In partnership with
| FACT | One cleared defense contractor employee's identity was used for at least 88 job applications at US companies, landing nine offers paying $120,000 to $190,000 a year. (CyberScoop, October 2026) |
|
The quiet infrastructure is getting loud. Devices nobody patches, apps everyone trusts and alerts people act on without thinking are now the attack surface, and this edition is about what happens when the boring stuff stops being boring. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
Critical Infrastructure / OT Europe's Supermarket Freezers Got Hacked Again, and This Time They Ran Hot Intro Three weeks after roughly 700 French victims had their store refrigeration tampered with, a second wave hit supermarkets across Europe early Monday, November 2. Retailers say freezers were remotely set to 50°C. What Happened Ahold Delhaize and Colruyt confirmed attacks, and The Record counted more than 50 affected sites in Belgium, a "limited number" in Sweden and over a dozen across Ireland, Estonia, the Netherlands and Luxembourg. Researchers point to internet-connected Danfoss and Copeland controllers that no longer get security updates; one Belgian installer says some units need physical changes, not just a patch. UK food suppliers were hit too, through Copeland XWEB controllers whose older firmware lets attackers in without a password. Why It's Important This is old, end-of-life kit that was never meant to face the internet, and it is now spoiling real inventory in at least six countries. Claroty warned about these units in August. The Other Side Nobody has claimed it, and Belgium's cyber agency says "it may never be possible to identify" who did. UK victims say they lost no stock, and the NCSC calls the impact "minimal" so far. | | 👉 Takeaway Find every building system, from fridges to HVAC, that answers on the internet, and pull it behind a VPN or offline. End-of-support gear is a liability, not a cost saving. |
TL;DR: A second wave of attackers cooked Europe's supermarket freezers through old, unpatched controllers. |
| | Password Manager mSeven Software emailed mSecure customers on November 3 about "suspicious activity associated with the mSecure password management application." It recommends changing passwords, resetting two-factor authentication and removing passkeys, but hasn't said what happened, when, or whether customer data was touched. Users with hundreds of saved logins are asking whether that means all of them. → mSecure user? Start with email, banking and work accounts today. |
| | Hardware Supply Chain An Indonesian buyer found an extra board with a cellular modem inside a Trezor Safe 5 bought in August from CryptoBilis. He says it reads the screen, recovery phrase included, and transmits it whenever the wallet is plugged in. Trezor dropped CryptoBilis October 9; Ledger drains tied to the seller top $93 million. → Bought from CryptoBilis since March? Move funds to a new seed now. |
| | Exploited / OT CVE-2026-58115 (CVSS 10) hits SIMATIC IoT2050 Advanced devices running Node-RED, whose HTTP interface has no authentication. Since October 30, VulnCheck's honeypots have seen attackers push malicious flows that download a Linux bot, and some plant a command endpoint that survives a reboot. Siemens flagged the bug in August. → Upgrade to Node-RED 4.3.4.1, or uninstall it and lock down the editor. |
|
Frontier models perform better in Attio’s agent harness.
We gave GPT-6 Astra the same job twice: analyze 100 sales calls and draft the follow-ups, once in Ask Attio and once in ChatGPT.
Ask Attio finished in 4 minutes 49 seconds. ChatGPT took 26 minutes 11 seconds, about 5.4 times as long.
The most ambitious GTM work requires more than frontier intelligence. It requires architecture that can put that intelligence to work at scale.
| | AI Malware Cisco Talos found VOLTA, a Windows stealer that sends each victim's stolen passwords, cards, seed phrases and keys through OpenRouter to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash on refusal. Out comes a "WHAT THEY'RE WORTH" dossier, checked against Gmail order receipts to confirm home addresses. It may be sold as a kit. → Infostealers now come with an analyst. Quit browser password saving. |
| | AI Supply Chain Glow Labs found coding agents in Claude Code, Cursor and Codex CLI installing deprecated MCP servers; in 98% of those sessions the agent picked the package from its training data, not the user. The packages have 17.3 million-plus npm downloads since July 2025, and four high-severity flaws in them, including remote code execution, have no fix. No exploitation seen yet. → Audit MCP configs for deprecated @modelcontextprotocol servers. |
|
| | Hacktivism Late Sunday, Kyiv users of the 6.6-million-user app got fake warnings of radiation, a chemical threat, street fighting and a possible Oreshnik strike; unknown group Hitcore Corp claimed it. Hours later, Kyiv-based DC8044 said it used Russia's EMERCOM app to claim nuclear warheads were headed for Russia. EMERCOM says its warning system was untouched. → An alert app is a broadcast channel. Guard its push access like a transmitter. |
| | Insider Threat John Allen Kurrle Jr., 62, held Top Secret/SCI clearance while letting foreign workers apply for remote jobs as him and hosting company laptops at home, prosecutors say. Per CyberScoop, one fake hire landed a generative AI project for a US military component until a video call exposed the mismatch. He says he didn't know of the North Korea link. → Live video ID checks still catch what background checks miss. |
|
| | Patch Now Barracuda disclosed CVE-2026-116606, a critical Email Security Gateway authentication flaw that can let attackers change an appliance's global configuration, and CVE-2026-111560, an admin-level command injection that runs as root across ESG, Load Balancer ADC, Message Archiver, WAF and Web Security Gateway. Chained, they reach root; no exploitation is reported yet, but ESG has been a zero-day target before. The play: apply each product's patch (ESG 9.4.017 or later) and expose admin interfaces only to trusted internal networks. |
|
North America buys up to 10 million tonnes of road salt from overseas each winter. Atlas Salt (TSXV: SALT) is building a closer source in Newfoundland, projected to generate C$188M a year.
 Strange but real The Ransomware Crew That Bought an AI Coding Army, Then Left the Door Open Intro The n0n gang spent thousands of dollars on AI to write its attack tools, then parked all of it on a public server anyone could browse. What Happened SOCRadar says the newcomer, which has claimed 108 victims since emerging in September, ran the OpenCode agent with 154 model entries across seven providers, from Claude, Gemini and GPT-5.x to "uncensored" models, for more than $7,216 by October 22. Its file server in Sweden exposed 1,719 files: attack scripts, ransomware source code and extortion tooling. The locker even had hardcoded encryption keys, apparently reused across victims. Why It's Important AI lowered the bar for writing malware, not for running an operation. n0n still got in the old way, with weak or stolen credentials, RDP and FortiGate VPN credential stuffing. The Other Side Sloppy is not harmless. The crew deleted backups, and in October it listed 38 maritime and logistics organizations with demands as high as $28 million. | | 👉 Takeaway Defending against AI-boosted crews looks a lot like the old basics: MFA on VPNs, rotated cloud keys and offline backups. |
TL;DR: A ransomware gang paid for an AI coding army, then left its whole workshop on an open server. |
“Running shos” shouldn’t return zero results. Gladly understands what your shoppers mean, typos and all, and finds the right products.
