{"id":"CMP-202611-ciccer","kind":"campaign","aliases":[],"related":[],"title":"Li Auto electric car owners in Russia locked out of their cars and extorted after attackers re-register the car's expired eSIM and take over the owner account","description":null,"summary":"Attackers are taking over the master user accounts of Li Auto smart EVs sold in Russia (grey-import exports). Using Li Auto VINs leaked in earlier data breaches, they find cars whose linked eSender eSIM number has expired, re-register the eSIM and the car to a new account, create a new master digital key, then lock the doors and engine and message the owner for a ransom (about $500-600 now; over $3,000 in a first wave in July 2025). Alexander Rasfairy, co-founder of a Li Auto car club, told autonews.ru at least 20 owners have confirmed hacks in this second wave, and the real number is likely higher (reported by Risky Business, 4 Nov 2026). Li Auto is reportedly aware and working on email-based master account registration so exported cars no longer need a Chinese phone number. Exact models and start date of the current wave are unknown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T07:42:29+00:00","products":[{"name":"Li Auto","fixed":[],"affected":"Li Auto smart EVs sold in Russia (models unknown)","ecosystem":"vehicle"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"You own a Li Auto car outside China (notably Russia) and its master account is tied to an eSender eSIM / Chinese phone number that has expired or lapsed. Signs of takeover: the Li Auto app no longer shows you as master user, a new digital key appears, doors or engine are locked remotely, or you get a message demanding payment to restore access. No other indicators published.","fix":"Keep the eSIM / phone number linked to your Li Auto master account active and renewed; check in the Li Auto app that you are still master user and remove unknown digital keys. Do not pay the ransom; contact Li Auto or an authorised service centre to restore the account, and move to email-based master registration once Li Auto offers it.","status":"open","published_at":null,"first_seen_at":"2026-11-04T07:42:29+00:00","triaged_at":"2026-11-04T07:42:29+00:00","updated_at":"2026-11-04T07:42:52+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':32A '-600':112B '000':116B '20':139B '2025':123B '2026':161B '3':115B '4':159B '500':111B 'account':30A,47B,90B,174B 'alexand':124B 'attack':16A,40B 'auto':2A,35A,50B,62B,132B,163B 'autonews.ru':136B 'awar':166B 'base':172B 'breach':68B 'busi':158B 'campaign':36B 'car':4A,12A,21A,71B,86B,133B,178B 'chines':183B 'ciccer':33A 'club':134B 'cmp':31A 'co':127B 'co-found':126B 'confirm':142B 'creat':91B 'current':193B 'data':67B 'date':190B 'digit':95B 'door':100B 'earli':38B 'earlier':66B 'early-warn':37B 'electr':3A 'email':171B 'email-bas':170B 'engin':102B 'esend':74B 'esim':24A,75B,83B 'ev':52B 'exact':186B 'expir':23A,78B 'export':59B,177B 'extort':14A 'find':70B 'first':119B 'founder':128B 'grey':57B 'grey-import':56B 'hack':143B 'higher':154B 'import':58B 'juli':122B 'key':96B 'leak':64B 'least':138B 'li':1A,34A,49B,61B,131B,162B 'like':153B 'link':73B 'lock':8A,98B 'longer':180B 'master':45B,94B,173B 'messag':104B 'model':187B 'need':181B 'new':89B,93B 'nov':160B 'number':76B,151B,185B 'owner':5A,29A,106B,140B 'phone':184B 'ransom':109B 'rasfairi':125B 're':18A,80B 're-regist':17A,79B 'real':150B 'regist':19A,81B 'registr':175B 'report':155B,165B 'riski':157B 'russia':7A,55B 'second':146B 'smart':51B 'sold':53B 'start':189B 'take':26A,42B 'told':135B 'unknown':196B 'use':60B 'user':46B 'vin':63B 'warn':39B 'wave':120B,147B,194B 'whose':72B 'work':168B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["auto","liauto"],"ptokens":["auto","li"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"fraud","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ciccer","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T07:42:29+00:00","fetched_at":"2026-11-04T07:42:29+00:00","note":null}],"documents":[{"id":65124,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzhtlxvqoc2f","title":"@campuscodi.risky.biz: -Hackers lock out and extort Li Auto EV owners in Russia\n-Second refrigerator ha","kind":"post","source":"bluesky","publisher":null,"text":"-Hackers lock out and extort Li Auto EV owners in Russia\n-Second refrigerator hack hits Europe\n-US boots Acronis from government networks\n-Distros patch Linux kernel RCE\n-Ukraine confirms it hacked Russia's alert system in revenge\n\nP: risky.biz/RBNEWS629/\nN: news.risky.biz/risky-bullet...\nhttps://risky.biz/RBNEWS629/ https://news.risky.biz/risky-bulletin-hackers-lock-out-and-extort-li-auto-smart-car-owners-in-russia/\n\nlikes 1 reposts 1","published_at":"2026-11-04T07:33:06+00:00","relation":"describes","confidence":null,"note":null},{"id":65127,"url":"https://news.risky.biz/risky-bulletin-hackers-lock-out-and-extort-li-auto-smart-car-owners-in-russia/","title":"Risky Bulletin: Hackers lock out and extort Li Auto smart car owners in Russia","kind":"blog","source":"analyst","publisher":null,"text":"Risky Bulletin 4 Nov 2026. Li Auto: attackers take over master user accounts of Li Auto smart EVs sold in Russia. They use Li Auto VINs leaked in data breaches, look for expired eSender eSIM numbers linked to Li Auto accounts, re-register the eSIMs and cars to new accounts, create a new master digital key, lock doors and engine, and demand ransom (over $3,000 in the first wave in July 2025, now about $500-600). Li Auto car club co-founder Alexander Rasfairy told autonews.ru at least 20 owners confirmed hacks. Li Auto reportedly aware and working on email-based master account registration (removing need for a Chinese phone number on exported cars). Also: third fridge hacking wave hit 40+ Ahold Delhaize stores across 12 European countries, losses tens of millions USD. Debian, Red Hat and SUSE released fixes for Linux kernel TCP RCE CVE-2026-98432 (kernels since 4.4, found by Anthropic); Canonical still working on Ubuntu. US orders federal agencies to remove Acronis products (Federal Register 2026-10-30) over Russian control.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}