#Cybercrime
All CosmicBytez Labs articles tagged #Cybercrime, across news, security advisories, how-to guides, and projects.
- News
Anne Arundel County, Maryland Confirms August Breach as Rhysida Claims 2.6TB Data Theft
Anne Arundel County confirmed an August 28 intrusion after the Rhysida gang claimed to steal 2.6TB of files and demanded a $2 million ransom.
- News
Moscow Police Detain Suspected DataSuckers Hackers Linked to Breaches in Ukraine and Russia
Russian police detained three suspected DataSuckers hackers after breaches of Dodo Pizza, Tez Tour, and Ukraine's ATB Market.
- News
When Your Ransomware Negotiator Works for the Other Side
Dark Reading's analysis of negotiator Edward Dubrovsky's arrest warns crisis urgency lets compromised IR vendors bypass normal vetting controls.
- News
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud
F-Secure's Threat Intelligence team catalogued 50+ consumer scam types from the victim's perspective as losses double and 52% of victims now lose money.
- News
INTERPOL-Coordinated Operation Arrests 95 Suspects in International CSAM Crackdown
Operation International Effort Confluencia led to 95 arrests across 17 countries and one child's rescue in an INTERPOL-led crackdown on CSAM networks.
- News
Global Takedown Hits Network Behind 1 Billion Phishing Messages
Microsoft, Japan's NPA, and partners dismantled YAM Store, a phishing-kit marketplace tied to over 1 billion malicious messages in 150 countries.
- News
Ransomware Gangs Embrace Physical Threats, Family Stalking
A 2026 Semperis survey finds ransomware gangs increasingly threaten violence, stalking, and abduction against victims and their families.
- News
YMCO Leader Pleads Guilty to Running 15,000-Mule Laundering Network for Cybercriminals
Oleg Korniev, 42, admitted leading YMCO, a ring of 15,000+ U.S. money mules that laundered over $10 million stolen by hackers since 2007.
- News
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, 54, a prominent Cypfer-linked ransomware negotiator, was arrested in Pennsylvania and charged with conspiracy to extort money.
- News
Ransomware Recovery CEO Indicted After Allegedly Paying Hackers and Pocketing Millions
MonsterCloud owner Zohar Pinhasi is charged with secretly paying ransoms while billing clients over $19 million for fake decryption tech.
- News
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania on extortion charges amid the FBI's ShinyHunters breach probe.
- News
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Former infrastructure engineer Daniel Rhyne, 59, gets 32 months for deleting admin accounts and demanding 20 bitcoin (~$750,000) from his ex-employer.
- News
FBI Arrests Another Suspected ShinyHunters Hacker After Agency Breach
FBI Director Kash Patel announced a third arrest tied to ShinyHunters' breach of the bureau's own FBIjobs.gov site.
- News
FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe
Krebs identifies the previously unnamed Pennsylvania arrestee as Cypfer co-founder Edward Dubrovsky, accused of aiding ShinyHunters.
- News
Germany Arrests Alleged Core Qilin Ransomware Member After Extradition
German authorities arrested a 28-year-old Russian national suspected of being a leading Qilin ransomware member following extradition from Japan.
- News
Dual Ukrainian-Russian Citizen Admits to Running 15,000-Mule Laundering Network for Cybercriminals
Oleg Korniev, 42, pleaded guilty to leading Your Mule Cashout, which used 15,000+ U.S. money mules to launder funds stolen from 750+ bank accounts.
- News
Owner of Empire Cybercrime Market Gets 40 Years in Prison
Raheim Hamilton, co-creator of Empire Market, was sentenced to 40 years and fined $5 million for $430 million in dark web drug and fraud transactions.
- News
ThreatsDay Recap: Ransomware Affiliate Betrayal, WhatsApp RAT & More
Weekly roundup: a ransomware affiliate's betrayal, a new WhatsApp RAT, exposed attacker tools, Qilin's extradition, and more supply-chain abuse.
- News
Uranium Crypto Exchange Hacker Convicted for Stealing $53 Million
A Manhattan jury convicted Jonathan Spalletta on all counts for hacking Uranium Finance twice in 2021 and laundering $53.3M in crypto.
- News
Musician Sentenced to Prison for $10 Million AI-Bot Streaming Fraud
Michael Smith got 18 months and an $8M forfeiture for using AI songs and 1,000+ bots to fake billions of streams and steal royalties.
- News
Ransomware Recovery CEO Charged Over Secret Ransom Payments
MonsterCloud's owner allegedly paid hackers for decryption keys, then billed victims up to 18x more while claiming proprietary recovery tech.
- News
Engineer Sentenced for Locking Over 3,000 Devices on Employer Network
Daniel Rhyne, a former infrastructure engineer, got 32 months after locking out servers and workstations and demanding $750,000 in bitcoin.
- News
Osaka Metropolitan University Cancels Classes After Suspected Ransomware Attack
A suspected ransomware attack took down ~500 servers at Osaka Metropolitan University, exposing data on 130,000+ students and staff.
- News
Alleged ShinyHunters Member Reportedly Detained in Jordan, Assisting FBI
Saif al-Din Khader, allegedly a top ShinyHunters figure, was detained in Jordan and is reportedly assisting the FBI after the group's FBI data-breach claims.
- News
University of Illinois Chicago Hit by Ransomware Attack on Medical School
UIC's College of Medicine confirms a ransomware intrusion; Booba gang claims 344GB stolen, but the claim is unverified and under investigation.
- News
Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
Spanish police arrested a 16-year-old Romanian national as KillSec's alleged lead operator; Operation KillSwitch seized 5 servers and 110TB of stolen data.
- News
ShinyHunters Suspect 'Rey' Reportedly Detained in Jordan, Helping FBI Identify Group Members
Suspected ShinyHunters member Saif al-Din Khader ('Rey') was detained in Jordan and is reportedly helping the FBI identify other group members, sources say.
- News
Alleged KillSec Ransomware Mastermind a 16-Year-Old
Ten-nation Operation KillSwitch dismantled the KillSec RaaS gang, arresting a 16-year-old alleged administrator and seizing 110TB of stolen data.
- News
ShinyHunters Hacker Reportedly Detained in Jordan, Aiding FBI
ShinyHunters member "Rey" was reportedly detained in Jordan on Oct. 1 and is cooperating with the FBI to identify other members of the group.
- News
US Sanctions Tren de Aragua Gang Members in ATM Jackpotting Crackdown
Treasury's OFAC sanctioned eight Tren de Aragua members and two Mexico-based firms over a $40.73 million ATM jackpotting scheme spanning 1,500+ attacks.
- News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-nexus group Longlegs is still abusing SharePoint ToolShell flaws and a BYOVD EDR killer to deploy Warlock ransomware on critical infrastructure.
- News
'Warlock' Ransomware Hits Critical Infrastructure in Portuguese- and Spanish-Speaking Countries
A China-nexus threat actor is exploiting Microsoft SharePoint flaws, including ToolShell, to deploy Warlock ransomware against critical infrastructure.
- News
Iranian Accused of Hacking American Universities Extradited From Montenegro
Amir Barati, accused in a $3.4B IRGC-linked hacking campaign against 144 U.S. universities, was extradited from Montenegro to face charges in New York.
- News
Police Dismantle KillSec Ransomware Gang Allegedly Led by 16-Year-Old
Police seized KillSec's ransomware leak site and arrested three suspects, including an alleged 16-year-old leader, recovering 110TB of stolen data.
- News
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
China-nexus actor Longlegs (Storm-2603) hit a water utility, telecom, government body, and university in Iberia and Latin America via SharePoint flaws.
- News
Alleged ShinyHunters Leader Arrested in the Netherlands
Dutch police arrested a 24-year-old Amsterdam man tied to ShinyHunters on Sept. 15 — a week before the group claimed to hack the FBI.
- News
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
ATNS found ransomware-linked malware on an operational network tied to weather data, and is probing possible exfiltration to China-based IPs.
- News
Former US Air Force Members Sentenced to 189 Months Combined Over BEC Scheme
Two former U.S. Air Force members were sentenced to a combined 189 months in prison for a two-year BEC and phishing scheme that stole millions.
- News
Former US Air Force Members Sentenced to Prison for $2 Million Cyber Fraud Scheme
Chijioke Odimegwu and Harafat Mogaji, both former Dover AFB airmen, received a combined 189 months for a multiyear BEC and phishing scheme.
- News
Vietnamese National Charged in $16 Million 'Pig Butchering' Crypto Scam
DOJ charges Vietnamese national Trung Nguyen Van with laundering $16M from a 'pig butchering' crypto scam; his wallets moved over $53M since 2018.
- News
ShinyHunters Trades Financial Extortion for a Reckless War of Ego With the FBI
ShinyHunters skips its usual ransom demand, instead threatening the FBI to retract a report — alarming experts who warn agent and family safety is at risk.
- News
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
A U.S. Army soldier was sentenced to 70 months in prison and ordered to pay $294,978 restitution for hacking telecoms and stealing 100M+ AT&T records.
- News
Bitget Hack Losses Climb to $387.5 Million as CEO Points to North Korea
Bitget's hack losses grew from an initial $351.6M estimate to $387.5M as North Korea-linked actors spoofed backend transfer approvals.
- News
ShinyHunters Hacked Clop's Leak Site Using a Grav CMS Path Traversal Flaw
ShinyHunters defaced Clop's Tor leak site via an unauthenticated Grav CMS flaw, claims stolen data and onion keys, and is extorting the gang for eight figures.
- News
3 Cyber Threats That Defined the Summer of 2026
DarkReading recaps summer 2026: OpenAI agents breaching Hugging Face, Fairlife's ransomware halt, and Iranian hits on US water utilities.
- News
FBI Investigating Alleged ShinyHunters Breach of Its Jobs Site
ShinyHunters defaced the FBI's jobs site and claims to hold data on nearly all FBI agents and applicants; the FBI says it is investigating.
- News
Ryuk Ransomware Operator Sentenced to 2 Years, Ordered to Pay $1.2 Million in Restitution
Armenian national Karen Vardanyan was sentenced to two years in federal prison and ordered to pay $1.2 million in restitution for Ryuk ransomware attacks.
- News
Latvia Arrests Suspected Hacker for Electronics Repair Company Breach
Latvia's State Police arrested a 23-year-old suspected of hacking TSC and another firm, stealing personal data and attempting extortion.
- News
Ryuk Ransomware Member Sentenced to 24 Months in Prison
Armenian national Karen Vardanyan got 24 months for Ryuk ransomware attacks that netted roughly 1,610 BTC from U.S. victims between 2019-2020.
- News
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
ShinyHunters claims it breached FBI systems via an Oracle PeopleSoft flaw, stealing 2-3TB of data on agents, applicants, and Director Patel.
- News
Two Arrested in UK After Microsoft Takedown of 'EvilTokens' AI Chatbot
Microsoft's DCU and UK police dismantled EvilTokens, an AI chatbot that automated account takeover and fraud for a $1,500 fee on Telegram.
- News
ShinyHunters Hijacks Cl0p's Ransomware Leak Site, Demands Extortion Payment
ShinyHunters seized Cl0p's dark web leak site, defaced it, and is demanding an eight-figure payment plus a public apology.
- News
Early Scattered Spider Member Pleads Guilty to Cybercrime Spree
Ahmed Elbadawy pleaded guilty to wire fraud conspiracy and identity theft tied to Scattered Spider; prosecutors now seek $17.6M in forfeiture.
- News
ShinyHunters Hacks Clop Leak Site, Threatens to Extort Ransomware Gang
ShinyHunters defaced Clop's Tor leak site and claims to have stolen its onion service private keys, threatening to extort the ransomware gang.
- News
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
A ransomware developer gets 13 years, a zero-click Plugin4Shell flaw hits AI coding agents, and a max-severity SAP bug enables pre-auth RCE.
- News
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Ransomware attacks on manufacturers rose nearly 40% in early 2026 as attackers exploit operational shutdowns to pressure ransom payments.
- News
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Roundup: novel InjectEave EM eavesdropping, an AT&T insider's SIM-swap sentencing, a Glasswing audit, and a $10M bounty on an Iranian cyber chief.
- News
Ukrainian Hacker Gets Four Years in US Prison Over Conti Ransomware Attacks
Oleksii Lytvynenko was sentenced to four years for his role as a hacker and developer in the Conti ransomware operation, which extorted over $150 million.
- News
Scammer Behind $245 Million Crypto Heist Pleads Guilty to RICO Charges
Malone Lam, ringleader of a social-engineering crypto theft ring, pleaded guilty to racketeering conspiracy over a $245M Bitcoin heist.
- News
Stronger Security Drives Ransomware Groups to Recruit From Within
As MFA and EDR harden perimeters, ransomware crews are increasingly recruiting employees and contractors as inside men to bypass defenses entirely.
- News
Aurora Ransomware Operators Use Cursor AI Against 10 Targets
Aurora ransomware operators used Cursor's agentic AI, running Claude Sonnet, to automate recon, lateral movement, and AD exploitation across 10 victims.
- News
Berlin Refuses to Pay Rhysida Ransom Over Alleged Senate Data Theft
Rhysida ransomware claims 5.7TB stolen from a Berlin Senate department; city officials say they will not pay the 30 BTC ransom demand.
- News
Five Plead Guilty in Latest Federal ATM Jackpotting Case
Five Venezuelan nationals pleaded guilty to a malware-based ATM jackpotting plot in Kansas, part of a nationwide scheme tied to Tren de Aragua funding.
- News
In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions
This week's roundup: a Log4j RCE scare gets debunked, container-security startup Minimus shuts down, and the US sanctions Iranian MOIS hackers.
- News
68-Year-Old Imprisoned After Making $1.3 Million by Pirating IPTV Services
A Chorley man, 68, was jailed 6.5 years for running an illegal IPTV service that made £980,812 pirating BBC, Sky and Premier League content.
- News
Interpol's Jackal IV Disrupts West African Crime Infrastructure
A 22-country INTERPOL operation targeting Black Axe and allied networks led to 58 arrests, 263 identified suspects, and seized criminal assets.
- News
Indian Man Who Fled US Arrested for Helping Scammers Siphon $7.5M from the Elderly
A Jersey City resident faces charges for acting as a money mule for overseas cyber scammers who stole $7.5 million from elderly New Yorkers.
- News
Police Arrest 58 Suspects in Global Cybercrime Crackdown
Law enforcement from 22 countries identified 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African criminal groups.
- News
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware loaders — WordlistLoader and SynkLoader — deliver ransomware-enabling payloads and steal Windows credentials via phishing.
- News
ReliaQuest Confirms Failed Data-Theft Attack After ShinyHunters Employee Impersonation
ReliaQuest disclosed a social engineering attack where ShinyHunters impersonated an employee to steal data — the attempt was detected and blocked.
- News
SickKids Hospital Hit by Cybercriminals Again as Employee Data Stolen
Canada's Hospital for Sick Children suffered a second cyber incident with employee data stolen via a compromised third-party app, four years after a 2022...
- News
CISA: Medusa Ransomware Hit Over 500 Critical Infrastructure Orgs
FBI and CISA warn that Medusa ransomware has breached 500+ US critical infrastructure organizations since 2021, demanding ransoms up to $15 million.
- News
Hackers Arrested Over €30M Bank Fraud Exploiting Service Provider Flaw
Operation Klonen: Brazilian and German authorities arrest 7 suspects behind a €30M bank fraud exploiting a third-party payment processor vulnerability at...
- News
Data Analyst Sent to Prison for Stealing Data, Extorting Employer
A former contractor at Brightly Software was sentenced to two years in federal prison for a $2.5 million extortion scheme targeting his employer.
- News
Shell Investigates 'Potential Incident' After Clop Data Theft Claims
Oil giant Shell is investigating after Clop ransomware gang claimed to have stolen 89GB of data from the company.
- News
Ukraine Shuts Down 94 Fraudulent Call Centers, Seizes Millions in Cash
Ukrainian authorities dismantled 94 fraud call centers running investment scams and bank credential theft operations across multiple cities.
- News
Akira Hackers Disable EDR with Safe Mode, Steal Data but Fail to Encrypt
An Akira affiliate rebooted a compromised system into Safe Mode to blind EDR tools, exfiltrated data via s5cmd, then failed to encrypt due to memory errors.
- News
Ukraine Dismantles 94 Fraudulent Call Centers, Seizes $2M and a Kilogram of Gold
Ukraine's National Police and SBU shut down 94 investment fraud call centers across 9 regions, seizing $2M, luxury cars, and 5,200+ SIM cards.
- News
DeadLock Ransomware Uses Blockchain to Resist Infrastructure Takedown
DeadLock ransomware stores its C2 configuration in Polygon smart contracts, making law enforcement takedowns ineffective against its 80+ victim operation.
- News
DeadLock Ransomware Uses Polygon Smart Contracts to Harden Extortion Infrastructure
The DeadLock ransomware group is leveraging Polygon blockchain smart contracts and the Session messaging network to build decentralized extortion...
- News
FBI, South Korea Warn of Gunra Ransomware Gang Targeting Critical Infrastructure
The FBI and South Korea's government have jointly warned that the Gunra ransomware gang is breaching critical infrastructure through vulnerabilities in...
- News
New StormEncryptor Ransomware Used by Former Medusa Affiliate
A financially motivated threat actor formerly associated with the Medusa ransomware operation is now deploying a new ransomware strain called...
- News
AI Sends Global Crime Syndicates Into Fraud Nirvana
Organized crime groups worldwide have fully embraced AI as a force multiplier for fraud, enabling operations at a scale and sophistication that INTERPOL...
- News
Vishing Extortion Group UNC6671 Rebrands After Making Millions
Vishing extortion group UNC6671 (formerly BlackFile) rebrands into Redact, Pink, Helix, and Falcon after earning millions from enterprise voice phishing.
- News
Canadian Pleads Guilty to Snowflake Cloud Data-Theft Attacks
Connor Riley Moucka of Kitchener, Ontario pleaded guilty to orchestrating one of the largest cloud data-theft campaigns in history, stealing billions of...
- News
Ransom Cartel Ransomware Creator Sentenced to 16 Years in Prison
Belarusian cybercriminal Maksim Silnikau, the mastermind behind Ransom Cartel ransomware-as-a-service, was sentenced to 16 years in federal prison for...
- News
Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People
Connor Riley Moucka pleaded guilty in Seattle federal court to computer fraud, wire fraud, and aggravated identity theft over the 2024 Snowflake...
- News
The Coordination Gap: How Attackers Are Outpacing Law Enforcement
Threat actors have evolved their strategies faster than law enforcement can coordinate across jurisdictions and agencies, creating a widening gap that...
- News
INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws
INC Ransomware has emerged as the dominant threat actor accelerating exploitation of recently disclosed SonicWall Secure Mobile Access 1000 series VPN...
- News
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack
River Bank & Trust in Alabama says it obtained representations from the ransomware group that attacked it in June 2026 that the stolen data has been...
- News
Interpol Leverages Global System to Curtail Fraud Payments
Interpol is deploying a global payment interception system to halt fraudulent transactions before cybercriminals can cash out. The initiative coordinates...
- News
SE Asian Cybercriminal Syndicates Become a Global Power
A new UNODC threat assessment reveals that Southeast Asian cyber fraud syndicates generated $88–$114 billion in losses in 2025 alone — and are now...
- News
FBI: Breaking Affiliate Trust Was Key to LockBit's Takedown
An FBI agent reveals how Operation Cronos dismantled the world's largest ransomware group by exploiting fractures in LockBit's affiliate trust model —...
- News
PTC Windchill Vulnerability Exploited in Ransomware Campaign
A critical unauthenticated deserialization flaw in PTC's Windchill PLM platform is being actively weaponized by the Cl0p ransomware group, targeting...
- News
Ransomware Attack Puts a Chill on Japanese Frozen-Food Chain
A ransomware attack on a major Japanese food and logistics firm has disrupted frozen food supply chains, affecting thousands of franchise clients...
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- News
RansomHouse Freezes Japan's Food Supply: Nichirei Logistics Cyberattack Disrupts KFC and Thousands of Clients
A cyberattack by Russia-linked RansomHouse on Nichirei Logistics Group, Japan's largest cold-chain operator, halted frozen food shipments across 140...
- News
Ransomware Is Accelerating — And It's Not Because of AI
Black Kite's 2026 Ransomware Report reveals 7,551 publicly disclosed victims in a single year — a 24.9% increase — driven not by AI but by ecosystem...
- News
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p ransomware group are actively exploiting chained pre-authentication vulnerabilities in PTC Windchill and FlexPLM...
- News
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
PRODAFT has published detailed analysis of the DevMan ransomware-as-a-service operation, revealing a professional-grade affiliate portal with payload...
- News
ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam
Threat actors are leveraging email addresses exposed in ShinyHunters data breaches to send highly personalized sextortion emails demanding $2,000 in...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- News
Swiss Rail Giant Stadler Refuses $12.3M Ransom Demand from Everest Group
Stadler Rail has publicly rejected a CHF 10 million (~$12.3M USD) ransom demand from the Everest extortion group following a breach of a supplier...
- News
How Enterprise GenAI Can Amplify Ransomware Risk — and How to Contain It
Enterprise AI assistants and agents that inherit excessive permissions or compromised identities create new ransomware attack paths. Identity controls,...
- News
Swiss Rail Giant Stadler Rejects $12.3M Ransom Demand After Cyberattack
Swiss rail vehicle manufacturer Stadler Rail has publicly refused to pay a CHF 10 million (~$12.3M USD) ransom demanded by the Everest ransomware group...
- News
Anubis Ransomware Claims Coca-Cola Fairlife Attack, Threatens Data Leak
The Anubis ransomware gang claims responsibility for a cyberattack on Coca-Cola's Fairlife dairy subsidiary, threatening to publish stolen corporate data...
- News
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Sysdig researchers link a second Langflow server attack to JADEPUFFER, an AI-agent-driven threat operator now deploying ENCFORGE — a Go-based ransomware...
- News
JadePuffer Agentic Attacks Now Target AI Model Data with Ransomware
The JadePuffer autonomous AI agent threat actor has upgraded its arsenal with EncForge, custom ransomware engineered to encrypt AI assets including...
- News
Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits
Nigeria has advanced new rules forcing organizations to disclose cyberattacks, joining a growing global shift toward mandatory breach transparency as...
- News
ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking
This week's threat roundup covers NuGet packages poisoned with game-cheat spyware, the Spirals ransomware deploying network-wide in under 24 hours, and...
- News
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker — Lawyers Say Wrong Man
Armenia has held a Russian tourist named Aleksandr Ermakov in detention since June 28 after a U.S. extradition request for a REvil ransomware suspect...
- News
In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint
This week's security roundup covers Iranian threat actors tracking US military personnel's phones, the newly discovered CrashStealer macOS infostealer, a...
- News
US Charges Two New Yorkers for Laundering $43 Million in Pig Butchering Investment Fraud
Federal prosecutors charged Zhuoying Chen and Haojie Zhang with conspiracy to commit money laundering after the pair allegedly moved $43 million in pig...
- News
Coca-Cola Fairlife Ransomware Attack Halts All US Dairy Production
The Coca-Cola Company filed an SEC 8-K disclosure after a ransomware attack on its Fairlife dairy subsidiary temporarily suspended all US production of...
- News
Identity Attacks Overtake Exploits as Top Ransomware Cause
Sophos 2026: 79% of ransomware attacks start with stolen identities. MFA was present in 97% of credential-based cases yet failed to stop every one of them.
- News
New Spirals Ransomware Encrypts Victim Network in Under 24 Hours
A newly identified ransomware group called Spirals has demonstrated alarming operational speed, completing the full attack lifecycle — initial access,...
- News
Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court for their roles in the 2024 cyberattack on...
- News
Dutch Police Bust Investment Fraud Ring Stealing Over €100 Million
Dutch Police have announced the arrest of multiple suspects believed to be part of an international investment fraud ring that stole over €100 million...
- News
US Charges Three Russians for Operating Bulletproof Hosting Behind $62M Ransomware Campaign
Federal prosecutors unsealed a 2024 indictment against three Russian nationals who ran Medialand LLC and ML.Cloud LLC — bulletproof hosting services used...
- News
Spanish Police Take Down €140 Million Cyber Fraud Ring, Arrest Four
Spanish National Police, coordinating with Europol, Interpol, Portugal, and Panama, have dismantled a sophisticated cybercriminal organization responsible...
- News
U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support
The U.S. Treasury's OFAC has designated two individuals and a VPN service provider for enabling ransomware actors and other cybercriminals — marking a...
- News
US Treasury Sanctions 1VPNS: The VPN Service Favored by Ransomware Groups
The US Treasury's OFAC sanctioned First VPN Service (1VPNS) and its Ukrainian administrator for providing anonymization cover to ransomware groups...
- News
Dutch Police Trace Odido Telecom Breach to Suspected Local Accomplice
Dutch police have identified evidence implicating a local Dutch suspect as an accomplice in the cyberattack on telecom provider Odido, which exposed the...
- News
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
A 41-year-old former cybersecurity professional has been sentenced to 70 months in federal prison for conspiring with the now-defunct BlackCat ransomware...
- News
Ryuk Operator Pleads Guilty; BlackCat/AlphV Conspirator Gets Nearly 6-Year Sentence
A Ryuk ransomware operator pleaded guilty in Oregon federal court while a BlackCat/AlphV conspirator received a 70-month prison sentence in Florida,...
- News
Third US Security Expert Sentenced to Prison for Helping Ransomware Gang
Angelo Martino, a former ransomware negotiator turned insider threat, was sentenced to 70 months in federal prison for actively assisting the...
- News
Armenian National Pleads Guilty to Ryuk Ransomware Attacks
Karen Vardanyan, an Armenian national, has pleaded guilty to federal charges related to Ryuk ransomware attacks and faces up to 15 years in prison with...
- News
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops
A weekly cybersecurity roundup covering the DHS database breach, Adobe accelerating its patch release schedule, Canada's law enforcement disruption of...
- News
Money Launderer Accused of Stealing $290K in Seized Crypto While Serving Prison Sentence
A Bulgarian national already serving over 10 years for laundering millions stolen from American fraud victims now faces new charges after allegedly...
- News
Police Suspects Dutch Hackers Were Involved in Odido Breach
The Dutch National Police has found strong indications that Dutch nationals were behind the February 2026 data breach at Odido, one of the Netherlands'...
- News
Former DigitalMint Ransomware Negotiator Sentenced to 70 Months for Defrauding Clients
Angelo Martino, a former cyber recovery specialist at DigitalMint, was sentenced to nearly six years in federal prison after secretly feeding confidential...
- News
'GodDamn' Ransomware Uses BYOVD Technique to Kill Security Software at US Companies
A new ransomware strain dubbed 'GodDamn' is leveraging a Microsoft-signed malicious kernel driver through the Bring Your Own Vulnerable Driver technique...
- News
GodDamn Ransomware Uses PoisonX Kernel Driver to Neutralize Endpoint Security
Symantec's Threat Hunter Team has flagged GodDamn, a new ransomware family that deploys the PoisonX kernel driver to disable endpoint detection and...
- News
GigaWiper: New Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
Microsoft has dissected GigaWiper, a destructive Windows backdoor that combines three distinct destructive capabilities — full disk wiping, fake...
- News
INTERPOL Arrests 5,800 Suspects in Operation First Light 2026 Global Fraud Bust
A 3.5-month INTERPOL-led operation spanning 97 countries resulted in 5,811 arrests, $293 million seized, and 142,000 victims identified — targeting...
- News
Police Arrest 5,800 Suspects and Seize $293M in Global Anti-Fraud Crackdown
A sweeping international law enforcement operation spanning 97 countries resulted in the arrest of 5,811 suspects and the seizure of $293 million in...
- News
Canada's Spy Agency Reports Hacking Three Criminal Groups in 2025
Canada's Communications Security Establishment publicly disclosed offensive cyber operations against a ransomware-as-a-service gang, a foreign online...
- News
JadePuffer: The First Fully Autonomous LLM-Driven Ransomware Attack
Security researchers at Sysdig have documented JadePuffer — an agentic threat actor powered entirely by a large language model that independently...
- News
Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware
This week's threat roundup covers residential proxy botnets hiding in streaming boxes, browser-based ransomware campaigns, AI agent abuse techniques, and...
- News
Teen Suspect in Scattered Spider Hacks Is Extradited to US
Peter Stokes, 19, has been extradited from Finland to face federal charges tied to Scattered Spider's hundred-million-dollar cybercrime spree — the latest...
- News
Agentic AI Used to Conduct Ransomware Attack via Langflow Vulnerability
Threat group JadePuffer leveraged an LLM agent to autonomously execute a multi-stage ransomware-style attack through a critical Langflow vulnerability,...
- News
Alleged Scattered Spider Hacker Peter Stokes Extradited to the United States
Peter Stokes, 19, a dual US-Estonian citizen known online as 'Bouquet,' has been extradited from Finland to face federal charges for his alleged role in...
- News
JadePuffer Ransomware Used an AI Agent to Automate the Entire Attack
Security researchers have documented what appears to be the first ransomware operation conducted entirely by a large language model agent — JadePuffer...
- News
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting
A roundup of security stories you may have missed: an Anonymous-linked Canadian hacker receives a prison sentence, a researcher drops zero-days in open...
- News
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
Sysdig researchers documented the first fully autonomous AI-driven ransomware campaign, where threat actor JADEPUFFER used an AI agent to chain Langflow...
- News
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
SOCRadar uncovered FortiBleed — a large-scale credential-harvesting campaign targeting 11,250 FortiGate portals across 150+ countries, resulting in 110...
- News
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Anubis ransomware affiliates are exploiting CVE-2025-5777 (Citrix Bleed 2) for initial access while pairing BYOVD techniques and stolen supply chain...
- News
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
A ransomware campaign is impersonating Interpol to pressure small and medium-sized businesses into paying extortion demands, using law enforcement...
- News
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
This week's security roundup covers AI compute theft, a newly discovered Apple Mail vulnerability, the emerging BlueHammer ransomware group, and 14...
- News
FortiBleed Credential-Theft Campaign Linked to Lynx Ransomware Group
Researchers have connected the massive FortiBleed credential-theft operation — which harvested credentials from over 86,000 FortiGate firewalls — directly...
- News
Blackfield Ransomware Demands $2 Million from Nidec Corporation
The Blackfield ransomware gang is demanding a $2 million ransom from Nidec Corporation after attacking its Taiwanese subsidiary, Nidec Chaun Choung...
- News
How Ransomware Syndicates Weaponize Corporate-Style Organization
From outsourced labor to tiered pricing models, today's top ransomware groups operate less like rogue hackers and more like Fortune 500 companies — with...
- News
Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk
Rising third-party breach incidents are forcing schools and universities to play defense as ransomware gangs and supply chain attackers increasingly...
- News
Minnesota Man Known as 'Snoopy' Sentenced in DraftKings Hack
Nathan Austad of Minnesota, who operated under the alias 'Snoopy,' has been sentenced for his role in the 2022 DraftKings data breach, becoming the third...
- News
Europe Evolves Into Ransomware's Favorite Region
New research from Black Kite shows ransomware attacks against European organizations surged 55% in the first four months of 2026 compared to the same...
- News
Local Police Collusion Hampers Crackdown on Asian Scam Centers
With tens of billions of dollars flowing into regional economies from cybercrime, scam centers across Southeast Asia continue to flourish despite...
- News
Malicious Edge Extension "Edgecution" Abuses Native Messaging to Deploy Ransomware Backdoor
Zscaler researchers exposed 'Edgecution', a rogue Microsoft Edge extension that exploits Chrome's Native Messaging protocol to escape the browser sandbox...
- News
Poland Busts SIM-Swapping Gang Tied to Millions in Crypto Theft
Polish authorities, working alongside the FBI and HSI, have arrested four members of a cybercrime gang that used SIM-swapping attacks to hijack...
- News
Amadey and StealC Malware Operations Disrupted in Operation Endgame Action
Microsoft, Europol, and international law enforcement partners have dismantled infrastructure supporting the Amadey malware loader and StealC infostealer...
- News
Stealthy Mistic Backdoor Linked to Ransomware Access Broker KongTuke
Security researchers have identified a new backdoor malware named Mistic being deployed by KongTuke, a ransomware initial access broker, in financially...
- News
INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific
A new INTERPOL report reveals a dramatic surge in Asia-Pacific cybercrime, with phishing rates nearly double the global average, ransomware attacks...
- News
Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
This week's threat roundup covers the Usbliter8 iPhone boot exploit, NarwhalRAT spread via fake Microsoft alerts, The Gentlemen ransomware's GentleKiller...
- News
New Prinz Eugen Ransomware Prioritizes Recent Files for Encryption
A new Go-based ransomware operation named Prinz Eugen targets recently modified files first, uses ChaCha20-Poly1305 encryption, and communicates with...
- News
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service operation distributes a sophisticated EDR-killing toolkit called GentleKiller to affiliates, capable of terminating...
- News
Australian Sugar Producer Works to Restore Operations After Ransomware Attack
Mackay Sugar, one of Australia's largest sugar producers, is working urgently to restore harvesting and milling operations after The Gentlemen ransomware...
- News
Gentlemen Ransomware Uses Multiple EDR Killers to Disable Defenses
The Gentlemen ransomware-as-a-service operation is actively developing and maintaining a suite of EDR killer tools to help affiliates evade detection and...
- News
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023
Cybersecurity researchers have charted the evolution of INC ransomware from a nascent RaaS operation to one of the most prolific cybercrime groups in...
- News
INC Ransomware Thrives by Mastering the Basics
The INC ransomware group has risen to prominence not through exotic exploits but by relentlessly targeting sectors — particularly healthcare — where...
- News
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack
Security researchers have uncovered a DragonForce ransomware attack deploying a new Go-based backdoor that uses Microsoft Teams relay infrastructure for...
- News
'Lorem Ipsum' Malware Pivots to ClickFix Delivery via WordPress
New analysis reveals the 'Lorem Ipsum' malware campaign has adopted ClickFix social engineering as its primary delivery mechanism, leveraging compromised...
- News
DragonForce Ransomware Hides C2 Traffic Inside Microsoft Teams Relays
DragonForce ransomware operators deployed a custom implant called Backdoor.Turn to camouflage command-and-control communications inside legitimate...
- News
FBI and Google Dismantle 'Outsider Enterprise' Phishing Service
A joint FBI and Google operation took down the Outsider Enterprise phishing platform — responsible for over 9,000 fake sites, nearly 4 million stolen...
- News
Conti Ransomware Member Pleads Guilty, Faces Up to 20 Years in Prison
Oleksii Lytvynenko, a 44-year-old Ukrainian national, has pleaded guilty to participating in the prolific Conti ransomware group after being arrested in...
- News
FBI Dismantles Massive AI-Powered Chinese Phishing-as-a-Service Operation
The FBI, Google, and Black Lotus Labs jointly dismantled Outsider Enterprise, a massive Chinese phishing-as-a-service platform that operated over one...
- News
Ex-School District IT Employee Sentenced to 21 Months for Cyberattacks on Former Employer
A former IT worker at an Iowa school district was sentenced to 21 months in federal prison after conducting a sustained cyberattack campaign against his...
- News
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs
Europol has dismantled AudiA6, a cryptocurrency laundering service described as a key financial pipeline for ransomware gangs and cybercriminal networks...
- News
Ukrainian National Pleads Guilty to Role in Conti Ransomware Operation
A Ukrainian national extradited from Ireland to the United States has pleaded guilty to conspiracy charges tied to the Conti ransomware operation, which...
- News
Authorities Dismantle 'AudiA6' Ransomware Crypto-Laundering Service
Law enforcement has dismantled the AudiA6 cryptocurrency laundering service used by ransomware actors and cybercriminals to clean more than $380 million...
- News
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
A new analysis of The Gentlemen ransomware operation reveals the financially motivated group has claimed 478 victims and evolved a worm-like...
- News
Infostealers Turn Millions of Devices Into Credential Theft Machines
Attackers increasingly favor stolen credentials over exploits, and infostealers have become the primary access broker feeding ransomware and cybercrime...
- News
Who Runs the Ransomware Group 'The Gentlemen'?
KrebsOnSecurity investigates the identity and structure behind The Gentlemen, the second most active ransomware gang of 2026, known for offering...
- News
Dark Web Nemesis Market Vendor Gets 26 Years for Selling Drugs
A California man was sentenced to over 26 years in federal prison for trafficking fentanyl and meth through Nemesis Market, a major dark web drug marketplace.
- News
Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown
Law enforcement agencies and major technology companies have jointly dismantled infrastructure tied to Southeast Asia-based scammers, disrupting more than 1.4…
- News
Police Dismantles 9 Crime Groups in Illegal Streaming Crackdown
A coordinated international law enforcement operation has dismantled nine organized crime groups and arrested 29 suspects in a major crackdown targeting…
- News
The U.S. Sanctions Nobitex Crypto Exchange Used by Ransomware
The U.S. Treasury's OFAC has sanctioned Nobitex, Iran's largest cryptocurrency exchange, for facilitating payments linked to terrorist activities and…
- News
AI-Built Ransomware Toolkit Automates EDR Evasion and AD Discovery
A threat actor has deployed an AI-generated ransomware attack toolkit that automates Active Directory discovery and helps evade endpoint detection and…
- News
Dutch Police Dismantle Massive 17-Million-Device Botnet
Dutch authorities seized command-and-control servers tied to a botnet of 17 million infected computers, smartphones, and tablets that was allegedly used to…
- News
Canadian Man Gets 33 Years for Using Social Media to Coerce US Children
A Canadian man received a 33-year US federal sentence after using fake online identities on social media to manipulate children into sending sexually...
- News
Latin American Cybercriminals Hoover Up Government Data
A reported breach of 5.8M Uruguayan records is the latest in a growing pattern of attackers monetizing Latin American government citizen data.
- News
Ransomware Actors Show Up In Person to Steal Law Firm Data
FBI warns the Silent Ransom Group is targeting law firms by physically arriving on-site and social-engineering access to sensitive client databases.
- News
7-Eleven Data Breach Exposes Personal Information of 185,000 People
The ShinyHunters extortion gang stole the personal information of over 185,000 customers after breaching convenience store giant 7-Eleven in April 2026, with.
- News
Former US Execs Plead Guilty to Aiding Tech Support Scammers
Two former executives of a call-tracking and analytics company have pleaded guilty to concealing a years-long tech support fraud scheme that victimized...
- News
Netherlands Seizes 800 Servers of Hosting Firm Enabling
Dutch financial crime investigators (FIOD) arrested two men and seized 800 servers from a hosting company that provided bulletproof infrastructure...
- News
''First VPN'' Cybercrime Service Disrupted, Administrator
The FBI and international partners have disrupted First VPN, a criminal VPN service used by dozens of ransomware groups for network reconnaissance and...
- News
Alleged Kimwolf Botmaster ''Dort'' Arrested, Charged in U.S. and Canada
Canadian authorities arrested a 23-year-old Ottawa man suspected of building and operating Kimwolf, an IoT botnet that enslaved millions of devices for...
- News
Canadian Man Arrested and Charged for Running KimWolf DDoS
Jacob Butler, a Canadian national, has been arrested and charged in the United States and Canada for running the KimWolf DDoS-for-hire botnet, which...
- News
First VPN Dismantled in Global Takedown Over Use by 25
International authorities have disrupted a criminal VPN service called First VPN that was used by more than 25 ransomware groups to conceal network...
- News
US and Canada Arrest and Charge Suspected Kimwolf Botnet
U.S. and Canadian authorities arrested and charged a Canadian man with operating the Kimwolf DDoS botnet, which infected nearly two million devices...
- News
Verizon DBIR 2026: Healthcare Fends Off Rising Social
The 2026 Verizon Data Breach Investigations Report highlights how evolving social engineering tactics are making the healthcare sector more vulnerable,...
- News
Europe Dismantles VPN Service Used by Cybercriminals to Hide Ransomware Attacks
European law enforcement has taken down First VPN, a privacy service that had been openly advertised on Russian-language cybercrime forums as a tool for...
- News
Police Seize 'First VPN' Service Used in Ransomware and Data Theft Attacks
International law enforcement has dismantled 'First VPN,' a criminal VPN service marketed on Russian-speaking cybercrime forums and used to facilitate...
- News
GitHub Confirms Being Hacked by TeamPCP, Says Customer Data
GitHub has officially confirmed it was breached by the TeamPCP threat actor after the group advertised stolen internal source code on a cybercrime forum....
- News
GitHub Investigating TeamPCP Claimed Breach of ~4,000
GitHub is investigating unauthorized access to its internal repositories after the TeamPCP threat actor listed approximately 4,000 GitHub internal repos...
- News
Ukraine Identifies Infostealer Operator Tied to 28,000
Ukrainian cyberpolice, working with US law enforcement, identified an 18-year-old from Odesa suspected of running an infostealer malware operation that...
- News
Cybercrime Service Disrupted for Abusing Microsoft Platform
Microsoft has disrupted a malware-signing-as-a-service operation that exploited the company's Artifact Signing service to produce fraudulent code-signing...
- News
Verizon DBIR 2026: Vulnerability Exploitation Overtakes
Verizon's 2026 Data Breach Investigations Report reveals a landmark shift: vulnerability exploitation has surpassed credential abuse as the leading breach...
- News
Foxconn Attack Highlights Manufacturing's Cyber Crisis
A Nitrogen ransomware attack on Foxconn's North American facilities is one of more than 600 hits on manufacturers so far in 2026, as ransomware gangs...
- News
Colorado Governor Commutes Prison Sentence for Election
Colorado Governor Jared Polis has commuted the nine-year prison sentence of Tina Peters, the election denier convicted of stealing voting system data,...
- News
American Lending Center Data Breach Affects 123,000
The non-bank lender discovered a ransomware attack nearly one year ago but only recently completed its investigation, notifying over 123,000 individuals...
- News
More Than $10 Million Stolen from Crypto Platform THORChain
THORChain officials confirmed that one of their six vaults was compromised in a security incident, leading to a loss of approximately $10.7 million. The...
- News
Foxconn Confirms Cyberattack Claimed by Nitrogen Ransomware
Foxconn, the world's largest electronics manufacturer, confirmed a cyberattack on its North American factories claimed by the Nitrogen ransomware gang,...
- News
Foxconn Confirms North American Factories Hit by Cyberattack
Electronics manufacturing giant Foxconn has confirmed a cyberattack on its North American operations after the Nitrogen ransomware group claimed...
- News
Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak
An OPSEC failure provides a rare window into the inner workings of The Gentlemen ransomware-as-a-service group, exposing their affiliate model, TTPs, and...
- News
West Pharmaceutical Services Hit by Disruptive Ransomware
West Pharmaceutical Services, a global manufacturer of drug delivery systems and packaging, has taken systems offline worldwide after hackers exfiltrated...
- News
West Pharmaceutical Warns of Ransomware Attack Impacting
West Pharmaceutical Services filed an SEC disclosure warning that hackers breached the company on May 4, stole data, and encrypted systems — forcing a...
- News
Worm Redux: Fresh Mini Shai-Hulud Infections Bite npm
Hundreds of npm packages in the TanStack open source ecosystem have been infected by a fresh wave of Mini Shai-Hulud worm activity from TeamPCP — the same...
- News
Hackers Used AI to Develop First Known Zero-Day 2FA Bypass
Google has disclosed a landmark discovery: an unknown threat actor used an AI system to develop a zero-day exploit in the wild — the first confirmed...
- News
UK Water Utility Fined £963,900 After Cl0p Lurked
The UK's Information Commissioner's Office fined South Staffordshire Water nearly £1 million after the Cl0p ransomware group maintained undetected access...
- News
Multiple Universities Forced to Reschedule Final Exams
Dozens of universities were forced to reschedule final examinations after a cybercriminal group displayed threatening messages through Canvas, the widely...
- News
New Bluekit Phishing Kit Features AI Assistant and Automated Domain Registration
A newly discovered phishing-as-a-service toolkit called Bluekit is emerging on underground forums, offering threat actors an AI assistant for campaign...
- News
Critical cPanel Flaw Mass-Exploited in 'Sorry' Ransomware
A newly disclosed critical vulnerability in cPanel and WHM tracked as CVE-2026-41940 is being mass-exploited by ransomware actors to breach web hosting...
- News
Cyber Incident Responders Sentenced to 4 Years for Carrying
Two cybersecurity incident responders who abused their trusted positions to secretly carry out ransomware attacks against the organizations they were...
- News
US Ransomware Negotiators Get 4 Years in Prison Over
Two former cybersecurity incident responders from Sygnia and DigitalMint were each sentenced to four years in federal prison for leveraging their trusted...
- News
FBI Links Cybercriminals to Sharp Surge in Cargo Theft
The FBI has issued a warning to the transportation and logistics industry about a sharp rise in cyber-enabled cargo theft, with estimated losses reaching...
- News
Former Incident Responders Sentenced to 4 Years for Ransomware Attacks on Clients
Ryan Goldberg and Kevin Martin, who worked as incident responders, were sentenced to four years in federal prison after using their trusted access to...
- News
Hackers Earning Millions from Hijacked Cargo, FBI Says
The FBI's new advisory reveals that cyber actors have spent the last two years systematically breaching freight broker and carrier systems, then posing as...
- News
Sandhills Medical Says Ransomware Breach Affects 170,000
Healthcare organization took nearly one year to publicly disclose a data breach after being targeted by Inc Ransom ransomware, with approximately 170,000...
- News
European Police Dismantles €50 Million Crypto Investment
Austrian and Albanian law enforcement jointly dismantled a large-scale cryptocurrency investment fraud operation estimated to have caused over €50 million...
- News
Swiss Police Arrest 10 Suspected Members of Nigeria-Linked
Swiss and German law enforcement arrested 10 suspected members of the Nigerian criminal network Black Axe, including a regional leader believed to oversee...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB
Threat hunters warn that VECT 2.0 ransomware contains a critical flaw in its encryption implementation that acts more like a wiper for files over 131KB...
- News
Broken VECT 2.0 Ransomware Acts as a Data Wiper for Large
Researchers have found that VECT 2.0 ransomware contains a critical flaw in its nonce handling that causes encryption to permanently destroy large files...
- News
Feuding Ransomware Groups Leak Each Other's Data
When rival ransomware groups 0APT and KryBit turned on each other, they exposed infrastructure details, operational data, victim lists, and internal...
- News
Money Launderer for Crypto Thieves Given 5-Year Prison
A California man has been sentenced to more than five years in federal prison for his role in laundering proceeds for a cybercriminal organization that...
- News
Money Launderer Linked to $230M Crypto Heist Gets 70 Months
Evan Tangeman, 22, of Newport Beach, California, was sentenced to 70 months in federal prison for laundering funds stolen in a $230 million cryptocurrency...
- News
ADT Says Customer Data Stolen in Cyber Intrusion
Home security giant ADT confirmed that cybercriminals breached its systems and stole a limited set of customer and prospective customer information. The...
- News
ADT Confirms Data Breach After ShinyHunters Leak Threat
Home security giant ADT has confirmed a data breach after the ShinyHunters extortion group threatened to publish stolen data unless a ransom is paid,...
- News
Trigona Ransomware Deploys Custom CLI Exfiltration Tool in Active Attacks
Recently observed Trigona ransomware attacks are using a bespoke command-line exfiltration tool to steal data from compromised environments faster and...
- News
Former Ransomware Negotiator Pleads Guilty to BlackCat
Angelo Martino, 41, a former employee of cybersecurity incident response firm DigitalMint, has pleaded guilty to targeting U.S. companies with BlackCat...
- News
Kyber Ransomware Gang Uses Post-Quantum Encryption to Target Windows and ESXi
A new ransomware operation called Kyber is targeting Windows systems and VMware ESXi endpoints, with one variant implementing Kyber1024 post-quantum...
- News
Spain Dismantles Major $4.7M Manga Piracy Platform, Arrests
Spanish police have shut down the largest Spanish-language manga piracy platform, which had operated since 2014 and served millions of monthly users...
- News
Former DigitalMint Ransomware Negotiator Pleads Guilty to $75.3M Extortion Scheme
Angelo Martino, a former ransomware payment negotiator for DigitalMint, has pleaded guilty to helping accomplish extort $75.3 million in ransom from five...
- News
Surge in Bomgar RMM Exploitation Demonstrates Supply Chain
A critical RCE flaw in BeyondTrust Bomgar remote monitoring and management software is being actively exploited to spread ransomware and compromise...
- News
The Backup Myth That Is Putting Businesses at Risk
Backups protect your data, but they don't keep your business running during downtime. Understanding the difference between backup and BCDR is critical as...
- News
The Gentlemen Ransomware Now Uses SystemBC for Bot-Powered
Researchers have discovered a SystemBC proxy botnet of over 1,570 compromised hosts linked to Gentlemen ransomware operations. The gang's affiliate is...
- News
6-Year Ransomware Campaign Targets Turkish Homes and SMBs
A ransomware campaign operating since at least 2019 has persistently targeted Turkish home users and small-to-medium businesses, largely evading major...
- News
New Jersey Men Sentenced to Combined 17 Years for Running
Two New Jersey men received prison sentences of nine and nearly eight years respectively for operating IT laptop farms that funneled over $5 million to...
- News
Grinex Exchange Blames Western Intelligence for $13.7M
Kyrgyzstan-based cryptocurrency exchange Grinex has suspended all operations after a $13.7 million hack, with the platform controversially attributing the...
- News
Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3
An international law enforcement operation has dismantled 53 DDoS-for-hire domains, arrested four individuals, and exposed over 3 million criminal...
- News
Payouts King Ransomware Uses QEMU Virtual Machines to Bypass Endpoint Security
The Payouts King ransomware group is deploying the QEMU open-source emulator as a covert reverse SSH backdoor, spinning up hidden virtual machines on...
- News
Ransomware Attack Still Disrupting London Healthcare Nearly
More than 18 months after a ransomware attack crippled hospitals in South East London, at least one NHS trust is still operating without fully restored...
- News
Dutch Hospitals Disrupted After Ransomware Hits Healthcare
A ransomware attack on Dutch healthcare software vendor ChipSoft has forced hospitals and patients across the Netherlands offline, disrupting the HiX...
- News
'It Reads Like a Spy Novel': $280M Drift Theft Linked to North Korean Fake Companies
A post-mortem of the $280 million Drift Protocol crypto theft reveals a sophisticated six-month North Korean social engineering operation involving fake...
- News
Cybercriminals Target Accountants to Drain Russian Firms'
Cybercriminals are stealing millions from Russian companies by compromising accountants' computers and disguising fraudulent transfers as routine salary...
- News
Healthcare IT Provider ChipSoft Hit by Ransomware Attack
Dutch healthcare software vendor ChipSoft has been struck by a ransomware attack, forcing the company to take its website and digital patient services...
- News
FBI: Cybercrime Losses Neared $21 Billion in 2025
The FBI received over 1 million complaints of malicious activity in 2025, with investment scams, business email compromise, and tech support fraud causing...
- News
FBI: Americans Lost a Record $21 Billion to Cybercrime Last
The FBI's Internet Crime Complaint Center reports that U.S. victims lost nearly $21 billion to cyber-enabled crimes in 2025 — an all-time record — driven...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- News
BKA Identifies REvil Leaders Behind 130 German Ransomware
Germany's Federal Criminal Police Office has publicly unmasked the real identity of "UNKN," the primary operator behind the now-defunct REvil and GandCrab...
- News
German Authorities Identify REvil and GandCrab Ransomware
Germany's Federal Police have publicly named two Russian nationals as the leaders of the GandCrab and REvil ransomware operations, linking them to at...
- News
Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
A joint operation by the US Department of Justice, Canada, and Germany has dismantled the infrastructure behind four highly disruptive IoT botnets that...
- News
Germany Doxes "UNKN," Head of RU Ransomware Gangs REvil
German authorities have publicly identified the elusive "UNKN," the operator behind the GandCrab and REvil ransomware groups, as 31-year-old Russian...
- News
Evolution of Ransomware: Multi-Extortion Ransomware Attacks
Modern ransomware has evolved far beyond simple file encryption. Multi-extortion tactics — combining encryption, data theft, and public leak threats —...
- News
Die Linke German Political Party Confirms Data Stolen by Qilin Ransomware
The Qilin ransomware group has claimed responsibility for an attack against German political party Die Linke, forcing an IT systems outage and threatening...
- News
In Other News: ChatGPT Data Leak, Android Rootkit, Water
This week's security stories you may have missed: a ChatGPT conversation data leak, a new Android rootkit on Google Play, a municipal water facility taken...
- News
Hacker Charged with Stealing $53 Million from Uranium
U.S. prosecutors have charged a Maryland man with hacking DeFi protocol Uranium Finance twice and laundering over $53 million through cryptocurrency mixers.
- News
Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations
Iranian APT groups are increasingly blurring the lines between state-sponsored cyber espionage and financially motivated cybercrime, deploying destructive...
- News
Leak Bazaar: New Criminal Service Plans to Monetize Data
A new underground platform called Leak Bazaar positions itself as a data-processing business, offering to monetize stolen records on behalf of ransomware...
- News
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
A new report reveals how industrialized credential theft has become the common thread connecting ransomware campaigns, SaaS platform breaches, and...
- News
Bearlyfy Hits Russian Firms with Custom GenieLocker
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, recently deploying a custom...
- News
Pro-Ukraine Hacker Group Bearlyfy Targets Russian Companies
The pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian businesses in the past year and is escalating operations...
- News
Russia Detains Alleged Admin of LeakBase Cybercrime Forum
Russian authorities have detained a suspected administrator of LeakBase, a major stolen-data marketplace with over 147,000 subscribers, just weeks after...
- News
LeakBase Admin Arrested in Russia Over Massive Stolen
Russian law enforcement has arrested the alleged administrator of LeakBase — a credential marketplace operating since 2021 with 142,000 members and...
- News
Manager of Botnet Used in Ransomware Attacks Gets 2 Years
Ilya Angelov, co-leader of the TA551/Mario Kart cybercrime group, was sentenced to two years in prison for operating a phishing botnet that sent 700,000...
- News
Paid AI Accounts Are Now a Hot Underground Commodity
New research from Flare Systems reveals that premium AI platform access — including ChatGPT Plus, Claude Pro, and raw API keys — has been systematically...
- Newsletter
Mar 25 Digest: DarkSword Leaks iPhone Zero-Days
This week: the DarkSword iOS exploit chain published on GitHub threatens to democratize nation-state-grade iPhone hacking; CanisterWorm turns the Trivy...
- News
Russian Hacker Who Helped Yanluowang Ransomware Gang Gets
Aleksei Volkov, a Russian initial access broker who sold unauthorized access to U.S. companies for the Yanluowang ransomware group, has been sentenced to...
- News
Two US Cybersecurity Professionals Plead Guilty to BlackCat
Former incident responder Ryan Goldberg and ransomware negotiator Kevin Martin admitted to running ALPHV/BlackCat ransomware operations against five US...
- News
DoJ Disrupts 3 Million-Device IoT Botnets Behind Record
The U.S. Department of Justice, in coordination with Germany and Canada, has dismantled the C2 infrastructure of four major IoT botnets — AISURU, Kimwolf,...
- News
LeakNet Ransomware Weaponizes ClickFix and Deno Runtime for Stealthy Corporate Attacks
The LeakNet ransomware gang is using ClickFix social engineering for initial access and a Deno-based malware loader to execute fileless payloads from...
- News
England Hockey Investigating Data Breach After AiLock
England Hockey, the national governing body for field hockey in England, is investigating a potential data breach after the AiLock ransomware group listed...
- News
Termite Ransomware Operator Velvet Tempest Chains ClickFix
Microsoft-tracked threat actor Velvet Tempest is deploying Termite ransomware via a ClickFix social-engineering chain that loads DonutLoader and installs...
- News
Spanish-Ukrainian Police Bust Gambling Ring That Exploited
Spanish and Ukrainian law enforcement dismantled a criminal organization that recruited war-displaced Ukrainian women to open bank accounts used to...
- News
Phobos Ransomware Admin Pleads Guilty — 1,000+ Victims
Evgenii Ptitsyn, 43, a Russian national who administered the Phobos ransomware-as-a-service operation, pleaded guilty to wire fraud conspiracy in the U.S....
- News
Europol-Coordinated Action Dismantles Tycoon2FA — 330
An international coalition led by Europol and Microsoft has taken down Tycoon2FA, a phishing-as-a-service platform responsible for 87.5 million phishing...
- News
WormGPT Hacked: 19,000 Cybercriminal AI Platform Users
A threat actor has published a database allegedly containing 19,000 user records from WormGPT, the underground AI platform marketed for offensive hacking...
- News
Ransomware Costs Projected to Hit $74 Billion in 2026, 30%
Cybersecurity Ventures forecasts ransomware damage costs will surge to $74 billion globally in 2026, up from $57 billion in 2025, as attacks grow more...
- News
The Rise of Ransomware-as-a-Service: 14 Active Platforms
Security researchers identify 14 active RaaS platforms operating sophisticated affiliate programs, with entry costs as low as $40 per month lowering the...
- News
Ransomware Attacks Surge in Early 2026 with 26 Claims in One Day
Threat intelligence reports show 8 active ransomware groups claimed 26 victims on February 2nd alone, with major corporations including BASF and Honeywell...