Cyber, in brief

Hackers hid code on real and fake websites to break into iPhones and Android phones that visited. [1] The attack needed no tap from the visitor. [2]

Sekoia, a French security firm, found the campaign in mid-October. [4] It published the work on 4 November. [3]

Sekoia ties it, with moderate to high confidence, to a hacking group called APT29. [3] APT29 is widely linked to Russia's Foreign Intelligence Service, its spy agency abroad. [3]

The attacks worked only on phones that had missed updates. [2] Apple and Google had already fixed all the flaws. [1]

The attackers used 8 known flaws across iPhones and Android phones. [3]

Sekoia says several sites are likely to draw important visitors in the war between Russia and Ukraine. [4] Army, special forces and drone-equipment sites were among them. [4]

A 2024 APT29 campaign on Mongolian government sites took cookies only for chosen websites. [3] This one took any cookie in the browser. [3]

Threat analysts call this a watering hole attack: the hackers poisoned websites and waited for visitors' phones to arrive. [1]

The hidden code reads each phone's software version, so the server picks an attack that still works on it. [1]

A pickpocket waits at the busy station everyone passes through, rather than knocking on each door.

The link to Russia rests on similar past attacks and overlapping online systems, Sekoia says. [1] It is a judgement of moderate to high confidence, not a proven fact. [3]

Sekoia says a phone running up-to-date software is safe from these attacks. [3]

US federal agencies have until 18 November to patch that flaw. [5]

Sekoia says packaged kits cut the cost and skill needed, so state hackers now reuse them. [4]

How many phones the Russian-linked attackers actually broke into.

Sekoia did not say how many devices were compromised. [3]

Whether the attackers wanted particular people or anyone at all.

Sekoia says it remains unclear whether they aimed at visitors to certain sites or took from as many old phones as they could. [4]

Credit Mutuel Arkea, a big French banking group, confirmed on 4 November that hackers took money from it. [6] A crypto investigator puts the theft above $133 million. [6]

That investigator, ZachXBT, works under a false name and first reported the theft on Monday. [6] The figure comes from tracing withdrawals from crypto exchange accounts. [6]

The bank would not confirm the figure, but said it could "validate the order of magnitude". [6]

The hackers went through the platform of a service provider, which the bank has not named. [6] That gave them direct access to the banking group. [6]

They then used the bank's own account to send money to other banks. [6] The bank says that money may then have been turned into crypto. [6]

The bank says customer accounts were not reached and customers' money is safe. [6] It says the loss is "absolutely not of a nature" to threaten its finances. [6]

Risk managers call this third-party risk: Credit Mutuel Arkea's attackers came through a supplier, not the bank's front door. [6]

The supplier's platform could reach the bank, so taking over that platform carried the attackers inside, the bank says. [6]

Someone holding the office cleaner's keys walks straight past the front desk.

ZachXBT says the attack ran over several days. [6] The bank says its systems spotted the activity very quickly. [6]

The bank also disputes French press reports that the way in was Fortuneo, its online bank. [6] It calls the attack sophisticated and not human error, and gives no further detail. [6]

Some of the converted money has been frozen, and the bank is working to recover the rest. [6]

Credit Mutuel Arkea says its systems spotted the attack very quickly, and that is reassuring to hear, but the bank gave no dates that would let anyone check it. [6]

How much Credit Mutuel Arkea really lost, and through which supplier.

The bank says the final loss is not established, and it has not named the supplier. [6]

Hackers changed settings on cold rooms at 3 sites of France's national blood service on 2 November. [8] The service, EFS, supplies blood to French hospitals. [8]

The rooms normally sit at minus 30C, and the setting reportedly went to 110C. [9] That does not mean the rooms or the blood reached that heat. [10]

The rooms hold frozen plasma for transfusions and blood samples. [9] EFS itself was not the direct target; its fridge supplier was. [8]

Coolworld, a Dutch fridge rental firm, confirmed an incident with its remote monitoring software. [10] It says the flaw was in another supplier's part. [8]

Shop fridges were also hit this week, in 8 European countries by one count and 10 by another. [12][9] France's health ministry says remote access to the blood fridges is off. [13]

Coop in Sweden has also cut its 7 hit shops' fridges off from the internet. [12]

Ahold Delhaize, a Dutch supermarket group, expects October's attack to cut quarterly sales by up to 250 million euros. [13]

Security researchers call a decoy system a honeypot: 3 firms set up fake fridge software to watch these hackers. [11]

Decoys run by Lupovis, a Scottish firm, saw probing 10 days before the second wave. [11] Only decoys placed in Europe were probed. [11]

A shop leaves a marked wallet on a table to learn who picks it up.

Russian hacktivist groups say they hacked Danfoss, a fridge-control maker. [11] Sekoia says it has no technical evidence that Russian-speaking groups were involved, and one group has made false claims before. [11]

Coolworld's statement, as reported, names neither the part nor the supplier it says was at fault. [8]

Why the days an intruder stays decide how many people get hurt

An intruder gets in, and nothing breaks that anyone can see

Ordinary work carries on, so people keep logging in and booking

Each new person adds their details to what the intruder can read

The number of people hurt keeps growing until someone notices

Responders count back to the first day, and the total jumps

Two attacks can use the same way in. The one that stays longer reaches more people, because new customers keep arriving while it is there.

How long each intruder had access, rounded to the nearest month or week. Plerdy lasted a week and Amadeus just over 3 years, from dates in the stories above.

On Japan Airlines' dates, new bookings kept entering the system from August 2023 to September 2026, so every passenger in those years joined what could be read.

Only people who logged in to the file manager during those months lost a password, so each week added more of them.

Every player who opened the launcher after 27 September ran the changed files, a researcher says, so each new launch could add a victim.

A break-in through a supplier was caught in one night, when a technician saw the temperature rise, and no blood was lost.

Dwell time is known only after the fact, and it counts from the first sign found, so the real first day may be earlier.

If Japan Airlines' dates are right, a passenger who booked a flight in 2025 could not see that someone was already inside the firm their airline had chosen, and the airline could not see it either.

France's blood service was the opposite case, because a technician saw a fridge temperature rise overnight and no blood was lost. [10]

Who hacked the fridges at France's blood service and in Europe's shops.

No formal blame has been made, and Sekoia's own report points to both Russian and Iranian actors. [11] The Register says it is unclear whether the blood stores were reached the same way as the shops. [9]

France's blood service lost no blood or plasma after hackers set its cold rooms to heat up. An on-call technician saw the temperature rise overnight, and staff moved the stock.

At least 7 Asian airlines have now reported data thefts traced to Amadeus, a Spanish firm that runs airline bookings. [14][15]

6 are Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines and Malaysia Airlines. [14] Local media also reported All Nippon Airways. [15]

Japan Airlines counts 92,000 customers, Cathay Pacific 53,000 records and Singapore Airlines 46,000 records. [14]

Japan Airlines says Amadeus told it the access ran from 10 August 2023 to 23 September 2026. [15] Cathay Pacific gives those months for the bookings hit. [16]

Some records held passports, frequent flyer numbers and email addresses. [14] Amadeus says it saw no sign that payment data was reached. [14]

Amadeus serves over 400 airlines and 210 airport operators. [15] It says it has fixed the flaw. [14]

Singapore Airlines will contact people with upcoming flights to change their exposed booking numbers. [14] It also warned customers to be wary of malicious emails. [14]

Amadeus told one airline the intruders used login details for a system account. [14] How they got those details has not been explained. [14]

On Japan Airlines' dates, new bookings kept entering the system from August 2023 to September 2026, so every passenger in those years joined what could be read.

Singapore Airlines passengers with upcoming flights must change their exposed booking numbers, and it has told customers to be wary of malicious emails. [14]

How long the intruders were really inside Amadeus.

Japan Airlines says access ran from August 2023 to September 2026, while Cathay Pacific gives those months for the bookings affected. [15][16]

How many people Amadeus's break-in reached in total.

Amadeus declined to say how many victims there are, so the only counts come from each airline. [14]

Anyone could rent internet addresses from the White House network for a few dollars, security firm Layer3 Intel found. [7]

Computers or phones of staff there seem to carry proxy software. [7] It lets strangers send their web traffic out through that device. [7]

Layer3 counted 236 exits through that network between 5 October and 3 November. [7]

The traffic used 6 addresses on 26 of 30 days. [7]

Layer3 found 28 separate proxy services could exit through this network. [7]

Synthient, another tracking firm, linked some to Windows 11 computers running Infatica, a proxy often bundled with free apps. [7]

Infatica's founder is Vladimir Fomenko, a Russian. [7] His hosting firm, King Servers, held 6 of the 8 addresses Russia's spies used against US election databases in 2016. [7]

Spur, a tracking service, found such software on nearly 300 government networks and 318 utilities in January. [7]

It also found it at 166 healthcare firms and 141 finance firms. [7]

To a website, the traffic looks as if it comes from the White House network, not from the renter. [7]

Network security calls this a residential proxy: other people's traffic leaves through a real user's device and address. [7]

App makers can embed proxy code and earn a small sum per install. [7] So a free app on a device brought to work can turn it into a rented exit. [7]

A stranger signs your name at the club door, and staff see only your name.

Layer3 says it found this by chance, without aiming at the White House network. [7] The White House did not immediately reply to questions. [7]

Some resellers charge as little as 60 cents a gigabyte, and buyers can skip identity checks, Synthient's founder says. [7]

Whose devices at the White House were carrying proxy software, and whether anyone misused them.

The tracking firms report the traffic and the software and name no person, and the White House had not replied. [7]

DreamHost, a US web host, says an intruder was inside its web file manager from August until 23 October. [17]

The intruder took upload logins and passwords from anyone who used that file manager in those months. [17]

Some webmail sessions may have been exposed too, DreamHost says. [17] TechCrunch reports hackers stole customer emails and credentials. [18]

A spokesperson says well under 10% of customers were hit. [18] DreamHost claims about 400,000 paying customers. [18]

DreamHost says it found no sign of access to control panel logins or card details. [17] It has closed the flaw and cancelled passwords and active sessions. [17]

DreamHost is telling those affected to check website files and email forwarding rules. [17]

Security engineers call this session hijacking: with a stolen DreamHost session, an intruder can act as that user. [18]

A session token keeps someone logged in after the password check, so stealing it skips that check. [18]

A festival wristband gets you back in without showing your ticket again.

DreamHost declined to say why it did not detect the attack until last week, citing the investigation. [18] It has not named the flaw. [18]

Only people who logged in to the file manager during those months lost a password, so each week added more of them.

Several of today's breaches were found long after they began: Japan Airlines says the access at Amadeus ran for just over 3 years, and DreamHost's intruder stayed about 2 months. [15][17]

They are told to check their own website files and email forwarding rules for unauthorised changes. [17]

How many DreamHost customers lost their login details.

DreamHost says only well under 10% of about 400,000, and left BleepingComputer's questions on the count unanswered. [17][18]

Zyxel, a maker of network gear, has fixed a new flaw in its GS1900 switches, boxes that link computers. [19]

GreyNoise, a firm that watches attacks, counted 996 switches hacked across 48 countries from around 17 August. [19]

The hackers took device settings and scrambled administrator passwords. [19] GreyNoise links them to a suspected Chinese-speaking group it calls Kapibala. [19]

At first GreyNoise and CISA, the US cyber-defence agency, blamed an older flaw Zyxel had fixed in June. [19]

Then Binarly, a firm that studies code inside devices, found the hackers' tool in an exposed archive. [19] It still worked on all 10 firmware versions patched in June. [19]

Zyxel confirmed the new flaw on 11 October and released updates on 22 October. [19] It published its advisory on 3 November. [19]

Switch owners who installed June's fix were still open to this tool until the October update. [19]

Software engineers call this an incomplete fix: June's Zyxel update added a check, and the attackers got past it. [19]

The check trusted a counter that the attackers could change first, so the check passed. [19]

A door count looks fine if someone resets the clicker before the guard reads it.

Zyxel classes this as a separate flaw. [19] It is unclear whether the tool was built to beat June's fix or used a related hole the fix missed. [19]

OpenAI says an upcoming AI model produced 948 working attacks on Linux in a 30-hour run in mid-October. [35]

Each lets someone already on a computer as an ordinary user take full control of it. [35]

The run looked at 2,308 possible flaws and reproduced 1,724 of them. [35]

It cost $1,213,430 in AI credits, or $1,279 per attack. [35]

Human researchers review each attack and its fix before reporting it to the Linux maintainers, OpenAI says. [35] In June, its earlier model had found 24 such attacks. [35]

Google's threat team says flaws disclosed each month rose from 5,045 in January to 10,740 in August. [35]

Britain's cyber agency says AI tools have almost certainly led to more unknown flaws being found. [35]

Security researchers call this exploit development: proving a flaw can really be used, as OpenAI's run did 948 times. [35]

Each proof cost OpenAI $1,279 in AI credits. [35] VulnCheck, a firm that tracks flaws, says such tools already let novices find flaws with little skill. [35]

A metal detector finds coins for a treasure hunter and for a thief alike.

These figures come from OpenAI's own report, and the model behind them is not yet released. [35]

Beget, one of Russia's largest web hosts, says attackers erased data across its cloud services overnight on Sunday. [20]

They got into the systems used to manage its computers, then ran scripts built to erase data. [20]

All binary backups of its rented virtual servers were lost as well. [20] File-level backups survived and may recover some data. [20]

More than 1,000 servers must be checked by hand before they come back, Beget says. [20]

Beget ranks second among registrars of Russian .RU web addresses, with about 540,700, or 14.7%. [20]

The European Union sanctioned Beget this year over services to Russian occupation authorities in Ukraine. [20]

Small and mid-sized firms that host online shops on Beget were mainly affected, the newspaper Kommersant reported. [20] Chestny Znak, Russia's product labelling system, was also disrupted. [20]

Disaster-recovery planners keep an offline backup, one copy no main system can touch; Beget lost all its binary backups. [20]

Beget's file-level backups survived, and it says nearly all shared websites can likely be recovered. [20]

Keeping the only spare house key inside the house does not help when you are locked out.

Beget found no sign that attackers copied customer data, but it tells customers to change passwords and keys anyway. [20]

It has told customers the attack may count as force majeure under Russian law, which could excuse it from some contract duties. [20]

Their online shops depend on servers that must be checked one at a time, and some virtual server data may not return. [20]

Who wiped Beget's servers and how they got in.

Beget has not said how the attackers entered, citing its investigation, and no group has claimed the attack. [20]

Hackers got into the website system and newsletter service of the Kyiv Independent, a Ukrainian English-language news outlet. [21]

They emailed false messages to subscribers in Russian and English. [21] One claimed President Zelensky had launched a nuclear warhead at Kyiv. [21]

Others made up an attack on Zelensky. [21] False posts also went on the website, and staff quickly removed them. [21]

The outlet says it has nearly 3 million monthly readers and over 35,000 paying members. [21]

Members' bank details were safe, it says, because outside services process payments. [21]

It came days after hackers sent fake nuclear alerts through Ukraine's air raid app. [21] No link between the two is confirmed. [21]

The editor, Olga Rudenko, called it "an attempt to sow confusion and erode trust". [21]

Communication researchers call it source credibility: these hackers used a trusted outlet's newsletter to carry a false claim. [21]

Subscribers had signed up to that newsletter, so the false email came from a name they already read. [21]

A prank note feels real when it arrives on the head teacher's own paper.

The outlet blames suspected Russian actors because of what the messages said. [21] It gave no technical evidence for that. [21]

Xen is software that runs many virtual computers on one real machine. [34] Two new flaws let one of them read and write the others' memory. [34]

That includes dom0, the virtual computer that manages all the others. [34]

Every Xen version from 4.6 on is affected, the Xen Project said on 3 November. [34] There is no known workaround, only the patch. [34]

Xen credits Anthropic, an AI company, with finding the flaws using its Claude model. [34] Ada Logics and CodeAnt AI also confirmed or reported them. [34]

Qubes OS, a security-focused desktop system, says every supported setup is affected. [34] Debian still listed 3 of its releases as open on 4 November. [34]

XCP-ng, a platform built on Xen, says a single compromised guest can take over the whole host. [34]

Operating-systems courses call this isolation: each virtual computer may touch only its own memory, and Xen checks that. [34]

To save time on a batch of copies, Xen reused checks it had already made. [34] Sometimes it did not check again when it should have. [34]

A guard checks the first badge in a group and waves the rest through.

Xen 4.6 to 4.16 are affected, yet the advisory has no patch for them. [34]

Xen's advisory mentions no attacks using these flaws, and patches came with it. [34]

A flaw in APT, which installs software on Debian and Ubuntu Linux, lets an attacker swap a checked package. [33]

The attacker's code then runs with full control of the computer. [33]

The attacker must be able to change the download traffic, as a bad mirror or proxy could. [33]

It relies on APT retrying failed downloads, which it does by default from Debian 12 and Ubuntu 22.04. [33]

Debian, Ubuntu and APT's developers all published notices on 4 November. [33] Debian has released fixes, and Ubuntu is releasing its own. [33]