Treasury Urged Insurers and Lenders to Screen for Ships With Fake Flags, Under Penalties That Do Not Require Intent

Confidence: HIGH · Iran, United States, India · Maritime, Insurance, Financial Services

US sanctions on Iran now reach companies that never touch an Iranian port. The Treasury Department has urged the insurers and lenders behind ordinary sea cargo to look harder at ships showing signs of a false flag, and it can penalize a violation without proving intent. The question for you is who checks the flag on the ships carrying your goods.

On November 4th the Treasury Department sanctioned Suniel Kumar Sharma, an Indian businessman in Chandigarh, along with his spouse and the companies they ran in India and Singapore, for selling fake flags and registration papers to tankers carrying Iranian oil. A flag is the country a ship is registered in, the government that vouches for it and whose law it sails under. Treasury says the business has been faking flags since 2014, and that a registry it set up in 2023 in the name of Eswatini, the small kingdom in southern Africa, has been publicly disowned by Eswatini's government and keeps flagging vessels anyway. Treasury's release notes that on April 22nd the US seized the MAJESTIC X, a vessel falsely flying Guyana's flag.

The same day, Treasury's sanctions office, the Office of Foreign Assets Control (OFAC), issued an alert encouraging "service providers, including insurers, financial institutions offering trade financing, and others providing services in the maritime sector" to run enhanced due diligence on vessels showing signs of a falsely claimed flag. It lists the signs: a flag that appears in no maritime database, a flag from a country that is commonly faked or has no registry at all, a ship's radio identity number whose country code contradicts the flag it reports, and registration papers that cannot be verified. A falsely claimed flag, the alert says, is "a strong indicator that a vessel is sanctioned or engaged in sanctionable activity." Treasury's release says OFAC can impose civil penalties "on a strict liability basis," meaning it does not have to show you knew, and that companies outside the US are barred from causing US companies to violate sanctions. Treasury adds that such ships have no valid liability insurance, a gap it warns could mean billions of dollars in damages.

On November 7th US Central Command (CENTCOM), the military command for the Middle East, set up Task Force Iron Gate, "an internal staff of approximately 20 civilian and military personnel based in Tampa, Florida," to coordinate with other US agencies against the movement of "advanced weapons systems, dual-use technologies, sanctioned materials, and illegal revenue streams across Iran's land borders and the Caspian Sea." The release names no ships, ground units, countries or border crossings. GIS Reports, a geopolitical analysis firm, wrote in September that the Caspian route is "free of disruption from the U.S. navy." The force behind the blockade is at sea. The same day, CENTCOM said a US aircraft had fired on the M/V Huda, a bulk carrier flagged in St. Kitts, in the Gulf of Oman after it left an Iranian port and, CENTCOM says, ignored repeated warnings. Since July, CENTCOM says, US forces have redirected 147 commercial vessels that complied and disabled five that refused.

The conflict has also cut Gulf gas. The International Energy Agency (IEA), the body that advises industrialized countries on energy security, says shipments of liquefied natural gas (LNG) from Qatar and the United Arab Emirates fell by more than 60 billion cubic meters year on year from March to October, with the Strait of Hormuz, the narrow channel at the mouth of the Persian Gulf, still disrupted. The EU entered the heating season with its gas storage at the lowest level since 2013, and in a colder-than-average winter the IEA's simulations have storage falling below 10% of capacity by the end of March 2027.

Oil moved the other way. Brent, the international benchmark price for crude oil, settled at $98.32 on Friday, down from $117.64 a week earlier, on hopes of a US-Iran deal. Axios reported Friday, citing two unnamed sources, that Vice President Vance has spent about two weeks in indirect talks toward a new ceasefire, speaking almost daily with Qatar's prime minister and Pakistan's army chief. Sources involved in the mediation told Axios that progress has been very slow, and FGE, an energy consultancy, rates an imminent deal unlikely. That points to a planning case of no deal before spring, with the blockade running through the heating season and OFAC continuing to go after the companies that service ships as well as the shipowners. A revived ceasefire framework would soften enforcement, and a restart of fighting would tighten everything.

The Takeaway: Treasury is urging insurers and lenders to look harder at any ship showing signs of a false flag, and OFAC can penalize a violation without proving intent. Your freight forwarder can check the flag of the ship it books against a maritime database. Oil fell this week, but Europe entered winter with the least gas in storage since 2013, so an energy budget built on this week's oil price may be too low.

• OFAC alert, falsely flagged vessels and enhanced due diligence, November 4th
• Treasury press release sb0681, designations of fraudulent flag registry operators
• CENTCOM, Task Force Iron Gate, November 7th
• CENTCOM, US forces disable M/V Huda, November 7th
• IEA Global Gas Security Review 2026, executive summary
• Maritime Executive, first disabling of a cargo ship in a month
• Axios, November 6th, Vance's push for a new Iran deal
• GIS Reports, trade routes and Iran sanctions
• FinanceFeeds, citing CNBC, Brent settles at $98.32
• gCaptain, FGE says a peace deal is not likely

Democrats' Win in Congress Leaves the 10% to 12.5% Tariffs on 60 Economies in Place

Confidence: HIGH · United States, China · Manufacturing, Retail, Logistics

Plan on the current tariff rates. They rest on authority Congress already delegated, a veto override takes more votes than Democrats hold, and the next changes depend on a trade court and on talks with China.

Democrats won both chambers on November 3rd. By the Associated Press's count they hold 54 Senate seats and lead the House 254 to 162 with 19 races uncalled, and Alaska and Mississippi are still being counted for the Senate. The tariff on the goods you import on Monday is the same as it was on Friday.

Since July 24th, imports from 60 economies, 59 countries plus the European Union counted once, have carried a tariff imposed under a trade law that lets the US penalize another country's unfair practices, in this case forced labor. The US Trade Representative's notice sets it at 10% for 17 economies including Canada, Mexico, India, the UK, Indonesia, Malaysia, Pakistan and Bangladesh, and 12.5% for every other economy investigated. For the EU and Taiwan, the new tariff plus the normal rate cannot exceed 10%, and for Japan, Korea and Switzerland it cannot exceed 12.5%. Goods already carrying the separate national-security tariffs are exempt. CNBC, the US business news network, puts the coverage at 99.4% of US imports.

How the tariff got here shows what can remove it. The Supreme Court struck down the emergency-powers tariffs on February 20th. A 10% stopgap under a different law, which limits such tariffs to 150 days, followed; the Court of International Trade, the federal court that hears tariff disputes, ruled the stopgap unlawful 2-1 in May, and the forced-labor tariffs took over when it lapsed. On September 30th the same court heard a challenge to the forced-labor tariffs brought by small businesses and Democratic-led states. On November 4th the three-judge panel ordered the plaintiffs to list the countries they import from, according to the trade publication Inside Trade. No ruling had been issued as of that order, and the tariffs remain in effect.

Congress cannot undo them quickly. Overriding a veto takes 290 votes in the House and 67 in the Senate, and Democrats hold fewer than that in both. The tariffs rest on authority Congress delegated years ago, so nothing has to pass for them to continue. The new Congress is sworn in during January 2027, and from there it can hold hearings and attach conditions to spending bills and the annual defense bill. Any bill it passes still faces a veto.

The other path is a negotiation with China. A separate arrangement agreed in Busan, South Korea, suspended heightened US tariffs on Chinese goods and was due to lapse on November 10th. Treasury Secretary Scott Bessent announced on September 23rd that the US and China had agreed to extend it to January 10th, 2027. On November 6th Bessent and US Trade Representative Jamieson Greer spoke with Chinese Vice Premier He Lifeng and, by their own readouts, pressed China to carry out its Busan commitments on agriculture and rare earths. The Asia-Pacific Economic Cooperation (APEC) leaders' summit opens in Shenzhen on November 18th, and whether a Trump-Xi meeting is scheduled there is unconfirmed. The Group of 20 leaders meet in Miami on December 14th and 15th.

The Takeaway: The 10% to 12.5% rate is the one to plan on until the trade court rules. A cost model that assumed relief after the election may be worth rerunning. The dates that can change it are the court's ruling, which has no date, the APEC summit on November 18th and 19th, and the end of the China truce extension on January 10th.

• USTR, action in the forced-labor trade investigations, July 23rd
• Federal Register, July 28th, notice of actions in the forced-labor trade investigations
• CNBC, September 30th, forced-labor tariffs and the trade lawsuit
• Inside Trade, trade court tells forced-labor tariff plaintiffs to name countries they import from
• Supreme Court, Learning Resources, Inc. v. Trump, February 20th
• Reuters, September 23rd, US and China agree to extend the Busan agreement to January
• Treasury readout of the call with He Lifeng, November 6th
• USTR readout of Greer's call with He Lifeng, November 6th
• Associated Press via Yahoo News, midterm results, November 7th

Attackers Set Refrigeration to Heat in Hundreds of French Supermarkets, Then in More Than 100 Stores Across 10 More Countries

Confidence: HIGH · France, European Union, United States · Retail, Agriculture, Healthcare

Attackers set commercial refrigeration to heat. France's national cyber agency points to controllers whose management web pages are exposed to the internet, though how the attackers got in is unconfirmed.

Overnight on October 11th to 12th, refrigeration units in about 700 French supermarkets were pushed as high as 50°C, about 122°F, according to Unit 42, the research arm of the security company Palo Alto Networks. Some caught fire, and spoiled food went in the trash. Reuters counted more than 350 establishments. Overnight on November 1st to 2nd, a second wave reached at least ten more European countries and 100 to 115 stores, among them four Delhaize supermarkets in Luxembourg, part of the "several dozen shops" the Belgian grocery chain said were affected.

France's national cybersecurity agency, through its computer emergency response team, CERT-FR, said on October 12th that the affected products are controllers from Danfoss, a Danish industrial equipment maker, and from Copeland and Dixell, two other refrigeration-control makers, whose management web page is exposed to the internet. CERT-FR says the campaign is probably still under way, that resetting a compromised unit is not enough because it stays vulnerable afterward, and that an unpatched end-of-life unit left on the internet is very likely to be compromised. Team82, the research team at the industrial security company Claroty, reported in 2025 that the login page of Danfoss's controllers could be reached publicly and that its "code of the day" protection could be bypassed. Danfoss fixed current models in 2025, but two older models, one out of support since 2021 and one discontinued in 2016, get no patch. Danfoss says the French attack involved those older models and current ones running old firmware. Unit 42 says how the attackers first got in is unconfirmed.

Unit 42's scans found more than 5,000 of these controllers reachable from the internet on November 5th and 6th; reachable is not the same as exploitable. The French count fell from 1,853 in the first half of October to 316 in the first week of November.

On November 5th the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the Departments of Health and Human Services, Agriculture and Transportation issued a joint fact sheet, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems." It warns that attackers can take control of unpatched or internet-reachable controllers and push units into nonstop heating and defrost cycles, and can blind operators by cutting off temperature readings, which it calls "denial-of-view." It names healthcare, chemicals, food and agriculture and transportation as the sectors at risk. It names no vendor or attacker and no US incident. CISA's acting executive assistant director for cybersecurity, Chris Butera, said "every organization that depends on refrigeration and monitoring systems should assume it could be a target."

Separately, four officials told Reuters on October 29th that freezer failures at US military commissaries, the grocery stores on bases, in late August are being treated as a suspected hack. At least six commissaries were affected; the only one named is Fort Huachuca, Arizona, where a base post said the freezer "went into defrost mode where it heated up all the food." Reuters could not confirm the brand or who was responsible, and any link to France is suspected only.

In France the attack reached beyond groceries. At three sites of the Établissement français du sang, France's national blood service, cold-storage units run by outside providers had their temperature and defrost thresholds set excessively high, CNBC, the US business news network, reports. The service says no blood products or samples were lost and there was no health impact, and Unit 42 found no evidence anything spoiled.

Two pro-Russian hacktivist groups, NoName057(16) and Z-Pentest, claimed the attacks in a Telegram video titled "Operation Chronicle: Danfoss." Denmark's national security agency said on November 5th that it could neither confirm nor rule out their involvement, and the Kremlin denied any role. No government has attributed the attacks to the Russian state or to anyone else.

The Takeaway: If your company runs commercial refrigeration or cold storage, ask whoever services the controllers whether their web login can be reached from the internet and whether the model still gets security updates. Units out of support since 2021 or discontinued in 2016 cannot be patched, only replaced. The US fact sheet's simplest fix is to set an allowed temperature range and alert when a controller leaves it.

• US fact sheet, Hardening Industrial Refrigeration and Cold Chain Monitoring Systems, November 5th
• CISA press release, November 5th
• CERT-FR alert CERTFR-2026-ALE-012
• Unit 42, November 6th, Turning Up the Heat, attacks on Europe's refrigeration systems
• Reuters via Military Times, October 29th, Pentagon treats base freezer malfunctions as a suspected cyberattack
• Paperjam, four Delhaize stores in Luxembourg hit
• CNBC, November 4th, blood bank refrigeration attacks
• Nordisk Post, November 5th, pro-Russian hackers claim the attacks
• Danfoss security advisory DSA-2025-03-01
• Cooling Post, Danfoss moves to mitigate cyberattack

Russia Put Japan Tobacco's Russian Factories Under a Company Registered in September, and the Shares Fell by a Fifth

Confidence: MODERATE · Russia, Japan · Manufacturing

Moscow took control of Japan Tobacco's Russian factories but not legal title, and gave no reason.

On Thursday, November 5th, Russian President Vladimir Putin signed a decree placing four Russian units of JT International, the overseas tobacco arm of Tokyo-listed Japan Tobacco, under the "temporary management" of a Russian company called Industrial Assets. On Friday a second decree, reported by Kyodo, the Japanese news agency, citing TASS, Russia's state news agency, covered JT International's shares in three more of its Russian companies, including JT International Russia. Japan Tobacco (JT) confirmed the first decree applied to four of its units. The company's shares fell about 19% in Tokyo trading on Friday from a record close the day before, according to Investing.com. Tokyo reopens Monday.

The Moscow Times, an independent English-language outlet covering Russia, reports that Industrial Assets was registered on September 16th and is owned by Sergei Dremov, a former officer of the FSB, Russia's domestic security service, in the Kursk region. The decree rests on an April 2023 order covering assets of companies from countries Russia calls "unfriendly," and temporary management transfers control, not legal title. The Moscow Times reports that Putin has said control could be returned under favorable conditions. No reason was given for the seizure. JT International said it is "assessing the situation and our options."

In September the Kremlin used the same order on the Russian operations of Nestlé, Auchan, Leroy Merlin and two logistics firms, handing them to L.E.V. Management, another Russian company. In 2023 it did the same to Danone's Russian business and Carlsberg's stake in the brewer Baltika. Japan's public broadcaster NHK, citing the Associated Press, reports that Western businesses placed under temporary management this way have ended up sold to Russian buyers at heavy discounts.

JT International employs about 4,000 people in Russia, by Kyodo's count, and holds up to 40% of the cigarette market there, by the Moscow Times's figures. Russia accounts for about a quarter of JT's adjusted operating profit, the Moscow Times reports. Analysts it quotes estimate the seized assets at 250 to 300 billion Russian rubles, about $3.1 to $3.7 billion; there is no official value. Japan's Finance Ministry owns 37.55% of JT, so the Japanese state is itself a large shareholder in what Moscow took control of. Chief Cabinet Secretary Minoru Kihara, the Japanese government's spokesman, said Tokyo protested and called for the decree to be withdrawn immediately. No sanctions or countermeasures have been announced.

No official trigger was given, and the readings differ. Some analysts quoted by the Moscow Times see retaliation aimed at Japan for its sanctions on Russia and support for Ukraine. Others point to pressure on Tokyo: Putin visited Etorofu, one of the islands Russia controls and Japan claims, in August, and the FSB detained a journalist from the Hokkaido Shimbun, a Japanese regional newspaper, on Sakhalin on October 13th. A third reading is a domestic wave of asset redistribution and fundraising that also hit French and Swiss companies in September, which would explain why the same order covered firms from countries with no Japan-style dispute. The evidence may favor the third reading, but it does not rule out the other two.

The Takeaway: Control passed by decree, with no reason given, to a company reportedly registered less than two months earlier. Western businesses put under temporary management this way have ended up sold at heavy discounts. A list of what your company owns, leases or buys from inside Russia, and who is authorized to act if any of it is named in a decree, is something you can have this week.

• The Moscow Times, November 5th, Kremlin seizes Japan Tobacco International's Russian assets
• Kyodo News, Japan Tobacco decree
• NHK World, November 6th, Japan protests the seizure
• Investing.com via Yahoo Finance, Japan Tobacco shares fall
• ABC News (Associated Press), Japan protests Russian takeover of Japan Tobacco subsidiaries
• Le Monde, September 18th, Russia seizes assets of French firms Auchan and Leroy Merlin

Phones Behind on Updates Were Infected Through Compromised Websites, Including a US Chemical Trade Association's, in a Campaign Sekoia Links to Russia

Confidence: MODERATE · Russia, Ukraine, United States · Energy, Technology

A phone that was behind on updates gave up data, in some cases messages and passwords, just by loading a website its owner had reason to trust. Sekoia says phones on a current operating system were safe.

Sekoia, a French cybersecurity company, reported on November 4th a campaign it calls "Poisoned Source" that infects phones through websites. A phone that loads one of the affected pages is checked for its model and software version, and if it is an iPhone or Android phone running a version with a known, already-fixed flaw, it is served an exploit script. The victim has to visit the page, and the phone has to be behind on updates; nothing else is needed. The attackers injected code into legitimate websites they had compromised and set up lookalike domains that mirror a real site through their own servers. A third route ran through Plerdy, a Ukrainian website analytics tool loaded by thousands of sites, mostly Ukrainian, which exposed hundreds of legitimate sites to the attackers' code.

What the phone gives up depends on how far behind it is. Older iPhones, on iOS 16.0 through 17.4, lose their cookies, the tokens that keep you logged in to websites. iPhones on iOS 18.5 lose far more, through an exploit kit Sekoia suspects was built by a commercial surveillance vendor: SMS, iMessage, WhatsApp and Telegram messages, the Keychain where passwords are stored, Wi-Fi passwords, contacts, location, Health data, photos and iCloud Drive. Android phones running Chrome versions 139 through 145, except 143, lose cookies, logins, browsing history and Wi-Fi configurations. According to Sekoia, the payloads do not establish persistence and a user on an up-to-date operating system is safe from these attacks.

Sekoia named a Ukrainian gas producer, where the discovery began in mid-October; a US trade association for the chemical industry; a European political party; a Bulgarian military-related site; and an Australian medical clinic. Lookalike sites impersonated america250.org and a London hotel. Sekoia gives no count of infected phones. Plerdy was compromised between August 27th and September 3rd, and the report came out November 4th. The Record, a cybersecurity news site, covered it on November 5th.

Sekoia attributes the campaign, with moderate to high confidence, to APT29, also called Midnight Blizzard, a group tied to Russia's foreign intelligence service, the SVR, based on the victims, the infrastructure patterns and overlap with a 2024 APT29 campaign. The attribution is Sekoia's own. Where the exploits came from is unknown; Sekoia judges they probably came from a third party.

The Takeaway: Phones on a current operating system lost nothing; the older the version, the more was taken. The share of company and executive phones on a current operating system is a number you can have this week, and a phone too old to update stays exposed for good.

• Sekoia, Poisoned Source, APT29 watering holes target mobile devices with n-day exploits, November 4th
• The Record, November 5th, Russian hackers target smartphones

Four State Attorneys General Settled a 13.3 Million-Person Medical Breach for $300,000, With $9.7 Million More Due if Promised Fixes Aren't Made

Confidence: HIGH · United States · Healthcare, Technology

Perry Johnson & Associates, a medical transcription company, agreed to pay at least $300,000 now and up to $9.7 million more only if it fails to meet the settlement's terms.

On Friday, November 6th, the attorneys general of New York, Connecticut, Michigan and New Jersey settled with Perry Johnson & Associates and affiliated companies over a March 2023 breach that reached more than 13.3 million people nationwide, about 4.2 million of them in New York and about 108,000 in Connecticut. New York announced the settlement as "up to $10 million." The terms are at least $300,000 in penalties, and $9.7 million more owed only if the companies fail to meet the agreement.

New York's findings run in sequence. The hackers used a Perry Johnson employee's credentials. Remote access did not require multi-factor authentication, a second proof of identity at login. Once inside they harvested passwords and reached unencrypted files. Logging software recorded the activity and was not configured to alert anyone. The company learned of the breach when the hackers contacted it about two months later. The exposed records included Social Security numbers, diagnoses, insurance details, dates of birth, home addresses, hospital account numbers and the text of transcribed clinical notes.

The order requires a written security program and incident response plan, multi-factor authentication, password management, encryption and asset inventory controls, yearly risk assessments in line with the federal health-privacy law, HIPAA, and rules on how long health records are kept and how they are destroyed.

The SEC is bringing fewer cases. The Brattle Group, an economic consulting firm, estimates about 308 SEC enforcement actions in the fiscal year that ended in September, the fewest since at least fiscal 2018 and 57% below the 2018 to 2025 average of 710. The 308 is Brattle's estimate; the SEC's own totals were 456 for fiscal 2025 and 583 for fiscal 2024. Cornerstone Research and New York University counted five SEC actions against public companies and their subsidiaries in the first half of the fiscal year, the fewest in any first half in at least 16 years. Separately, 42 state attorneys general settled with the genetic testing company 23andMe in July, according to the Colorado attorney general's office.

The Takeaway: State attorneys general ask whether specific controls were in place. The Perry Johnson order names multi-factor authentication on remote access, alerts from logs and encryption of stored files. The attorneys general who may come to you are the ones in the states where your customers live. Counsel can tell you which states those are and whether those three controls are in place.

• New York Attorney General, settlement with Perry Johnson & Associates, November 6th
• CT Health News, Connecticut's share of the settlement
• Brattle Group, October 20th, SEC enforcement remained low in fiscal 2026
• SEC press release 2026-34, fiscal 2025 enforcement results
• Cornerstone Research and NYU, SEC enforcement against public companies, first half of fiscal 2026
• Colorado Attorney General, multistate 23andMe settlement, July 14th

Got this forwarded to you? Subscribe at stateofthethreat.com/subscribe — one email per week, no tracking, no spam.

Want headlines as they break, not just once a week? Check the daily brief box at stateofthethreat.com/subscribe.

Know someone who needs this? Forward this email. The threats they don't know about are the ones that hurt.