MEFILES

Supermarket freezers failed across nine European countries and no government has named a culprit

The second wave of refrigeration-controller attacks hit retailers in Belgium, Sweden, Ireland and beyond on 2 November. The only state agency to publish anything substantive about the vector was Israel’s — and it named no actor.

Temperature controls at grocery refrigerators across Europe were manipulated in the early hours of Monday 2 November, the second such wave in weeks. Recorded Future News reported more than 50 affected stores identified in Belgium and over a dozen more in Ireland, Estonia, the Netherlands and Luxembourg, with retailers describing a “limited number” of smaller stores hit in Sweden. A spokesperson for the privately held Swedish chain ICA told Reuters by email: “We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems.” The Belga news agency reported overnight temperature increases at dozens of Ahold Delhaize stores in Belgium and Luxembourg, blamed on a cyberattack by the chief executive of the refrigeration company Sabcobel. Katrien Eggers, spokesperson for the Centre for Cybersecurity Belgium, told Recorded Future News her agency was aware of the incident but could not provide further information.

Two attribution tracks are circulating, and neither rests on a named official. United24 Media, a Ukrainian state-founded outlet, relayed POLITICO reporting of 3 November that the attacks spanned at least nine EU countries — Belgium, Luxembourg, Sweden, Germany, Ireland, the Netherlands, Estonia, Finland and Romania — and that cybersecurity experts, unnamed, suggested a link to Russian hybrid operations. Separately, Nextgov/FCW’s David DiMolfetta reported on 29 October that officials, also unnamed, suspect Iran in a series of cyberattacks on freezers at US military bases; the conditional framing that this would demonstrate Tehran’s ability to disrupt military-related equipment is the publication’s own. Those are two different incidents in two theatres, and no published technical evidence links them. Al Jazeera managed to invoke both hypotheses in a single sentence, citing concern over hybrid warfare stemming from Russia’s invasion of Ukraine and the Iran–United States war.

The one on-the-record official response came from Jerusalem. The Israel National Cyber Directorate issued a warning on Monday to retail chains, food companies and logistics centres, urging them to inspect refrigeration and control systems with particular attention to those permitting remote access by technicians and service providers, and to report back with inspection results and the protective measures taken. INCD said, via Israel National News, that attackers exploited vulnerabilities in internet-connected control systems, remotely changing temperature settings and activating defrosting mechanisms. Its mitigations, reported by i24NEWS, were conventional and specific: keep control systems off the open internet, replace default passwords, update outdated systems. The advisory describes a vector without naming an actor — which is more than any European agency has published four days into the second wave.

Assessment: The useful question is not which state did it but whether these were nine national incidents or one supplier. French retailers in the October wave outsourced refrigeration management to third parties and could not set their own security; if the Belgian, Swedish and Irish victims share an equipment vendor or a remote-access platform, this is a supply-chain compromise and the country count is noise. Sabcobel’s chief executive has already spoken; the suppliers are the reportable party. Treat the Russia and Iran theories as equally unevidenced, and note that both are convenient to someone. Watch for an ANSSI, CCB, ENISA or Europol statement naming a controller vendor or CVE. CISA’s April advisory on Iranian-affiliated actors and exposed programmable logic controllers is resurfacing alongside this story; nothing published connects them.

An espionage campaign phishing with Gulf webmail lures took a gigabyte from a Kurdistan government cloud

Dream Security’s DarkBlinders research, published 3 November, describes credential theft, a fake meeting application and GitHub-hosted backdoors — and hedges its attribution carefully. The domains are the part that matters in the Gulf.

The Israeli vendor Dream Security says it observed the campaign it calls DarkBlinders between August and October 2026, and that the operation remained active at publication. Confirmed activity includes credential theft and the exfiltration of at least one gigabyte from a government cloud environment in Iraqi Kurdistan, alongside the compromise of a high-profile Israeli individual associated with the security sector. The tradecraft described is patient rather than noisy: impersonation of government webmail, cloud-drive and meeting services to establish access, then a review of infected systems before a second-stage implant was selectively deployed. Some lures copied Google Drive sharing links on domains themed around the Kurdistan Regional Government. For resilience, the malware could read a hidden comment in the public Microsoft vscode repository to locate new infrastructure if GitHub shut down its account.

The indicators published include gcc-sg[.]cloud and gcc-sg[.]online as Gulf Cooperation Council webmail lures, and drive-g[.]cloud, cdndrive[.]online, cdn-gdrive[.]cloud and drive-go[.]cam for Drive-style delivery. On attribution Dream hedges, and the hedge should travel with the finding: medium-to-high confidence that DarkBlinders overlaps with UNC5795 and Dust Specter, and only medium confidence on possible relationships with UNC5187 within APT34, on the basis of shared servers, matching malware and a common focus on Iraqi government targets. Dream positions the operation as an extension of the activity behind Unit 42’s previously documented Blinder Tunnel campaign, which recorded fake Dubai Airports recruitment lures and abuse of the GitHub API. This desk did not obtain the primary Dream report; the details above come from trade secondaries.

Assessment: Single-vendor research naming a new actor is a commercial act as well as a technical one, and Israeli vendors publishing on Iranian-nexus clusters have an obvious market. That does not make the indicators wrong — domains and GitHub fallback channels are checkable by anyone, and the Gulf-branded webmail lures are the operationally useful part regardless of which cluster label survives. The APT34 link is the weakest claim in the package and is where secondary coverage will harden the hedge into a fact. Two things to watch: whether GitHub disables the C2 accounts given the vscode-repository fallback, and whether activity continues after disclosure. A campaign that keeps running after being named was never relying on stealth.

Tehran’s networks faltered hours before anticipated US strikes, and nobody can yet say why

Users in Tehran and surrounding provinces reported outages on Tuesday 3 November. Iran’s own CITNA says the extent, the operators affected and the cause have not been officially established.

Internet users in Tehran and several other provinces reported outages and unstable connections on Tuesday amid uncertainty over renewed US military action, after the New York Times reported that Washington could launch strikes as early as Wednesday. The disruptions mainly affected Tehran and surrounding provinces, with problems reported elsewhere in the country. CITNA, the Iranian telecoms news outlet, said the full geographic extent, the operators affected and the causes had not been officially established. APA, citing Iranian media, reported outages at Hamrah-e Aval and the Telecommunications Company of Iran in parts of Tehran alongside severe slowdowns on other operators' networks, and said users reported access to the global internet being cut off for roughly ten minutes before restoration. That figure rests on user reports relayed through Iranian media and has not been confirmed by measurement data.

The framing to resist is that Iran’s connectivity problems began with the war. ACLED’s expert comment, published roughly two weeks ago, records that restrictions were first imposed months earlier in response to nationwide anti-government protests triggered by worsening economic conditions and a collapsing currency, spreading across all 31 provinces, and then continued through the conflict period. Asked whether access had been restored after what it calls the largest state-imposed internet shutdown in modern history, ACLED’s answer was flat: “No. While internet access has been partially restored, Iran remains far from fully online. Connectivity is still extremely slow, many platforms and messaging apps remain restricted, and the VPNs many Iranians previously relied on are no longer effective or affordable.” Iran was largely cut off for much of 2026, meaning much of what happened during both the protests and the war never reached the outside world.

Assessment: Note the sourcing geometry before the substance. Iran International is funded from the Gulf and is a participant in the information conflict it covers; APA is Azerbaijani. Neither is a neutral arbiter of whether Tehran throttled deliberately, and the absence of NetBlocks or IODA curves from this cycle is the gap that matters — the shape of the drop distinguishes an administrative shutdown from a cable or power fault from an external operation. Everyone has a motive here: an outage ahead of expected strikes serves Tehran as cover and serves its adversaries as evidence of repression. Until measurement data lands, the honest position is CITNA’s own: cause unestablished.