The Kyiv Independent and The Record reported that Ukraine’s Air Alert app, developed by the Digital Transformation Ministry and Ajax Systems, was hijacked late Sunday, Nov. 1, to send fake warnings of radiation and chemical threats and street fighting, including one message reading, “Hi! A nuclear alert is about to go off all across Ukraine! Don’t worry, the Oreshnik is on its way” (Kyiv Independent). The developers said “unauthorized persons have interfered with the application,” disabled push notifications and temporarily suspended the app, and service was gradually restored by about 2 a.m. local time Monday (Kyiv Independent). Ukraine’s Air Force warned the app had “likely been compromised by the enemy,” and the State Emergency Service said the national warning system kept working normally (The Record). Hours later, early Monday, Russia’s Emergencies Ministry app sent false alerts that “nuclear warheads” had been launched across Russia and told users to stock up on three weeks of food and shelter in basements (Kyiv Independent); AP, citing the ministry, said the alerts went out around 2:45 a.m. Moscow time in 33 of Russia’s 89 regions. The ministry said the app hack “has not affected and cannot affect the operation of the public warning system” (The Record). According to The Record, a previously unknown group called Hitcore claimed the Ukrainian breach and a group calling itself DC8044, which describes itself as an independent hacking community based in Kyiv, claimed the Russian one; AP said it could not verify Hitcore’s claim.

• Indicators to watch · Disclosure of how the attackers got in (including any API abuse) and fixes for both apps, attribution by either side’s security services, copycat attacks on other public alerting services, malicious links embedded in the fake alerts

• C2JMIC keeps the Hormuz threat at SEVERE after 18 confirmed attacks since Oct. 6gCaptain said the Joint Maritime Information Center kept its SEVERE threat assessment for the Strait of Hormuz in its Nov. 1 update, warned further deliberate attacks were highly likely and counted 18 confirmed attacks in the strait since Oct. 6; 490 vessels were waiting outside the strait as of Nov. 1.

U.S. Impact Assessment

• Energy and inflation: cheaper crude, same Gulf riskCrude fell more than 7% on diplomatic signals, but in the same stretch UKMTO reported fresh strikes on ships off Saudi Arabia and Oman and the JMIC kept the Hormuz threat at SEVERE. With Tehran’s conditions unchanged and a White House decision still pending after Election Day, prices and physical shipping risk can move apart, so U.S. refiners, shippers and fuel buyers should base cargo routing, inventory and war-risk coverage decisions on vessel-level risk rather than the price move alone.
• Food retail and cold chain: refrigeration controllers are now a proven targetAttackers have now twice in a month remotely switched supermarket refrigeration in Europe to defrost and spoiled stock across hundreds of stores. U.S. grocers, distributors and cold-storage operators that rely on vendor-managed controllers should check for internet-exposed devices, default credentials and vendor remote-access paths, and make sure temperature alarms reach staff who can act on them.
• Public alerting: app push channels can be hijackedBoth Ukraine and Russia saw official alert apps used to push fake nuclear warnings while their national siren networks kept working. State and local emergency managers, utilities and companies that send safety notifications through apps should lock down push-notification APIs and sender credentials, require two-person approval for mass alerts, and rehearse how fast they can issue a correction.
• Markets: tech selloff meets Election DayThe Nasdaq fell 1.07% and the VIX rose 10.25% to 21.41 on Monday even as oil dropped, and the Treasury’s 10-year yield slipped to 4.91% (Nov. 2). With midterm results Tuesday and October payrolls Friday, companies with near-term financing or FX exposure should review their funding and hedging calendars around those dates.

Edition archiveRSS

• Monday, Nov 2 · Evening Edition · 16:43 ET · CurrentOil plunges more than 7% as the U.S. and Iranian presidents signal openness to a deal, but ships are still being hit in the Gulf, Russia bombs a Ukrainian aid center as a local truce ends, and hackers hijack emergency alert apps and European supermarket freezers
• Monday, Nov 2 · Morning Edition · 04:43 ETOil drops more than 3% on a report that Trump wants to give Iran diplomacy more time, even as ships keep getting hit in Hormuz, and North Korea says it will field the cluster warheads it just tested by year-end
• Sunday, Nov 1 · Evening Edition · 16:39 ETA ship is reported hit in the Strait of Hormuz and Iran’s Revolutionary Guards claim two tankers blew up on mines, as Axios reports Netanyahu is pressing Trump to strike Iran right after Tuesday’s midterms
• Sunday, Nov 1 · Morning Edition · 04:37 ETThe FBI formally pins the record $6.3 billion Binance theft on North Korea as Pyongyang touts a cluster warhead for its tactical ballistic missiles, while Iran brands Britain’s navy and air force terrorist groups and Trump says he’s “not in that much of a hurry” on a deal
• Saturday, Oct 31 · Evening Edition · 17:42 ETIran floats a conditional two-day reopening of Hormuz even as its supreme leader orders a response “without geographic limits,” Rubio says Trump hasn’t decided on new strikes, and the G20 foreign ministers wrap up without a joint statement
• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack

The BBC and NBC News reported that on Monday supermarkets and food shops in Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia had refrigeration and freezer systems remotely manipulated, pushing temperatures to about 50°C (122°F) and forcing them to throw out food; the BBC counted seven countries including Finland, NBC six. Affected chains include 15 Carrefour stores in Belgium, five Spar shops run by Colruyt Group, 13 SuperValu stores in Ireland, six to seven Coop stores in Sweden and about 40 Delhaize stores in Belgium and Luxembourg (BBC, NBC). The CEO of Belgian refrigeration company Sabcobel, which runs Delhaize’s systems, told the Belga news agency it was a cyberattack in which the units’ evaporators were switched to defrost mode (NBC), and the BBC said Danish manufacturer Danfoss’s systems were attacked in the Netherlands. Sweden’s national cybersecurity center is investigating but could not say who was behind it, no one has claimed responsibility (NBC), and the U.K.’s National Cyber Security Centre is investigating with international partners (BBC). The European Commission said the attack “highlights how digital threats can increasingly affect citizens’ everyday lives” (NBC). Both outlets said hundreds of French supermarkets were hit by a similar attack in October.

• Indicators to watch · Belgian, Swedish and Dutch cyber agencies’ findings on the intrusion path, advisories from Danfoss, Sabcobel and other controller vendors, CISA ICS advisories and KEV additions, internet-exposed refrigeration controllers at U.S. grocers and cold-storage sites

• B2Russia says it downed 212 Ukrainian drones overnight; Russian drones wound at least 17 across UkraineAP reported that Russia claimed to have shot down 212 Ukrainian drones overnight while Russian drone attacks injured at least 17 people across Ukraine. Zelensky said Ukraine had expected Russia to escalate at a time when it is short of air defense missiles.
• B1U.S. to drop South Africa and Rwanda from AGOA trade preferences on Jan. 1, 2027AP and the Sowetan reported that U.S. Trade Representative Jamieson Greer said Monday that South Africa and Rwanda will lose AGOA benefits as of Jan. 1, 2027, citing South African trade and investment barriers and threats to U.S. national security and foreign policy interests, and Rwanda’s support for M23 rebels in eastern Congo. South African Trade Minister Parks Tau said, “Whatever the outcome, our economy will remain stable” (Sowetan).

• C2Chainalysis says an attacker using “offensive agentic techniques” accessed customer names and emailsSecurityWeek reported that Chainalysis detected an external actor using AI agents to reach its systems and internal tools, exposing user IDs, names, email addresses and organization role labels but not investigation content or credentials. It did not say how many users were affected and said the incident is unrelated to the Binance theft.
• C2Amadeus exposure widens to Qantas; Korean Air and Asiana counts still undisclosedBeinsure reported that Qantas said Amadeus told it of unauthorized access to one of its systems and that it is checking the impact on its bookings. The access ran from August 2023 to September 2026 and also hit Japan Airlines, ANA, Cathay Pacific, Korean Air, Malaysia Airlines and Asiana.
• C2Binance theft: FBI flags 628 addresses as scammers push fake compensation offersHelp Net Security said the FBI, which attributed the theft to North Korea on Oct. 31, published 628 suspicious addresses for blocking, and Tether, Circle and partners froze about $3 billion on the first day. Binance warned that posts promising $150 in compensation are fake.

Sources 20

• R
  Reuters (via The Globe and Mail)Oil drops 7% as Iran signals openness to peace talks
  B
• C
  CNBCCrude oil prices sell off more than 7% on Iran peace talk hopes ahead of U.S. midterms
  B
• A
  Al JazeeraIran pushing accelerated plan for ceasefire talks with US
  B
• g
  gCaptainNew Wave of Attacks Hits Tankers and LNG Carrier in Strait of Hormuz and Persian Gulf
  C
• G
  Gulf NewsVessel Struck by Unknown Projectile Near Strait of Hormuz, UKMTO Reports
  C
• A
  AP (via The Globe and Mail)Russia bombs aid centre in Ukraine, killing 26, officials say
  B
• A
  ABC News Australia (Reuters)Russian strikes on Ukrainian shelter and aid centre in Zaporihzhia region kill 24
  B
• T
  The RecordRussian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warnings
  C
• T
  The Kyiv IndependentUkraine's air raid alert system hacked, Russian system targeted hours later
  B
• B
  BBC (via Yahoo News Australia)Shop freezers in seven European countries hit by cyber-attack
  B
• N
  NBC NewsSupermarkets across Europe hit by new fridge cyberattacks
  B
• C
  CNBCTreasury yields are mixed as oil prices tumble ahead of the midterms
  B
• A
  AP (via WSLS)Trump administration will cut South Africa and Rwanda from the AGOA trade program
  B
• S
  SowetanUS removes South Africa from Agoa trade pact
  B
• N
  News1South Korea-India economic security dialogue launch meeting discusses supply chain, shipbuilding and energy cooperation (in Korean)
  B
• N
  NewspimPresidential office: South Korea and India to continue supply chain security cooperation after first economic security dialogue (in Korean)
  C
• B
  BleepingComputerFintech platform Sageworks taken offline after suspected cyberattack
  C
• S
  SecurityWeekChainalysis Discloses Data Breach Following AI-Driven Cyberattack
  C
• B
  BeinsureQantas and major Asian airlines affected by Amadeus data breach
  C
• H
  Help Net SecurityFBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users
  C

Reuters and CNBC reported that crude fell more than 7% Monday after the U.S. and Iranian presidents signaled they are open to a diplomatic solution; CNBC said it was WTI’s biggest one-day loss since July 27. Trump said Iran wants to “make a deal and that could happen,” and Iranian President Masoud Pezeshkian said Tehran is seeking to resolve the problem through dialogue and that Supreme Leader Mojtaba Khamenei has granted the government authority to do so (CNBC, Reuters). Al Jazeera reported that Foreign Ministry spokesman Esmaeil Baghaei said Iran’s seven-step plan has been “condensed and can be implemented within two days” instead of seven, and Foreign Minister Abbas Araghchi said, “By accepting these conditions, the Strait of Hormuz will be opened and negotiations will resume.” Those conditions are lifting the naval blockade of Iranian ports, repealing sanctions, guaranteeing an end to strikes and a full regional ceasefire, especially in Lebanon, and Baghaei gave no sign that Tehran had changed its demands or that Washington had accepted them (Al Jazeera). Reuters said Qatari mediators traveled to Tehran Monday evening for talks with Araghchi. Secretary of State Marco Rubio said the president has “incredible confidence that if we needed to do something militarily, we would have the ability to do it. But we would prefer to do it peacefully,” and that Trump hasn’t decided whether to strike again; on Saturday Khamenei ordered the armed forces to meet any threat with “an immediate, impactful, and geographically unrestricted response” (CNBC). Al Jazeera said Trump called the talks “going fine” while suggesting strikes remain possible after the Nov. 3 elections. On our tiles, Brent stood at $104.05 (-8.27%) and WTI at $95.90 (-7.89%) as of 16:04–16:05 ET.

• Indicators to watch · White House decisions on Iran after the Nov. 3 midterms, a formal U.S. reply to Tehran’s plan, the schedule of Qatari- and Pakistani-mediated talks, UKMTO strike advisories and Hormuz transit counts, war-risk insurance rates

AP and Reuters (via ABC Australia) reported that on Monday Russia struck a school building used to hand out humanitarian aid and a neighboring shelter in the village of Komyshuvakha in southern Ukraine’s Zaporizhzhia region. Zelensky said on X that 10 guided bombs targeted the area and that “after the first aerial bomb strike, there was a double-tap strike with nine more bombs,” calling it “further proof that Russia wants no de-escalation and no real justice” (ABC). AP, citing Ukraine’s emergency services, put the death toll at 26, while Reuters (ABC) reported 24; AP said about 20 people were missing and ABC said 27. AP said Russian drones kept attacking during the rescue, and ABC said Russia had not commented. The same day Russia resumed attacks on Kherson region after the local truce that began Oct. 27 ended: Euronews reported a drone hit a car in Kherson’s Korabelny district around 8 a.m. Monday, wounding two, a senior Ukrainian official told AFP that Russia refused Kyiv’s offer to extend the truce, and Ukraine’s military alleged Russia used the pause to “fortify its positions.” Euronews also said U.S.-mediated Russia-Ukraine talks are set to resume this month.

• Indicators to watch · Final casualty count in Komyshuvakha and any Russian Defense Ministry statement, shelling and civilian casualties around Kherson and Oleshky, a date, venue and format for U.S.-mediated talks, Ukraine’s supply of air defense interceptors

• —North Korea: no notable activity confirmed in the windowWe found no JCS announcement of a North Korean launch and no new North Korean state media report of a weapons test during this collection window (Nov. 2, 4:43 a.m. to 4:15 p.m. ET).

Watchlist next 12–48 hours and beyond

• Tue, Nov 3
  Midterm elections — and the White House’s next move on Iran and its reply to Tehran’s plan
• Tue, Nov 3
  JOLTS release; Reserve Bank of Australia policy decision
• Thu, Nov 5
  Bank of England policy decision
• Fri, Nov 6
  October nonfarm payrolls
• All week
  National cyber agencies’ findings on the European refrigeration attacks, controller-vendor advisories and any CISA ICS advisories
• Sun, Nov 15
  Comment deadline for China’s draft revision of its technology export control catalogue (MOFCOM Announcement No. 48)

Intelligence gaps · unconfirmed

• Oil: The Brent and WTI settlement prices and percentage moves cited by Reuters, CNBC and others use different timestamps from our tiles (Brent $104.05, -8.27%; WTI $95.90, -7.89%; 16:04–16:05 ET), so we did not reproduce them. The Brent and WTI figures on the signal board are EIA spot prices as of Oct. 27 and are not compared with the futures tiles.
• Iran: Khamenei’s grant of negotiating authority rests on Pezeshkian’s remarks and state news agency IRNA; its scope is unclear. The outcome of the Qatari mediators’ Tehran talks was not available within the window.
• Gulf shipping: Names, flags and damage for the ships hit on Nov. 1 and the attackers were not disclosed. The Ras Al Khafji tanker strike is confirmed by gCaptain and Khaama Press; the Lima, Oman, strike by Gulf News and gCaptain. Both strikes happened before the collection window opened.
• Komyshuvakha: AP reports 26 dead, Reuters (ABC) 24; missing counts differ (about 20 per AP, 27 per ABC). We could not find a Russian response. The BBC original was blocked. Euronews says the Kherson truce ended Sunday, AP says Monday.
• Alert apps: Claims by Hitcore and DC8044 are self-reported and unverified. The number of users who received fake alerts and the intrusion path have not been disclosed.
• Refrigeration attacks: The BBC counts seven countries (including Finland), NBC six; Coop store counts differ (six per NBC, seven per BBC). The exploited vulnerability, the extent of Danfoss equipment involvement and the scale of October’s French attack are unconfirmed. Axios’s piece on U.S. exposure was blocked.
• Markets: Bloomberg’s Treasury story was blocked. Apple’s results were not checked within the window. The 10-year differs between our market tile (Yahoo Finance 4.894%, -4bp) and the signal board (Treasury 4.91%, -3bp) because of different bases.
• Korea: A Newsis report on a State Department comment that North Korea relies on cybercrime to fund missiles could not be checked against the original and was not used. The Amadeus item rests on a single outlet (Beinsure), and Korean Air’s and Asiana’s counts are undisclosed.
• Not used: The Florida business-jet crash, a Wizz Air bomb-threat diversion, the U.S. approval of a Patriot sale to Ukraine (Oct. 30, before the window), Florida Department of Education and Revolve data breaches (single sources), and undated analysis pieces on rare-earth risks to U.S. weapons programs.
• Scoring notes: Nothing in this window met the criteria for ‘us-strike-iran-territory-nov3’ (announced U.S. strike on Iranian territory) or ‘hormuz-merchant-ship-sinks-nov15’ (confirmed sinking). On ‘oleshky-ceasefire-extended-nov4’, Euronews cited a senior Ukrainian official saying Russia rejected an extension, and none was announced. On ‘amadeus-breach-total-scale-nov30’, we found no Amadeus disclosure of a total count.