Telegram Removed from App Store After Extortionist Plants AI-Modified CSAM in Archived Message
Telegram and its experimental client Telegram X disappeared from the App Store on the morning of August 4 in several countries, including Russia, Turkey, and the United States. The removal lasted roughly ninety minutes and temporarily disrupted push notifications for some iOS users, while macOS and Android versions were unaffected.
Founder Pavel Durov attributed the incident to an extortionist who modified an archived message in a public group. The attacker inserted material depicting child sexual abuse (CSAM) that had been altered with artificial intelligence, making the post invisible to active participants and preventing normal user reports. The same account then submitted a complaint directly to Apple, which detected the prohibited content and removed the applications.
According to Durov, the perpetrator belongs to a group that targets owners of public channels and groups. The extortionists demand payment under threat of planting illegal material and filing complaints with Apple. Automated accounts and technical bypasses are used to evade standard moderation filters.
Apple confirmed that the applications were reinstated after Telegram removed the prohibited material and blocked the distributing account. Durov expressed concern that Apple had activated the removal process without first contacting Telegram administrators, describing the approach as dangerous for any platform hosting user-generated content.
Telegram called on Apple to apply consistent and thorough verification to all reports across every application rather than acting on isolated complaints that can be engineered to trigger sudden delisting.
Related articles
Negotiating with Ransomware Attackers: Lifeline or Legal Trap?
Ransomware incidents leave organizations facing encrypted systems and threats to leak stolen data, prompting urgent questions about whether to contact extortionists. Experts emphasize that initial response must focus on containment, evidence preservation, and backup verification rather than immediate payment discussions. NCSC guidelines stress isolating affected systems, securing communication channels, and understanding the exact nature of demands before any dialogue begins. Real-world cases such as the PowerSchool breach demonstrate that paying ransoms does not ensure data deletion or end extortion attempts. Legal risks vary by jurisdiction, with prohibitions in places like North Carolina and sanctions concerns from OFAC complicating decisions for many entities. Technical recovery options, including tools from the No More Ransom project, should be evaluated alongside insurance and regulatory notification requirements under Russian Federal Law No. 152-FZ. Ultimately, successful resolution depends on verified restoration capabilities and eliminating attacker persistence rather than any negotiated discount.
Qilin Ransomware Claims at Least 365 Victims in Three Months of Attacks
The Qilin ransomware group has claimed responsibility for at least 365 organizations compromised over a three-month period, according to research published on November 11, 2026. Operating as a ransomware-as-a-service platform since September 2022, Qilin supplies the attack infrastructure while affiliates conduct intrusions and receive at least 80 percent of ransom payments. The group employs double extortion tactics, stealing sensitive data before encryption and threatening public leaks if ransoms are not paid. Its affiliate program was described as the most active worldwide during the measured timeframe. Researchers also linked the group's administrator, known as Haise, to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of Saint Petersburg, Russia, through reused online identities spanning multiple cybercrime forums and leaked records from Gosuslugi. The investigation highlighted Qilin's technical reach, including targeted attacks against VMware vCenter and ESXi environments using remote management tools, lateral movement, and vulnerable drivers to disable security products.
Ransomware Group BYOD Claims Theft of Toyota Customer Personal Data in Unverified Extortion Listing
A ransomware group calling itself BYOD has added Toyota to its victim list on a dark web extortion site, claiming to have stolen personal information belonging to the automaker’s customers. The announcement, updated on November 10, 2026, alleges access to full names, email addresses, physical addresses, telephone numbers, and dates of birth, along with data from the company’s self-service kiosk terminals. No independent verification of the claims has been performed, and the listing provides no details on the volume of records, affected regions, or specific business units involved. The group states that parts of the environment were isolated but claims residual remote access paths remained; however, the announcement contains no technical indicators or proof-of-compromise samples. Toyota has not issued any public statement confirming or denying the incident. The report notes that similar unverified listings are sometimes used to pressure victims into negotiations and may include repackaged data from prior breaches. This marks a contrast with Toyota’s 2023 public disclosure of a separate cloud misconfiguration incident that the company itself reported.
Santos Port Authority Systems Offline After Suspected Cyber Incident and Possible Ransom Demand
The systems of Autoridade Portuária de Santos (APS), which manages Brazil's largest port, have been unavailable since the morning of November 6, 2026. The outage began after a power fluctuation that affected servers and later recurred despite initial restoration efforts. APS has confirmed a suspected cyber incident but has not determined the full scope or whether data was accessed. Local reporting indicates that alleged attackers demanded financial ransom to restore operations, though this claim remains unconfirmed by APS or federal police. Backups have been sent for forensic examination while Serpro technicians assist in recovery. Port operations continue using manual procedures and heightened security measures, but vessel and truck wait times have increased significantly.