Risky Bulletin: Hackers brick Chinese EVs in Russia

0:04Hackers brick Chinese EVs in Russia. A second wave of hacks defrost European supermarket freezes. The US boots Acronis from government networks. And the major distros patch a Linux kernel RCE. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 4th of November, and this podcast episode is brought to you by Sublime Security. In today's top story, hackers are locking Russian owners out of their Chinese EVs. The threat actors are demanding Russian owners of Li Auto cars cough up$500 to$600 to restore access to their vehicles. The hackers have been able to lock owners out of their cars by taking over online accounts linked to them.

0:54This is the second time Li Auto owners have been targeted like this. A similar incident took place in July. In other news, a threat actor has hacked freezers and refrigerators at dozens of European supermarkets and raised their temperatures to 50 degrees Celsius. The incident caused food to defrost and spoil at supermarkets in 12 European countries. The supermarkets estimate losses will run to tens of millions of US dollars. More than 40 of the affected supermarkets are owned by Ajo del Haze, which was scheduled to patch its refrigerators this week. This is the third refrigerator and freezer hacking incident in recent months, with hackers having already hit Department of Defense commissaries and French supermarkets.

1:42Ukrainian President Volodymyr Zelensky has confirmed his country's cyber forces hacked Russia's emergency alert system. Ukrainian operators pushed fake alerts about nuclear strikes in 33 Russian regions on Sunday night. In an interview with PBS, President Zelensky said Ukraine had acted in response to Russian hackers sending similar alerts through Ukraine's Air Raid alert app hours earlier. Cryptocurrency platform Binance has restored operations after suffering a$6.3 billion hack last week. The company's used its own reserves to cover 95 % of the losses. Half the stolen crypto has been frozen by other exchanges and is expected to be recovered by Binance.

2:29Chainalysis and Elliptic expect it will take months for North Korea to launder the rest of the stolen funds. In its post-mortem report, Binance said the hack involved a supply chain attack and a fake job interview that targeted one of its engineers. Hackers have stolen$49 million worth of crypto assets from Brazil's largest cryptocurrency exchange, Mercado Bitcoin. The hack took place on Monday. The company says it managed to freeze$11 million of the stolen crypto. Mercado Bitcoin says it will refund all affected users. A$49 million crypto theft seems a bit quaint at the moment, doesn't it? Threat actors are redirecting cryptocurrency payments being processed by BTC Pay servers.

3:14The servers are used by merchants to accept cryptocurrency payments. According to BTC Pay, the attack is a targeting service that didn't apply a security patch released in August. Estimated losses to date are just over$1.6 million. A cyber attack crippled Russian cloud hosting provider BGET on Monday. The attackers hit the company's DNS, email and backup servers. Biget didn't say when it expects to be back online. A breach of the Armadeus travel reservation platform has exposed passenger data from at least six airlines. Qantas, Japan Airlines, All Nippon Airlines, Cathay Pacific, Malaysia Airlines and Korean Air have all disclosed impact from the Armadeus breach in recent weeks.

4:03The Armadeus intrusion took place in September. Other airlines were also likely affected. Web application firewall CP Guard says hackers hijacked the app's update mechanism and deployed malware to customer servers. The incident took place on Monday. The malicious update collected password data, database config files, shell history, SSH authorization and known hosts files. Password manager M-Secure is investigating a potential security breach after discovering suspicious activity on its servers. The company has notified users and urged them to reset their passwords, 2FA methods and passkeys. Both current and former customers received notifications.

4:53Russian data centre operators have been ordered to allocate 10 % of their resources to hosting government services. Russian President Vladimir Putin signed a decree on Monday, which came into effect immediately. The Kremlin signed the decree after recent Ukrainian drone strikes crippled major Russian data centres. Germany's Cybersecurity Agency says members of the German Parliament have been targeted with mercenary spyware. The agency, BSI, learned of the attacks after Apple notified spyware targets last week. Some of Chancellor Mertz's allies and staff were among those who received the warnings.

5:35The US government has ordered federal agencies to remove Acronis software products from their networks. A government investigation found the Swiss-based company was still controlled by Russian investors and Russian developers were still involved in managing its code bases. The investigation began years ago and spanned multiple White House administrations. Google and industry partners have dismantled the XCPE botnet, which was made up of 1.3 million set-top boxes. Google linked the botnet to Video Strong Technology, which is an authorised Android equipment manufacturer. The company deployed the XCPE backdoor on its devices and then rented out access to the botnet to criminal groups.

6:20The botnet was used for advertising fraud, residential proxying, DDoS attacks and credential stuffing attacks. Russian authorities have arrested three members of the Varsigrek hacking group. Also known as FluffyWoof, the group's been targeting Russian companies since at least 2020. The group staged phishing campaigns and deployed malware rented from other crime groups such as Pay2Key and PureCryptor. Europol has disrupted a company that provided criminal groups with server infrastructure and fraud websites. Authorities seized more than 100 servers and detained seven suspects during a raid on Tuesday.

7:02German authorities are seeking to extradite the suspects in connection with investment scams. The major Linux distros have released security fixes for a remote code execution attack in the Linux kernel TCP networking stack. Debian, Red Hat and SUSE have all pushed patches. Anthropic found and disclosed the bug last month. The vulnerability impacts all kernel versions released in the past decade. Canonical is still working on a fix for Ubuntu. Threat actors are attempting to hack industrial devices by exploiting vulnerability in a lightweight web server used to host their web panels. Attacks against Node Red were detected against Canary servers last week.

7:47The bug they're exploiting was patched in August. Microsoft Edge will automatically disable browser notifications from websites caught sending fake virus and malware alerts. The new feature shipped last week with Edge v156. And finally, the newest Android operating system is installed on less than 1 % of all Android devices, despite being released four months ago. Android 16 is currently the most widely used release, with 25 % of devices running it. More than 50 % of Android devices are running a recent release that's still supported. And that is all for this podcast edition. today's show was brought to you by our sponsor sublime security find them at sublime.security thanks for your company