NCSC – CERT-SE veckobrev v.45
Cyberattacks target food retailers, blood banks, and air raid systems across Europe and Ukraine.
Run Synology?
Get an email when a reviewed story names Synology, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Several European countries, including Sweden and France, experienced cyberattacks targeting food retailers, leading to significant food spoilage. French blood banks were also hit, affecting cold storage systems. Separately, Ukraine's air raid alert system and the Kyiv Independent newspaper were targeted, with Russia's system also reportedly attacked in retaliation. Additionally, Synology NAS servers are under threat from ransomware, and a massive $6.3 billion cryptocurrency theft occurred at Binance, attributed to a North Korean state-sponsored actor.
The lesson from this incident
Full lessonThis wave of attacks highlights how critical infrastructure sectors — food supply chains, healthcare logistics, and civil alert systems — remain dangerously exposed to targeted cyberattacks. The disruption to cold storage systems at food retailers and blood banks demonstrates that physical consequences, including spoilage of perishable goods and medical supplies, can follow from digital intrusions. Ransomware targeting Synology NAS servers further illustrates that unpatched network-attached storage is a persistent weak point exploited at scale. The state-sponsored theft of $6.3 billion from Binance underscores that nation-state actors are conducting high-impact financial and infrastructure attacks with impunity. Without robust segmentation, rapid response playbooks, and cross-sector coordination, the blast radius of such attacks will continue to grow.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- malware — C3rb3r