A Russia-aligned cyberespionage group has targeted Ukrainian justice, law enforcement, local government and defense organizations since at least February 2025, using a custom infostealer to harvest credentials, VPN configurations and documents. Damien Schaeffer of ESET detailed the group, which the firm named Gorbag, in research published on November 3, after presenting it at Virus Bulletin in October. ESET found targets only in Ukraine, many of them near the Russian border. About a quarter were justice and law enforcement bodies and another quarter local administrations, mostly city councils near the front line. The rest included defense entities and an organization publicly documented as a major transport hub for foreign military aid. ESET said the choices closely align with Russia’s wartime intelligence priorities, pointing to possible interest in war-crimes prosecutions, damage from air strikes and incoming military supplies. – Infosecurity Magazine Russia-Aligned Gorbag Targets Ukraine for Intelligence
Hackers have stolen cryptocurrency from hot wallets on outdated BTCPay Server instances, with blockchain analysis tracing about $1.63m in Bitcoin and Litecoin to addresses linked to the thefts. BTCPay Server said in an incident update on November 2 that the thefts hit servers running version 2.4.1 or earlier of the open-source payment platform, and that attackers had used a different method to exploit a vulnerability fixed in version 2.4.2, released on August 7. It had seen no impact on servers already running 2.4.2 or later when it issued its warning. – Infosecurity Magazine Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency
Supermarkets across at least nine European countries have reportedly been impacted by a cyber-attack on their refrigeration systems, resulting in food stock being destroyed. Reports and official statements emerged about the incident on November 1 from supermarket retailers in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden. At the time of writing, there is no confirmation about how the incident occurred or the perpetrators. However, the incident appears to be similar in nature to the cyber-attack on refrigeration systems providers Danfoss and Copeland in October 2026, which led to hackers changing temperatures on internet connected refrigerators across several chains of supermarkets in France. – Infosecurity Magazine Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europe
