Do Son The suspected administrator of xss.is, a notorious Russian-speaking cybercrime forum, has been arrested in Ukraine after a joint operation by French police and Europol.
Cybercrime
Greedy Sponge, a financially motivated group, is back with an upgraded AllaKore RAT and SystemBC, targeting Mexican organizations for banking credentials and financial fraud.
Group-IB exposes MaisonReceipts, a subscription service selling fake receipts for major brands via Telegram and TikTok, fueling widespread digital fraud.
A new ransomware, KAWA4096, combines features from Qilin and Akira, targeting organizations in the US and Japan with multi-threaded encryption and anti-recovery measures.
Operation Eastwood, a massive international effort led by Europol, has significantly disrupted the pro-Russian cybercrime group NoName057(16), known for DDoS attacks.
GLOBAL GROUP, a rebranded RaaS operation, is aggressively targeting critical infrastructure worldwide, leveraging AI chatbots for automated, high-pressure ransom negotiations.
The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.
A former US Army soldier, Cameron John Wagenius (kiberphant0m), pleaded guilty to hacking telecom companies, stealing data, and attempting to extort $1 million.
Russian basketball player Daniil Kasatkin was arrested in France on a US warrant for allegedly acting as a ransomware negotiator in attacks on 900+ organizations.
OFAC sanctioned Song Kum Hyok (Andariel) and others for orchestrating North Korea's remote IT worker scheme, which used stolen identities to fund DPRK weapons programs.
The DOJ unsealed an indictment against OmegaPro founders for a $650M global crypto Ponzi scheme. They face charges for defrauding investors with fake forex trading promises.
Chinese cybercriminals are escalating attacks on the Philippine financial sector, exploiting NFC technology and smishing to steal from mobile wallets, with a 230% surge in dark web activity.
Anatsa, an advanced Android banking trojan, is targeting North America via Google Play. It steals credentials and conducts remote fraud through disguised apps and overlay attacks.
The DOJ is criminally investigating a former DigitalMint ransomware negotiator for allegedly colluding with hackers and taking a cut of ransom payments, a betrayal of client trust.
A misconfigured Google Cloud Storage bucket belonging to CIEE exposed 248,725 sensitive Brazilian records, including medical reports and job videos, now published by data broker "888."
SCATTERED SPIDER targets U.S. airlines with ransomware, vishing, and VMware exploits—CrowdStrike warns of a rising threat across cloud identities.
A Chinese student was jailed in London for running a smishing campaign with an "SMS Blaster" hidden in his car, spoofing texts to steal data.
OFAC sanctioned Russia's Aeza Group, a bulletproof hosting provider, and its executives for enabling ransomware, infostealers (Meduza, Lumma), and darknet drug trafficking operations globally.
The DOJ dismantled a North Korean scheme exploiting remote IT jobs at 100+ U.S. firms, using stolen identities and laundering millions to fund DPRK weapons programs.
Nicholas Michael Kloster pleaded guilty to hacking organizations to promote his cybersecurity services, facing up to 5 years in prison for his illegal "self-promotion" tactics.
Proofpoint reveals two Russian threat clusters (TA829 & UNK_GreenSec) blending financial cybercrime with state-aligned espionage, using RomCom and TransferLoader malware.
The DOJ dismantled a North Korean scheme exploiting remote IT jobs at 100+ U.S. firms, using stolen identities and laundering millions to fund DPRK weapons programs.