Binance's $6.34B Heist, Cold-Chain Attacks Hit Blood Banks, Apple Flaw Added to KEV

CISA, FBI and agencies warn of attacks on cold-chain refrigeration systems

CISA, the FBI, HHS, USDA, and the Department of Transportation jointly published a fact sheet on November 5 warning that malicious actors are targeting industrial refrigeration and cold chain monitoring systems used across healthcare, food and agriculture, chemical, and transportation sectors. The agencies say attackers are exploiting unpatched or internet-accessible electronic temperature controllers to force continuous heating and defrost cycles, risking inventory loss, fire hazards, and safety impacts on temperature-sensitive products. Recommended mitigations include removing devices from the internet, enforcing phishing-resistant multifactor authentication, patching firmware, and retiring unsupported legacy controllers. (CISA)

Cyberattack on refrigeration vendor disrupts French blood bank cold rooms

France's Blood Establishment (EFS) said three blood banks detected and reversed a dangerous temperature spike after a cyberattack hit a refrigeration equipment provider used in its cold rooms. Temperature and defrost thresholds were reset to extreme levels, but EFS monitoring and alarm systems caught the anomalies before any blood or plasma products were affected. The EFS, which supplies roughly 1,900 healthcare facilities, is working with France's ANSSI and the Ministry of Health, and says collection and distribution are unaffected. The incident follows a wider wave of refrigeration-targeting attacks reported at supermarkets across several European countries. (Help Net Security)

Binance details $6.34 billion crypto theft tied to North Korea

Binance published an incident report describing how a tampered Homebrew installer and a fake job-interview scheme gave attackers a path to compromise engineers' machines, eventually reaching the exchange's wallet-signing service. The attackers exploited Ethereum's EIP-7702 delegation mechanism to gain partial control of a hot wallet, moving roughly $6.34 billion out of Binance on October 29. The FBI has attributed the attack to North Korea's TraderTraitor group, previously linked to the $1.5 billion Bybit theft. Binance says it has recovered most funds and is continuing an independent review of the incident. (Help Net Security)

CISA adds actively exploited Apple authentication flaw to KEV catalog

CISA added CVE-2024-27834, an improper authentication vulnerability affecting multiple Apple products, to its Known Exploited Vulnerabilities catalog on November 4 based on evidence of active exploitation. The flaw lets an attacker with arbitrary read and write capability bypass pointer authentication, and separate research from Sekoia linked it to an APT29 mobile exploit chain targeting iPhones running iOS 16.7. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on internet-exposed assets; CISA encourages all organizations to do the same. (CISA)

Poisoned cPGuard update compromises nearly 3,000 hosting servers

OPSShield confirmed that an attacker compromised the update infrastructure of its cPGuard security suite for Linux web hosting servers and pushed a malicious update to roughly 2,950 customer servers running as root between fake versions 5.88.12 and 5.88.19. The script collected password hashes, SSH keys, and database credentials and exfiltrated them to a server tied to OPSShield's own licensing system, which was also compromised, exposing contact information and hashed passwords for about 7,900 customers. OPSShield has released a clean update, rotated keys, and is rebuilding affected billing systems. (Help Net Security)

Keyfactor names Gerald Beuchelt as Chief Information Security Officer

Keyfactor appointed Gerald Beuchelt as Chief Information Security Officer, giving him responsibility for the company's enterprise-wide security strategy, governance, risk management, and compliance programs as it expands globally. Beuchelt previously served as CISO at Acronis and held senior security roles at Sprinklr, LogMeIn, and Demandware. The appointment follows a period of growth for Keyfactor, which provides machine identity and cryptographic security software and recently surpassed $200 million in annual recurring revenue with a growth investment exceeding $1 billion led by Summit Partners. (PR Newswire)