[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fryGuv6HlUzain1sdN0KIrpWgtf9Vlzai-4kRdUBMV1o":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"f5849a18-de0e-4275-9c14-4dbd0847c9c8","NCSC – CERT-SE veckobrev v.45","ncsc-cert-se-veckobrev-v-45-74ecf6","I veckans brev kan du läsa om de cyberangrepp som drabbade flera livsmedelsbutiker i Sverige och andra europeiska länder tidigare i veckan.","Several European countries, including Sweden and France, experienced cyberattacks targeting food retailers, leading to significant food spoilage. French blood banks were also hit, affecting cold storage systems. Separately, Ukraine's air raid alert system and the Kyiv Independent newspaper were targeted, with Russia's system also reportedly attacked in retaliation. Additionally, Synology NAS servers are under threat from ransomware, and a massive $6.3 billion cryptocurrency theft occurred at Binance, attributed to a North Korean state-sponsored actor.","Cyberattacks target food retailers, blood banks, and air raid systems across Europe and Ukraine.","https:\u002F\u002Fwww.cert.se\u002F2026\u002F11\u002Fncsc-cert-se-veckobrev-v45.html",null,"2026-11-06T11:00:00+00:00","2026-11-06T12:00:18.328591+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Synology","vendor",{"name":21,"type":19},"Binance",{"name":23,"type":24},"North Korean state-sponsored actor","threat_actor",{"name":26,"type":27},"OpenSSH","product",{"name":29,"type":27},"DSM","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":12,"name":32,"slug":33},"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":12,"name":48,"slug":49},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":51},{"id":52,"icon":12,"name":53,"slug":54},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[56],{"type":54,"value":57,"context":58},"C3rb3r","Ransomware targeting Synology NAS servers",[18,21,26],{"controls":61,"vendors":148},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,74,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":63,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":120,"name":121,"problem":122,"products":123},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"multi-sector-cyberattacks-hit-food-retail-blood-banks-and-critical-infrastructure-across-europe","Multi-Sector Cyberattacks Hit Food Retail, Blood Banks, and Critical Infrastructure Across Europe","This wave of attacks highlights how critical infrastructure sectors — food supply chains, healthcare logistics, and civil alert systems — remain dangerously exposed to targeted cyberattacks. The disruption to cold storage systems at food retailers and blood banks demonstrates that physical consequences, including spoilage of perishable goods and medical supplies, can follow from digital intrusions. Ransomware targeting Synology NAS servers further illustrates that unpatched network-attached storage is a persistent weak point exploited at scale. The state-sponsored theft of $6.3 billion from Binance underscores that nation-state actors are conducting high-impact financial and infrastructure attacks with impunity. Without robust segmentation, rapid response playbooks, and cross-sector coordination, the blast radius of such attacks will continue to grow.",[154,155,156,157,158,159,160],"CIS Control 17: Incident Response Management","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":162,"MITRE ATT&CK T1566: Phishing":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 17: Incident Response Management":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 explicitly requires incident handling procedures for essential service operators; food retailers, blood banks, and civil alert systems all qualify and must demonstrate tested response capabilities under this obligation.","State-sponsored actors frequently gain initial access to critical infrastructure and financial platforms through spear-phishing; awareness of this technique is essential for defenders protecting civil alert systems and cryptocurrency exchanges.","Timely identification and remediation of flaws in NAS firmware and infrastructure software is directly mandated by SI-2 and would have reduced the attack surface exploited in the ransomware campaign.","The attacks on food retailers and blood banks caused significant physical harm; mature incident response plans with sector-specific playbooks would have enabled faster containment and reduced spoilage damage.","Synology NAS servers were targeted by ransomware through known vulnerabilities; a continuous vulnerability management programme with enforced patching deadlines would have closed these attack vectors before exploitation.","A.8.8 requires organizations to identify and remediate technical vulnerabilities in a timely manner, which would have mandated patching of the Synology NAS systems before ransomware actors could exploit them.","The Binance theft attributed to North Korean actors highlights failures in privileged access control; PR.AA requires strong authentication and least-privilege access on high-value systems to impede unauthorized transfers."]