Risky Bulletin: France blames Iran for supermarket freezer hacks

0:03France blames Iran for supermarket freezer hacks. The White House nominates Palantir's CISO as CISA director. Another Russian cloud provider gets hacked and Enable takes down its SaaS platform after a researcher discloses 33 vulnerabilities in it. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 11th of November and this podcast episode is brought to you by Airlock Digital. all. In today's top story, French officials have accused the Iranian cyber unit Shahid Kaveh of hacking refrigeration controllers at French supermarkets last month. Shahid Kaveh is part of the Iranian Islamic Revolutionary Guard Corp Cyber Electronic Command.

0:50The unit also operates the Cyber Avengers hacking group. After a month-long investigation, France found the attack impacted 700 retail stores but also hit butchers, food factories and a slaughterhouse. The attackers set freezer temperatures as high as 50 degrees Celsius, causing food to defrost and spoil. The high temperatures also caused fires in 15 locations. In other news, the Trump administration has nominated Palantir Chief Information Security Officer Michael Losapio to lead CISA. The agency has been without a director since Jen Easterly resigned in January 2025, shortly before President Donald Trump took office.

1:33Last year, the Trump administration nominated Sean Planky to lead the agency, but his nomination didn't progress through the Senate. The FBI has established a dedicated cyber branch to unify its offensive and defensive cyber units. In a NextGov opinion piece, FBI Director Kash Patel said the new branch eliminates redundant work and technical risk. The Australian Government will establish an AI safety regulator to manage risks posed by Frontier AI Labs. The new office will be set up via Australia's upcoming AI standards legislation. The new law will also require AI companies to report any security breaches caused by their agents.

2:17Hackers have stolen more than$6 million worth of crypto assets from Kepler cryptocurrency wallets. The attackers exploited a vulnerability in Web3Auth, a third-party component that allows users to log into wallets with their Apple or Google accounts. Kepler says the attackers drained funds from more than 44 ,000 wallets. In response, Web3Auth exploited the same flaw to move$5.6 million of Kepler wallet funds to secure locations. The Ethereum Swarm project has been hit with a supply chain attack. Attackers breached the project on Monday and added malicious code to the Swarm desktop app and BJS library.

2:58The code stole crypto wallet seed phrases and configuration files for B blockchain nodes. The Ethereum Swarm team urged users to move their funds before they're stolen. Hackers breached and encrypted the service of Russian VPS and cloud provider ESTT over the weekend. The company said it had restored about 90 % of infrastructure by Monday. ESTT is the third Russian cloud provider to be hacked in the past month after First VDS and BGET. Hackers breached AI training platform Fireworks and stole secrets and tokens from customer accounts. The breach took place last month. Fireworks linked the intrusion to an e-crime group that sells stolen tokens via illicit LLM routing gateways.

3:46Multiple cloud platforms have reported similar incidents. Fireworks is one of the nine AI-related platforms that got hacked in October alone. Private AI inference provider Near AI has also disclosed a security breach. The company says the hackers breached one of its SGLang servers and then pivoted to the rest of its network. The hackers stole data from around 100 user accounts, but only two of them had their API keys stolen. A threat actor has breached the QBOL Data Lake platform. According to security firms Centra and Wears, the attackers compromised QBOL's main AWS account and then pivoted to customer environments.

4:28Once inside, the attackers enumerated resources and then stole secrets and configuration files. The attackers were active in QBOL's environment for almost one month. The Philippine Securities and Exchange Commission is notifying taxpayers of a data breach that exposed their data. The agency confirmed the breach on Monday after hackers posted the stolen data online. The hackers claim to have stolen the private data of 10 million Filipinos, including their full names, email addresses, mobile numbers, dates of birth, genders, home addresses and tax identification numbers. Vanderbilt University told students and staff on Monday to turn off university-issued devices and disconnect from its Wi-Fi network.

5:15The university said it was dealing with a cyber attack and was rebuilding its IT systems. A ransomware group named BYOD took credit for the attack in a post on their dark web portal. It's the third US university the group has hit in the past month after Michigan State University and the University of New Mexico. Hackers breached Japan's disaster alert system and used it to send phishing emails. The attackers breached Arcadia's email service, stole over 3 million email addresses and sent more than 1.4 million spam messages. Arcadia shut down systems for weeks to investigate and evict the hackers.

5:57The system is used by police and fire departments, schools and private companies. Japanese authorities have arrested a Chinese national for driving across Tokyo with an SMS blaster in his car. Authorities identified the individual after the device disrupted the mobile network of a local telco. The SMS blaster sent out Chinese language smishing messages. It targeted tourists and tried to lure them to phishing pages with fake credit card suspension messages. Proofpoint researchers have developed a new phishing technique named Blue Phishing. The technique abuses blueprint consent, a process through which Microsoft creates entra-AI agents.

6:39If approved, the attacker can create malicious agents that can access organizations' Microsoft 365 tenants. Software company Enable has taken down its SaaS platform after a security researcher disclosed 33 vulnerabilities affecting it. The dump, codenamed Able2Shell, includes proof-of-concept exploits. The researcher Sean Bales says he published the vulnerabilities without notifying Enable after the company failed to patch previously reported bugs. Google has released a security update to patch an actively exploited Chrome Zero Day. The Zero Day is a memory management bug in Chrome's XML component.

7:21It's the eighth Chrome Zero Day so far this year. Vart has released a security update to patch an actively exploited Zero Day in the Zen Orchestra virtualisation stack. The zero-day authentication bypass flaw allows adversaries to perform admin-level actions. The attacks were discovered and reported by Danish ISP, TDCnet. Threat actors are exploiting two vulnerabilities in Barracuda Network's appliances to access corporate email servers. The vulnerabilities allow attackers to bypass authentication and inject commands on the devices. Barracuda patched the issues last week. In the wild exploitation was confirmed on Monday.

8:04And finally, Huawei has launched a desktop PC model made with entirely domestic components. The Chinyun HM650 model uses Kirin CPUs and runs Huawei's own Harmony OS and is priced from$1 ,000 to$1 ,500. And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them at airlockdigital.com. Thanks for your company.