nobody can see directly, such as who hacked a system

They pick a likelihood word from a fixed scale, from 'remote chance' to 'almost certain'

Each word stands for a set range of odds, so the reader knows how probable it is

Separately, they give a confidence level: how good and how complete the evidence is

A claim with neither label, like a gang's boast, says nothing about either

An analyst can call something highly likely while having only moderate confidence, because the odds and the strength of the evidence are rated separately.

Two separate labels: the NCSC's 'highly likely' rates the odds of an event, and Google's 'high confidence' rates the strength of its evidence.

The NCSC calls an AI-powered ransomware attack on British essential services by 2028 'highly likely', a word for the odds of an event.

Google says it has 'high confidence' that Videostrong built the malware in on purpose, a word for how strong its evidence is.

Fortinet links the attacks to Bitter 'with high confidence' and lists what that rests on: file names, server patterns and code.

The hackers' claims carry no rating at all, and Rosstat answers that it found no sign of a leak, so neither side is on a scale.

The words only work when the writer and the reader share the scale; outside an intelligence agency, 'likely' can mean very different odds to different people.

Every reader of today's stories is weighing claims from Google, Britain's cyber agency, criminal gangs and governments without seeing their evidence.

Google says Videostrong, a Chinese maker it had approved, put malware into 1.3 million TV boxes before they were sold. [2][3]

A takedown with a big number sounds like the end of the problem, but the malware is still sitting on the boxes in people's homes.

It kept making money from the boxes after they were sold, by selling criminal groups access to them. [1]

Their software was loaded onto the infected boxes, giving them home connections to rent out without the owners knowing. [1][3]

Strangers used their home connections without their knowledge, and the malware returns unless they load clean firmware. [3][2]

How many TV boxes are really infected, and where.

Google counts 1.3 million, but Synthient's founder calls that highly conservative. TrendAI counted more than 170 countries, while The Register reports more than 200. [1][3][5]

Hackers changed fridge and freezer settings overnight into Monday in more than 115 shops in 6 European countries. [6]

In some shops the temperature was set to 50C, so frozen food thawed and was thrown away. [6][7]

About 40 Delhaize shops in Belgium and Luxembourg were hit, and 15 Carrefour shops in Belgium. [6]

It follows an attack on 12 October that hit the fridges of 700 shops in France. [9][11]

Sabcobel, which runs Delhaize's fridge systems, said the units were switched to defrost mode. [7] That is believed to be the method used in France. [7]

Christophe Hansen, the EU's farm and food commissioner, called it a deliberate attempt to disrupt Europe's food supplies. [9]

One Delhaize shop in Hoeilaart, Belgium, said it lost 100,000 euros of food. [7]

Hansen said food security is not at risk, but the waste and the cost to shops are real. [9]

Engineers call machines run by computers over a network operational technology, and shop fridges are now part of it. [9]

Shops link fridges to the internet so engineers can fix them remotely. [7] Anyone who reaches those controls can also switch a freezer to defrost. [12]

It is like putting your home thermostat on a website, where a stranger can turn the heating right up.

Sabcobel says its units need physical changes, not just software updates, to close the weakness found in October. [7]

No group has claimed it. [10] A Sophos researcher's two likeliest explanations are a state showing what it can do, or a lone hacker. [10]

Someone also set the freezers in more than 115 European shops to as high as 50C. [6]

A Proxy Delhaize manager near Brussels had to throw away all of the store's fresh and frozen food. [8]

Who heated the freezers in Europe's shops.

No group has claimed it, and a Sophos researcher names two possible kinds of attacker, a state or a lone hacker. [10]

How many shops and countries the freezer attack reached.

BleepingComputer counted more than 115 shops in 6 countries. The BBC reports 7 countries, adding Finland. [6][7]

Most customers of Sabcobel, the Belgian firm that runs Delhaize's fridges, had moved their fridges onto secure connections after the French attack in October.

Britain's National Cyber Security Centre, the NCSC, part of the GCHQ spy agency, published its yearly report on Tuesday. [14][13]

Its head, Richard Horne, warned of a 'real prospect of an unprecedented rise in the number of cyber incidents'. [13]

He says the cause is old flaws that AI can now find and use at a huge scale. [13]

The report judges it highly likely that AI-powered malware hits British essential services in a ransomware attack by 2028. [14]

Essential services here include power stations, airports and hospitals. [14]

The NCSC will spend £70 million on a new centre that uses AI to find flaws across British industry. [13]

Horne said leaders who 'got away with tech on the cheap' must invest. [15] Otherwise they will have to explain empty shelves and dark homes. [15]

He called the recent attacks on supermarket fridges in Europe a warning to invest in defences. [14]

The NCSC calls years of put-off fixes and upgrades technical debt. [13] It says AI is now exposing that debt. [13]

State hackers often got in through flaws whose fixes existed but were not installed in time, the report says. [13]

It is like skipping a car's small repairs to save money, until the brakes fail on a busy road.

The NCSC says experts have not yet seen a matching rise in attacks that use these flaws. [13]

The NCSC calls an AI-powered ransomware attack on British essential services by 2028 'highly likely', a word for the odds of an event.

Mercado Bitcoin, a crypto platform in Brazil, stopped all deposits and withdrawals on Monday after a cyberattack. [16]

It calls itself Latin America's largest digital-asset investment platform, with about 4.5 million customers. [16]

Blockchain security firms said more than $46 million left the platform late on Sunday night. [16] Mercado Bitcoin has not confirmed that figure. [16]

The company published the addresses the stolen coins went to and said it would reopen in the coming days. [16]

Tether's chief executive said Tether froze about $4.5 million of the stolen coins. [16] Other platforms froze another $2 million. [16]

It came days after $6.3 billion was stolen from Binance, another crypto platform. [16]

Several crypto platforms have lost millions to hackers in the last 6 months, some more than $100 million each. [16]

Blockchain tracing means following stolen coins as they move, as Chainalysis is doing here. [16] Publishing where the coins went lets other firms freeze them. [16]

It is like giving every shop the serial numbers of stolen banknotes, so any till can refuse them.

Mercado Bitcoin says customers were not harmed. [16] Blockchain experts published evidence that some customer wallets were emptied. [16]

Whether Mercado Bitcoin's customers lost money.

The company says customers were not harmed, but blockchain experts published evidence that some customer wallets were emptied. [16]

Two hacking groups say they wiped servers at Rosstat, Russia's state statistics agency, over the weekend. [17]

They are the Belarusian Cyber Partisans, who oppose Belarus's government, and Silent Crow, which backs Ukraine. [17]

They say they spent months inside the network and reached about 25,000 computers and other devices. [17]

They also say they put Ukraine's figures on Russian army losses on Rosstat's servers for about an hour. [17]

Rosstat confirmed an attack but said it found no sign that protected data had leaked. [17]

The same groups hit Aeroflot, Russia's main airline, in July 2025, and more than 100 flights were cancelled. [17]

Rosstat holds Russia's population records, including data from the parts of Ukraine Russia occupies. [17]

A wiper attack destroys a target's computers and data on purpose. [17] Here the groups say they destroyed servers and storage systems. [17]

The groups say they spent 4 months quietly collecting data, then about a month preparing the destruction. [17]

It is like a burglar who copies every file in an office before setting fire to the cabinets.

The hackers' claims about what they destroyed and stole could not be independently checked. [17]

The hackers' claims carry no rating at all, and Rosstat answers that it found no sign of a leak, so neither side is on a scale.

They say they put Ukraine's figures on Russian army losses on Rosstat's own servers for about an hour. [17]

What the hackers really destroyed and took at Rosstat.

Their claims could not be independently checked, and Rosstat says it found no sign that protected data leaked. [17]

Synology, a Taiwanese maker of network storage boxes, told customers to update now as ransomware attacks surge. [18]

Ransomware locks a victim's files and demands a payment to unlock them. [14]

The attackers use a flaw that Synology fixed in December 2024, on boxes that were never updated. [18]

Victims found their files locked and a note selling a 'C3rb3r Decryptor' for thousands of dollars. [18]

Shadowserver, a group that watches the internet, counts more than 380,000 Synology boxes reachable online. [18]

Synology last warned of attacks like this in August 2019, so such alerts are rare. [18]

Shadowserver does not say how many of those boxes are already fixed. [18]

Their files were locked, and a note offered a decryptor for thousands of dollars. [18]

BTCPay Server is free software that lets shops take Bitcoin payments straight into their own wallets. [19]

Attackers have been draining 'hot wallets' on shops' servers running old versions, the project warned on Monday. [19]

They logged in as administrators on servers running version 2.4.1, from July, or older. [19]

Bitcoin and Litecoin were sent out in payments nobody had approved. [19]

On 29 October the project disclosed a critical flaw found by Anthropic's code scanner and released 2.4.7. [19]

The project asked hosting firms to take hit servers offline and told users to update to 2.4.7. [19]

Shops that lost money were asked to tell the project and their local police. [19]

The project says it has no credible reports of thefts from servers running 2.4.7. [19]

Attackers are using a top-danger flaw in Node-RED, a tool that automates machines in factories and plants. [20]

It is built into products such as Siemens' SIMATIC IoT2050, a gateway box for industrial machines. [20]

Siemens rated the flaw 10 out of 10 in August. [20] Affected devices ask for no password before their programs are changed. [20]

VulnCheck, a security firm, saw the first attack on 30 October on one of its decoy machines. [20]

The attacker tried to make the device download and run a Linux program named bot-linux-amd64. [20]

The Register links it to a wider rise in attacks on machines that act in the physical world, like fridges. [20]

VulnCheck calls this opportunistic mass scanning: one machine trying many old and new flaws on anything it finds. [20]

One address tried this flaw 16 times, plus 7 other flaws, including one 7 years old. [20]

It is like someone walking down a street trying every front door, not choosing one house.

VulnCheck did not download the program, so it cannot say what it does once running. [20]

The BYOD ransomware gang says it stole personal data on 1.3 million current and former Michigan State University students. [21]

The gang added the university to its leak site on Sunday evening. [21]

Michigan State says the claim is tied to an incident in early October. [21] It then made every student and worker reset their password. [21]

New passwords had to be at least 15 characters long. [21]

BYOD is a new gang that appeared in September, and little is known about it. [21]

Last week BYOD attacked the University of New Mexico and shut down its hospital. [21]

If the claim is true, it reaches former students as well as current ones. [21]

The university calls it a possible credential compromise: someone got hold of working logins. [21]

Resetting every password stops stolen logins from working, so Michigan State reset everyone's at once. [21]

It is like changing every lock in a building after one key goes missing, because nobody knows whose it was.

Michigan State says it has no evidence other university data was taken or changed. [21] It did not answer questions about the gang's post. [21]

Abrigo sells software to more than 2,400 US community banks and credit unions. [22]

It took its Sageworks lending app offline on 30 October after spotting 'irregular activity'. [22]

Lenders use Sageworks to process loan applications and check borrowers' finances. [22]

Most of the app is back, but the parts borrowers use are still off. [22]

Earlier this year someone claiming to be from the ShinyHunters gang said they stole 1.7 million records from Abrigo. [22]

Some researchers advised banks using Sageworks to change its access keys, though no break-in is confirmed. [22]

Abrigo has not said whether a break-in or a technical fault caused the outage. [22]

What took Sageworks offline.

Abrigo has not said whether it was a break-in or a technical fault. [22]

Attackers posing as a company's own IT help desk contacted staff on Microsoft Teams, Microsoft reported. [23]

They talked staff into opening Quick Assist, a Windows remote-help tool, and reading out its code. [23]

From that computer they got login certificates for powerful accounts from a badly set-up Windows certificate service. [23]

In one of the 2 break-ins Microsoft studied, company data was copied to an outside server. [23]

Microsoft did not name the group behind it. [23]

No Teams flaw was used, so there is no patch. [23] Microsoft's defence is staff checking any surprise support request through a known channel. [23]

Incident responders call cutting a hacked account off containment. [23] In the first case, one powerful account was left out of the automatic cut-off. [23]

The attacker kept using that one account to reach a file server and copy data out. [23]

It is like changing the locks after a burglary but forgetting the back door, the one the burglar uses.

Microsoft says such a certificate keeps working even after the account's password is reset. [23]

Criminals using companies' stolen AI access keys can run up more than $100,000 in charges a day, Google's Mandiant says. [24]

Mandiant is Google's team that responds to break-ins. [24] Some victims' bills reached $1 million before they cut the thieves off. [24]

The trick is called LLMjacking: using someone else's paid access to AI models. [24]

One service, Jet Night, sold unlimited AI use for about $60 a month, far below normal prices. [24]

Normal plans cost between $100 and $250 a month, and Google believes Jet Night runs on stolen keys. [24]

Google says locking down these keys also protects everyone else from a flood of cheap automated attacks. [24]

Researchers see a split of jobs: some criminals steal the access, others resell it through services Google calls LLM Mixers. [24]

It is like someone using a stolen phone to sell cheap calls, while the phone's owner pays the bill.

Jet Night has admitted outages, which Google says are likely stolen keys being cancelled by victims. [24]

They pay for the AI use that thieves run up, and some bills reached $1 million. [24]

IBM rated 2 flaws in Langflow, a free tool for building AI agents, 9.8 out of 10 for danger. [25]

They let an attacker with no account get past the login or run their own code on the server. [25]

Every version from 1.0.0 to 1.12.8 is affected, and the only fix is version 1.13.0. [25]

Metasploit, a public hacking toolkit, already includes a module for one of the flaws. [25]

6 other Langflow flaws are already on that US list of flaws used in attacks, the latest added in August. [25]

Langflow's automatic login signs users in as all-powerful superusers, with no password asked. [25] It was on by default in 1.12.8. [25]

It is like a new phone that arrives with no screen lock, until its owner sets one.

IBM gives no workaround for servers that cannot upgrade yet. [25]

Neither flaw was on the US list of flaws known to be used in attacks, as of 30 October. [25]

Trigger.dev, a cloud service for running AI agents and workflows, said on Sunday an attacker reached some customers' settings. [26]

The attacker took environment variables: settings that often hold passwords and keys to other services. [26]

Trigger says the way in is now blocked, and affected customers have been told what to do. [26]

Its listed customers include the fashion brand Emporio Armani and the calendar service Cal.com. [26]

The Register says stolen keys could let an attacker reach linked services, such as payments through Stripe. [26]

Trigger has not said which customers were hit, and told The Register to wait for a full report. [26]