Warm Freezers, a Six Billion Dollar Heist, and Norway Moves to High

This Week in Brief

Issue 039 covers 23 October through 4 November, weeks 44 and 45 with the tail of week 43, picking up where issue 038 left off. The refrigeration sabotage that hit French supermarkets in October came back as a continental wave in the night to 2 November, took down cold chains in Sweden, Belgium, Finland, Ireland, Luxembourg and Estonia in one go, and reached Norway the following night when a salvage-goods warehouse in Ytre Enebakk had its freezers forced into defrost through an unsecured 4G modem. Binance lost around 6.3 billion dollars in twenty minutes on 30 October, the largest cryptocurrency theft on record, and both TRM Labs and Chainalysis point at North Korea’s TraderTraitor. At home, NSM raised the national cyber risk level to high on 27 October, the first time the level has been made public, after a year in which successful attacks on Norwegian organisations tripled, and UiT in Tromsø spent a weekend fending off what it called a targeted attack by an actor with significant resources.

Underneath, Ivanti Connect Secure gained two more zero-days chained with October’s flaw for unauthenticated root, a CVSS 9.8 remote-root bug in the Linux TCP stack sat unpatched on Ubuntu and RHEL at month end, Oslo tingrett stopped Meta’s AI business terms, the Oleshky truce in Ukraine ran its six days and lapsed, and mines appeared in the Strait of Hormuz.

Security

Supermarket refrigeration sabotage spreads across Europe, and reaches Norway

In the night to Monday 2 November the remote tampering that disrupted French supermarket cold chains in October returned at scale. ICA, Coop and Axfood stores across Skåne, Öland, Gävle and Gothenburg lost refrigeration, a Böda freezer was found at 55 degrees in defrost mode, and the Sjöbo ICA manager put discarded goods at up to a million kronor (SVT, 2 November). The same night Delhaize, Colruyt, Carrefour and Intermarché stores in Belgium, Kesko in Finland, 13 SuperValu stores in Ireland, Delhaize in Luxembourg and a Selver in Estonia reported the same symptoms, and Belgian prosecutors opened an investigation (CNBC, 3 November; NRK, 2 November). Norway’s first case came the following night. Havaristen, a 3,000 square metre salvage-goods warehouse in Ytre Enebakk run by Miko Trading, had its freezer settings changed remotely, the evaporators overheated and set off the sprinklers, and the fire service arrived at 03:11. Entry was through an unsecured external 4G transmitter the refrigeration supplier used for remote control (NRK; TV 2; Aftenposten, 3 November). NSM director Arne Christian Haugstøyl called it serious. E24’s report of a fruit store in Ullensvang hit the same day is single-source.

The mechanism is mundane: the controllers sit on the public internet with built-in support logins, the vendor patched in August, thousands of units were never updated and the oldest cannot be (Fredrik Blix, Stockholm University, via CNBC). Danfoss, which supplied the French units, says older models no longer receive updates. Nobody has claimed responsibility, nobody has been arrested, ransomware has been ruled out, and TV 2’s suggestion that Russia is the obvious suspect remains speculation with nothing published behind it. EU Commissioner Christophe Hansen called the campaign a deliberate attempt to disrupt the food supply and convened a task force with ENISA and Europol, while Nkom’s Espen Slette noted that the Cyber Resilience Act is not yet in force in Norway, so update commitments have to come through supplier contracts (Nkom, 3 November).

Operational read: every cellular modem a supplier bolts onto a building controller is a remote-access path you do not manage. Inventory them, get firmware versions and update commitments in writing, and put a temperature alarm on anything that can spoil.

Binance loses around 6.3 billion dollars in twenty minutes, North Korea blamed

Binance detected the largest cryptocurrency theft on record on 30 October CET. TRM Labs traced 6.36 billion dollars leaving Binance wallets across ten blockchains, with preparation visible at least 36 hours earlier and most of the assets moved in about twenty minutes; around three billion was frozen in transit, and Binance pledged to cover all losses from its SAFU fund and its own balance sheet (CNBC, 30 October). TRM Labs attributes the theft with high confidence to the North Korean cluster TraderTraitor, Chainalysis CEO Jonathan Levin concurs, Pyongyang denies it and the US Secret Service is assisting (BBC). Reported totals run from 6.3 to 6.43 billion depending on outlet. The initial vector is contested: Binance says a DevOps engineer’s device was compromised and used to submit withdrawals with no private-key leak (The Hacker News), while later reporting of a fake job interview and misused AI tooling rests on a single source. By 31 October Binance said 90 percent of the stolen assets had been replenished, and Finans Norge used the episode to tell Norwegian investors to trust nobody who contacts them unprompted (TV 2, 31 October).

Operational read: the money went through a person and an endpoint, with no key leak. Anything that signs for value needs its developer workstations treated as production.

Ivanti Connect Secure: two more zero-days chained for unauthenticated root (CVE-2026-111357, CVE-2026-118527)

Volexity found an actor it tracks as UTA0576 chaining two new Connect Secure flaws, a missing-authentication bug and a predictable-identifier file upload, with October’s CVE-2026-104935 against fully patched appliances since at least 3 October. No malware or webshell stays on the device, it is re-exploited per command, logs are tampered with and the Integrity Checker Tool is evaded (BleepingComputer; SecurityWeek). Ivanti has patched, CISA added both CVEs to KEV on 30 October with a federal deadline of 13 November, and Shadowserver counts more than 5,000 exposed instances (Help Net Security, 2 November). If the October patch was your last action on these boxes, assume compromise and rebuild from a known image.

Linux kernel CVE-2026-98432 (CVSS 9.8): remote root through the TCP stack

A race-condition use-after-free in IPv4 TCP connection handling, reachable through the MPTCP and tcp_migrate_req paths, affects kernels from 4.4 onward. Eric Dumazet’s fix landed upstream on 5 October, the CVE was published 15 October, and Anthropic disclosed on 27 October that one of its models had produced a working remote-root exploit, which it has not released; Akamai saw no public proof of concept as of 2 November (Akamai; CSO Online). Fixes are in 7.3 and the stable branches back to 5.10.272. Debian, SUSE, Oracle and Amazon Linux shipped them, Ubuntu and RHEL had not as of 30 October (The Stack). Until they do, set net.mptcp.enabled=0 and net.ipv4.tcp_migrate_req=0, which lowers the odds without closing the hole.

In brief

• Volt Typhoon: Lumen’s Black Lotus Labs mapped “Silent Train”, a rotating relay network of hacked SOHO routers and IoT devices fronting four confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, with chains rebuilt in under two minutes; Cisco Talos added the KeyDrift implant stealing control-plane keys from SD-WAN controllers hit through CVE-2026-20127 (CyberScoop; BleepingComputer, 28 and 29 October).
• Brotli CVE-2026-111497 (HTTP2Shell), an overflow in the C decoder, forced an emergency .NET update on Sunday 25 October; fixed in Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, and Python brotli 1.2.1; in KEV since 27 October alongside Adobe Commerce CVE-2026-48356, which PolyShell is using against hundreds of Magento stores (BleepingComputer; SecurityWeek; The Hacker News).
• PHP2Shell: a public proof of concept, a US government-affiliated network rooted, Linux CVE-2026-46300 (Fragnesia) chained for root, Mirai operators joining in, NSM saying on 28 October the attacks are still running, and the UK NCSC sending 110,000 proactive notifications (The Hacker News; digi.no; Infosecurity Magazine).
• Also exploited: VMware ESX CVE-2026-41709 (CVSS 2.7, used by China-nexus Warp Panda to erase audit trails), GitLab CVE-2026-97229 (CVSS 10.0, Alpine Linux rebuilt its instance and reset all passwords), Cisco ASA/FTD CVE-2026-76418 (crashes SSL VPN, more than 51,000 exposed), Arista VeloCloud CVE-2026-114625 (third VCO zero-day in four months), and 2024 Synology flaws under C3RB3R ransomware (SecurityWeek; BleepingComputer).
• Chainalysis disclosed a breach via what it called offensive agentic techniques, exposing names, emails and roles of customer staff, many in law enforcement (SecurityWeek); Sophos found Aur0ra ransomware operators handing Cursor agents VPN logins to map Active Directory (Help Net Security, 2 November); NCSC chief Richard Horne called an AI-powered ransomware attack on UK critical infrastructure highly likely by 2028 (Infosecurity Magazine, 3 November).
• University of Copenhagen lost data on about 525,000 people, CPR numbers included, from a test environment on 23 October (digi.no/NTB; Computerworld DK); Google dismantled the XCPE botnet of 1.3 million backdoored Android TV boxes (BleepingComputer); Ukraine’s and Russia’s emergency-alert apps both pushed fake nuclear alerts on the night of 1 November, hours after the Oleshky truce lapsed (CBS News; AP).

Norway and the Nordics

NSM raises the national cyber risk level to high

On 27 October NSM set the national cyber risk level to “høyt”, the second-highest step and the first time the level has been published. Director Arne Christian Haugstøyl said successful cyber operations against Norwegian organisations have tripled over the past year, that AI has cut the window for closing a known vulnerability from weeks to hours, and pointed to the Lørenskog municipality theft and its dark-web sale as the pattern (NSM; NRK; TV 2, 27 October). No actor was named, and Euronews lists the defence industry, space, critical infrastructure and their suppliers as the targets. Justice minister Astri Aas-Hansen asked every organisation to review its security against NSM’s 21 recommended measures, and on 29 October NSM and DSB jointly told the public to prepare for loss of power, mobile and internet as a consequence of cyberattacks.

UiT hit by “an actor with significant resources”

UiT, Norway’s Arctic University, confirmed on 30 October a targeted attack aimed at the university alone. A handful of small servers were taken down, external help was brought in, and administrative director Jørgen Fossland described the attacker as having significant resources (NRK, 30 October). By 3 November UiT said the situation was stable and services were returning (NRK; VG). Nothing has been said about data theft or attribution. Nammo, meanwhile, warned staff at Raufoss on 27 October about information-gathering and phishing attempts through dating and check-in apps (TV 2, single source).

Støre and Stubb call Putin, Copenhagen objects, a Bulava flies

On 27 October Prime Minister Støre and Finnish President Stubb phoned Putin to press for an end to the war, then briefed Zelensky, the first direct Nordic head-of-government contact with the Kremlin in over a year (NBC/Reuters; NRK). Danish PM Mette Frederiksen said Europe should stick together rather than go solo, Listhaug and Søreide criticised the handling at home (E24; TV 2), and the FT’s account of a 90-minute Russian history lecture is disputed by Støre. The next day the Borei-A submarine Generalissimus Suvorov test-fired an R-30 Bulava from the Sea of Okhotsk to the Chizha range in Arkhangelsk (TASS, 28 October). Two days earlier Norwegian F-35s had escorted a USAF B-52 over the Norwegian Sea in Global Thunder, the morning after Trump called Norway a “shithouse” country over the Nobel Prize (Barents Observer; NRK).

Also this fortnight: Økokrim’s largest fisheries-crime action, more than 30 arrested and 20 companies charged across Finnmark, Nordland and Møre og Romsdal (TV 2; VG; NRK, 27 to 29 October); Nord-Troms og Senja tingrett kept the Russian vessel Professor Molchanov under arrest at Svalbard (NRK, 28 October); Cheap Energy took 16 days to tell customers about a breach detected 5 October (digi.no; Nettavisen); Forsvaret deployed air surveillance in Sør-Varanger to catch stray drones (NRK, 3 November); and emergency-radio sales tripled after the October Telenor outage while DSB finds six in ten poorly prepared for a long loss of connectivity (E24; digi.no).

Regulatory and Policy

Oslo tingrett halts Meta’s new business terms

On 28 October Oslo tingrett barred Meta from applying its 20 November business-terms change to Norwegian media pending a ruling on legality, after NRK, TV 2 and Schibsted sued through MBL. The terms would have let Meta train AI on and redistribute media content without consent; Meta must pay more than NOK 1 million in costs and says it will consult the industry first (NRK; E24; digi.no, 28 October).

The CRA gap, and deadlines ahead

The Commission’s task force with ENISA and Europol is the EU response to the fridge attacks. Nkom’s point on 3 November matters more for Norwegian importers and grocers: the Cyber Resilience Act is not yet in force here, so update and vulnerability-handling commitments come from the contract or from nowhere. Elsewhere, the Gjedrem committee’s proposal to fold the oil fund’s Etikkrådet into an internal advisory group has chair Svein Richard Brandtzæg threatening to resign (E24, 28 to 30 October); Senterpartiet switched to backing a freeze on new datacentres while a Menon report finds 94 percent of datacentre value creation in Norway is foreign-owned (digi.no; E24); and the government sent a draft law bringing the Digital Markets Act to Norway on consultation (regjeringen.no, single source on timing). Dates to hold: 10 November for Fortinet’s full disclosure and Patch Tuesday, 11 November for the KEV deadline on VMware ESX and Fragnesia, 13 November for the Ivanti pair.

Scams and Consumer Protection

Eurojust and Europol dismantled an investment-fraud network on 3 November with seven arrests, 17 searches and more than 100 servers seized across Germany, Cyprus, Finland, Albania, Israel, Kosovo, North Macedonia and Poland; a Cyprus- and Israel-based firm allegedly sold fake trading platforms as a service to Balkan call centres, with losses above four million euros (Eurojust; BleepingComputer). NRK found phone scammers calling from genuine Norwegian numbers, and a telco changed its practice after the findings (NRK, 24 October, single source). Telenor warns of a scam wave ahead of Black Week in which even experts get caught (TV 2, 2 November), four Swedes were charged over a Sandefjord home invasion to steal cryptocurrency in which the victim was threatened with losing a finger (TV 2, 30 October, single source), and Danish police warn of scams riding on MobilePay’s name change (TV 2 Danmark; TV Syd).

Epstein

Presumption of innocence applies to everyone named here; nobody in this section has been charged in connection with Epstein.

Police Scotland confirmed on 30 October that it has opened inquiries into a 1999 visit by Andrew Mountbatten-Windsor to Balmoral with Jeffrey Epstein and Ghislaine Maxwell, following allegations that women were trafficked to the estate; the force calls it a very early stage and will not confirm details (The Guardian; Aftenposten; SVT, 30 October). Aftenposten notes his separate February arrest on suspicion of misconduct in public office, which he denies. In the United States, Judge Jesse Furman ruled on 26 October that the Justice Department unlawfully fired Epstein prosecutor Maurene Comey and ordered her reinstated (CNBC). CBS News reported on 28 October that a March 2025 FBI log lists classified material pulled from the Epstein files and estimates around 1.2 million pages missing from one email section, against earlier DOJ statements that nothing was withheld on national-defence grounds; DOJ did not respond. A judge dismissed with prejudice Trump’s ten billion dollar defamation suit against the Wall Street Journal over the Epstein birthday letter on 31 October (The Guardian), and House Judiciary Democrats released a 50-page report calling for a special counsel, allegations only (The Hill; Forbes). No new Nordic developments.

Conflicts

Ukraine

The truce in Russian-held Oleshky, brokered through Melania Trump and Pope Leo, ran from 27 October to 22:59 on 1 November and let nearly 800 civilians out to Ukrainian-held territory (RFE/RL; other outlets give hundreds to about 1,000). It ended without extension and fighting resumed within hours, the Kremlin warning against reading a wider peace into it. Trilateral US, Ukraine and Russia talks are set for 10 and 11 November in Abu Dhabi, without the Europeans (Meduza; Reuters). A drone hit a Dnipro railway platform on 29 October, killing at least 13 (RFI; other outlets 14 or 15), aerial bombs on a school used for aid distribution in Komyshuvakha on 2 November killed 33 by Reuters’ 3 November count, with earlier figures from 24 to 31, and 3 November brought Russia’s largest energy barrage of the year across ten regions (Reuters). Kyiv puts Russian losses in October at 54,400 troops, a General Staff figure that cannot be independently checked. Starlink service in Ukraine was restored on 24 October after a week of speed caps, Musk saying Ukraine had broken terms by using civilian service for strikes (NRK; Newsweek).

Iran, Israel, Korea

Iran’s Revolutionary Guard said three to four tankers hit mines in Hormuz on 29 and 30 October, Reuters sources describing limpet mines, and Brent passed 115 dollars. Supreme Leader Mojtaba Khamenei ordered an immediate, geographically unrestricted response to any attack, Tehran designated the Royal Navy and RAF as terrorist organisations, and Qatari mediation moved to Doha with Araghchi calling the talks progressing (Reuters via Al-Monitor; USA Today). The US struck radar and missile sites on Qeshm Island on 2 and 3 November in what it called defensive action (CNN; Al Jazeera). Israel’s 27 October election ended deadlocked between the Netanyahu and Eisenkot blocs, Netanyahu alleged the vote was stolen and the elections chief rebuked him (FT), and on 3 November Trump said US aid to Israel of about four billion dollars a year ends at year-end in favour of arms purchases (AP). North Korea fired around ten short-range ballistic missiles from near Wonsan on 29 October (Reuters; USNI).

By the Numbers

What to Do This Week

1. Inventory every third-party remote path into building and refrigeration systems, cellular modems first; get firmware versions and written update commitments from the supplier, and alarm the temperature.
2. Ivanti Connect Secure: apply the 30 October fixes, then assume compromise if the appliance faced the internet in October and rebuild from a clean image; the Integrity Checker Tool will not tell you.
3. Ubuntu and RHEL hosts: check whether the CVE-2026-98432 kernel has landed, and until it has, set net.mptcp.enabled=0 and net.ipv4.tcp_migrate_req=0.
4. Patch the rest of the list: Brotli-dependent stacks on Node.js, .NET and Python, self-hosted GitLab to 19.3.5 or later, Cisco ASA with secondary authentication, Synology NAS firmware, Tailscale clients.
5. Work through NSM’s 21 measures with the hours-to-close framing in mind: segmentation, MFA on every remote entry, and an exposure scan of your own perimeter.
6. After Binance, treat developer and DevOps endpoints as production: hardware-backed MFA, no personal browsing, and an alert on any new withdrawal or deployment signer.
7. Brief family and finance staff on the Black Week scam wave and on calls from spoofed Norwegian numbers; caller ID alone proves nothing.

Methodology: this issue was compiled from open-source reporting over 23 October to 4 November, researched directly against the local SearXNG instance and cross-checked against named outlets. Coverage of the Norwegian technology press was lighter after 30 October. Sources cited: SVT, CNBC, NRK, TV 2, Aftenposten, E24, VG, Nkom, NSM, BBC, The Hacker News, BleepingComputer, SecurityWeek, Help Net Security, Volexity, CISA, Akamai, CSO Online, The Stack, CyberScoop, Cisco Talos, digi.no, NTB, Infosecurity Magazine, Computerworld DK, CBS News, AP, Euronews, NBC News, Reuters, FT, TASS, Barents Observer, Nettavisen, Dagsavisen, regjeringen.no, Eurojust, TV 2 Danmark, TV Syd, The Guardian, The Hill, Forbes, RFE/RL, Meduza, RFI, Newsweek, Al-Monitor, USA Today, CNN, Al Jazeera, USNI. Single-source and contested claims are marked in the text. Presumption of innocence applies throughout the Epstein coverage. Editorial responsibility: Thomas A. Kleppestø, FTRCRP.

Issue 039, weeks 44 and 45, 5 November 2026