Daily Briefing for 11.02.26

Top stories.

1. FBI attributes $6 billion Binance heist to North Korea.
2. More cyberattacks target European supermarket refrigeration systems.
3. LLMJacking attacks exploit enterprise AI usage.
4. Aur0ra ransomware operators use AI to automate operations.

FBI attributes $6 billion Binance heist to North Korea.

The US Federal Bureau of Investigation (FBI) has formally attributed last week’s $6 billion Binance hack to North Korea’s TraderTraitor group. The Bureau stated, “The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

The FBI has provided a list of addresses associated with TraderTraitor, adding, “FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."

More cyberattacks target European supermarket refrigeration systems.

Another wave of cyberattacks hit refrigeration systems at European supermarkets early this morning, raising temperatures and spoiling food, the Record reports. The attacks affected dozens of stores across Sweden, Belgium, Ireland, Estonia, the Netherlands, and Luxembourg. 

No motive has been identified, nor has the attack been attributed to any group. Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium (CCB), told the Record, “It is not known who is behind this attack, and it may never be possible to identify them.”

A similar attack hit around 700 grocery stores in France last month, causing damage estimated in the tens of millions of euros. No motive has been identified in that attack, either.

LLMJacking attacks exploit enterprise AI usage.

Google’s Threat Intelligence Group (GTIG) and Mandiant have published a report on “LLMJacking,” a relatively new technique in which threat actors hijack enterprise access to Large Language Models (LLMs) and rack up charges exceeding $100,000 in resource consumption per day. In some cases, attackers’ AI usage generated charges up to $1 million before their access was revoked.

The researchers say the goal of these attacks is “the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.”

The attackers generally gain initial access by targeting backend resources directly, “either identifying publicly exposed LLM endpoints or obtaining valid LLM application programming interface (API) keys.”

Aur0ra ransomware operators use AI to automate operations.

Sophos researchers say the cybercriminal group behind Aur0ra ransomware is making extensive use of AI agents to automate intrusions and evade security defenses.

The researchers explain, “Intrusions were orchestrated by Cursor's Composer agentic coding model as well as AI models provided by Anthropic, xAI, and Moonshot. Analysis indicates that the threat actors initially used Anthropic almost exclusively but then introduced other models. The shift may be related to the threat actors’ objectives, as they transitioned from building tools to conducting intrusions.”