A TraderTraitor's guide to getting away with billions.

The FBI blames North Korea for a record-breaking crypto heist. Hackers hijack air raid alerts in Ukraine and Russia. European supermarket freezers come under attack again. Aur0ra ransomware operators put AI agents to work. Android’s SMS of Death gets a proof-of-concept exploit. Malicious Claude Code extensions infiltrate Cursor’s marketplace. Google offers a quarter-million-dollar bug bounty. ChatGPT faces a wrongful death lawsuit. Monday business briefing. Our guest is Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Director of the FBI’s Cyber Division, sharing how the AI cybercrime economy is open for business and booming. The secure USB drive that wasn’t.

Today is Monday November 2nd 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

The FBI attributes last week’s record crypto heist to North Korea. 

The FBI has attributed last week’s theft of more than six billion dollars from cryptocurrency exchange Binance to North Korea’s TraderTraitor hacking group. Investigators say the attackers are converting stolen assets into Ethereum and laundering funds through decentralized finance platforms and instant swap services.

Blockchain analytics firm Elliptic reports that roughly 2.9 billion dollars has been frozen or seized, leaving approximately 3.3 billion beyond issuers’ reach, spread across hundreds of cryptocurrency wallets.

Binance says it will cover the losses, protecting customer funds. The company continues investigating what it calls a complex attack involving multiple perpetrators and a self-destruct mechanism designed to erase forensic evidence.

TraderTraitor has been linked to several major cryptocurrency thefts, including the previous record-breaking 1.5-billion-dollar Bybit heist.

Hackers target air raid alert systems in both Ukraine and Russia. 

Hackers targeted air raid alert systems in both Ukraine and Russia over the weekend, sending false warnings of nuclear attacks and other threats.

Ukraine’s official Air Alert app was compromised late Saturday, pushing messages in Russian warning of incoming nuclear strikes, chemical threats, and street fighting. Sirens also sounded across the country. Authorities temporarily disabled notifications, warned residents against clicking suspicious links, and restored normal operations within hours.

Early Sunday, Russia reported a similar attack on its emergency alert app. Users received bogus warnings that nuclear warheads had been launched across Russia, along with instructions to stockpile food and shelter in basements.

The Russian incident may have been retaliation for the earlier attack on Ukraine, although responsibility remains unconfirmed. Both countries acknowledged their systems had been compromised.

Supermarket refrigeration systems across Europe were once-again targeted. 

Supermarket refrigeration systems across Europe were once-again targeted, remotely raising freezer temperatures and spoiling food.

Monday’s attacks affected more than 50 stores in Belgium, along with retailers in Sweden, Ireland, Estonia, the Netherlands, and Luxembourg. Some freezers were reportedly set to 50 degrees Celsius, or 122 Fahrenheit.

The incident follows a similar attack three weeks earlier that affected roughly 700 supermarkets in France. Authorities haven’t identified the perpetrators or established whether the attacks are connected.

Some affected systems rely on discontinued refrigeration controllers that no longer receive security updates. Technicians say certain equipment requires physical modifications rather than software patches.

The incidents highlight the risks posed by internet-connected industrial equipment, particularly when aging devices remain accessible remotely. For supermarkets, the consequences are immediate: spoiled inventory and costly repairs.

The Aur0ra ransomware group is extensively using AI agents to automate intrusions. 

Sophos researchers say the cybercriminal group behind Aur0ra ransomware is extensively using AI agents to automate intrusions and evade security defenses.

The group, tracked as GOLD OGRE, reportedly used the AI coding tool Cursor to test endpoint security products and help conduct attacks. Human operators supplied credentials, network access, and objectives, then let AI agents handle reconnaissance, credential attacks, privilege escalation, and lateral movement with limited supervision.

Researchers observed agents adapting their techniques when initial attempts failed, sometimes gaining domain administrator access. Three organizations investigated were subsequently named on Aur0ra’s leak site.

The attackers also reportedly bypassed AI safety restrictions by describing their activities as authorized security testing.

Sophos warns that agentic AI could accelerate ransomware operations and lower the technical expertise required to carry them out.

The Android SMS of Death gets a proof of concept. 

A security researcher has published a proof-of-concept exploit for an Android vulnerability dubbed “SMS of Death.” Tracked as CVE-2026-58882, the zero-click flaw allows attackers to crash phones or disrupt cellular service, including emergency calls, using specially crafted text messages.

Victims receive no visible warning, and repeated messages can trigger reboot loops requiring a factory reset.

Google reportedly patched the vulnerability in October for Android 14 through 17, although the fix wasn’t listed in its security bulletin. Older Android 12 and 13 devices remain vulnerable.

Malicious versions of Anthropic’s Claude Code extension were distributed through Cursor’s marketplace. 

Attackers distributed malicious versions of Anthropic’s Claude Code extension through Cursor’s marketplace in a supply chain attack on October 29th.

Two compromised versions remained available for approximately eleven hours, potentially reaching 5,000 developer systems running Windows or macOS.

The malicious code collected system information and attempted to establish persistent remote access through reverse SSH tunnels. Cursor says those attempts generally failed because the extension lacked administrative privileges.

Anthropic confirmed its official distributions were unaffected.

Cursor removed the malicious extensions, temporarily suspended its marketplace, rotated security keys, and took steps to shut down the attacker’s infrastructure.

Affected users are urged to investigate their systems, since uninstalling the extension may leave malicious persistence mechanisms behind. Cursor has released detection tools and indicators of compromise.

Google offers a quarter million dollar bug bounty. 

Google is offering security researchers up to $250,000 for vulnerabilities that could enable complete administrative takeover of Google Cloud environments.

The expanded bug bounty program rewards exploits that grant unrestricted control over cloud projects or organizations without requiring stolen credentials, existing access, or social engineering.

Remote code execution in Google’s underlying production infrastructure may also qualify.

Google has established strict testing rules to protect customer systems, including a cryptographic method for demonstrating unauthorized access without compromising real accounts.

The company says AI-assisted research is helping uncover increasingly sophisticated vulnerabilities.

ChatGPT faces a wrongful death lawsuit. 

The parents of a 31-year-old Seattle software engineer are suing OpenAI, alleging that dangerous medical advice from ChatGPT contributed to their daughter’s death.

According to the lawsuit, Bowen Wan consulted the chatbot after losing her job, concerned that her epilepsy medication was affecting her English-speaking abilities during interviews.

The complaint alleges ChatGPT provided instructions for discontinuing her medication, discouraged consulting doctors, and reassured her when she began experiencing seizures.

Wan died from a seizure in February.

Her parents claim OpenAI failed to implement adequate safeguards, particularly for Chinese-language conversations.

OpenAI called the case heartbreaking, noting that Wan used an older version of ChatGPT. The company says newer models are better at recognizing medical emergencies, while emphasizing that ChatGPT cannot replace professional medical care.

Monday business briefing. 

Cybersecurity investors are opening their wallets, with cloud and AI security companies leading the latest funding rounds.

San Francisco’s Upwind Security tops the list with a $400 million Series C, followed by Estonian DDoS protection provider Blackwall, which raised $100 million.

Agentic AI security startup Infisical secured $40 million, while Israeli security operations company Mave emerged from stealth with $34 million.

Mobile security provider iVerify and confidential cloud startup Modelyo each raised $17 million. Ultra Security secured $10 million, industrial cybersecurity firm Indurex raised $7.8 million, and Northstar Security landed $7 million. QuestorAI and Cygrid each raised $3 million.

On the acquisition front, healthcare technology provider Tegria purchased cybersecurity and cloud hosting firm CloudWave. Forte Technologies acquired managed security provider Business Cyber Security Solutions.

And Belgian developer security company Aikido Security launched a new workforce security business called Noon, combining its acquisitions of Poland’s Cyberly and Belgium’s Outkept.

The secure USB drive that wasn’t. 

Security researcher Xusheng Li discovered that a Lenovo fingerprint-protected USB drive, advertised as offering AES-256 encryption, was essentially an ordinary SD card in an expensive disguise.

The fingerprint reader controlled access to the USB connection, but the data itself wasn’t encrypted. Anyone with physical access could simply extract the card.

Further investigation uncovered similar problems across multiple manufacturers, including hardcoded encryption keys, exposed passwords, and hidden accounts with simple credentials.

Using AI-assisted reverse engineering, Li cracked several supposedly secure products in minutes.

Lenovo has issued fixes for affected devices, although some require owners to ship their drives back or arrange firmware upgrades.

The research is a reminder that security claims aren’t always what they seem, particularly when manufacturers rely on proprietary technology nobody bothers to examine. As it turns out, some of these supposedly encrypted drives were keeping secrets from everyone except the people trying to steal them.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

And that’s the CyberWire Daily, brought to you by N2K CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.