Weekly CTI roundup: ShinyHunters-linked arrest, DPRK laptop farms raided, Ledger supply-chain implants, French refrigeration sabotage
This SentinelOne weekly roundup covers three developments. The FBI arrested Edward Dubrovsky, a former CYPFER executive, on conspiracy and extortion charges. Kash Patel described him as a suspected co-conspirator of ShinyHunters, though he has not been officially named as one. The FBI says the group breached more than 140 organizations and extracted at least $70 million in ransom over the past year. Separately, the DoJ charged 14 people and seized about 187 devices in Operation Lonestar Roundup, targeting North Korean remote IT worker laptop farms in Texas.
Ledger confirmed that signers sold by the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that exfiltrates 24-word recovery phrases over LTE. A coordinated remote attack on internet-connected refrigeration controllers hit about 700 French supermarket stores, including Intermarché, Coopérative U, Carrefour Market, Monoprix and Super U. Losses are estimated at tens of millions of euros. SentinelLABS researcher Tom Hegel said the incident bears the hallmarks of a nation-state sabotage operation. The article provides no technical attribution evidence, and no extortion demands or hacktivist claims were made.
Detalhes técnicos
- Ledger implant: a separate component inside the enclosure reads the display output and button presses. When it detects the seed phrase screens during setup, its microcontroller decodes the words and sends them over LTE using a provisioned eSIM.
- The implant does not modify the Secure Element or the Ledger OS, so tampered devices passed Ledger's built-in verification.
- Mark Karpelès performed an independent teardown, and Tibane Labs confirmed it. Tibane found two Ledger Nano X variants, one under the battery compartment and one under the OLED display.
- Tampered devices were also reported via unauthorized sellers in Europe and airport retail kiosks in Singapore. Ledger has not verified the total number of victims or the total value lost.
- France refrigeration attack: actors remotely accessed Danfoss AK-SM/AK-SC and Copeland/Dixwell XWEB controllers, many of them legacy units without vendor security updates. They raised internal temperatures to as high as 50°C by triggering defrost cycles, which caused food loss and electrical equipment fires. The Paris prosecutor's office has opened an inquiry.
- DPRK IT workers use stolen identities, remote-access technology and proxy infrastructure to obtain jobs at U.S. companies. Two U.S. facilitators, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested. Twelve of the 14 charged remain at large.
Remediação
- Ledger: do not set up a CryptoBilis-bought signer, and contact Ledger Support. If one was already set up, move assets to a new signer with a new recovery phrase. Never enter a recovery phrase into a website, app or form.
- Refrigeration and building management controllers: per CERT-FR, disconnect exposed controllers or restrict network access. Take them off the public internet, enforce strong authentication, and replace hardware that no longer receives security updates.
- Facilities contractors should not deploy these controllers without involvement from enterprise security teams.
Linha do tempo
-
Weekly CTI roundup: ShinyHunters-linked arrest, DPRK laptop farms raided, Ledger supply-chain implants, French refrigeration sabotage
ler a análise desta fonte ocultar
This SentinelOne weekly roundup covers three developments. The FBI arrested Edward Dubrovsky, a former CYPFER executive, on conspiracy and extortion charges. Kash Patel described him as a suspected co-conspirator of ShinyHunters, though he has not been officially named as one. The FBI says the group breached more than 140 organizations and extracted at least $70 million in ransom over the past year. Separately, the DoJ charged 14 people and seized about 187 devices in Operation Lonestar Roundup, targeting North Korean remote IT worker laptop farms in Texas.
Ledger confirmed that signers sold by the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that exfiltrates 24-word recovery phrases over LTE. A coordinated remote attack on internet-connected refrigeration controllers hit about 700 French supermarket stores, including Intermarché, Coopérative U, Carrefour Market, Monoprix and Super U. Losses are estimated at tens of millions of euros. SentinelLABS researcher Tom Hegel said the incident bears the hallmarks of a nation-state sabotage operation. The article provides no technical attribution evidence, and no extortion demands or hacktivist claims were made.
Technical Details
- Ledger implant: a separate component inside the enclosure reads the display output and button presses. When it detects the seed phrase screens during setup, its microcontroller decodes the words and sends them over LTE using a provisioned eSIM.
- The implant does not modify the Secure Element or the Ledger OS, so tampered devices passed Ledger's built-in verification.
- Mark Karpelès performed an independent teardown, and Tibane Labs confirmed it. Tibane found two Ledger Nano X variants, one under the battery compartment and one under the OLED display.
- Tampered devices were also reported via unauthorized sellers in Europe and airport retail kiosks in Singapore. Ledger has not verified the total number of victims or the total value lost.
- France refrigeration attack: actors remotely accessed Danfoss AK-SM/AK-SC and Copeland/Dixwell XWEB controllers, many of them legacy units without vendor security updates. They raised internal temperatures to as high as 50°C by triggering defrost cycles, which caused food loss and electrical equipment fires. The Paris prosecutor's office has opened an inquiry.
- DPRK IT workers use stolen identities, remote-access technology and proxy infrastructure to obtain jobs at U.S. companies. Two U.S. facilitators, Michael James Bostelle and Juan Cecilio Pena Carrillo, were arrested. Twelve of the 14 charged remain at large.
Remediation
- Ledger: do not set up a CryptoBilis-bought signer, and contact Ledger Support. If one was already set up, move assets to a new signer with a new recovery phrase. Never enter a recovery phrase into a website, app or form.
- Refrigeration and building management controllers: per CERT-FR, disconnect exposed controllers or restrict network access. Take them off the public internet, enforce strong authentication, and replace hardware that no longer receives security updates.
- Facilities contractors should not deploy these controllers without involvement from enterprise security teams.