Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Crime. Show all posts
NFC Relay Attack
Bank fraud Contactless Payments Cyber Crime Dutch Police NFC Relay Attack

Dutch Police Arrest Two Over $400,000 NFC Relay Bank Fraud

 

Dutch police have arrested two men suspected of operating a sophisticated bank-fraud scheme that used NFC relay attacks to steal more than €380,000, approximately $425,600, from 170 victims. The suspects allegedly combined AI-generated robocalls, fake bank employees, and malicious mobile applications to trick people into exposing their contactless debit-card data. The arrests highlight how criminals are adapting near-field communication technology, which is designed for convenient tap-to-pay transactions, into a tool for remote account theft. 

According to Dutch authorities, the scam began with automated calls that used AI-generated audio to impersonate banks, companies, or other trusted organizations. Victims were told that suspicious activity had been detected on their accounts and were asked to press “1” if they were not responsible. Once the victim responded, the call was transferred to a suspect posing as a bank employee, who claimed that the person’s debit card had been blocked and needed verification. 

The fraudsters then instructed victims to download an application and hold their debit card against their phone. Rather than simply verifying the card, the app extracted data from the card’s NFC chip, which supports contactless payments. That information was relayed in real time to an accomplice waiting at an ATM, who used it to withdraw money from the victim’s bank account. This technique is known as an NFC relay attack because it effectively extends the card’s contactless signal across a distance. 

Police arrested a 23-year-old man from Vaassen and a 25-year-old man from Ede on October 6. Investigators believe the younger suspect likely built the technical infrastructure behind the operation and orchestrated the attacks, while the second suspect played a coordinating role. Authorities also took the criminals’ servers offline and seized them, along with phones and laptops believed to be connected to the scheme. Both men remain in custody while the investigation continues. 

The case is a warning that a phone call claiming to be from a bank should never be treated as proof of identity. Genuine banks generally do not ask customers to install unknown apps, scan their cards against a phone, or share one-time codes. Consumers can reduce their risk by hanging up and calling their bank using the number on the official website or card, avoiding app downloads from unsolicited calls, and treating any request to tap a payment card on a phone as a major red flag.
Read more »
Telegram
AI Attacks BYOVD CloudFlare Cyber Crime Data Extortion DNS Ransomware SOCRadar Telegram

Ransomware Affiliates Built an AI-Powered Attack Platform That Logged Its Own Crimes

 



An operational security slip by affiliates of two ransomware groups left a server exposed long enough for researchers to pull 8,257 AI-generated messages documenting how the operators ran intrusions, negotiated ransoms, and managed their victim pipeline. The logs, recovered from a directory at IP address 45.227.254.43, form one of the most detailed windows into how criminal groups are now deploying artificial intelligence to execute attacks at scale.

The research, published by SOCRadar, links the activity to affiliates of INC ransomware and The Gentlemen, a data extortion group. Analysts assess the operators are Russian-speaking and function both as an intrusion team and as an infrastructure provider, leasing out their toolkit to other ransomware partners.


The Framework Behind the Operation

At the center of the operation sits a custom platform called Phantom, described in its own documentation as an "Autonomous Red Team Kill Chain Framework." The tool ships with 18 skill modules, a routing engine, an autopilot orchestrator, and agents written in Python and Go. It connects to OpenCode, which lets the AI select attack techniques and assign tasks to remote agents. On victim machines, those agents masquerade as Windows Update components and phone home to a domain linked to the operation.

To run the AI components, operators routed prompts through OpenRouter, a commercial model aggregator, using legitimate AI models including Anthropic's claude-opus-4.6 and Moonshot AI's Kimi-K3. When models declined to help with a specific task, operators did not switch tools. They reframed the request as an "Authorized Red Team Assessment Request" and resubmitted it. That workaround appears frequently across the 133 recorded sessions.

Alongside Phantom, the group built WormGPT-MCP, a layer of 32 Model Context Protocol servers that tie the AI to purpose-built tools covering everything from reconnaissance to ransom negotiation. A partner guide found on a second server advertised "55+ tools" and access to more than 9,000 proof-of-concept exploits. The name WormGPT refers to a persona prompt layered over commercial models, not a separate AI system.

For persistence and communication, the group used Ghost C2, a family of three generations of polymorphic implants that route traffic through Cloudflare, Telegram, or DNS to avoid network-level detection.


How They Got In

The operation targeted exposed edge devices and widely used IT management software. Three vulnerabilities drove confirmed access: CVE-2024-57727, a path traversal flaw in SimpleHelp, gave the group admin passwords from 427 servers after scanning nearly 5,000; CVE-2026-35616, an authentication bypass in FortiClient EMS, allowed operators to create backdoor admin accounts across more than 4,000 managed endpoints; and CVE-2026-41940, an authentication bypass in cPanel and WHM, was used to reach small hosting providers and their clients' email servers.

Credential reuse turned single points of access into full-network compromises. In at least one documented case, a single reused password opened the door to a VPN, several servers, a remote management platform, backup infrastructure, and the organization's security management tools. To suppress endpoint detection tools, operators deployed a driver-based EDR killer that abused a vulnerable Zemana driver, a technique known as Bring Your Own Vulnerable Driver.


The Victim Picture

Researchers identified 62 named organizations in the operational logs, with 36 located in the United States. Industrial, manufacturing, and energy firms made up the largest share of targets at roughly 16 percent. Healthcare and pharmaceuticals came in second at about 14.5 percent. Most targeted companies were smaller businesses, with 27 of 35 classifiable organizations reporting revenue below $250 million. Some were reached indirectly through a managed service provider whose admin credentials had been stolen.

Four organizations ended up listed on public leak sites. The operation's timeline runs from mid-July 2026 through a live encryption event on September 30, 2026.


Extortion by the Numbers

The playbook prioritized data theft over encryption. Operators sifted through stolen financial records to gauge what a victim could pay, then opened contact with a text-only email carrying no ransom figure. Pressure escalated through scripted vishing calls, threats to notify customers and regulators, and hard deadlines of 24 to 72 hours before publication. Payment was planned in Monero, though researchers found no wallet or confirmed transaction records.

Demand figures from recovered case files show the range of the operation. A EUR 15 million demand sent to a company called Aidon was later revised down to EUR 4 million after the operators realized they had compromised the wrong parent company. A healthcare network in Australia received demands between AUD 3 million and AUD 8 million. The Gentlemen's communications to Leo Schachter Diamonds included a four-message sequence and a vishing plan. For Trulite Glass and Aluminum, the group set up a look-alike domain, trulitesupport[.]com, to warn the company's own customers about the breach.

Total spending on the operation's infrastructure is estimated at just under $24,000.



Read more »
Online Fraud
Africa Cybercrime Crackdown Cyber Crime CyberCrime Cybercrime Arrests Cybercrime Investigation INTERPOL Cybercrime Operation Online Fraud

Africa-Wide Cybercrime Operation Recovers More Than $105 Million


During an international cybercrime operation coordinated across 21 countries, INTERPOL has arrested 1,462 suspects and disrupted 10,909 malicious networks. Operation Serengeti III also resulted in the recovery of more than $105 million in illicit funds. 

During the crackdown, which took place between June 29 and August 31, 2026, ransomware, online scams, business email compromises, digital extortion and other cyber-enabled financial crimes were targeted. An investigation conducted by INTERPOL identified 65,929 victims connected to criminal networks. Financial investigations indicated that an amount of $385 million was lost as a result of the activity. 

Law enforcement agencies from Nigeria, Uganda, Angola, Kenya, South Africa, Ghana, Tanzania, and the Democratic Republic of Congo were involved in the operation along with the United States and other participating nations. 

The private sector also contributed intelligence on threat intelligence and criminal infrastructure, and Group-IB, one of the participating private-sector partners, provided information about phishing kits, botnets and malicious resources that were hosted in Africa or targeted at the region. This information provided investigators with information about infrastructure supporting cyberattacks and the individuals responsible for operating them.

Fraud Networks and Illegal Crypto Mining Targeted

Authorities in Uganda detained 365 foreign nationals suspected of being connected to two transnational fraud networks, which was one of the largest arrest figures in the operation. A number of online investment schemes and pension scams targeting Asia were linked to these groups.

Investigators discovered schemes which involved call centres, fraudulent websites, and fake trading platforms, attempting to persuade victims to invest in unreal projects. Several illegal cryptocurrency mining facilities in Angola have been dismantled and nine suspects have been arrested. 

Investigators have seized over 2,000 cryptocurrency mining devices and six illegal power transformation stations. Approximately $1 million was spent on electrical equipment, which underscores the substantial infrastructure and resources involved in these illegal mining operations. The investigation also included Nigeria, where authorities arrested a suspect allegedly implicated in an extensive phishing and business email compromise operation. 

According to the report, the activity involved the collection of software credentials as well as approximately 2.1 million email addresses. A separate case involved the arrest of another Nigerian suspect related to international investment fraud schemes promoted using messaging applications. The investigation identified a total of more than $2.4 million in suspected criminal proceeds, of which a substantial portion was reportedly laundered by cryptocurrency exchanges. 

INTERPOL Warns of Rising AI-Enabled Cybercrime in Africa

An increase in concerns over the changing cyber threat landscape across Africa has led to this operation. According to Interpol's African Cyber Threat Assessment Report 2026, artificial intelligence is increasingly being used in cybercrime as well as the number of financial losses resulting from digital crimes continues to rise.

In advance of Operation Serengeti III, investigators from 20 African countries and the United States received information regarding suspicious domains, IP addresses, and command-and-control infrastructure associated with criminal activity. In addition to identifying malicious resources, tracing connections between criminal networks, and targeting suspected perpetrators, these details also helped authorities identify suspicious individuals. 

A number of private-sector companies were involved in the operation, including Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security and Meta, which provided threat intelligence, technical analysis and investigative expertise. Additionally, the initiative was supported by the Global Anti-Scam Alliance, Cybercrime Atlas and Zimbabwe’s Postal and Telecommunications Regulatory Authority. 

The Director of Cybercrime for INTERPOL, Neal Jetton, noted that international cooperation is imperative as criminal organizations continue to operate across international borders and use technology to target victims in greater numbers. By conducting coordinated investigations, we were able to disrupt these networks, recover criminal assets, and reduce the damage caused by cybercrime. 

A number of investigations associated with the crackdown remain ongoing. Authorities continue to investigate digital evidence seized, trace suspected criminal proceeds, and identify additional individuals associated with these networks. During the previous phases of Serengeti III in September and October 2024, as well as June and August 2025, more than 2,000 arrests were made. 

Further highlighting the importance of cross-border intelligence sharing and cooperation between law enforcement agencies and cybersecurity firms, the latest operation demonstrates how organized crime can be combatted through cross-border intelligence sharing and cooperation.

Read more »
Tax fraud
Cyber Crime Identity Theft Investment Scam Tax fraud

Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft

 

A Nigerian man has been sentenced to eight years in a U.S. prison for his role in wide-ranging hacking, tax fraud, identity theft, and investment fraud schemes. Chukwuemeka Victor Amachukwu, also known as “Chukwuemeka Victor Eletuo” and “So Kwan Leung,” pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud. The sentence was announced by the U.S. Attorney’s Office for the Southern District of New York on October 19, 2026. 

According to U.S. prosecutors, Amachukwu and Nigeria-based co-conspirators began targeting U.S. tax preparation businesses around 2019. They used spearphishing emails to gain access to the companies’ electronic systems, then stole tax and identity information belonging to at least about 800 customers. The affected businesses were located in New York, Texas, and other U.S. states. 

The stolen data was allegedly used to file fraudulent tax returns with the Internal Revenue Service and state tax authorities. Prosecutors said the group sought fraudulent refunds of at least approximately $8.4 million and successfully obtained at least $2.5 million. The conspirators also used stolen identities to submit fraudulent claims under the Small Business Administration’s Economic Injury Disaster Loan program, receiving about $819,000 in additional payouts. 

Amachukwu was also accused of participating in a separate investment fraud scheme. Prosecutors said he posed as a wealthy overseas financier to persuade U.S. victims to invest in purportedly valuable standby letters of credit. The investments did not exist, and Amachukwu and his co-conspirators allegedly pocketed more than $7 million in fraudulent proceeds. 

In addition to the eight-year prison term, the 40-year-old was sentenced to one year of supervised release. He was ordered to pay $3,647,629.39 in restitution and forfeit $10,846,634.39. U.S. Attorney Jamie McDonald said the case demonstrated that offenders cannot assume they can operate safely from abroad, while the FBI was credited for its investigative work.
Read more »
supply chain attacks
cloud backup ConnectWise Cyber Crime IP Address Microsoft 365 supply chain attacks

Compromised ConnectWise OAuth App Exposes Over 170 Microsoft 365 Tenants in Supply Chain Attack

 




A compromised credential tied to a ConnectWise cloud backup application has allowed threat actors to access more than 170 Microsoft 365 environments managed by the company's partners and customers, with security researchers and Microsoft all tracking what they describe as an active supply chain attack.

The affected application, ConnectWise Cloud Backup, was formerly known as SkyKick before ConnectWise acquired it. The tool is designed for managed service providers (MSPs) and handles backup duties across Microsoft 365 and Google Workspace environments, covering mailboxes, OneDrive, SharePoint, Teams chats, and directory data for every tenant where it is installed. That built-in breadth of access is precisely what made the compromise so damaging.

Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants. Researchers traced the suspicious activity to a single IP address, 144.172.64.128, which obtained tokens on October 15, 2026, between 6:13 and 8:34 UTC. The movement across tenants was methodical: the actor worked through environments in sorted GUID order, hitting each one a few seconds apart, a pattern consistent with an automated script running through a pre-built target list. Before that, the same IP address was used to password-spray four law firm tenants on October 13 and 14, though no successful user sign-ins were logged during that activity.

The attack went further than reconnaissance. In at least one partner tenant, a separate ConnectWise application called Cloud Management for Teams elevated itself to the Global Administrator role. From there, the actor added client secrets to an MSP management app and to Huntress's own app, using a Python-urllib/3.12 user agent. That kind of credential insertion is a classic backdoor move, designed to maintain persistent access even after the initial intrusion is addressed.

Huntress also noted that some of the access, particularly directory reads through Microsoft Graph, does not generate an audit trail, which complicates the task of establishing the full scope of what was seen or copied.

Security company Todyl, which also investigated the activity, pointed out that the inherited consent model made the damage difficult to contain quickly. Because the Cloud Backup application had been granted permission by tenant administrators, it could read and write to mail via Exchange Web Services, access OneDrive and SharePoint files, and reach Teams chats, including restoration capabilities. Revoking user sessions had no effect on the attack, since the access did not depend on user sign-ins. Disabling the application entirely stops new tokens from being issued, but tokens already in circulation remain valid for up to 90 minutes.

Microsoft confirmed it is tracking the campaign as an active supply chain attack, identifying it by the Cloud Backup application's OAuth App ID (506e08f9-6e9a-4da4-942b-a099a03644ae). The company said the actor likely abused Directory.ReadWrite.All permissions granted by customers, and observed follow-on activity including Graph API reconnaissance and attempts to add credentials to service principals as a persistence mechanism.

ConnectWise responded by shutting off Cloud Backup application access entirely and stated it found no evidence that partner backup data stored within the platform was copied or exfiltrated.

For organizations trying to determine whether they were affected, the key step is checking service principal sign-in logs in the Entra Admin Center, filtered by the Cloud Backup App ID. The default User sign-ins tab will not show this activity. Administrators should flag any sign-ins originating from IP addresses outside expected Microsoft or Azure ranges, since the application's normal outbound traffic uses Azure private IPv6. A full audit of any credentials added to applications since October 13 is also recommended, along with a review of Entra audit logs for any ConnectWise or SkyKick apps that added themselves to directory roles.

The ConnectWise incident surfaced alongside a separate supply chain campaign reported by Google Mandiant, Google Threat Intelligence Group, and ManageEngine Threat Analysis Lab. That operation, attributed to a previously undocumented threat cluster called UNC7017, repeatedly tampered with update servers belonging to backup software maker AOMEI. Between April and July 2026, attackers redirected downloads to malicious ZIP packages during short five-to-ten-minute windows. The payloads included a downloader called CROSSROAD and a modular backdoor named SHINYROAD, deployed through DLL sideloading. The campaign hit organizations in IT services, telecommunications, and higher education across roughly 11 countries, including the United States, Brazil, India, and Spain.

Together, the two incidents reinforce a pattern security researchers have flagged for years: backup tools and management platforms carry privileged access across dozens or hundreds of environments simultaneously, making them attractive targets for attackers looking to move laterally at scale without touching endpoint defenses.



Read more »
OLVX
Cyber Crime Data Theft FBI North Macedonia OLVX

FBI and North Macedonia Arrest Alleged OLVX Market Operator

 

Authorities in North Macedonia have arrested and charged the alleged administrator of OLVX, an underground cybercrime marketplace accused of selling stolen personal data, login credentials, and tools used in cyberattacks. The operation was conducted jointly by North Macedonia’s Ministry of Interior and the U.S. Federal Bureau of Investigation (FBI), marking what officials describe as the first coordinated cyber operation between the two countries. The suspect, identified only by the initials E.A., is a 20-year-old man from Golema Rečica near Tetovo. 

According to investigators, OLVX operated from 2023 to 2025 and became a popular platform for criminals seeking access to compromised accounts and digital identities. The marketplace allegedly allowed more than 1,500 seller accounts to offer victims’ personally identifiable information and login credentials. Officials said the site also facilitated the sale of phishing kits, remote desktop access, stolen data, and other resources used to launch cybercrimes. 

The investigation began after the FBI supplied intelligence to North Macedonian authorities. Police later raided the suspect’s home and seized devices for forensic examination. Earlier action against the platform reportedly uncovered a server database containing more than 2,600 customer accounts, while illicit sales were estimated to have exceeded $500,000. The charges against E.A. include computer fraud, misuse of personal data, and the production and distribution of child sexual abuse material.

Authorities also linked the suspect to ONEMILI, a Telegram group allegedly used to advertise software and services for cybercrime, including fraudulent refund schemes. The FBI said the marketplace directly endangered the digital security of thousands of people in the United States by making stolen account credentials and personal information available to criminals. The case underscores how underground platforms can connect data thieves, fraudsters, and attackers across borders. 

The arrest sends a strong signal that international law enforcement is increasingly targeting the infrastructure behind cybercrime rather than only individual attacks. It also highlights the importance of strong account security: users should enable multi-factor authentication, use unique passwords, avoid reusing credentials, and monitor accounts for unauthorized activity. While the charges remain allegations until tested in court, the takedown of OLVX represents a significant blow to a marketplace that allegedly enabled large-scale identity theft and fraud.
Read more »
Sextortion
Blackmail Cyber Crime DFC FTC Sextortion

Company Accused of Making $60 Million by Exploiting Sextortion Victims


A US-based digital forensics company is facing allegations that it collected at least $60 million from people seeking help with sextortion threats but failed to provide the assistance it promised. 

According to a complaint filed by the US Federal Trade Commission (FTC), Digital Forensics Corporation (DFC), its owner Dmitry Belkin, and associated businesses allegedly misled victims who were already experiencing fear, emotional distress, and threats of having private images exposed.

Scam details

According to the FTC complaint, DFC collected at least $60 million between February 2023 and July 2026. The company allegedly charged customers between $1,499 and $20,000 for services advertised as helping identify blackmailers, stop threats, and support investigations.

The complaint claims that the company misrepresented its investigative capabilities and the results it could achieve. Among the allegations is that DFC used fabricated investigative chat transcripts to make customers believe its investigators were actively communicating with suspected criminals.

The FTC also alleges that the company reused location information to create the impression that it had successfully tracked down perpetrators. Such tactic could lead customers to believe that meaningful investigative work was being conducted when the evidence presented to them did not support those claims.

Besides this, the complaint argues that customers were pressured into purchasing extra services. The company reportedly used positive reviews that were not genuine to strengthen its reputation and made obtaining refunds difficult for dissatisfied customers. 

“Instead of communicating with the sextortionist through the victim's account, defendants routinely change the victim's account settings simply to block the sextortionist's communications. Instead of obtaining investigative information, defendants fabricate chat transcripts,” the complaint said.

FTC’s response

According to the complaint, “Defendants falsely portray themselves as digital forensics experts, claiming they can track and identify sextortionists, prevent the spread of explicit material and coordinate with law enforcement to bring criminals to justice."

The FTC filed a lawsuit against DFC, Belkin, and several affiliated companies, accusing violations of consumer protection laws. A federal court temporarily halted the company's operations while the legal case proceeds. The agency is seeking action against the alleged deceptive practices.

The FTC also reported that the company advertised its services through search engines, video-sharing websites, and social media platforms, potentially reaching people actively searching for urgent help. 

Read more »
Workplace Surveillance
AI Security Confidential Data Protection Corporate Espionage Cyber Crime Hidden Recording Device Insider Threat OpenAI Employee Arrest OpenAI Security Incident Workplace Surveillance

OpenAI Employee Arrested Over Hidden Recorder Allegations


In connection with the arrest and prosecution of an employee of OpenAI, it has been claimed that a recording device was allegedly placed in an executive conference room at the company's San Francisco headquarters. This device was reportedly intended to record confidential discussions regarding the company's artificial intelligence research and strategic plans. 

As a result of the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national, on October 9, 2026, his position has been terminated. A federal charge has been filed against him by the U.S. Department of Justice (DoJ) for using or attempting to use an electronic or mechanical device to intercept oral communications. He joined OpenAI in July 2025 and worked on its product team. 

In the executive conference room, OpenAI personnel discovered a hidden audio recording device connected to a USB port behind a television on September 30, causing an alarm to sound. During the period of September 28 to December 31, the device was installed and wrapped in toilet paper to conceal it, according to the complaint.

The room was regularly used to hold executive meetings related to highly confidential technical, commercial, and strategic matters. This information included proprietary research, product development plans, business opportunities, government engagements, and information concerning the company's artificial intelligence progress. The investigation also included review of office surveillance footage that showed Alfozan near the conference room several times before the device was discovered.

According to the complaint, he did not play any part in the meetings in which the device was discovered. As a result of the investigation, the investigation has also allege that later he returned to the room and observed the recording device behind the television. Furthermore, Alfozan is accused of using a workplace productivity tool to gather information about OpenAI's offices, conference rooms, meeting schedules, and room capacity before the device was installed, according to the FBI complaint. 

The searches reportedly included information about leadership meetings as well as sessions involving external partners, raising questions regarding potential attempts to identify opportunities for recording confidential conversations. As part of the investigation, investigators examined prompts submitted via an account associated with Alfozan's spouse's chatbot.

According to the account, between September 24 and 30, it was allegedly used to obtain information about building and configuring audio recorders, setting up Wi-Fi, enabling live audio monitoring, encrypting stored data, and remote access to the device. According to the complaint, the chatbot account shares identifiers and other attributes with Alfozan's own account. 

A second recording device was allegedly discovered on October 5, when OpenAI's security personnel inspected an unattended bag left in another room of the company's building. Among the items in the bag are Alfozan's wallet and identification as well as a device similar to that found in the executive conference room. 

A surveillance video was also allegedly captured by investigators capturing him checking behind the television, where the first device had been placed. OpenAI reported that the recording device had encryption capabilities, audio monitoring capabilities, and an encrypted data transfer mechanism for avoiding detection. 

Following the analysis of the device by internal AI models and the identification of the employee who allegedly perpetrated it, the company referred the case to the FBI. Even though the allegations were somewhat serious, OpenAI stated that there was no evidence that Alfozan improperly accessed or removed model weights, source code, or customer data. Security measures provided by the company were intended to address threats ranging from insider threats to cybercriminals and nation-state actors. 

As a result of his arrest, Alfozan appeared in federal court and is facing the possibility of five years in prison, a $250,000 fine, and a three-year probation period. Unauthorized recording of confidential technical developments and business strategies can expose confidential information even without direct access to the digital systems, as outlined in the investigation of the risks posed by insider threats at organizations engaged in sensitive AI research. 

Those organizations developing advanced artificial intelligence technologies should take precautions against insider threats, maintain workplace security controls, and protect confidential information. This case is currently being investigated, and the allegations have not yet been proven in court.
Read more »
YMCO
Cyber Crime money laundering money mule russia YMCO

Ukrainian-Russian Dual National Behind 15,000-Mule Money Laundering Ring Pleads Guilty in North Carolina




A Ukrainian-Russian dual national who spent years overseeing one of the most operationally sophisticated money laundering rings in recent cybercrime history pleaded guilty last Thursday in a federal court in North Carolina, admitting to routing stolen funds through tens of thousands of ordinary Americans before shipping the cash to criminal operatives in Eastern Europe.

Oleg Korniev, 42, was a principal at Your Mule Cashout, or YMCO, a criminal outfit that ran from September 2007 through 2014 and maintained a network of more than 15,000 money mules across the United States. The plea came roughly a decade after a grand jury first indicted him, and about 10 months after U.S. authorities caught up with him and arrested him in North Carolina in December 2025.


Not a side player

Federal prosecutors did not describe Korniev as a peripheral figure. He managed YMCO's daily operations, hired and fired staff, and handed out rewards or penalties depending on performance. He also helped design the procedural framework that kept the organization functioning across multiple countries simultaneously.

YMCO's approach was simple in concept but deliberately layered in practice. The group posed as legitimate staffing or payment-processing companies and sent spam emails to Americans advertising open positions. What followed was a carefully staged recruitment process built to look real: job applicants went through an employment test, reviewed a contract, and were walked through what appeared to be standard company policy. They were then asked to upload their bank details to a fictitious company website and told their job was to receive payments into their personal accounts and wire the money to company accounts overseas.

The money they were receiving was stolen. Hackers had broken into U.S. bank accounts using malware, funneling the proceeds into the mules' accounts and relying on those individuals to move the funds out of the country before anything flagged.


How the cash moved

From the mules' accounts, the money traveled through Western Union and MoneyGram to what YMCO called "cash-out contractors" in Moldova, Ukraine, Russia, and Latvia. These operators received a cut of each transfer for their role and passed the remainder back to the organization. Running stolen money through a human relay network like this put distance between the hackers and the funds, making the trail harder to reconstruct.

According to court documents, YMCO processed more than $10 million drained from over 750 U.S. bank accounts across more than 35 financial institutions. The group also ran parallel schemes in Germany, Italy, the United Kingdom, and Australia. Korniev's plea agreement put total actual and intended losses to confirmed victims at more than $14.7 million. He personally admitted to laundering at least $7 million of the $9.7 million he received from cybercriminals as payment for YMCO's services.


A decade-long chase

Korniev was originally indicted alongside Serghei Ivanovich Tomuz, a Moldovan national who allegedly ran YMCO's cash-out operation inside his home country. Tomuz was reportedly detained at a Romanian border crossing in May 2022 and spent years fighting extradition to the United States. His case was ultimately terminated in U.S. federal court this past May.

Four other Ukrainians tied to YMCO were arrested abroad years earlier, extradited to the Western District of North Carolina, and pleaded guilty to conspiracy to commit money laundering. Sentenced in 2018, they received prison terms ranging from 37 to 63 months and were each ordered to pay more than $9.1 million in restitution to American victims.

Korniev now faces a minimum sentence of two years and a maximum of 50 years after pleading guilty to money laundering, aggravated identity theft, conspiracy to commit money laundering, conspiracy to commit computer fraud, and conspiracy to commit access device theft. His plea agreement includes a commitment to fully repay confirmed victims for their documented losses.


What prosecutors want criminals to understand

Assistant Attorney General A. Tysen Duva made the department's position on mule networks clear. "Money mules play crucial roles in cybercrime, so the Justice Department pursues mules and their recruiters wherever they operate and however long it takes," Duva said.

The case puts into focus how money mule operations function as the financial plumbing beneath large-scale cybercrime. Without them, proceeds from bank fraud and account takeovers would be far harder to extract without triggering detection.

That infrastructure is a recurring target for law enforcement. Five years ago, Europol announced that authorities from 27 countries had arrested 1,803 money mules out of 18,351 identified as part of a coordinated crackdown called the European Money Mule Action, or EMMA. Europol has consistently flagged that criminal groups recruit mules from vulnerable populations, specifically students, immigrants, and people facing economic pressure, using job ads on social media and employment sites that look entirely legitimate.

Many mules sign up without understanding what they are walking into. Others are coerced. In either scenario, courts have made clear that receiving and wiring stolen money is not a protected form of ignorance.



Read more »
Privileged Access Abuse
Bitcoin Ransom Demand Cyber Crime Cyber Extortion Daniel Rhyne industrial cybersecurity Insider Threat Network Sabotage Privileged Access Abuse

Engineer Jailed Over Insider Cyber Extortion Plot Against Industrial Firm


The former infrastructure engineer was sentenced to 32 months in federal prison for sabotage of his employer's computer network and for demanding a ransom of $750,000 in Bitcoin from his employer. 

According to the US Department of Justice (DOJ), Daniel Rhyne, 59, was convicted of extortion involving threats to damage protected computers and intentional damage to protected computers. Rhyne was previously employed as a core infrastructure engineer with a Somerset County, New Jersey industrial company. 

Providing services across various sectors, the company specializes in manufacturing, healthcare, biopharmaceuticals, electronics, energy and industrial processing. Rhyne is alleged to have prepared a coordinated disruption in November 2023 by using his privileged access and knowledge of the company's network. 

An alternative to conventional ransomware was used in this attack, which involved scheduled tasks that removed administrator accounts and changed passwords across the entire organization's systems and could have prevented employees from accessing critical information. 

Attack Disrupted Administrative Access

A court document indicates that Rhyne set up scheduled tasks on the domain controller to delete 13 domain administrator accounts and change the passwords of 301 domain users. Two additional tasks were also performed on November 25, 2023, to target two local administrator accounts related to 254 servers and two others affecting 3,284 workstations. 

Among the changes was a security threat that threatened the availability of a large number of devices across the network, as well as the locking of administrators and other employees out of company systems and data. Select employees received an email extortion request from an external address with the subject line "Your Network has been breached" approximately one hour after scheduled tasks had been executed. 

According to the message, administrator accounts were revoked, backups were removed, and administrator accounts had been deleted or locked out. Rhyne also threatened to shut down 40 servers randomly each day for ten days if the company did not meet its ransom demand. In this email, Rhyne demanded 20 Bitcoin, which was approximately $750,000 at the time. This incident demonstrated that access to administrative systems can be abused to disrupt an organization without the use of traditional file-encrypting malicious code. 

Due to the attacks targeting accounts, passwords, and server access, the company was unable to manage its own IT environment and maintain normal business operations as a result of the attacks. 

Investigation Leads to Arrest and Prison Sentence

In response to the discovery of suspicious network activity, the company launched an internal forensic investigation. Investigators analyzed system logs and compared them with physical access records in order to determine the source of the changes. As a result of the FBI investigation, the activity was traced to the residential IP address of Rhyne in Warren County, New Jersey, which was associated with Rhyne. 

A criminal complaint was filed on August 8, 2024 by FBI Special Agent Timothy Lee in response to the findings. Rhyne was arrested on August 27, 2024, in Kansas City, Missouri, following his relocation to the area. He pleaded guilty to the charges on April 1, 2026, in federal court in Trenton, New Jersey, before US District Judge Michael A. 

On September 28, 2026, Shipp delivered the 32-month prison sentence. An employee with extensive administrative privileges poses substantial security risks. While outsider attacks tend to exploit software vulnerabilities or steal credentials from external users, insider attacks are capable of exploiting legitimate access to disrupt a wide range of systems. 

Security teams may struggle to regain control of critical systems when mass password changes and administrator account deletions occur. By restricting access to privileged accounts, monitoring unusual account activity, and maintaining backups that are protected from production network access, similar incidents may be reduced. 

It is also crucial to review and revoke access as soon as your employment responsibilities change to minimize the risk of deliberate misuse. This case illustrates the risks associated with insider threats and improper use of privilege. A strong access control system, continuous monitoring, as well as secure backups are essential to safeguarding critical business systems from intentional attacks.

Read more »
spyware
Apple California Cyber Crime iCloud Lawsuits NSO Group pegasus spyware

California Court Dismisses El Faro Journalists' Pegasus Spyware Lawsuit Against NSO Group for Second Time

 



A California federal judge has once again dismissed a lawsuit brought by journalists from Salvadoran investigative outlet El Faro against NSO Group, the Israeli company behind the Pegasus spyware allegedly used to surveil their phones for nearly two years. The ruling, issued Wednesday, marks the second time the case has been thrown out on jurisdictional grounds, though the journalists' legal team at the Knight First Amendment Institute at Columbia University has said it intends to appeal.

The case, Dada v. NSO Group, was the first lawsuit against NSO filed in any U.S. court when the Knight Institute took it on in November 2022 on behalf of 18 current and former El Faro journalists and staff. Between June 2020 and November 2021, Pegasus spyware was deployed against the outlet's employees at least 226 times, according to the Institute. Digital forensic analysis eventually confirmed that 22 members of El Faro's staff had their phones infected. The attacks were not random. Surveillance peaked during significant political moments and in the run-up to major investigations, including reporting on the Bukele administration's secret negotiations with criminal gangs, the theft of pandemic food relief, back-channel Bitcoin dealings, and the financial holdings of government officials.

The lead plaintiff, Carlos Dada, is the co-founder and director of El Faro, one of Central America's most prominent independent news organizations. El Faro was founded in El Salvador in 1998 and has built a reputation for independent investigative reporting. The outlet has paid a steep price for that journalism. Beyond the spyware attacks, El Faro says it has faced physical surveillance, advertiser harassment, and public defamation from government officials and ruling-party legislators. In 2023, the newsroom relocated its administrative and legal operations out of El Salvador entirely.

The core question before the court was whether Northern California was the right place to try this dispute. Dada and the plaintiffs argued it was, pointing to compromised U.S.-based infrastructure that was used as part of the attack chain. The judge was not persuaded. The court noted that there was no allegation Apple's California servers were actually exploited in delivering the Pegasus infections, even where the plaintiffs alleged the attacks moved through Apple's iMessage or iCloud systems. The same argument had failed once before: in March 2024, a California federal judge threw out the same lawsuit, saying the case was "entirely foreign" and that the journalists had no standing to sue in the U.S.

That first dismissal did not hold. The Ninth Circuit Court of Appeals reversed the March 2024 ruling in July 2025 and sent the case back to the Northern District of California, finding that the lower court erred in its analysis. The Ninth Circuit had concluded that the district judge failed to properly account for allegations that NSO created Apple ID accounts and engaged with California-based servers as part of the attack infrastructure. One factor that also came into play was a recent acquisition of NSO Group by a group of American investors, which El Faro's lawyers cited as further reason for trying the case on U.S. soil. After the Ninth Circuit's reversal, Dada called the outcome "good news." That window has now closed again.

The journalists had wanted specific remedies from the court. They asked the court to require NSO Group to identify, return, and delete all information obtained through the attacks, to prohibit the company from deploying Pegasus against them again, and to name the government client that commissioned the surveillance. That last demand was perhaps the most politically charged. NSO has never publicly identified its clients. The company maintains it sells Pegasus exclusively to government agencies for use against criminals and terrorists, subject to Israeli government authorization. El Salvador's government has repeatedly denied being an NSO client or playing any role in the surveillance.

With Apple having dropped its own case against NSO in September 2024, and WhatsApp having won a $167 million judgment against the company earlier in 2025, the El Faro lawsuit had become the last active case against NSO Group in U.S. courts. That distinction is now moot, at least temporarily.

The Knight First Amendment Institute plans to appeal. El Faro's director Carlos Dada said when the original lawsuit was filed that the outlet turned to the U.S. court system because justice in El Salvador was not possible. With the case now dismissed a second time and the appeal road still open, that search for accountability continues.

NSO Group did not respond to a request for comment.



Read more »
ShinyHunters Hacker
Cyber Crime Cyber Extortion Data Theft FBI Cybercrime Investigation Hacker Arrest Saif Al-Din Khader ShinyHunters ShinyHunters Hacker

ShinyHunters Hacker Reportedly Detained as FBI Seeks Cooperation


The FBI has reportedly detained a suspected ShinyHunters member known online as “Rey” and is cooperating with the government. Jordanian authorities captured a suspect identified as Saif al-Din Khader this week. According to two sources cited by Reuters, Khader is helping U.S. and international investigators identify other members of the hacking group. 


It is believed that Khader's cooperation will provide investigators with information regarding the group's activities and alleged co-conspirators, according to a source. He has shown investigators his electronic devices and digital communication to help locate other suspected members. The FBI has not responded to Khader's reported detention specifically, however it has stated that it is continuing to investigate the recent cyber incident allegedly involving ShinyHunters and is collaborating with international partners to resolve the matter. 

A series of law enforcement actions targeting individuals affiliated with ShinyHunters has led to this reported detention. Dutch authorities arrested a 24-year-old man in connection with an investigation into the group in September. Following the arrest, the FBI issued a warning encouraging other suspected members to surrender while they continued to investigate the matter. 

The developments are following the claim by ShinyHunters that a job portal breach had taken place. As claimed by the group, it obtained a significant amount of sensitive information from FBI systems. Particularly, it claimed to have acquired employee information, though the extent of the alleged theft has yet to be independently verified. During Khader's reported detention, the group's online activity was also disrupted. 

In addition to the disappearance of the group's data leak website, an account previously used to communicate with journalists no longer responded. Later, another ShinyHunters leak site appeared, indicating the group may continue to conduct activities. Moreover, Khader's reported cooperation strengthens the investigation, which has already been conducted by several individuals associated with the ShinyHunters network in general. 

Khader's identity was previously associated with the group until the latest detention was made. It has been reported that Brian Krebs identified Khader as a member of the Scattered Lapsus$ Hunters umbrella operation in 2025, which is affiliated with ShinyHunters, Lapsus$, and Scattered Spider. Aside from being linked to the HellCat leak site and BreachForums hacking forum, Khader had previously asserted that he was cooperating with law enforcement and had ceased all data theft and extortion activities. Those claims were not independently verified. 

While this was the case, ShinyHunters continued to conduct attacks in 2026, including attacks on Rockstar Games as well as Canvas, which disrupted schools across the country. Despite this, the group has continued to engage in data theft and extortion operations. ShinyHunters has recently begun targeting cloud-based services as well as third-party providers, resulting in incidents that are linked to organizations such as Google, Cisco, and Pornhub.

ShinyHunters has also been linked to the May 2026 breach involving Instructure Canvas, while previous investigations have resulted in arrests related to Snowflake-related attacks, PowerSchool and Breached hacking forums. It may be possible for investigators to gain a better understanding of how this loosely organized network operates and who remains active within it through the recent arrests. 

It has been reported that FBI agents have indicated that information obtained from arrests and seized infrastructure may be useful for identifying additional participants. However, the appearance of a new ShinyHunters leak site following the earlier closure indicates that the organization has not been completely dismantled. Furthermore, the case illustrates the difficulty of disrupting cybercrime groups that are built upon informal networks rather than a rigid organizational structure. 

According to Reuters, investigations and prosecutions can become complicated by the young age of some suspects, the fluid nature of related groups, and the limited cooperation of victims. While ShinyHunters' continued online activity suggests that law enforcement efforts are ongoing, the reported detention and cooperation may provide investigators with valuable insight into ShinyHunters' wider network.
Read more »
North Korea
bitget Crypto Breach cryptocurrency Cyber Crime Hackers Lazarus Group North Korea

Bitget Hack Climbs to $387.5 Million as Exchange Launches Recovery Bounty and Points to North Korea

 



Crypto exchange Bitget confirmed on September 25 that hackers stole approximately $387.5 million from its hot and warm wallets a day earlier, revising an initial estimate upward as investigators traced funds across multiple blockchains and accounting for assets on Zcash and TRON that were missed in the first tally. The exchange has since launched a structured bounty program for anyone who helps freeze or recover stolen funds, and has brought in independent cybersecurity firms Mandiant and SlowMist to assist with the investigation.

Bitget's security systems first flagged the unauthorized transfers at 18:31 UTC on September 24. By the time the exchange confirmed the breach publicly, the damage figure had already reached $351.6 million. The revised total of $387.5 million reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON not captured in the initial estimate. The exchange confirmed no further unauthorized transfers occurred after the incident was contained.


How the Attack Worked

Bitget CEO Gracy Chen clarified that attackers did not steal private keys or forge user withdrawal requests. Instead, they broke into a backend system inside Bitget's wallet infrastructure and used it to spoof transaction data, tricking the exchange's own authorization process into approving payouts that looked routine.

The mechanics were methodical. The attacker's first transfer was a small 0.84 ETH test payment to a fresh address, after which Bitget's main Ethereum hot wallet made roughly 380 transactions during the attack. Every time the hot wallets refilled from the warm wallet layer, the attacker drained them again. The warm wallet, which normally only pays the exchange's own hot wallets, sent 13,966 ETH worth approximately $37 million to an address less than an hour old, with no approved list check and no secondary authorization on a wallet holding over $40 million.

The single largest piece of the haul was roughly 103 million XRP, valued at approximately $157 million at the time of the theft. About $75 million of the stolen funds were held in stablecoins including USDT and USDC.

Some of that ETH moved quickly into mixers: on-chain analysis shows around 6,300 ETH, close to $19 million, funneled through Tornado Cash within hours of the breach.

The confirmed affected assets span XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, spread across Ethereum and several EVM-compatible networks, the XRP Ledger, Zcash, and TRON.


User Funds and the Protection Fund

Bitget operates a three-tier wallet architecture, and the breach touched only portions of the hot and warm wallet layers. Cold wallets remained fully secure throughout the attack. Bitget's User Protection Fund, which holds more than $464 million, will cover the full loss, meaning customer account balances stay intact even though the funds themselves were taken. The protection fund was set aside in 2023 specifically to cover hacks and theft so users would not absorb the impact.


North Korea in the Frame

During a three-hour livestream on X, CEO Gracy Chen said Bitget suspects North Korean attackers exploited the backend authentication system, making fraudulent withdrawals appear legitimate. Chen added that she has personally been targeted by the same group before, losing about $80,000 from a personal wallet unconnected to Bitget. North Korea's Lazarus Group, also tracked under the codename TraderTraitor, has been blamed for the industry's biggest thefts, including Bybit's $1.4 billion hack in February 2025, which the FBI confirmed weeks later was North Korean work.


The Recovery Bounty

Bitget has launched a Recovery Bounty Program covering eligible voluntary actions that have already resulted in affected funds being frozen, as well as future actions that directly contribute to freezing or recovering funds. The structure is straightforward: 5% of successfully frozen funds goes to the eligible person or entity whose efforts directly caused the freeze, and 5% of successfully recovered funds is available on the same terms. Bitget will also use Bybit's LazarusBounty initiative as a core channel for the effort.

To support the hunt, Bitget published a real-time fund tracing dashboard at trace.bgblockchain.xyz, an API tracking attacker-controlled addresses updated continuously, and a submission portal for anyone with freezing or recovery information. Exchanges, stablecoin issuers, bridges, custodians, and other infrastructure providers have been encouraged to monitor the flagged addresses and report relevant information through the recovery portal.

The attack is the largest cryptocurrency breach of the year to date and lands in an already turbulent stretch for the industry. Earlier in September, Liquid Network suffered a $319 million security breach, and in late July, hardware wallet maker Coldcard was hit in a separate incident that drained around $116 million in Bitcoin.

Bitget said it will publish a full incident report including root-cause analysis once technical teams complete remediation. Withdrawal restoration was expected to be announced by September 26, 4:00 AM UTC.


Read more »
Scams
Banking Crypto Cyber Crime Cyber Fraud Scams

$13 Billion in Losses Since 2023, Treasury Asks Banks to File Cyber Scam Reports


The federal government has asked financial organizations to be more careful in detecting and reporting scams done by overseas scammers. 

The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) launched and alert to the financial industry besides a detailed study of over 33,000 cyber fraud cases reported between September 2023 and December 2025. According to the report, around $12.7 billion was stolen in a cryptocurrency investment scam from American victims in the US.

As per Treasury Department official Gene Lange, “The transnational criminal organizations behind these scams exploit both emerging technologies and human vulnerabilities, resulting in devastating financial losses for innocent American victims.”

The report is prepared on the basis of reports given by around 1,300 financial organizations and is linked to a 2023 alert from the Treasury about pig butchering scams. FinCen discovered that the rate of scam operations is rising as the schemes go beyond centers in Laos, Myanmar, and Cambodia. 

Scammers use distinct profiles, from financial adviser to romantic partner, and force people into sending money, either via cryptocurrency or with traditional bank transfers.

Significant reports were received from cryptocurrency firms, which found around $5.5 billion in suspicious scam activity. 

Traditional banks reported around $6.4 billion in possible friends, saying they “often detected schemes when a victim sent funds to an [financial institution] in the digital asset sector to purchase digital assets, or when a customer sent a wire transfer to a scam-affiliated beneficiary, frequently referencing digital asset investments.”

The report finds that few victims sent applications for second mortgages and loans as part of their involvement in a scam.

More financial institutions note thousands of incidents where targets liquidated their investment accounts to try wiring transfers or fund digital assess to scammer-related accounts. According to the report, “[A financial institution] involved in the digital assets sector reported an older adult victim transferred nearly $640,000 from her retirement fund to send to a suspected scammer in connection with an apparent digital asset investment scheme.”

“The victim stated she met an individual over social media who instructed her to invest in an apparently fictitious digital asset-related company.”

Another victim took out around $150,000 from his retirement account, withdrew credit on his home, and withdrew a personal loan to send the money to a scammer who pretended to be his digital romantic partner, and wanted to invest the money in a venture.

The filings noted the use of coins like USD Coin (USDC), Ethereum, and Tether (USDT), but 18 more coins were found in the reports.

Read more »
Xinbi Guarantee
Cryptocurrency Fraud Cryptocurrency Laundering Cyber Crime Cyber Scam Marketplace Online Scam Networks Scam Centres Telegram Cybercrime U.S. Cybercrime Crackdown Xinbi Guarantee

US Disrupts Xinbi Guarantee Marketplace Linked to Cyber Scams

 

A Telegram-based marketplace known as Xinbi Guarantee has been sued by U.S. authorities for providing services to scam centers engaged in cyber fraud and money laundering. This operation involved seizing Telegram channels and cryptocurrency wallets connected to the marketplace, as well as freezing digital assets worth more than $52 million. 

A U.S. Department of Justice announcement was made in conjunction with a broader operation led by the Scam Center Strike Force. Authorities also deployed teams to Madagascar to support the disruption of 13 scam compounds that were allegedly operated by Chinese organized crime groups. According to the Justice Department, approximately $52 million in cryptocurrency tied to scam-related money laundering has been restrained in a single day.

The strike force has therefore restrained about $938 million in total assets. The Xinbi Guarantee platform became a major marketplace for the cybercrime ecosystem after other similar services, such as HuiOne Guarantee and Tudou Guarantee, were discontinued. Through the use of Telegram, the platform enabled scam operators to connect with vendors providing services required for large-scale fraud schemes. 

As reported by the marketplace, services offered include the creation of fraudulent investment sites, the laundering of proceeds from wire fraud, and recruitment of individuals for scam compounds in Southeast Asia. Additionally, Xinbi served as an intermediary, holding payments until vendors completed the requested services. Using blockchain analytics, Elliptic identified and frozen wallets holding $52.8 million in Tether's USDT stablecoin in coordination with the United States Secret Service. 

According to Xinbi's estimates, it has processed approximately $30 billion in transactions since its emergence around 2022, ranking among the top illicit marketplaces to date. Also linked to U.S. sanctions are entities involved in this marketplace. 

A US Treasury official indicated that Xinbi's infrastructure had been used by North Korean hackers and sanctioned groups related to the Prince Group. Two cryptocurrency wallets containing approximately $12 million were seized from Xinbi that were used to receive vendor payments directly. In addition, two companies accused of supporting Xinbi's operations were sanctioned. 

SafeW Technology of Singapore was sanctioned based on its role as a provider of encrypted communications, whereas Anwen Technologies of Cambodia was sanctioned for its association with XinbiPay, also known as NewPay, an application for digital wallets. 

It was discovered by blockchain intelligence firm TRM Labs that Xinbi's network offers a wide range of services, including stolen personal information, counterfeit identification documents, artificial intelligence-driven deep fake tools, satellite internet equipment and over-the-counter cryptocurrency exchanges. These services provided scam groups with the technical and financial resources necessary for large-scale fraud campaigns.

According to TRM Labs, Xinbi may have handled more than $36 billion in transactions, higher than the U.S. government estimate of over $24 billion. As a result of the decline in HuiOne Guarantee and Tudou Guarantee, daily inflows almost doubled between May and December 2025, according to the firm's analysis. 

Elliptic reported Xinbi appeared offline in response to the latest action, and Telegram removed its main channels and banned the platform's usernames, thereby negatively affecting the marketplace's online presence. This disruption poses a direct threat to a marketplace that relies on communication channels, vendor connections, and cryptocurrency payments for its operation. 

A larger U.S. effort is being made to disrupt the infrastructure underlying Southeast Asia's scam economy. The Scam Center Strike Force has expanded its activities beyond financial seizures, with teams sent to Madagascar to assist with the closure of 13 scam compounds allegedly operated by Chinese criminal groups. 

In addition to drawing attention to the financial threat, the U.S. government has also emphasized its scale. During 2024, Americans lost at least $10 billion to scams originating from Southeast Asia, according to a March report published by the U.S.-China Economic and Security Review Commission; losses are expected to increase in 2025. The commission noted that criminal groups are maintaining their operations in spite of enforcement efforts by using advanced technology and cryptocurrency. 

Separate investigations conducted by the House Select Committee on China have indicated that scam compounds in Cambodia and Myanmar are part of a larger criminal ecosystem which includes money laundering, cyber fraud, and human trafficking. 

The findings show that online scam operations are increasingly supported by interconnected financial, technological, and physical infrastructures rather than isolated fraud groups. An action against Xinbi Guarantee demonstrates the growing focus on dismantling the financial, technological, and communication infrastructure that supports large-scale cyberfraud schemes.
Read more »
SourTrade Malware
Browser-Based Malware cryptocurrency security Cyber Crime Cyber Threats JavaScript Malware Malvertising Campaign Service Worker Attack SourTrade Malware

Browser Memory Becomes New Target in JavaScript Malware Campaign


 

Security researchers have discovered a large-scale malvertising campaign that uses fake cryptocurrency and trading websites to assemble malware inside the web browser of the victim, making it increasingly difficult to detect using traditional security tools. 

A security firm named Confiant claims the operation has been in operation since late 2024 and primarily targets retail traders and cryptocurrency investors in 12 countries. Asia-Pacific and Latin America regions are particularly targeted. In addition to supporting 25 languages, the campaign employs sophisticated filtering techniques to prevent researchers, automated scanners, and security bots from reaching malicious sites, as well as redirecting researchers and automated scanners to harmless blank pages to avoid damage. 

Security researchers, automated scanners, and bots are served empty pages before the fake websites are displayed in order to determine whether or not the users are legitimate targets. In contrast, retail traders and cryptocurrency investors receive convincing replicas of legitimate platforms when using selective filtering. By doing so, routine security scans are significantly reduced in the likelihood of detecting the infrastructure. 

Users are presented with websites that appear legitimate that offer software downloads by impersonating popular platforms such as Solana, Luno, and TradingView. By utilizing JavaScript techniques, the websites construct malware locally within the victim's browser memory rather than delivering a malicious file directly to the victim. It is said that the browser acts as a "local assembly pipeline" because it is capable of assembling malware rather than downloading a complete executable file.

As part of the attack, a Service Worker is registered to manage the download process, whereas a SharedWorker is created directly from JavaScript embedded within the webpage, so that the source code does not appear as a separate network request. 

After receiving the configuration file, the worker requests instructions for assembling the malware, including a template, randomized session values, and instructions. Each download is uniquely generated based on randomized parameters, thus producing a unique file hash for each victim. By utilizing this approach, the malware can bypass static detection methods that depend upon identifying known file signatures. 

Browsers download legitimate Bun runtimes from a secondary domain as part of the assembly process, and they combine them with attacker-controlled executable components and locally generated data as part of the assembly process. Since Bun is a legitimate component for building standalone Windows applications, attackers exploit this feature to disguise the final executable. 

Each session generates a unique file hash based on a random seed and file size, reducing the effectiveness of hash-based malware detection. By delivering the executable through the same domain that the website uses, the download appears legitimate from the browser's perspective, so that the download appears legitimate. 

Despite receiving Microsoft's Mark-of-the-Web security tag, network-based detection and forensic analysis are significantly more difficult without a fully transmitted malicious file. According to Confident, earlier versions of the campaign, tracked as SourTrade, used the open-source StreamSaver project to deliver malware.

Since April 2026, however, the operators have switched to using more sophisticated Service Worker-based delivery mechanisms. Researchers did not publicly identify the malicious payload for this campaign, but they linked it to Bitdefender's previous findings, which documented malware capable of intercepting internet traffic, stealing passwords and browser cookies, logging keystrokes, capturing screenshots, harvesting cryptocurrency wallet data, and maintaining persistence on compromised systems for a period of time. 

A Confident representative noted that the campaign does not exploit browser vulnerabilities or bypass Microsoft's Mark-of-the-Web (MotW) security features. Instead, it utilizes legitimate browser capabilities to deliver malware without transmitting a full executable over the network. In addition, researchers noted that there is currently no software patch available for this technique, which requires users to remain aware of and to practice safe software downloading practices to protect themselves. 

Earlier versions of the campaign used the open-source StreamSaver project hosted on GitHub to facilitate malware downloads, allowing investigators to trace its evolution from earlier versions. The operators replaced that approach in April 2026 with a Service Worker-based download mechanism, which encapsulates the entire delivery process within the impersonated website, making it increasingly difficult to analyze the network and detect malware. 

A security expert recommends downloading cryptocurrency and financial software from official vendor websites, avoiding sponsored advertisements or social media promotions, and verifying the digital signature and publisher of the application before installation. In light of the increasing stealthy techniques used by attackers to compromise users, these precautions remain critical. In light of the increasing sophistication of cybercriminals' malware delivery techniques, campaigns such as SourTrade underscore the challenges that defenders face. 

Through the use of legitimate browser functionality in order to assemble malware locally, attackers are able to bypass many traditional detection methods. It is recommended that you only download software from legitimate sources, verify digital signatures, and be wary of sponsored advertisements and promotional links relating to cryptocurrencies and financial institutions.
Read more »
Ransomware
AI AI Hacking Cyber Crime Cyber Threats Ransomware

AI Is Fueling a New Wave of Cybercrime

 

Cybercriminals are increasingly turning to artificial intelligence, and the biggest barriers that once slowed adoption are rapidly disappearing. According to a recent Axios report, restricted access to models, high costs, and limited incentive to change old hacking methods are no longer holding attackers back. Open-weight AI models are becoming powerful enough to rival mainstream systems in some cyber tasks, while underground marketplaces are offering jailbroken tools, custom-built models, and AI-powered hacking services. That mix is making AI more practical for criminal use than ever before. 

The shift matters because hackers are no longer just experimenting with AI in isolated tests. They are now weaving it into existing workflows to speed up ransomware, fraud, phishing, and cloud intrusions. Axios cites recent cases showing how attackers are using AI to generate exploit code, steal data, and even negotiate with victims. In one example, a lone hacker used AI agents to automate most of a ransomware attack. In another, AI helped compress a cloud attack that would normally take weeks into just 72 hours. 

Researchers also say the threat is spreading across different types of crime. A separate case described by Axios involved a bank fraud scheme targeting Mexico-based financial organizations, where AI-generated malware played a role in the attack chain. These incidents suggest criminals are learning how to blend AI with traditional tactics instead of replacing human hackers entirely. That makes the attacks harder to predict, because AI is being used as an accelerator rather than a standalone weapon. 

For defenders, the most serious problem is time. AI is helping attackers move faster, which leaves organizations with fewer hours to detect suspicious behavior, investigate compromises, and patch weak spots before damage spreads. Security teams that once had days or weeks to respond may now have only a narrow window. That raises the pressure on companies to monitor systems more closely, strengthen access controls, and prepare for attacks that are increasingly automated and adaptive.

The broader message is clear: AI is lowering the cost and complexity of cybercrime while increasing the scale and speed of attacks. What once required a skilled team and long preparation can now be compressed into a shorter, more efficient operation. As criminal adoption grows, the cybersecurity industry will need to match that pace with faster detection, stronger resilience, and better incident response.
Read more »
Cyber Crime
AI Boko Haram Cambridge Study Chatbot Cyber Crime

Boko Haram Used AI Chatbots to Support Attacks, Cambridge Study Finds

 

Boko Haram has reportedly exploited mainstream AI chatbots to support terror operations, according to a Cambridge University study cited by the South China Morning Post. The research suggests the group used both US and Chinese AI tools for bomb-making, attack planning, propaganda, and day-to-day operational support. 

The study is based on interviews with 27 former Boko Haram members in northeast Nigeria, giving researchers a rare inside look at how the insurgent group adapted to new technology. Former fighters said AI tools were used to answer practical questions about weapons, tactics, surveillance, and movement, showing that the technology was not used only for messaging or recruitment. 

One of the most concerning findings is that Boko Haram reportedly organized internal AI training and created specialized units to help members use chatbot systems more effectively. The report says outside trainers, likely linked to the Islamic State network, helped members learn how to use AI tools with VPNs and encryption software, while also teaching ways to bypass built-in safety restrictions. 

Researchers said the group used AI for operational tasks such as bomb construction, improving attacks, and troubleshooting weapons. Former commanders described using chatbots to solve battlefield problems, including how to modify motorcycles for raids and how to increase the destructive power of improvised explosives. This suggests that extremist groups are no longer treating AI as a novelty, but as a repeatable support system for violence. 

The findings raise a broader security concern for governments and AI companies. If militant groups can regularly extract harmful guidance from consumer chatbots, then safety filters alone may not be enough to stop misuse. The study also strengthens calls for tighter international coordination, especially between the US and China, because the major AI systems being exploited are built in those two countries. As AI becomes more advanced and more accessible, the risk is not just misinformation or fraud, but the possibility that extremist groups will use it to become faster, better organized, and harder to stop.
Read more »
Subscribe to: Posts (Atom)