Smashing Security podcast #492: How hackers turned Russian cars into pumpkins

Owners of Chinese Li Auto electric SUVs in Russia are facing a novel cyberattack where hackers remotely disable their vehicles and demand ransom payments to restore access. The attacks involve criminals taking over car accounts linked to phone numbers, rendering the vehicles unusable until owners pay up to 45,000 rubles (approximately $550).

The scam begins when a car's dashboard suddenly goes dark, displaying a QR code in Chinese that prompts the owner to reactivate their vehicle through an app. However, when owners try to use the app, they discover their car is no longer listed, effectively locking them out of their own vehicle.

Within ten minutes of the immobilization, owners receive calls from strangers offering to sell back the digital keys to their cars for the ransom amount. This scheme has been ongoing since at least 2025, though the ransom demands have significantly decreased from the previous 250,000 rubles (about $3,500).

Account Takeover

The attacks don't involve direct hacking into the vehicles themselves, but rather account takeover through the car's mobile application. Li Auto cars use digital keys that are essentially accounts in the app, with access controlled through phone numbers.

Many of these Chinese vehicles have been hardcoded to require Chinese phone numbers for app functionality, leading Russian owners to rent such numbers through middlemen. The criminals exploit these account connections to gain control.

Evolving Tactics

Last year, Russian authorities advised owners to register their Chinese phone numbers in their own names and keep the accounts paid up to prevent unauthorized access. Despite following these precautions, owners continue to be targeted.

The criminals have adapted their approach, now focusing on owners who had previously secured their accounts. They've also lowered their ransom demands, possibly indicating increased competition among cybercriminals or a shift in their business model.

In previous iterations of this scam, hackers would remotely open windows, doors, and start engines as if taunting owners. The current attacks focus on complete immobilization followed by ransom demands.

Growing Concern

These attacks highlight the increasing vulnerability of internet-connected vehicles.

The trend of connected vehicles being targeted continues to grow, with reports of everything from smart freezers and blood banks to electronic billboards being compromised. As more devices become internet-enabled, the potential attack surface expands significantly.

The Li Auto case represents a concerning evolution in automotive cybercrime, where owners are not just losing access to their vehicles but being actively extorted for the return of something that should rightfully be theirs.