Skip to content
September 24, 2026
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • CVE Data
    • CVE Watchtower
    • Top Exploited CVEs
    • CVE Stats by Vendor
    • Q2 2026 Report
    • CVE Alerts
    • CVE Alert Settings
    • Pricing
  • Cyber Criminals
  • Data Leak
  • Free Tools
    • CVSS 3.1 Calculator
    • Certificate Viewer
    • DNS Lookup
    • Encoder & Hash Generator
    • IP / Subnet Calculator
    • Whois Lookup
  • Linux
  • Malware
  • Vulnerability
  • Submit Press Release
  • Weekly Recap
Light/Dark Button
  • Home
  • News
  • Cyber Security
  • DarkOverlord hacker group member arrested by Serbian police
  • Cyber Security

DarkOverlord hacker group member arrested by Serbian police

Do Son May 20, 2018 2 minutes read
Add Daily CyberSecurity as a preferred source on Google

Serbian authorities recently arrested a 38-year-old man from Belgrade suspected of being a member of the Dark Overlord hacker group.

DarkOverlord first stepped into sight in June 2016. It took a medical insurance database from a company in Farmington, Missouri, which included personal details of 47,864 patients.

Not only that, it also stole a database of medical institutions in the Midwestern United States that contained personal details of 210,000 patients. Another database is owned by the Athens Orthopedic Clinic in Atlanta, Georgia, and involves personal details of 397,000 patients.

Founded in 1997, Netflix (Nasdaq NFLX) is an online video rental provider headquartered in Los Gato, California. In May 2017, the company was hacked by DarkOverlord and some TV drama resources that have not yet officially aired were stolen.

In addition, in the same month, DarkOverlord also claimed to have obtained ABC a new game program Steve Harvey’s Funderdome related resources for the upcoming 8 episodes, but due to the low visibility of the program, it did not cause much concern.

On October 2, 2017, DarkOverlord issued a death threat to the Johnston Community School District in Iowa, USA. Some of these schools were forced to close temporarily. DarkOverlord claimed to have stolen a large amount of student personal data, including names, phone numbers, home addresses, and voice mail, and sent messages to schools and parents that they would harm or even kill these children.

The identity of the arrested suspect has not yet been announced, but according to the limited details shared by the Serbian authorities, the man is a citizen of Belgrade.  In a press release, Serbian authorities stated that DarkOverlord has attacked at least 50 companies or organizations worldwide and has profited from more than $275,000 in attacks. Its main monetization method is threatening threats – claiming to have stolen sensitive data from the victims. If you do not pay the full amount of ransom, the data will be publicly released.

It is unclear whether the number of members of DarkOverlord may be composed of only one person or may consist of multiple members. If it consists of only one person, the success of this arrest means that the organization will be destroyed. 

Source: Newsweek

Related coverage

  • OfflRouter Virus: A Persistent Threat in Ukraine Exploiting Confidential Documents
  • Tech Giants Vulnerable as Hackers Probe Kodex’s Defenses
  • Iranian “Prince of Persia” APT Resurfaces with Telegram-Controlled Stealth Malware
Track all actively exploited CVEs →

Support Our Threat Intelligence

Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee Logo Buy Me a Coffee
Select your plan
Free Pro Team

Hover over a plan to see its benefits.

Get Zero-Hour Vulnerability Alerts

Critical CVEs, CVSS scores, and PoC updates — straight to your inbox every week.

We respect your inbox. Unsubscribe anytime.

SHARE
Share on FacebookShare on XShare on LinkedInShare on TelegramShare on BlueskyShare on Mastodon
Written by
@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Tags: DarkOverlord hacker

Search

Translation

CVE ALERTS
📧

Email Delivery
Get threat intel straight to your inbox.

♾️

Unlimited Vendors
Track every technology in your stack.

🚨

All New CVE Alerts
Be the first to know about new flaws.

⚙️

Custom EPSS Threshold
Filter noise, focus on real risks.

💬

Slack & Teams Webhook
Integrate directly into your SecOps.

🚫

100% Ad-Free
Enjoy an uninterrupted reading experience.

$7/mo
Subscribe Now

🚨 Active Exploits in the Wild

  • CVE-2026-48842CVSS 8.1
    Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
    Admin intel📅 Updated: Sep 23, 2026
  • CVE-2026-87902
    Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
    Admin intel📅 Updated: Sep 23, 2026
  • CVE-2026-94127CVSS 9.8
    When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious...
    Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
  • CVE-2026-85102CVSS 9.8
    Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote...
    Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
  • CVE-2026-93616CVSS 9.8
    A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on...
    Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
  • CVE-2026-93952CVSS 10.0
    VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access...
    Admin intelCISA KEV📅 Added to KEV: Sep 22, 2026📅 Updated: Sep 22, 2026
  • CVE-2026-32996CVSS 7.3
    A vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
    Admin intel📅 Updated: Sep 22, 2026
  • CVE-2026-7273CVSS 8.8
    A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a...
    CISA KEV📅 Added to KEV: Sep 21, 2026
Powered by CVE Watchtower

Critical Vulnerabilities

  • CVE-2026-71362CVSS 9.1
    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
    📅 Updated: Sep 24, 2026
  • CVE-2026-78225CVSS 9.0
    A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.
    📅 Updated: Sep 24, 2026
  • CVE-2026-81855CVSS 9.1
    A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.
    📅 Updated: Sep 24, 2026
  • CVE-2026-54617CVSS 9.8
    GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can...
    📅 Updated: Sep 24, 2026
  • CVE-2025-59953CVSS 9.8
    LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior...
    📅 Updated: Sep 24, 2026
  • CVE-2026-54752CVSS 9.6
    NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation...
    📅 Updated: Sep 24, 2026
  • CVE-2026-54626CVSS 9.8
    SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles....
    📅 Updated: Sep 24, 2026
  • CVE-2026-45140CVSS 9.8
    Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker...
    📅 Updated: Sep 24, 2026
Powered by CVE Watchtower

Daily CyberSecurity

  • About SecurityOnline.info
  • Advertise with us
  • Announcement
  • Contact
  • Contributor Register
  • Login
  • Disclaimer
  • DCMA
  • Privacy Policy
  • About SecurityOnline.info
  • Advertise on SecurityOnline.info
  • Contact Us

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

  • CVE Watchtower
  • CVE Statistics by Vendor 2026
  • Q2 2026 Report
  • Top Exploited CVEs
  • Bluesky
  • Facebook
  • Linkedin
  • Mastodon
  • RSS
  • Twitter
  • Youtube
© 2017 - 2026 Daily CyberSecurity. All Rights Reserved.