By the N2K CyberWire staff
Top stories.
- US government warns of cyberattacks targeting refrigeration systems.
- FBI attributes $6 billion Binance heist to North Korea.
- Apple warns German politicians of spyware targeting.
- Chainalysis breach affected all customers.
- Google disrupts a major Android botnet.
US government warns of cyberattacks targeting refrigeration systems.
The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on Thursday warning of attacks targeting industrial refrigeration and cold chain monitoring systems. These attacks have targeted supermarkets across Europe in recent days, as well as a French blood bank, spoiling food and attempting to ruin blood supplies. The Pentagon is also investigating freezer malfunctions at US military bases as potential cyberattacks, Reuters reports.
Thursday's advisory, issued jointly with the FBI, Health and Human Services (HHS), the US Department of Agriculture (USDA), and the Department of Transportation (DoT), urges operators to defend against these attacks by “using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.”
See attack paths across AWS, Okta, GitHub, and more
BloodHound Enterprise extends attack path management across your hybrid environment, mapping how identities, permissions, and trust connect across AWS, cloud, and identity providers so teams can find and break the paths that reach critical assets. Try BloodHound Enterprise today.
FBI attributes $6 billion Binance heist to North Korea.
The US Federal Bureau of Investigation (FBI) has formally attributed last week’s $6 billion Binance hack to North Korea’s TraderTraitor group. The Bureau stated, “The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”
The FBI has provided a list of addresses associated with TraderTraitor, adding, “FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."
Why analysts continue to recognize Thales as a DSPM leader
As organizations struggle to secure sensitive data across hybrid and multi-cloud environments, they're looking for DSPM solutions that do more than identify risk. Thales was recognized as a leader by Omdia, KuppingerCole, and Frost & Sullivan for its Data Security Posture Management capabilities. Thales attributes this leadership to its ability to help customers not only identify risks, but also remediate them through integrated data protection controls.
Apple warns German politicians of spyware targeting.
Germany’s federal cybersecurity office, the BSI, has disclosed that several members of the German Bundestag were targeted by mercenary spyware, TechCrunch reports. The BSI says the politicians received threat notifications from Apple.
Apple last week sent out a new wave of threat notifications to users targeted by spyware, warning users in 99 countries that their devices were potentially compromised. While a threat notification does not necessarily mean a device was hacked, the BSI says users who received these notifications “assume that their device may have been compromised.”
Privileged Access Management is changing. So is the Gartner® MQ.
Privileged access now extends beyond traditional administrator accounts to vendors, machines, applications, workloads, and AI identities. See how Gartner evaluates the PAM market and where Xage Security is positioned in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management. See the 2026 Gartner® Magic Quadrant™ for PAM.
Chainalysis breach affected all customers.
Blockchain intelligence company Chainalysis has disclosed that all of its customers’ names, usernames, password hashes, and live tokens were exposed in a recent breach by a malicious actor, BleepingComputer reports. The firm’s customers include the major financial institutions, international law enforcement agencies, global regulators, and the top cryptocurrency exchanges.
Chainalysis stated, “At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated. Recognizing the importance of our compliance transaction monitoring products to our customers’ businesses, we implemented additional proactive monitoring systems for unusual activity. Today, we discovered abnormal activity and took KYT (the user interface and API) offline alongside other address screening products and the login page. We are directly notifying customers whose KYT accounts appear to have been accessed without authorization.”
Where cyber leaders come together to turn challenges into action.
The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.
Google disrupts a major Android botnet.
KrebsOnSecurity reports that Google and industry partners have disrupted a botnet composed of more than 1.3 million backdoored Android TV set-top devices. The Google Threat Intelligence Group (GTIG) said in a blog post that the compromised devices were manufactured and knowingly backdoored by Videostrong Technology Co., a China-based Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM).
The botnet malware, dubbed “XCPE,” conducted ad fraud, enrolled victims’ Internet addresses into residential proxy services, and enabled the installation of additional malware. GTIG says Videostrong operated the botnet for financial gain, and the researchers “believe this campaign wasn’t an isolated rogue insider or a development oversight.”
Google used legal action to dismantle the botnet’s infrastructure, and the company has banned Videostrong from building and selling certified Android devices in the future.
