France has turned up the heat on Iran over destructive cyberattacks targeting refrigeration controllers at more than 700 grocery stores in October, spoiling food and sparking fires. The country vowed to take action using “all available means of response.” The supermarket attacks, which affected Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros, according to a Monday report by France’s Cyber Crisis Coordination Centre (C4). The C4 includes the National Cybersecurity Agency of France, the Directorate General for External Security, the Directorate General for Internal Security, the Directorate General for Armament, and the Cyber Defence Command. “This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory,” France’s Ministry for Europe and Foreign Affairs said in a statement. All signs point to CyberAv3ngers Both the report and the statement attributed the refrigeration controller hacks to the Iranian Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit. The Shahid Kaveh unit, which French national security officials say is led by Reza Salarvand and Mahdi Lashgarian, is better known by its hacktivist personas, including CyberAv3ngers. This is the same crew suspected of involvement in the July attacks that targeted more than 100 internet-exposed water systems in America. While the US government hasn’t attributed the intrusions to any country or group, private-sector security analysts blamed Iran, and specifically CyberAv3ngers. The IRGC-affiliated hacking crew has been breaking into industrial controllers for years, and in 2023, American national security and law enforcement agencies attributed a series of cyberattacks against "multiple" US water facilities to CyberAv3ngers. “The Iranian cyber threat against French interests is not new,” according to the Ministry for Europe and Foreign Affairs. “Iran has already carried out several destabilizing acts against us, notably targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.” Since at least June 2024, the Shahid Kaveh unit has had the ability to scan, access, and control industrial control equipment from Schneider Electric, Siemens, and Rockwell, the French government said in its report. It pins the refrigeration controller hacks on this particular Iranian crew for a couple of reasons. Making the case for attribution First: the infrastructure used to carry out the October supermarket attacks was also used during this timeframe to conduct reconnaissance on Schneider Electric equipment, zeroing in on small- and medium-sized energy and water production units. “The techniques used during these actions are known to have been used by the Shahid Kaveh unit since at least April 2026,” the report says. It also notes that investigators found “traces of Farsi use” in the attack infrastructure. Plus, Iranian media outlet CyberbanNews, which is reportedly linked to the Shahid Kaveh unit, publicized the incidents that occurred late on October 11 and into October 12 extremely quickly: “as early as October 13.” In early November, similar cyberattacks on commercial refrigerators and freezers were reported across Europe, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden reporting widespread food losses after miscreants spiked temperatures to as high as 122°F (50°C). Last week, the US federal government urged owners and operators to take security measures to prevent these types of attacks from spreading to America. France fights back The French government, for its part, said that it would “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.” This includes proposing additional EU sanctions against Iranian entities and individuals involved. France also vowed to express “its strongest condemnation of these cyberattacks” to the Iranian ambassador. However, the country didn’t rule out responding with more than just harsh words: “France reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.” ®
AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]
Vanderbilt University warns it is responding to a cyberattack claimed by the BYOD ransomware gang, which claims to have encrypted the university's databases and stolen sensitive student, employee, and research data. [...]
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]
N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems. [...]
York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires. [...]
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]
Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. [...]
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
AI agents are taking over routine governance, risk, and compliance tasks, forcing GRC professionals to rethink the skills needed to stay relevant. Anecdotes examines three essential skills for the AI-driven GRC workplace: data literacy, agent governance, and communication. [...]
A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers under investigation. [...]
The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs. [...]
Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers. [...]
69% of Brits don't think their bank could detect an AI deepfake impersonating them
Four in five do at least expect ID verification to get slicker in the next five years
Most want convenience and are only prepared to wait two extra minutes
More than two in three (69%) Brits worry their bank couldn't distinguish them from an attack designed to impersonate them, according to new Digidentity research.
With rising AI threats targeting businesses and consumers alike, four in five would now expect their bank to have AI deepfake detection tools in place when they're running selfie-based identity checks.
This comes as more and more citizens end up preferring increased security measures like vide-based identity checks – with half (53%) believing that one-time security codes sent by text are no longer sufficient.
Banks aren't fully trusted to spot a deepfake
The fallout from a successful attack can have far-reaching consequences, so it's no surprise UK citizens are scrutinizing their banks. Vicims could face months or years of disputing fraudulent debts or challenging mystery accounts opened in their names, for example.
The report comes after Bank of England governor Andrew Bailey called for social media companies to take greater responsibility for tackling scams.
But there is hope, and citizens feel fairly confident in banks' longer-term strategies. Four in five (79%) expect ID verification processes to become smoother over the next five years despite these systems ultimately having to do more heavy lifting, and with good reason. Three in five (62%) respondents said they'd only be willing to tolerate up to two additional minutes of checks.
However, there are challenges. Banks don't typically run their own verification systems, instead choosing to opt for a third party.
"Banks put their own reputation behind the identity provider they choose," Digidentity UK Country Manager Jonathan Evans wrote. "If that provider lets an imposter through, it is the bank’s relationship with its customer that suffers."
Looking ahead, banks are under the most pressure they ever have been to verify legitimate activity and block malicious attacks, but they're also under equal pressure to deliver experiences that are convenient and quick for the end user despite rising threats.
Russian hosting provider Beget was subject to a cyberattack on November 1st, 2026
While 1000s of websites were hit, cloud storage, VPS hosting, and Kubernetes servers were wiped
The attack came amidst a spate of drone and online attacks targeting Russian tech companies, presumably by Ukraine-based attackers or anti-Putin elements within Russia
A “massive cyberattack” took Russian web hosting company Beget’s entire operation offline, with abnormal activity recorded immediately ahead of the incident. All levels of its infrastructure were affected, with websites, cloud storage facilities, VPS hosting, and even hosting for Kubernetes containers knocked offline.
The impact of the attack took several days for the company’s experts to assess, with estimates that over 1,000 servers need to be physically checked. This indicates either lasting damage from the attack or infrastructure that was already weakened, perhaps by unpatched exploits.
Beget has been the subject of EU sanctions due to it providing hosting services to authorities in the Russian-occupied Ukraine regions of Crimea, Donetsk, and Luhansk.
Recovering data
Responding to news of the attack, Beget issued a defiant statement, boldly stating “We are not giving up and are continuing to look for ways to recover this data.”
"Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected.”
The organization told Kommersant (translated from Russian) that most data should be recoverable from backups for the majority of its virtual hosting and cloud infrastructure, adding “We continue to work on data recovery, but due to significant volumes, this process will require a long time.”
However, Beget’s response to the attack is hampered by how it organizes and prioritises data, with many customers not using disaster recovery plans.
Anatoly Sazonov, Head of the Department of Compliance with the requirements of the Softline Group of Companies, told Kommersant, “Beget’s mass failure is an example of a systemic risk that arises from a high business dependency on a single provider. If a website, corporate mail, databases and other services are posted on one site, the provider’s problems can paralyze several areas of business work at once.”
EU sanctions
Beget was founded in 2007 and has become the second largest domain registrar in Russia for .ru domains, overseeing 14.7% of the market alongside providing web hosting, cloud computing, and other services.
As is standard, Beget has encouraged customers to change their passwords and remove and update and access keys, credentials, or other sensitive information that may have been uploaded to its cloud servers.
Beget has already had a difficult year, having been targeted by EU sanctions for providing hosting services in Russian-occupied territories in Ukraine. Whether the domain registrar and web hosting company was targeted because of this, or as a more general piece of cybercrime, remains to be seen.
A post on X by Psalter shows TempestSDR, which can capture the signal from your HDMI cable and almost recreate the image on another screen, because the cable creates an electromagnetic field that can be read. The quality isn't great, but if you bring AI into the mix you can enhance it to make text readable and images clearer. An AI system especially for the task, called DeepTempest, reduces errors by over 60%.
The video below is quite alarming.
your HDMI cable can leak what’s on your screenwatch the laptop on the left. it reconstructs the video playing on the monitor beside it from radio signals leaking out of the HDMI connectionthis is TempestSDR. an antenna picks up the leakage, a HackRF radio captures it, and software turns it back into an imageresearchers took this further with Deep-TEMPEST, using AI to make recovered images and text easier to read. this clip shows the original techniquequality depends on shielding, distance and interference. the picture is imperfect, but recognizable content still gets througha wired connection can still leave a wireless traceNovember 8, 2026
Intercepting or playing with electronic leakage isn't new: 2001's Tempest for Eliza broadcast music to your radio by sending RF signals via your monitor, displaying images that generated specific radio frequencies. What's new is the AI element.
Is it time to don the tinfoil hat?
Not yet. DeepTempest does dramatically enhance images and reduce text errors, but as you can see from the video things are still pretty indistinct — and that's when the cable you're intercepting is right next to you, so you're close enough to see the display that you're intercepting.
You're not going to see much if you're in a van across the street, even if the cable being used is really poorly shielded, unless you've got a seriously powerful scanner.
DeepTempest was developed by Federico Larroca at the University of the Republic in Montevideo, Uruguay, and it does represent a major step forward: using text capture software DeepTempest was able to reconstruct text with roughly 30% of characters being misinterpreted.
That sounds like a lot but it's not enough to render text incomprehensible to human readers. And that error rate is a whopping 60% lower than the previous state-of-the-art attack.
The word Tempest is used in these systems because it's a US National Security Agency (NSA) codename that refers to spying via electromagnetic leakage, and measures to prevent it.
Those measures are distance, shielding, filtering and masking, and they consider more than just leakage: they also include sounds and vibrations, so for example it's possible to log keystrokes via a phone's motion sensor.
The history of this is fascinating and goes back to the Second World War, where the US military's teleprinters were found to be generating detectable electromagnetic spikes that could be intercepted to capture the text. The recommendation for shielding, filtering and masking comes from the machines' supplier, Bell System, and while technology has advanced somewhat since then the advice is still sound: if you're the kind of person that security services or other shadowy organizations might be interested in, don't buy crappy cables.
Pricier cables have electromagnetic shielding, and while high-end companies used to tell us that was essential because otherwise the audio and video fidelity wouldn't be as pristine as you want… but maybe it's signal leaking out rather than in that people will be more worried about in the modern world.
Researchers found over 1,400 exposed ARTEX instances online, with many linked to offensive security tooling
ARTEX combines AI agents with reconnaissance capabilities and has been increasingly adopted in real-world attacks
Some operators accidentally exposed malware, exploits, credentials, and internal infrastructure through misconfigured servers
Around 1,500 malicious instances of ARTEX were found on the internet, available to anyone who knew where to look, experts have warned.
Security researchers Censys said they identified 1,465 hosts running exposed ARTEX consoles. Of those, 155 (roughly 10%) were also running at least one tool commonly used in cyberattacks, including Cobalt Strike, Vshell, or Adaptix C2. They also found 32 publicly accessible directories on ARTEX hosts, some of which exposed exploit binaries, post-exploitation tools, and other sensitive files.
Usually, the ARTEX console does not require public-facing access, the researchers said, stressing that overall global deployment is “likely higher”.
Hijacking ARTEX
ARTEX is a legitimate penetration testing tool hijacked for malicious purposes, meaning at least some of these instances were set up by threat actors.
The story of ARTEX is similar to that of the now infamous Cobalt Strike. It was released by a developer called Autumn-27, who also authored ScopeSentry - a tool Censys describes as a “widely used Chinese asset-discovery and vulnerability-scanning platform”.
The researchers described ARTEX as an “AI agent layer on top of that recon foundation”. In other words - it is an LLM-powered version of Scope Sentry that syncs assets found by the tool’s domains, subdomains, IPs, ports, and endpoints.
ARTEX was released in late July 2026 and quickly gained popularity. On October 7, security researchers CrowdStrike reported seeing it used in malicious attacks and a day later, the developer distanced themselves from the illicit activity and stressed the tool was built for testing within authorized asset scopes. They then turned it into a closed-source tool with no further releases. However, despite the repository being taken down, Censys claims archived copies, translations, and different rebrands are still circulating.
Since then, numerous researchers observed it being used in different attacks. The CrowdStrike report described an unidentified threat actor using ARTEX to target South Korean financial institutions. The attacker, believed to be a financially-motivated Chinese actor (as opposed to being a state-sponsored one), compromised a broker-facing loan inquiry service at one bank and an employee mobile system at another. In both instances, they walked away with sensitive data.
They used ARTEX with DeepSeek v4.1-flash as their primary AI model, while also running Claude Code and Grok. The researchers found the operation in part because the attackers left publicly accessible directories where they exposed prompts, session histories, and ARTEX configuration files.
Censys later said the directories had been left exposed in mid-August, roughly seven weeks before CrowdStrike published its findings. File names also suggested they were targeting payment and gaming services, as well.
At one point Microsoft linked it to Storm-0940, a China-aligned threat actor responsible for compromising ConnectWise Cloud Backup customer environments. Apparently, the threat actors used ARTEX to automate scanning, password spraying, and OAuth application abuse, peaking at 2,900 sign-in attempts per minute at one point. Some Microsoft’s customers were allegedly seeing privileged cloud access granted in less than three hours.
Exposing their own infrastructure
Now, Censys says ARTEX is being paired with other offensive tools. At least 70 hosts were seen running both ARTEX and CyberStrikeAI, and others were seen deploying PentAGI, HexStrike AI, and RedAmon. Ironically enough, the researchers also found some actors had inadvertently exposed sensitive information through poorly secured directories. One installation exposed the operator’s entire home directory, including SSH configuration files and shellac command history, while others contained Windows lateral movement tools, malware implants, reverse-shell scripts, and exploit code.
Censys also stressed that not all of the exposed instances are malicious. They also said that roughly 650 of the detected hosts belonged to two groups of identically configured hosting infrastructure, leaving approximately 815 unique installations.
Attackers are actively exploiting the Plex2Shell vulnerability chain to compromise internet-exposed NAS devices
QNAP urges immediate updates, as older Plex Media Server versions allow remote code execution and full device takeover
Systems exposed before patching may already be compromised and require credential resets and full remediation
QNAP has issued a security advisory warning users to install the latest version of the Plex Media Server app on their Network Attached Storage (NAS) devices.
It says older versions are being actively abused in the wild using the dreaded Plex2Shell vulnerability chain.
“Plex has confirmed that these vulnerabilities are being actively and widely exploited,” the company said in the advisory. “QNAP urges all users running Plex Media Server on a QNAP NAS to update immediately and to review their devices as described below.
What is a QNAP NAS and what does it have to do with a flaw in Plex?
A Network Attached Storage device is a dedicated system allowing users to store, back up, and share files across a network. Essentially it’s a series of hard drives connected to a local network for easy access. Consumers and businesses alike often use it as an alternative to subscription-based cloud storage models, and sometimes even to stream audio and video files.
One popular way to do that is via a software application called Plex Media Server, which allows users to organize and stream their personal collection of movies, TV shows, music, and other multimedia content. By installing Plex on their NAS, and a compatible player app on a smartphone and similar device, users can access their media libraries over a local network or remotely via the internet.
This last part - via the internet - is where trouble was recently found.
Earlier in November 2026, Plex disclosed having fixed four vulnerabilities in Media Server versions 1.43.2 and older: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Separately, these four are relatively dangerous. Chained together, they allow unauthenticated threat actors to execute arbitrary code with the highest privileges, remotely. In other words, they can use Plex Media Server to take over the QNAP NAS and, if they choose to, access and steal sensitive content found there. These four have been given the nickname Plex2Shell.
Plex released a fix in September 2026, and a proof-of-concept (PoC) exploit was made available a few weeks later. Since then, multiple security companies reported seeing Plex2Shell abused in the wild, mostly to install proxy software and cryptocurrency miners. The latter might not be particularly useful, given that most miners require powerful GPU units, but the former could prove lucrative.
Patching Plex
A proxy network allows cybercriminals to route their traffic through legitimate residential infrastructure, helping them not just to hide their identities and whereabouts, but also to launch disruptive Distributed Denial of Service (DDoS) attacks. As such, residential proxy services are always in demand, and can earn their operators a hefty sum.
The US Cybersecurity and Infrastructure Security Agency (CISA) added all four bugs to its Known Exploited Vulnerabilities (KEV) catalog on October 20, and gave Federal Civilian Executive Branch (FCEB) agencies a mere three-day window to apply the fix or stop using Plex entirely.
That being said, Plex addressed the flaws in Media Server version 1.43.3 (build 1.43.3.10861), which can now be downloaded via QNAP’s App center. The company confirmed that the bugs exist only in Plex Media Server, QTS and QuTS operating systems were not affected. Still, Plex said if the NAS device was reachable from the internet while running older versions of the software, updating is not enough and the NAS should be treated as compromised.
Those users are advised to complete a clean reinstall, compromise check, and credential reset.
The exact number of internet-accessible QNAP NAS devices is difficult to determine, but according to figures from BitSight, there are tens of thousands of them, right now. That does not mean all of them are vulnerable (many might not be running Plex Media Server to begin with), but the theoretical attack surface is quite large.
However, free VPNs often come with caveats and need to earn money somehow. In the case of Planet VPN, this may be achieved via Planet Search — a Chrome extension that re-routes users' internet searches through intermediary platforms before they reach monetized Yahoo search results.
While its role modifying a user's search engine has previously been documented and is identified in the Chrome Web Store, our investigation reveals that the developer was actively funneling users from its VPN product to its Chrome extension until at least mid-January this year.
Planet search, redirect & monetize
According to Socket’s report, these ‘searchjacking’ apps can “take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID.”
TechRadar has independently analyzed the source code of Planet Search and confirmed that it changes Chrome’s default search engine — using the chrome_settings_overrides.search_provider manifest key — to planet-search[.]com.
Using planet-search[.]com as the default search engine redirects users’ search queries through several intermediary platforms before landing on Yahoo’s syndication endpoint (/yhs/search) configured with commercial syndication parameters and campaign tracking tags.
Developer tools reveal the redirect pipeline: a search initiated through Planet Search bounces through several domains before delivering syndicated Yahoo results. (Image credit: Future)
While Planet Search states in the Chrome Web Store that it alters default search settings, the listing explicitly promises that “default search results will be provided by Google.” On another page it says the provider will be switched to Microsoft Bing. However, during our tests we consistently landed on Yahoo search result pages.
While TechRadar’s technical analysis traced the redirect hops to a Yahoo search endpoint, Planet Search’s privacy policy discloses that “certain web search services” are provided through CodeFuel, a search monetization platform. The same document also states the service may "gather data related" to usage, specifically citing "search queries" along with "the time and date of your search queries."
The Socket.dev report suggests many of the extensions may have obtained users via paid advertising campaigns. However, our research suggests that in the case of Planet Search, some of its users have been funneled from its VPN product.
Planet VPN's installer promoted the extension
TechRadar’s analysis of older Planet VPN desktop clients confirms that in version V.2.10.69.99, released on January 13, 2026, the app prompted users to install the Planet Search extension at setup.
The Planet VPN desktop setup wizard recommending the Planet Search extension during installation. (Image credit: Future)
However, frustration over the extension goes back years, with several people highlighting difficulties removing the tool .One user said they had "tried everything like deleting all of the folders on my PC" to get rid of the extension, while another said "it feels like malware."
Planet VPN’s developer confirming to a frustrated user that the browser extension can only be uninstalled through the desktop VPN application settings. (Image credit: Future)
TechRadar has not verified whether the current Planet Search extension still uses methods which make it difficult to remove.
How Planet Search may profit
When you enter a query while using the extension, that query is routed via its planet-search[.]com domain and several intermediary domains. The query is then handed off to major search providers (in our case Yahoo) with partner syndication tags (e.g. hspart or hsimp) at the end of the URL.
In search revenue-sharing arrangements of this kind, a user clicking on sponsored ads may generate a referral commission for the ad network, which may then share revenue with the extension publisher. TechRadar could not confirm whether Planet Free VPN receives any revenue from this arrangement.
While common among ad-tech toolbars, routing searches through redirect hops may expose user search intent to third-party commercial networks and is not something normally associated with the digital privacy protections of a VPN.
The free VPN privacy dilemma
All commercial VPNs exist to make a profit. And when an app is free, more often than not, you are what’s generating that profit.
While there are a few reputable free VPN providers, even the most well-established providers come with caveats — whether data limits, the inability to choose servers, or limited access to international servers.
For this VPN, Planet Search may be one way the provider is able to make money, although TechRadar could not confirm whether it earns revenue through the extension. It also offers paid-for tiers and may be monetizing its products in other ways.
Free Planet VPN S.R.L. did not respond to a request for comment before publication.
Login
