Thursday, 5 November 2026 — today's briefing covers a coordinated European refrigeration cyberattack hitting French blood banks and supermarkets, a major Amadeus IT supply chain breach affecting six Asian airlines, Kremlin-linked iOS and Android watering hole attacks, and the discovery of White House staffers running residential proxy software. Also: a $133M French bank cyber heist, Chrome 157 with 213 security fixes, CISA flagging WordPress RCE as actively exploited, the XCPE botnet takedown (1.3M devices), and INC RANSOM's 20+ victim surge including Unilever and Stoke Damerel Community College in the UK.
Security News
Cyberattack disrupts blood storage refrigeration systems in France (BleepingComputer) — Attackers compromised a refrigeration supplier to manipulate temperature settings at three French blood bank facilities, part of a coordinated wave hitting European supermarket refrigeration simultaneously.
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus (The Record) — Japan Airlines, Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines, and Malaysia Airlines all disclosed breaches traced to Amadeus IT Group.
Hackers use n-day exploits in zero-click attacks on iOS, Android devices (BleepingComputer) — Kremlin-linked actors exploited patched iOS and Android flaws in a large-scale watering hole campaign targeting websites including a US 250th anniversary portal.
Want to Rent an Internet Address at the White House? (Krebs on Security) — Several White House staffers' devices are enrolled in residential proxy services, including one linked to a Russian company.
French bank confirms cyber heist — estimated $133 million stolen (The Record) — Crédit Mutuel Arkéa confirmed attackers used the bank's own account to execute transfers after compromising a supplier.
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical (SecurityWeek) — Update immediately; fixes include critical memory safety bugs and missing authorisation issues.
CISA flags WordPress RCE flaw as actively exploited in attacks (BleepingComputer) — High-severity WordPress vulnerability confirmed exploited in the wild; added to CISA's Known Exploited Vulnerabilities catalogue.
Google Calendar phishing campaign hijacks sessions, bypasses MFA (BleepingComputer) — Operation CloudFire used Calendar invites and trusted redirects to hijack corporate Google sessions; ~900 domains taken down.
Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet (Dark Reading) — Google alleges Android manufacturer Videostrong ran the operation, infecting set-top boxes with a backdoor.
DreamHost confirms data breach exposed FTP logins and webmail sessions (BleepingComputer) — Attackers had access for two months; FTP/SFTP credentials compromised.
CISA Known Exploited Vulnerabilities
WordPress Remote Code Execution vulnerability — Added to the KEV catalogue; active exploitation confirmed. Patch immediately.
HIBP
Harvard University — 850,537 records. Exposed: names, email addresses, dates of birth, ethnicity, employment, job titles, charitable donation data.
NCSC
Artificial intelligence and cyber intrusion — Published 3 November 2026. NCSC assessment of AI-enabled threat trends and projections to 2028.
Ransomware Activity
83 victims across 18 groups (last 48 hours)
INC RANSOM (30+)
Coeur Mining 🇺🇸 (Mining); Minco Silver 🇨🇦; Patel & Panchal 🇮🇳 (Accounting); Pomer & Boccia PC 🇨🇦 (Legal); Kalahari Resorts 🇺🇸 (Hospitality); Beaver County Government 🇺🇸; Somervell County Government 🇺🇸; Stoke Damerel Community College 🇬🇧 (Education); Audacie Inc. 🇨🇦 (949.5GB); Tanner Clinic 🇺🇸 ⚠️ (Healthcare); PolyVista 🇺🇸 (IT); Shenwan Hongyuan 🇨🇳 (Financial); Retail inMotion 🇮🇪 (Aviation); Richardson Pullen & Buck 🇺🇸 (Law); Overum Agro 🇸🇪; Millimed 🇹🇭 ⚠️ (Pharma, 3TB); D.L. Steiner 🇺🇸; dunbarandboardman 🇦🇪; Association ENSEMBLE 🇫🇷; BCP Systems 🇺🇸; Avolta AG 🇨🇭; Nota Groep 🇳🇱; KOLIN Construction 🇹🇷 (prev. Qilin); American Council on Education 🇺🇸; Roane Transportation 🇺🇸; PT Forisa Nusapersada 🇮🇩 (2.8TB); Stadtwerke Waldbröl 🇩🇪
medusalocker (18)
MSN 🇺🇸; DIAN 🇨🇴 (Colombian Tax Authority); Vinitgloves 🇮🇳; Jobmongers 🇬🇧; Laval University 🇨🇦; Hirschinjurylaw 🇺🇸; Interativa Plasticos 🇧🇷; Ruixiang Jidian (elevator manufacturer); The Courier Guy 🇿🇦; plus unnamed victims
BrainCipher (11)
hamiltonhealthcenter.com 🇨🇦 ⚠️; fbc.ca 🇨🇦 (Financial); hhjcpa.com 🇺🇸; prairieridge.net 🇺🇸; ciscocems.com 🇺🇸; parkell.com 🇺🇸 ⚠️; tritonclaims.com 🇺🇸; and 4 others
N0n (10)
Companies #123–132 — anonymous entries across US, Germany, Saudi Arabia; running total now 132
safepay (8)
ruscopackaging.com 🇺🇸; titres-services.net 🇧🇪; sportschule-steinbach.de 🇩🇪; fuss-sprunggelenk.de 🇩🇪 ⚠️ (Healthcare); prospecthillcamberwell.com.au 🇦🇺; jhz-bernardshof.de 🇩🇪; ehrenwall.de 🇩🇪; valemany.com 🇪🇸
incransom (5)
bliss1041.com 🇺🇸; innovativedriven.com 🇺🇸; butler.legal 🇺🇸; roundglass.com 🇺🇸 ⚠️; fidepartners.com 🇪🇸
play (5)
Aripack 🇦🇷; StrucSure Home Warranty 🇺🇸; Standard Sand & Silica 🇺🇸; Misura 🇨🇦; AVIR
Booba Project (4)
DROUIN SAS 🇫🇷 (20GB); City of Edgewater 🇺🇸 (47GB); Vetstoria 🇸🇪 ⚠️ (5GB); Boardman Park 🇬🇧 (5GB)
Aoqin (4)
SILIKO d.o.o. 🇸🇮 (230GB); ENAP Sipetrol 🇨🇱 ⚠️ (Chilean state energy); Nextron Technology 🇨🇳; Goldsmith & Hull 🇺🇸
rhysida (3)
El Cajon CA 🇺🇸; Juge Napolitano Ruli Putfark & Pittman (Law); Pope and Johnson County Title (Financial)
Dark Project (3+)
Custom Bakehouse 🇺🇸 (100GB); Simplehuman 🇺🇸; Homestead Creamery 🇺🇸; Food Bank of Central Louisiana 🇺🇸
SilentRansomGroup (3)
K... R..., W... G..., G... R... — all redacted, timers active
Whitearmor (2)
Unilever 🇬🇧 ⚠️ (Manufacturing — global FMCG company); "Project Trojan Horse" (IAB post, not a victim)
akira (2)
Krishnan (Unknown); Erowa 🇨🇭 (Manufacturing)
Other groups (1 victim each)
Scarlettgroup: sigsauer.com 🇺🇸 (SIG Sauer, firearms manufacturer)
Falcon: Buchanan Ingersoll & Rooney PC 🇺🇸 (Law, 260GB)
chaos: darrequipment.com 🇺🇸 (325GB)
Global Secret Group: Kontron North America 🇺🇸
Doommageddon: ASLAN TEKSTIL 🇹🇷
⚠️ = Healthcare, CNI, or critical sector | 🇬🇧 = UK victim