In today’s cybersecurity news…
North Korean hackers steal more than $2B in crypto
North Korean hackers stole an estimated $2 billion in cryptocurrency in 2025, the largest annual total on record, according to blockchain analytics firm Elliptic. The largest theft was the Bybit hack in February ($1.46B). Elliptic also attributes 30 crypto-heists this year to North Korean actors. The United Nations and government agencies say stolen crypto funds support North Korea’s weapons programs. (Bleeping Computer)
Group suspected of sending stolen UK phones to China
The Metropolitan Police dismantled an international gang that allegedly smuggled up to 40,000 stolen UK phones to China over the past year. The investigation began after a victim tracked a stolen iPhone to a warehouse near Heathrow Airport, leading to raids on 28 properties and the arrest of 18 suspects, mostly women. Afghan and Indian nationals face charges for handling stolen goods and conspiracy. Police said stolen devices were sold overseas for up to £4,000 each. (BBC)
Avnet confirms breach, says stolen data unreadable
Electronic components distributor Avnet confirmed a data breach affecting an internal sales tool in its EMEA region, saying the stolen data is largely unreadable without proprietary tools. Attackers claim to have taken 1.3TB of compressed data, including sensitive operational and personal information, and are pressuring Avnet for ransom via a dark web leak site. The company said global operations were unaffected, authorities were notified, and impacted customers and suppliers will be contacted. (Bleeping Computer)
US medical scanning biz gets clear image of stolen patient data
Florida-based Doctors Imaging Group disclosed that a November 2024 cyberattack exposed the medical and financial data of 171,862 patients, including Social Security numbers, health insurance details, and treatment information. The company completed its investigation back in August and started notifying victims recently. Despite the scale of the breach, it’s not offering credit monitoring, instead advising patients to use free annual credit reports and fraud alerts. No ransomware group has claimed responsibility for the attack. (The Register)
Huge thanks to our sponsor, ThreatLocker
Critical Flaw Exposes 60,000 Redis Servers
A critical flaw in Redis, also known as “RediShell,” has exposed about 60,000 servers to remote code execution. The bug was hidden for 13 years in Redis’s Lua scripting engine and lets attackers escape the sandbox and run arbitrary code. Exploitation requires authentication, but tens of thousands of exposed instances lack protection. Redis and Wiz disclosed the issue October 3rd, and released patches for all major versions. No active exploits are confirmed. (Infosecurity Magazine)
Russia blocks mobile internet for foreign SIM cards over drone threats
Russia is blocking mobile internet for anyone entering the country with a foreign SIM card, citing “drone threats.” Travelers from Belarus and Kazakhstan report a 24-hour blackout on mobile data and SMS upon connecting to Russian networks, which resets when crossing regional borders. The rule isn’t formally backed by law, but adds to a surge of regional internet shutdowns since May. (The Record)
BK Technologies cops to cyber break-in
Florida-based BK Technologies, which supplies radios to U.S. police, firefighters, and military agencies, disclosed a cyber intrusion detected around September 20th. The company said an attacker accessed some employee data but that core operations continued without major disruption. BK isolated affected systems, brought in external investigators, and has notified law enforcement. It expects cleanup costs to be covered by insurance. The source of the breach remains unknown, and no customers appear to have been directly affected. (The Register)
Qilin Claims Ransomware Attack on Mecklenburg Schools
Russian ransomware group Qilin (chee-leen) has claimed responsibility for a September cyberattack on Mecklenburg County Public Schools in Virginia, which disrupted classes and forced teachers offline for a week. The group says it stole 305 GB of data, including financial and student medical files. Superintendent Scott Worner confirmed Qilin’s involvement and said the district doesn’t plan to pay the ransom. Qilin has been active since 2022 and has claimed more than 100 ransomware attacks this year. (Infosecurity Magazine)