Supermarket freezers that cooked their own stock overnight. Text messages about traffic fines that quietly steal payment PINs. North Korean IT workers paying Americans to keep remote jobs at U.S. companies. This weekly cybersecurity roundup brings together incidents that reached well beyond stolen data, causing spoiled food, store fires, disrupted grocery deliveries and drained bank accounts. Here are the stories that shaped the week.

Hackers Turned French Supermarket Freezers Into Ovens Overnight

Hundreds of French supermarkets woke up to spoiled stock after hackers took remote control of internet-connected refrigeration systems overnight. Retailers confirmed on Monday that attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F) while stores were closed. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling. The attack did not use a new exploit. It targeted ageing connected devices still online years after their manufacturer stopped supporting them. E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. At least 300 Intermarché and Netto stores were affected, Coopérative U reported more than 100, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, noted that estimates sit around 400 stores, with some branches reporting losses of about €250,000. Some reports put the total above 500 shops. Read More

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

GhostBat RAT, an Android malware strain first identified by Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI, wallet and fintech apps. It spreads through SMS messages about unpaid traffic challans that lead victims to fake mParivahan download pages, with GitHub repositories also used to host the malicious files. Cyble's research also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution. Many of the fake apps are first-stage loaders that hide the real payload in encrypted files or download it later, helping them pass initial scans. Read More

Death Threats, Laptop Farms, Stolen IDs: Inside North Korea's Job Scam

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, according to an updated FBI public service announcement. The Justice Department also announced charges, two arrests and the seizure of about 187 computer devices linked to the scheme. The FBI said Americans are being hired to appear on camera, sit for job interviews, verify fake identities, lend social media or professional networking accounts, ship packages, complete drug tests or fingerprint submissions, and keep work laptops running from their homes. The workers also use stolen identities, extort victims and threaten physical violence. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, which helps fund its nuclear weapons and military programs. Read More

Ahold Delhaize Incident Disrupts Grocery Supply in Netherlands and Belgium

A cyber incident at Ahold Delhaize has disrupted parts of the grocery retailer's IT infrastructure, prompting it to take some systems offline. Stores remain open, but reports from the Netherlands and Belgium indicate disruption to distribution, customer service and some delivery operations. The company has not disclosed the nature of the incident or whether customer or employee data was affected, and it has given no timeline for full recovery. Ahold Delhaize operates in nine countries, employs more than 384,000 people and owns U.S. brands including Food Lion and Stop & Shop. Read More

Kerala Police Signs MoU With Cyble for Cybercrime Investigations

Kerala Police has signed a three-year Memorandum of Understanding with Cyble to bring threat intelligence into cybercrime investigations. The agreement, signed through Cyble Infosec India Private Limited and announced on October 12, 2026, covers intelligence support, investigative assistance and capacity building. It will support the Kerala Police Cyber Operations wing and Cyberdome in identifying and investigating emerging threats. Read More [caption id="attachment_114716" align="aligncenter" width="600"] Image Source: Cyble[/caption]

Seoul National University Reports 28 Hacking Incidents Since 2021

Seoul National University has suffered 28 hacking incidents since 2021, exposing more than 1,100 pieces of personal information belonging to students, faculty and staff. The figures come from data the university submitted to Rep. Baek Seung-ah of the Democratic Party. There were eight attacks in 2021, a peak of 10 in 2022, none in 2023, one in 2024 and five in 2025, with four confirmed so far this year. Departmental systems were hit most often, in 19 incidents, followed by laboratory systems with six, research systems with two and one institutionwide system. Read More

Morocco Prioritizes AI Threats and Critical Infrastructure Defense

Morocco is placing greater focus on proactive threat detection, critical infrastructure protection and artificial intelligence in its cybersecurity strategy. Speaking at the opening of National Cybersecurity Week in Rabat, Abdellatif Loudiyi, Minister Delegate in charge of National Defense Administration, said cybersecurity must be built into institutional governance rather than treated as an extra expense. He called for stronger preparedness, early detection and coordinated incident response. The event runs from October 12 to 14. Taken together, this week's incidents show attackers targeting the systems people rely on every day, from shop refrigeration and grocery supply chains to payment apps and hiring processes. Follow The Cyber Express for next week's weekly cybersecurity roundup and ongoing coverage of these stories. Read More

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

Law enforcement agencies in the United States and France have seized two CSAM domains linked to NudeLeaksTeens (NLT), a website that advertised hacked and stolen sexually explicit images and videos of young women and girls for sale. French authorities simultaneously arrested a 25-year-old man in Northern France suspected of being the site's main administrator. The action was announced by the U.S. Attorney's Office for the Eastern District of Virginia (EDVA), the FBI Washington Field Office, and the Cybercrime Division of France's Parquet de Paris. It was carried out under Operation Inevitable, a coordinated effort against the spread of child sexual abuse material (CSAM) and the non-consensual publication of intimate images. The seizure notice now displayed on the sites also references Operation Torch.

What the Seized CSAM Domains Offered

According to the seizure warrant, NLT sold leaked content that had been hacked and stolen from victims. Investigators found that despite warnings on the website against CSAM, the site also offered sexually explicit images and videos of children. [caption id="attachment_114652" align="aligncenter" width="600"] Image Source: FBI[/caption] The site sold content in packages it called "albums" and "collections." Many included victims' personal identifying information alongside explicit material. Some victims have been identified and confirmed to have been minors when the images were created. One package named after the site claimed to contain 6,200 private files of teenagers and adults, mostly American, taken from hacked Snapchat, Instagram, TikTok, and Facebook accounts. Authorities say this collection also contained CSAM.

How the CSAM Domains Were Taken Down

The United States obtained court authorization to seize both domains. Visitors now see a notice stating that the FBI took control of the sites under a seizure warrant issued by the U.S. District Court for the Eastern District of Virginia, citing several federal statutes. The notice carries the insignia of the FBI, the Department of Justice, the Arlington County Police Department, the Parquet de Paris, and the French Gendarmerie's national cyber unit, UNCyber. In France, police arrested a 25-year-old man living in the northern part of the country who is suspected to have been NLT's main administrator. The arrest was carried out at the same time as the seizure of the CSAM domains.

FBI Comments on CSAM Domains Seizure

Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, said, "The seizure of these domains represents a decisive step in dismantling the criminal networks that hide behind anonymous online platforms to exploit victims." Cox said the operation cut off the infrastructure used to distribute images and videos obtained by hacking victims' social media accounts, striking at the core of the illicit marketplace. He added that the FBI will continue to act against those who use the internet to cause harm, wherever they operate and whoever they target. The announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for EDVA; Cox; and Charles "Andy" Penn, Arlington County Chief of Police. The Justice Department's Office of International Affairs provided significant assistance. Assistant U.S. Attorneys April Russo, Lauren Halper, and Meredith Clement are representing the United States.

A Joint Effort Against Online Exploitation

Officials credited cooperation among national, international, and private sector partners for the operation. The case shows how hacked social media accounts can become a source of material sold on illicit sites, affecting both adults and minors.

New Zealand has announced a new round of sanctions against Russia, targeting 33 individuals and entities accused of supporting Moscow’s war against Ukraine. The latest New Zealand sanctions against Russia place particular focus on cyber actors, individuals linked to the forced relocation and re-education of Ukrainian children, and entities supporting Russia’s military-industrial complex. Foreign Minister Winston Peters said the package also targets individuals involved in creating and spreading anti-Ukraine propaganda, as well as actors from the Democratic People’s Republic of Korea (DPRK) and Iran providing support to Moscow. “Children should never be used as instruments of war,” Peters said, expressing concern over efforts to abduct and re-educate Ukrainian children through state-directed programmes.

New Zealand Sanctions Target Russian Cyber Actors

The latest Russia sanctions include several individuals previously accused by the United States and other Western governments of malicious cyber activity. Among them are Yuliya Pankratova and Denis Degtyarenko, members of the pro-Russian hacktivist group Cyber Army of Russia Reborn (CARR). The U.S. Treasury sanctioned both individuals in 2024 over alleged cyber operations targeting U.S. critical infrastructure. U.S. officials identified Pankratova, who uses the alias “YUliYA,” as the group’s leader, while Degtyarenko, known as “Dena,” was described as one of its primary hackers. American officials alleged that Degtyarenko was responsible for compromising an industrial control system at a U.S. energy company and had developed training materials for compromising supervisory control and data acquisition (SCADA) systems. Pankratova has also allegedly been associated with Z-Pentest, another pro-Russian hacking group accused of targeting critical infrastructure. New Zealand has also sanctioned Aleksandr Volosovik, known online as “Yalishanda.” U.S. prosecutors have accused him of helping operate Media Land, a Russian bulletproof hosting provider allegedly used by cybercriminals to target organizations including hospitals, schools and banks. In July, the U.S. Justice Department unsealed charges against Volosovik and two other Russian nationals, alleging activities that caused more than $62 million in losses to victims in the United States and other countries.

GRU-linked Official Among Sanctioned Individuals

Another individual included in the latest New Zealand sanctions against Russia is Andrey Averyanov, a senior Russian military intelligence officer who previously commanded GRU Unit 29155. Western governments have linked the unit to cyberattacks, sabotage and other covert operations. Its cyber division has been accused of targeting governments, defense organizations, think tanks and other entities in Ukraine and NATO countries. New Zealand had previously sanctioned members of the unit over alleged malicious cyber activity targeting Ukraine and other countries.

Russia Propaganda and Technology Entities Targeted

The new sanctions also target Russia’s Internet Development Institute (IRI), a Kremlin-backed organization that finances digital media and content promoting Russian state narratives. IRI director Alexey Goreslavsky has also been designated. The British government has previously said the institute was established by Russia’s presidential administration and received hundreds of millions of dollars in government funding. Its projects have included films and video games promoting narratives associated with the Kremlin. Russian information technology company LANIT has also been added to the sanctions list. The company has provided services to Russia’s Defense Ministry and sanctioned defense-industry companies, including state-owned conglomerate Rostec. LANIT had previously been sanctioned by the United States, Canada and Ukraine.

New Zealand Reaches 36th Russia Sanctions Round

The latest package represents New Zealand’s 36th round of Russia sanctions since the Russia Sanctions Act came into force in March 2022. New Zealand has now imposed sanctions on more than 2,000 Russian individuals, entities and vessels, alongside trade restrictions. The measures generally include asset freezes and travel bans and prohibit New Zealanders from making funds or other assets available to designated individuals and entities. Peters said cyber activity can have real-world consequences, noting that cyber actors are increasingly being used to gather intelligence, enable sanctions evasion and disrupt those opposing Russia’s aggression.

The Suisun City emergency declared by local officials followed a cyberattack that forced the Northern California municipality to shut down its information technology network, disrupting some communications used by public safety agencies. The incident has placed the California city of roughly 30,000 residents among communities confronting the growing threat of cyberattacks against essential local services.  The Suisun City Council declared a state of emergency Saturday after the attack compromised the city's computer systems. Officials said the network shutdown was necessary to contain the threat and preserve potential evidence for a federal investigation into the incident.  Although the Suisun City cyberattack affected communications operations involving both the fire and police departments, city officials said there was no imminent danger to the public. They also emphasized that public safety services continued to operate despite the disruption.  One of the most significant effects involved the handling of emergency communications, including the routing of 911 calls. Suisun City dispatchers began receiving emergency police and fire calls through the Solano County dispatch center as officials worked around the damaged municipal network. 

Suisun City Emergency Response Shifts Dispatch Operations 

The Suisun City emergency response required officials to temporarily move some communications functions outside the city's own computer infrastructure. By Sunday morning, online city services and internal municipal operations remained unavailable while cybersecurity specialists investigated the attack.  Those experts were also working to restore the affected systems. The decision to take the network offline was intended not only to stop the cyberattack from spreading but also to protect evidence that could assist federal investigators in determining how the intrusion occurred and who was responsible.  City officials described the attack as apparently the first incident of its kind to affect Suisun City. The municipality is located about 55 miles north of San Francisco and has a population of approximately 30,000. 

California City Attack Highlights Broader Cyber Threats 

The California city incident also comes amid federal investigations into a separate wave of cyberattacks involving municipal water systems in a dozen states.  Late last month, the FBI, the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency warned that cyberattackers had remotely accessed online infrastructure used by water and wastewater systems in at least seven states. Federal agencies said the hackers believed to be affiliated with Iran were targeting internet-connected industrial controllers with the goal of “to cause disruptive effects within the United States.”  The risks became apparent in Minnesota, where 30 water systems were affected by a cyberattack. Officials reported dramatic declines in water levels before backup systems were activated to prevent further disruption.  While the water-system attacks are separate from the Suisun City cyberattack, the incidents illustrate the expanding range of public infrastructure that can be exposed when essential services depend on connected computer networks.

Suisun City Cyberattack Comes Amid Funding Concerns 

The recent attacks have also prompted calls for greater federal support for cybersecurity efforts. Last week, a bipartisan group of lawmakers urged the restoration of federal funding for Department of Homeland Security programs intended to coordinate cybersecurity efforts across multiple states.  The lawmakers' concerns reflect the increasingly interconnected nature of cyber threats. An attack may occur within one municipality or state, but the technology and infrastructure involved can be linked to broader systems and networks that cross jurisdictional boundaries.  Gov. Gavin Newsom's office, in a statement to The Times, said there was no evidence that California water systems were among those targeted in the recent series of attacks. The governor's office nevertheless argued that cybersecurity efforts conducted independently by individual states are less effective than a coordinated federal approach.  “Cyber threats do not stop at state lines, and no state can defend against them alone,” the governor's office said.  The statement also pointed to reductions in the federal cybersecurity workforce and cuts affecting critical programs. According to the governor's office, those changes have weakened partnerships, threat intelligence capabilities and technical assistance intended to protect essential services nationwide.  “Federal cuts to the nation’s cybersecurity workforce and critical programs have weakened the partnerships, threat intelligence and technical support that help protect essential services across the country,” the governor's office said. “Reducing these capabilities while cyber threats continue to grow leaves every state, and the nation, less prepared for the next attack.”