Cybercrime Archives • Daily CyberSecurity

PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures

Do Son September 18, 2026

At a glance Actor or group: PAPERMILL (suspected Silver Fox-adjacent cluster) Activity type: Tax-themed phishing, DLL sideloading,...

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts Redirect to legitimate device code sign-in page

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

Do Son September 18, 2026

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code...

Smishing Triad Phishing Kit Exposed by Group-IB The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

Smishing Triad Phishing Kit Exposed by Group-IB

Do Son September 17, 2026

Security researchers at Group-IB recently published an investigation into a Smishing Triad phishing kit deployed across global...

North Korean IT Worker Scam Infiltrates Tech Jobs GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

North Korean IT Worker Scam Infiltrates Tech Jobs

Do Son September 17, 2026

Security researchers at Silent Push identified a fraudulent job recruitment scheme hosted on a Discord server. The...

PivotC2 FortiGate RAT Drives Firewall Compromises Diagram of the PivotC2 FortiGate RAT infection chain following CVE-2025-25249 exploitation

Diagram of the PivotC2 FortiGate RAT infection chain following CVE-2025-25249 exploitation

PivotC2 FortiGate RAT Drives Firewall Compromises

Do Son September 14, 2026

At a Glance Russian-speaking cybercriminals targeted over 30,000 IP addresses to deploy the PivotC2 FortiGate RAT onto...

Unit 42 Exposes OfferLoader Malware Campaign OfferLoader malware diagram showing the OfferLoader malware campaign infection flow

Unit 42 Exposes OfferLoader Malware Campaign

Do Son September 14, 2026

At a Glance Unit 42 researchers identified over 10,000 distinct samples of OfferLoader malware distributing dangerous payloads...

CVE-2026-51990: Sogou Input Method Flaw Exploited in the Wild FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

CVE-2026-51990: Sogou Input Method Flaw Exploited in the Wild

Do Son September 14, 2026

At a Glance Security researchers at Gen Threat Labs discovered a critical remote code execution flaw in...

Conti ransomware developer sentenced for extortion and wire fraud

Conti Ransomware Developer Sentenced to Four Years in Prison

Do Son September 11, 2026

At a Glance Category Details Actor or Group Conti ransomware syndicate (Oleksii Lytvynenko) Activity Type Wire fraud...

Outsider Phishing Kit Survives Operation Ghost Hook Takedown Outsider Phishing Kit tracking panel and ChenLun Outsider PhaaS kit dashboard

Outsider Phishing Kit Survives Operation Ghost Hook Takedown

Do Son September 8, 2026

At a Glance Actor or group: Threat actor known as “ChenLun” and affiliated subscribers. Activity type: Phishing-as-a-Service...

Phantom Deal Scam Targets Executives With Fake NDAs Phantom Deal campaign document tracking diagram illustrating the Phantom Deal scam

Phantom Deal Scam Targets Executives With Fake NDAs

Do Son September 8, 2026

At a Glance Actor or group Unidentified cybercrime actors (dubbed Phantom Deal operators) Activity type Executive impersonation,...

Chinese Actor Gambling Goblin Hijacks Brazilian Gov Sites Gambling Goblin campaign targeting government servers with Gambling Goblin malware

Gambling Goblin campaign targeting government servers with Gambling Goblin malware

Chinese Actor Gambling Goblin Hijacks Brazilian Gov Sites

Do Son September 8, 2026

At a Glance Actor or group Suspected Gambling Goblin (linked to Earth Berberoka) Activity type SEO poisoning,...

Russian National Indicted in Freelance Malware Scheme A Russian national indicted for malware targeting freelance workers

Russian National Indicted in Freelance Malware Scheme

Do Son September 3, 2026

At a Glance Actor Searzhudin Tamirlanovich Aktulaev Activity Type Malware distribution, wire fraud, identity theft Targets Users...

Cisco Talos Exposes UAT-10147 Agentic AI Attacks Diagram showing UAT-10147 agentic AI attacks and automated intrusion workflows

Cisco Talos Exposes UAT-10147 Agentic AI Attacks

Do Son August 21, 2026

At a glance Factor Details Actor UAT-10147 (Suspected Chinese-speaking cybercrime threat group) Activity Type Search engine optimization...

Canadian Man Pleads Guilty to Cloud Hacking Extortion Scheme That Hit 165 Companies Cloud hacking extortion guilty plea over the Snowflake data breach affecting 165 companies

Cloud hacking extortion guilty plea over the Snowflake data breach affecting 165 companies

Canadian Man Pleads Guilty to Cloud Hacking Extortion Scheme That Hit 165 Companies

Do Son August 7, 2026

At a glance Actor Connor Riley Moucka, 26, of Kitchener, Ontario Activity type Cloud account intrusion, data...

DOJ Indicts Chinese National Over Gift Card Fraud Scheme in New Hampshire Gift card fraud conspiracy indictment tied to a wire fraud conspiracy charge and a New Hampshire electronics warehouse

Gift card fraud conspiracy indictment tied to a wire fraud conspiracy charge and a New Hampshire electronics warehouse

DOJ Indicts Chinese National Over Gift Card Fraud Scheme in New Hampshire

Do Son July 24, 2026

At a glance Actor Jinbin Ren, 38, a Chinese national who lived in Lynnfield, Massachusetts; co-conspirators unnamed...

GST Phishing Campaign Distributes Remcos RAT Malware DPRK IT Workers, APT38 Crypto Forfeiture

GST Phishing Campaign Distributes Remcos RAT Malware

Do Son July 23, 2026

Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase...

Mycelium Framework: First AI-as-a-Service Botnet TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Mycelium Framework: First AI-as-a-Service Botnet

Do Son July 13, 2026

At a Glance Malware Family: Mycelium Framework Threat Actor: Unknown (suspected underground developer) Targets or Victims: Enterprise...

Scattered Spider Arrest: Teen Extradited in $100M Scheme Scattered Spider arrest suspect Peter Stokes extradition

Scattered Spider Arrest: Teen Extradited in $100M Scheme

Do Son July 2, 2026

At a glance Actor or Group: Scattered Spider (Octo Tempest, UNC3944, 0ktapus) Activity Type: Data extortion, computer...

Cloud DNS Takeover Powers Thai Gambling Campaign hacking

Cloud DNS Takeover Powers Thai Gambling Campaign

Do Son June 23, 2026

At a Glance Actor: Suspected single Chinese operator Activity Type: Cloud DNS takeover, SEO poisoning Targets: 163...

Conti Ransomware Guilty Plea Marks Major Victory Against Cybercrime Conti ransomware guilty plea, ransomware attacks Deniss Zolotarjovs Sentencing Karakurt Ransomware Leader

Conti ransomware guilty plea, ransomware attacks Deniss Zolotarjovs Sentencing Karakurt Ransomware Leader

Conti Ransomware Guilty Plea Marks Major Victory Against Cybercrime

Do Son June 12, 2026

Recently, a major breakthrough occurred in the fight against global digital extortion. Following his extradition from Ireland,...

Sophisticated TA4922 Cybercrime Operations Expand Globally Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Sophisticated TA4922 Cybercrime Operations Expand Globally

Do Son June 9, 2026

The Rising Threat of TA4922 A prominent cybersecurity research group recently exposed a highly active threat cluster...

Romanian Hacker Sentenced to Prison Following Government Cyberattacks Romanian hacker sentenced identity theft conviction Pig-Butchering Crackdown Operation Level Up Oleksandr Didenko North Korean IT Workers Coinbase TaskUs insider breach, Hyderabad police Coinbase arrest Scattered Spider, Cybercrime Scattered Spider group

Romanian hacker sentenced identity theft conviction Pig-Butchering Crackdown Operation Level Up Oleksandr Didenko North Korean IT Workers Coinbase TaskUs insider breach, Hyderabad police Coinbase arrest Scattered Spider, Cybercrime Scattered Spider group

Romanian Hacker Sentenced to Prison Following Government Cyberattacks

Do Son May 29, 2026

A federal judge handed down a stiff prison term to an international cybercriminal yesterday. Specifically, a Romanian...

Critical Alert 1 Active Exploit Detected Today