Hackers breach alert apps in Ukraine and Russia as European fridges overheat

Binance lost $6.3bn (£4.7bn) on Oct. 30 in a theft described as a record heist. The theft has been attributed to the North Korean state. The theft was one of three hacking incidents over a number of days cited by The Guardian. North Korea is hampered by sanctions and short of cash, yet has a long-standing reputation as a crypto hacker.

Hackers broke into Ukraine’s emergency alert app on Nov. 1 and sent people in Kyiv a fake nuclear strike alert. The intrusion was part of a cluster of three incidents over several days cited by The Guardian. Hours later, intruders breached Russia’s Emergencies Ministry app and pushed false nuclear warnings to millions of users. The Russian breach followed the Ukrainian alert app attack by about three hours.

Officials in both nations confirmed the hacks, turned push notifications off for a while, and later restored them. Independent reports have not tied either alert app intrusion to a specific hacking group. Ukraine’s Center for Strategic Communications accused Russia of the Ukrainian app attack, though independent confirmation is lacking. The close timing of the two alert app breaches does not establish that one was retaliation or that both had the same operator.

Alex Pearce was doing morning rounds at his London fruit and vegetable wholesale business on Monday last week when he saw defrost lights on refrigeration units 2 and 4, with panel readings of 150C. His suspicion of a cyber attack proved correct. He walked to the box connecting his refrigeration units to the internet and yanked out the cable after suspecting a cyber attack.

Retailers across Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported similar refrigeration issues that day, the same day as Pearce’s discovery. Refrigerators and freezers in some affected shops soared to as high as 50C (122F), part of the same refrigeration attack cluster. French blood banks were among those suffering from the hacking attack, in addition to retailers and Pearce’s business. French supermarket fridges were attacked last month in what may have been a trial run for the wider campaign.

Hackers target the companies that supply operating systems for internet-connected commercial refrigeration units, giving them a remote access route to victims. Danfoss, a Danish system provider and one of the affected system providers, said most affected gear was old and no longer got security updates. Danfoss said it has long urged customers to update or replace obsolete software. A key flaw targeted by hackers is end-of-life product versions no longer produced or receiving software updates, versions the source describes as no longer being produced or receiving glitch-eradicating updates.

Pearce said his fridge monitoring system by US firm Copeland, installed in 2018, would need updating. Pearce’s Langridge Organic business monitoring system dates to 2018. Pearce has not reattached the internet cable but his Langridge Organic business was otherwise unaffected.

Websites around the world were temporarily taken offline as a precaution last month when AI technology from OpenAI helped discover a flaw in PHP, an example of AI being used to find IT flaws. Sophos, a leading cybersecurity firm, reported no major client incidents from the PHP glitch, though it observed many exploit attempts.

Vulnerabilities found by leading tech companies increased eight-fold since Anthropic released its Mythos model in April. The source attributes the surge to the AI startup’s model released in April. The volume of attacks has not risen as sharply as vulnerabilities. Richard Horne, head of the UK’s National Cyber Security Centre, said, “There are so many vulnerabilities out there that … you could say are waiting to be exploited.”

The NCSC said last week that AI-powered malware is highly likely to be used against UK power stations, airports and hospitals by 2028. The NCSC said AI helps attackers scout targets, find weaknesses in IT networks and write malicious code, tasks the organisation says AI would assist with.

Paul Chichester, NCSC director of operations, said AI was not needed to find the cold storage flaws since they were already public, among them default access passwords in one fridge operator’s manuals. Chichester said the hackers really didn’t need AI for the fridge flaws. Ollie Whitehouse, NCSC chief technology officer, said this week it is quite clear internet-connected devices such as smart speakers and broadband routers could be susceptible to hackers. Whitehouse said this week about everyday internet-connected objects.

Manufacturers need to invest more in secure products and consumers need to pay more for robust products and keep updating them, according to the NCSC. The NCSC said manufacturers and consumers need to act on security. Wes Streeting, defence secretary, said the country must prepare for state-sponsored terrorism aimed at everyday infrastructure.

Ciaran Martin, founding chief executive of the NCSC, played down the Wuhan moment comparison and cited NotPetya and WannaCry in 2017 and a ransomware surge in 2021. Martin said this was not the first time the world faced a concerted threat. One expert said the fridge attacks show signs of Russian involvement, a view the source describes as at least one expert saying the fridge attacks bear Russian hallmarks. The Guardian said Russia is considered a likely suspect in the Ukraine alert hack, and the source says Russia is naturally a suspect in the Ukraine incident.

Finland’s border with Russia measures 1,340km or 832 miles. Cyber-attacks of all kinds in Finland have escalated since the 2022 Ukraine invasion, a tie the source makes to the 2022 invasion. Finland’s national cybersecurity centre logged nearly 21,000 incidents last year for a population under 6 million. Finland recorded about 13,000 incidents in 2022.

This year, hackers compromised up to 50,000 Finnish government mobile phones. Last year, hackers took down the website of Finland’s ministry of defence.

The trend is especially pronounced in European and Nato countries bordering Russia, a pattern the source says is a trend across Europe and Nato countries, especially bordering Russia. Samuli Bergström, vice-president of WithSecure, said AI is boosting attacks as well as Russian state activity. Bergström is based in Helsinki. Bergström said attackers are mostly opportunistic and will probably attack anything facing the internet; connected devices should be assumed to be attacked sooner or later, an explanation of attacker behaviour from the Helsinki-based executive.

Finland and most European nations have plans for disrupted payment systems or an attack on the grid. The UK’s Be Ready campaign, launched last month, urges people to store three days of food and up to nine litres of water for weather, cyber or other emergencies. Cyber-attacks won’t necessarily have the same effect as bombing a power station because software is more quickly patched and devices can be disconnected.

Some officials said the goal for state actors could be more psychological than anything. Making fridges overheat or attacking a blood bank is dramatic and sticks in the memory, though the flaws are probably fixed now. No guarantee exists that a criminal group could mount that exact fridge attack again.