Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 4 items in Mobile & IoT. Show all 52 items

November 2026

3 items

  • Mobile & IoT

    US agencies warn of attacks on refrigeration controllers after European supermarket hacks

    CISA, the FBI and the US Departments of Health and Human Services, Agriculture and Transportation warned on 5 November 2026 that attackers are targeting unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. According to BleepingComputer, the warning followed October attacks that remotely defrosted refrigerators at an estimated 250 to 350 French supermarkets, a second wave affecting more than 115 stores across six European countries, and an incident at three facilities of France's blood service. The agencies urged operators to take controllers off the public internet, change default passwords and apply available updates.

    • Network & infrastructure testing
    • Incident response
    • Threat modelling
  • Mobile & IoT

    Sekoia ties mobile watering-hole campaign using iOS and Android n-day chains to APT29

    Sekoia's Threat Detection & Research team reported on 4 November 2026 a watering-hole campaign, uncovered in mid-October, that used compromised or cloned websites in the US, Ukraine, the Czech Republic and Bulgaria to profile visitors and serve platform-specific n-day exploit chains to unpatched iPhones and Android devices without user interaction. Between 27 August and 3 September 2026 the attackers also tampered with the Plerdy analytics tracker, which Sekoia says is loaded by thousands of mostly Ukrainian websites. Sekoia assesses with moderate to high confidence that APT29 (Midnight Blizzard) ran the campaign, and says every flaw used had been fixed by the respective vendor before it began.

    • Incident response
    • Website security audit
    • Mobile application testing
  • Mobile & IoT

    Google and partners dismantle XCPE backdoor botnet on 1.3 million Android TV boxes

    Google Threat Intelligence Group (GTIG) said on 2 November 2026 that Google and industry partners had dismantled the XCPE backdoor, which had enrolled more than 1.3 million set-top boxes into a botnet. GTIG assessed with high confidence that the backdoor was intentionally developed and operated for financial gain by Android device manufacturer Videostrong Technology Co., which sold access to criminal affiliates whose modules carried out ad fraud, enrolled devices in residential proxy networks and loaded further malware. Google assessed that taking down the affiliates' command-and-control domains will sever access to at least 10 million additional compromised devices, and it has banned Videostrong from building certified Android devices.

    • Network & infrastructure testing
    • Threat modelling
    • Mobile application testing

March 2026

1 item

  • Mobile & IoT

    Authorities disrupt Aisuru, Kimwolf, JackSkid and Mossad IoT DDoS botnets

    The US Justice Department, working with authorities in Germany and Canada, disrupted command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets in March 2026. According to the DOJ, as reported by BleepingComputer and KrebsOnSecurity, the four botnets collectively infected more than three million IoT devices, including web cameras, digital video recorders and Wi-Fi routers, and their operators sold access to other cybercriminals to launch DDoS attacks. Cloudflare's 2025 Q4 report had described a record 31.4 Tbps attack and a quarter it said was characterised by an 'unprecedented bombardment' from the Aisuru-Kimwolf botnet; its Q3 2026 report recorded a sharp fall in attacks above 1 Tbps.

    • Network & infrastructure testing
    • Incident response
    • Cloud configuration review

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works