Spy Chips, Frozen Supermarkets, and a Ransomware Negotiator Arrested
Monday, October 12, 2026 · 5-minute read
Drone attacks damaged three Yandex data centers over the weekend, forcing two of them to shut down entirely and a third to operate at reduced capacity. Yandex is Russia's biggest cloud services provider, and the outages cut off users from their stored files. This is one of the most significant infrastructure hits to a major Russian tech company since the war in Ukraine began.
↗ BleepingComputerAttackers remotely took control of refrigeration controllers made by Danfoss at multiple French supermarket chains and switched them off overnight. The attack spoiled perishable food across several stores. It's a sharp reminder that internet-connected industrial equipment is a real target — not just a hypothetical one.
↗ BleepingComputerCyberattacks that hit South Korean financial institutions earlier this month were carried out by a Chinese hacker using the ARTEX AI penetration testing suite alongside Claude AI agents. It's one of the first confirmed cases of an attacker using commercially available AI assistants as part of a live bank heist. Expect more of this.
↗ BleepingComputerLedger has confirmed that hardware crypto wallets sold through Southeast Asian reseller CryptoBilis were physically tampered with before reaching buyers. At least one device contained a hidden hardware implant designed to steal funds the moment a wallet was set up. More than $86 million has been reported stolen so far. Ledger has paused all sales through CryptoBilis while the investigation continues.
This is not a software bug. Someone physically modified the devices somewhere in the supply chain — likely after they left Ledger's factory — before they reached customers. If you bought a Ledger wallet from CryptoBilis in the last 90 days, your funds may be at risk even if your device looks perfectly normal.
Ahold Delhaize — the company behind Stop & Shop, Food Lion, and Giant — confirmed it took systems offline after detecting a cybersecurity incident on its network. The company operates thousands of grocery stores across the US and Europe. No ransomware group has publicly claimed responsibility yet, but the pattern of taking systems offline defensively is a well-worn response to ransomware attacks.
This flaw lets anyone on the internet — no account required — upload and run their own code on any WordPress site running the Bricksforge plugin. In plain terms: a stranger could take over your website completely. Attackers started exploiting it on October 7, just days after it was discovered. Bricksforge is a popular visual design add-on used by thousands of WordPress sites.
Status: Patch available — update to Bricksforge version 3.1.8.10 immediately. If you can't update right now, deactivate the plugin until you can.
This bug affects SonicWall's Secure Mobile Access appliances — devices that companies use to let employees connect to the office network remotely. The flaw is a type called server-side request forgery, which lets an attacker make the device do things on their behalf without logging in. At least 135 exploitation attempts have already been recorded from two IP addresses in the US.
Status: Patch released October 6, 2026. If your organization uses SonicWall SMA 1000, apply the update to versions 12.4.3-03670 or 12.5.0-03082 without delay.
GitLab is warning users about a maximum-severity flaw in the tool it uses to automate software builds and deployments. An attacker could exploit it to run their own code on your GitLab server remotely — no login needed. This is particularly dangerous for software development teams, since a compromised CI/CD pipeline could be used to slip malicious code into apps you build and ship.
Status: Patch available. GitLab is urging all users to update immediately. Don't wait on this one.
Security researchers at Varonis have published a detailed breakdown of a new Windows malware loader called AvisLoader. What makes it stand out is how it communicates: instead of contacting a single command server that defenders can block, it uses encrypted peer-to-peer connections, like a mini BitTorrent network for cybercriminals. It spreads via ClickFix lures, digs itself into Windows shortcuts to survive reboots, and can receive commands from attackers remotely. The design is deliberately resilient — even if defenders take down part of the network, the malware keeps running. It's the kind of infrastructure investment that suggests a serious, well-funded operation.
When your company gets hit by ransomware, you might hire a specialist to negotiate with the criminals. It's a legitimate — if uncomfortable — industry. But what happens when one of those specialists is allegedly working with the criminals too? That's the question at the heart of one of the most dramatic cybercrime stories of the year.
Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania on October 8 while attending a cyber insurance conference in Philadelphia. He's been charged with conspiracy to extort and interference with commerce by threats — charges that multiple sources have linked to the FBI's sprawling investigation into the ShinyHunters hacking group. Dubrovsky's firm, CyberSteward, specialized in ransomware negotiations — meaning he'd sit between panicked companies and the hackers demanding payment. His case has now been moved to the Eastern District of Texas, which sources say is the FBI's command center for the entire ShinyHunters takedown.
ShinyHunters itself has been unraveling fast. A teenage suspected ringleader known as "Rey" — identified as Saif Al-din Khader from Amman, Jordan — was detained by Jordanian authorities and is reportedly cooperating with the FBI. Rey had been brazenly taunting law enforcement on social media, posting memes after stealing sensitive FBI data by exploiting a zero-day vulnerability in Oracle's PeopleSoft platform. He even tried to frame a recently arrested Dutch associate for the hacks by planting that person's avatar in the taunting posts.
For regular people, the Dubrovsky case is a sobering reminder that the cybersecurity industry — like any industry — is not immune to bad actors operating from within. If your organization ever faces a ransomware attack and brings in outside help, ask hard questions about who you're hiring, how they get paid, and what their relationship with the criminal underground looks like. The line between negotiator and participant can be thinner than it appears. Watch for more arrests as the FBI's Texas-based operation continues to roll up ShinyHunters' network.