Do Son India's DoT mandated SIM-binding for all messaging apps (WhatsApp, Telegram, Signal). Users must re-verify every six hours to combat cybercrime and cross-border fraud.
Cybercrime
Europol dismantled the centralized mixer CryptoMixer, which laundered over €1.3B in Bitcoin since 2016. Authorities seized three servers and confiscated more than €25M in digital assets.
Cybercriminals are using fake Battlefield 6 cracks and trainers to deploy infostealers. Avoid "InsaneRamZes" & "RUNE" torrents to protect your data.
Unit 42 reveals how malicious LLMs like WormGPT 4 and KawaiiGPT weaponize AI to automate ransomware and phishing, democratizing cybercrime for all.
Dutch police seized 250 servers from a bulletproof hosting provider (CrazyRDP) used by cybercriminals since 2022, facilitating over 80 cybercrime investigations.
Australia imposed sanctions and travel bans on four entities and one individual for engaging in cybercrime to fund North Korea's WMD and missile programs. The regime stole $1.9B in crypto in 2024.
OFAC sanctioned 8 individuals and 2 banks linked to North Korea for laundering millions in stolen crypto and IT earnings to fund Pyongyang's WMD and missile programs.
GreyNoise tracked a coordinated cryptojacking blitz exploiting PHP RCE flaws (CVE-2024-4577, ThinkPHP) to deploy miners on cloud infrastructure. The spike is driven by high Bitcoin prices.
Conti Ransomware Operator Oleksii Lytvynenko Extradited from Ireland to Face Federal Hacking Charges
Conti Ransomware Operator Oleksii Lytvynenko Extradited from Ireland to Face Federal Hacking Charges
Ukrainian national Oleksii Lytvynenko was extradited from Ireland for his alleged role in the Conti ransomware operation. The DoJ charges him with wire/computer fraud for extorting over $500,000.
Cisco Talos reports Qilin RaaS is one of 2025’s biggest threats (40+ victims/month), abusing Cyberduck and Backblaze for data exfiltration and exploiting WDigest to steal admin passwords.
A sophisticated Lumma Infostealer MaaS campaign targets users with pirated software installers. It uses NSIS/AutoIt scripts, Process Hollowing, and MEGA cloud to steal credentials from browsers and crypto wallets.
Resecurity exposed Qilin RaaS's reliance on bulletproof hosting (BPH) in Russia/HK. The same network was linked to the Asahi Group Holdings ransomware attack that stole 27 GB of data.
Huntress exposed a covert campaign using log poisoning on exposed phpMyAdmin to deploy a web shell and the Nezha monitoring tool, ultimately delivering the Ghost RAT backdoor to 100+ victims in Asia.
Cisco Talos exposed UAT-8099, a Chinese group compromising IIS servers for SEO fraud, using BadIIS malware and Cobalt Strike to steal credentials and manipulate search rankings.
Rhadamanthys stealer's v0.9.2 update adds new anti-analysis checks, a custom executable format, and uses noisy PNG files for payload delivery to bypass security tools.
The Detour Dog campaign is using DNS TXT records for stealthy C2, infecting thousands of websites and quickly shifting infrastructure to evade sinkholing efforts.
Russian-speaking Lunar Spider group is using the sophisticated Latrodectus V2 loader and a FakeCaptcha lure to gain initial access for ransomware operations.
Silent Push details how cybercriminals and APTs are misusing DDNS services for stealthy C2 servers, phishing, and malware delivery. Dozens of high-profile groups are involved.
The new infostealer Acreed is rapidly gaining market share post-Lumma takedown. It uses BNB Smart Chain and Steam profiles for C2, with a focus on crypto theft.
Olymp Loader, a new assembly-based MaaS, has emerged in underground markets. It's a turnkey solution for cybercriminals, with stealth and persistence features.
A new report shows LAPSUS$, Scattered Spider, and ShinyHunters have formed a collaborative alliance, sharing tactics like social engineering and MFA bypass to launch global attacks.
LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.