CySecurity News - Latest Information Security and Hacking Incidents: FBI

cyber attack Cyber Fraud cyberattacks trending news FBI Scattered Spider Threat Group

FBI Raises Alarm as Scattered Spider Threat Group Expands Target Sectors

The Federal Bureau of Investigation (FBI) has issued a high-level cybersecurity alert warning about the growing threat posed by Scattered Spider, a cybercriminal group now targeting the transportation sector specifically the aviation industry and expanding its focus to insurance companies. Previously associated with large-scale ransomware attacks in the retail sector, including a significant breach at Marks & Spencer in the UK that resulted in losses exceeding $600 million, the group is now shifting tactics and industries.

A recent analysis by cybersecurity firm Halcyon, confirmed by the FBI, highlights how Scattered Spider is using advanced social engineering to bypass multi-factor authentication (MFA), often by impersonating employees or contractors and deceiving IT help desks into adding unauthorized MFA devices. The FBI has urged organizations to strengthen their MFA procedures and report any suspicious activity promptly. Research from Reliaquest shows the group often spoofs technology vendors and specifically targets high-access individuals like system administrators and executives.

Scattered Spider is financially driven and reportedly connected to a broader cybercriminal collective known as The Community. Its collaborations with ransomware operators such as ALPHV, RansomHub, and DragonForce have enabled it to access sophisticated cyber tools. What makes the group particularly dangerous is its ability to blend technical skill with social engineering, recruiting English-speaking attackers with neutral accents and regional familiarity to convincingly impersonate support staff during Western business hours. Real-time coaching and detailed scripts further enhance the success of these impersonation efforts.

Beyond aviation, experts are now seeing signs of similar attacks in the U.S. insurance sector. Google’s Threat Intelligence Group confirmed multiple such incidents, and security leaders warn that these are not isolated cases. Jon Abbott, CEO of ThreatAware, emphasized that this trend signals a broader threat landscape for all industries.

Richard Orange of Abnormal AI noted that Scattered Spider relies more on manipulating human behaviour than exploiting software vulnerabilities, often moving laterally across systems to gain broader access. The group’s exploitation of supply chain links has been a consistent tactic, making even indirect associations with targeted sectors a point of vulnerability. As the FBI continues to work with affected industries, experts stress that all organizations, regardless of sector, must enhance employee awareness, implement strict identity verification, and maintain vigilance against social engineering threats.

Scattered Spider Hackers Target Airline Industry Amid FBI and Cybersecurity Warnings



 

Scattered Spider ransomware

airline industry Cyber Attacks cyberattacks on airline FBI Hacker attack Hawaii MFA Palo Alto Networks Scattered Spider Scattered Spider ransomware

Scattered Spider Hackers Target Airline Industry Amid FBI and Cybersecurity Warnings

The FBI has issued a new warning about the cybercriminal group known as Scattered Spider, which is now actively targeting the airline industry. Recent cyber incidents at Hawaiian Airlines and Canadian carrier WestJet underscore the growing threat.

According to the FBI’s advisory released late last week, Scattered Spider is known for using advanced social engineering tactics, often posing as employees or contractors. Their goal is to manipulate IT help desk teams into granting unauthorized access—frequently by requesting the addition of rogue multi-factor authentication (MFA) devices to compromised accounts.

The group’s typical targets include large enterprises and their third-party service providers. “That puts the entire aviation supply chain at risk,” the FBI noted. Once they gain entry, the hackers typically exfiltrate sensitive information for extortion purposes and sometimes deploy ransomware as part of their attacks. The agency confirmed that it is working closely with industry partners to contain the threat and support affected organizations.

Hawaiian Airlines reported late last week that it had detected suspicious activity in some of its IT systems. While full flight operations were not disrupted, the airline stated it was taking protective steps. “We’ve engaged with authorities and cybersecurity experts to investigate and remediate the incident,” the company said in a statement, adding that it’s focused on restoring systems and will share further updates as the situation evolves.

Earlier in June, WestJet disclosed that it had experienced a cybersecurity event, which led to restricted access for certain users. The airline has brought in third-party experts and digital forensic analysts to investigate the breach.

Although the culprits haven’t been officially named, recent analysis from security firm Halcyon indicates that Scattered Spider has broadened its scope, now targeting not only aviation but also sectors like food production and manufacturing.

“These attacks are fast-moving and devastating,” Halcyon warned. “They can cripple an entire organization in just a few hours, with impacts on everything from operations to consumer trust.”

Other experts echoed these concerns. Palo Alto Networks’ Unit 42 recently advised aviation companies to be extra cautious, particularly regarding suspicious MFA reset requests and socially engineered phishing attempts.

Darren Williams, founder and CEO of cybersecurity company BlackFog, emphasized the high value of the airline sector for cybercriminals. “Airlines manage immense volumes of sensitive customer data, making them an extremely attractive target,” he said. “With international travel surging, attackers are exploiting this pressure point.”

Williams added that the disruptions caused by such attacks can ripple across the globe, affecting travelers, business continuity, and public confidence. “These incidents show that airlines need to invest more heavily in cybersecurity infrastructure that can protect passenger data and maintain operational integrity.”

FBI Warns of Scattered Spider Cyberattacks on Airline and Transport Sectors



 

FBI

cyber attack Cyber Security cyberattacks news cyberattacks on airline cyberattacks on transportation FBI

FBI Warns of Scattered Spider Cyberattacks on Airline and Transport Sectors

The FBI, along with top cybersecurity firms, has issued a fresh warning that the notorious hacking group Scattered Spider is expanding its targets to include the airline and broader transportation industries. In a statement released Friday and shared with TechCrunch, the FBI said it had “recently observed” cyber activity in the airline sector bearing the hallmarks of Scattered Spider’s tactics.

Experts from Google’s Mandiant and Palo Alto Networks’ Unit 42 also confirmed they have identified attacks on aviation-related systems linked to the same group. Scattered Spider is widely known in cybersecurity circles as a loosely organized yet highly active group of hackers, believed to be comprised mainly of young, English-speaking individuals. Motivated largely by financial gain, the group is infamous for using sophisticated social engineering techniques, phishing campaigns, and even threats directed at corporate help desks to infiltrate systems. In some cases, their intrusions have led to the deployment of ransomware.

The FBI’s alert highlighted the group’s pattern of targeting both major corporations and their third-party IT service providers. This broad approach means that anyone within the airline ecosystem from airline staff to external contractors could be a potential target. The warning follows a series of cyber incidents involving airlines.

Hawaiian Airlines confirmed on Thursday that it was responding to a cyberattack affecting its systems. Meanwhile, Canadian carrier WestJet reported a breach on June 13 that is still ongoing. Media reports suggest that Scattered Spider may be responsible for the WestJet intrusion.

This latest activity comes after a string of attacks by the group on other industries, including retail chains in the U.K. and several insurance companies. In the past, Scattered Spider has also been linked to breaches involving casinos, hotel groups, and large tech firms. Cybersecurity professionals warn that the group’s evolving methods and willingness to exploit human vulnerabilities make them a significant threat across sectors, especially industries reliant on large-scale digital infrastructure and third-party vendors.

FBI Warns: Millions of Everyday Smart Devices Secretly Hijacked by Cybercriminals



 

Smart Devices

Badbox Cyber Crime FBI Smart Devices

FBI Warns: Millions of Everyday Smart Devices Secretly Hijacked by Cybercriminals

The FBI recently raised concerns about a large-scale cybercrime network that has quietly taken control of millions of smart gadgets used in homes across the United States. This cyber threat, known as BADBOX 2.0, targets everyday devices such as TV streaming boxes, digital projectors, tablets, and even entertainment systems in cars.

What is BADBOX 2.0?

Unlike common malware that slows down or damages devices, BADBOX 2.0 silently turns these gadgets into part of a hidden network called a residential proxy network. This setup allows cybercriminals to use the victim's internet connection to carry out illegal activities, including online advertising fraud and data theft, without the device owner realizing anything is wrong.

Which Devices Are at Risk?

According to the FBI, the types of devices most affected include:

1. TV streaming boxes

2. Digital projectors

3. Aftermarket car infotainment systems

4. Digital photo frames

Many of these products are imported, often sold under unfamiliar or generic brand names. Some specific models involved in these infections belong to device families known as TV98 and X96, which are still available for purchase on popular online shopping platforms.

How Does the Infection Spread?

There are two main ways these devices become part of the BADBOX 2.0 network:

Pre-installed Malware: Some gadgets are already infected before they are even sold. This happens when malicious software is added during the manufacturing or shipping process.

Dangerous App Downloads: When setting up these devices, users are sometimes directed to install apps from unofficial sources. These apps can secretly install harmful software that gives hackers remote access.

This method shows how BADBOX 2.0 has advanced from its earlier version, which focused mainly on malware hidden deep within the device's firmware.

Signs Your Device May Be Infected

Users should watch for warning signs such as:

• The device asks to disable security protections like Google Play Protect.

• The brand is unfamiliar or seems generic.

• The device promises free access to paid content.

• You are prompted to download apps from unknown stores.

• Unusual or unexplained internet activity appears on your home network.

How to Stay Safe

The FBI recommends several steps to protect your home network:

1. Only use trusted app stores, like Google Play or Apple’s App Store.

2. Be cautious with low-cost, no-name devices. Extremely cheap gadgets are often risky.

3. Monitor your network regularly for unfamiliar devices or strange internet traffic.

4. Keep devices updated by installing the latest security patches and software updates.

5. If you believe one of your devices may be compromised, it is best to disconnect it immediately from your network and report the issue to the FBI through their official site at www.ic3.gov.

6. Be Careful with Cheap Deals

As experts warn, extremely low prices can sometimes hide dangerous risks. If something seems unusually cheap, it could come with hidden cyber threats.

FBI Warns of Luna Moth Ransomware Attacks Targeting U.S. Law Firms



 

Social Engineering

Cyber Attacks Extortion FBI Luna Moth Ransomware attack Social Engineering

FBI Warns of Luna Moth Ransomware Attacks Targeting U.S. Law Firms

The FBI said that over the last two years, an extortion group known as the Silent Ransom Group has targeted U.S. law firms through callback phishing and social engineering tactics.

This threat outfit, also known as Luna Moth, Chatty Spider, and UNC3753, has been active since 2022. It was also responsible for BazarCall campaigns, which provided initial access to corporate networks for Ryuk and Conti ransomware assaults. Following Conti's shutdown in March 2022, the threat actors broke away from the cybercrime syndicate and created their own operation known as the Silent Ransom Group.

In recent attacks, SRG mimics the targets' IT help via email, bogus websites, and phone conversations, gaining access to their networks via social engineering tactics. This extortion group does not encrypt victims' systems and is infamous for demanding ransoms in order to keep sensitive information stolen from hacked devices from being leaked online.

"SRG will then direct the employee to join a remote access session, either through an email sent to them, or navigating to a web page. Once the employee grants access to their device, they are told that work needs to be done overnight," the FBI stated in a private industry notification.

"Once in the victim's device, a typical SRG attack involves minimal privilege escalation and quickly pivots to data exfiltration conducted through 'WinSCP' (Windows Secure Copy) or a hidden or renamed version of 'Rclone.'”

After acquiring the victims' data, they use ransom emails to blackmail them, threatening to sell or publish the information. They frequently call employees of breached organisations and force them into ransom negotiations. While they have a dedicated website for disclosing their victims' data, the FBI claims the extortion ring does not always followup on its data leak promises.

To guard against these attacks, the FBI recommends adopting strong passwords, activating two-factor authentication for all employees, performing regular data backups, and teaching personnel on recognising phishing efforts.

The FBI's warning follows a recent EclecticIQ report detailing SRG attacks targeting legal and financial institutions in the United States, with attackers observed registering domains to "impersonate IT helpdesk or support portals for major U.S. law firms and financial services firms, using typosquatted patterns.”

A recent EclecticIQ report about SRG attacks against American legal and financial institutions revealed that the attackers were registering domains to "impersonate IT helpdesk or support portals for major U.S. law firms and financial services firms, using typosquatted patterns." The FBI issued the warning in response to this information.

Malicious emails with fake helpdesk numbers are being sent to victims, prompting them to call in order to fix a variety of non-existent issues. On the other hand, Luna Moth operators would try to deceive employees of targeted firms into installing remote monitoring & management (RMM) software via phoney IT help desk websites by posing as IT staff.

Once the RMM tool is installed and started, the threat actors have direct keyboard access, allowing them to search for valuable documents on compromised devices and shared drivers, which will then be exfiltrated via Rclone (cloud syncing) or WinSCP (SFTP). According to EclecticIQ, the Silent Ransom Group sends ransom demands ranging from one to eight million USD, depending on the size of the hacked company.

FBI Urges Immediate Action as Play Ransomware Attacks Surge



 

VPN

CISA Cyber Security FBI Ransomware VPN

FBI Urges Immediate Action as Play Ransomware Attacks Surge

The Federal Bureau of Investigation (FBI) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have released a critical warning about the sharp rise in Play ransomware attacks. The agencies report that this cyber threat has affected hundreds of organizations across the Americas and Europe, including vital service providers and businesses.

The updated alert comes after the FBI identified over 900 confirmed victims in May alone, which is three times more than previously reported. Cybersecurity experts are urging organizations to act quickly to strengthen their defenses and stay informed about how these cybercriminals operate.

How the Play Ransomware Works

Play ransomware attackers use various advanced methods to break into systems. They often start by targeting services that are accessible from outside, like Remote Desktop Protocol (RDP) and Virtual Private Networks (VPNs). Once they gain access, they move within the network, stealing login details and aiming to control the system entirely.

The FBI notes that the attackers do not immediately demand payment in their ransom notes. Instead, they leave email addresses that victims must contact. These emails usually come from unique addresses linked to German domains. In some cases, the criminals also make threatening phone calls to pressure victims into paying.

Connections to Other Threat Groups

Investigations suggest that the Play ransomware may be connected to several known hacking groups. Some security researchers believe there could be links to Balloonfly, a cybercrime group involved in earlier ransomware attacks. There have also been reports connecting Play to serious security incidents involving Windows systems and Microsoft Exchange servers.

In the past, attackers have taken advantage of security flaws in popular software, including Microsoft’s Windows and Fortinet’s FortiOS. Most of these security gaps have already been fixed through updates, but systems that remain unpatched are still at risk.

Key Steps to Protect Your Organization

The FBI strongly recommends that all organizations take immediate steps to reduce their risk of falling victim to these attacks. Here are the essential safety measures:

1. Create backup copies of important data and store them in secure, separate locations.

2. Use strong, unique passwords that are at least 15 characters long. Do not reuse passwords or rely on password hints.

3. Enable multi-factor authentication to add extra security to all accounts.

4. Limit the use of admin accounts and require special permissions to install new software.

5. Keep all systems and software up to date by applying security patches and updates promptly.

6. Separate networks to limit how far a ransomware attack can spread.

7. Turn off unused system ports and disable clickable links in all incoming emails.

8. Restrict the use of command-line tools that attackers commonly use to spread ransomware.

Staying alert and following these steps can help prevent your organization from becoming the next target. Cybersecurity is an ongoing effort, and keeping up with the latest updates is key to staying protected.

Mysterious Entity ExposedGang Exposes Cyber Criminals



 

TrickBot

Conti Cyber Crime Dark Web FBI ID Leak Internet Ransomware TrickBot

Mysterious Entity ExposedGang Exposes Cyber Criminals

An anonymous leaker is exposing the identities of the world’s most wanted cybercriminals.

Recently, a mysterious leaker exposed leaders behind Trickbot and Conti ransomware, hacking groups that are known for some of the biggest extortions in recent times.

Recently, The Register contacted an anonymous individual known by the alias GangExposed, who is on a personal mission to “fight against an organized society of criminals known worldwide”. GangExposed takes pleasure in thinking he can rid society of at least some of the cybercriminals. "I simply enjoy solving the most complex cases,” he said.

Stern doxxed

One of the criminals doxxed is Stern, the mastermind of Conti ransomware operations and TrickBot. GangExposed claims Stern is Vitaly Nikolaevich, CySecurity reported about this case recently.

After the doxxing of Stern, GangExposed went after another important criminal, AKA professor, who is a 39-year-old Russian called Vladimir Viktorovich Kvitko. He is living in Dubai. Apart from exposing important individuals, GangExposed also leaked videos, ransom negotiations, and chat logs.

About GangExposed

The leaker said it was not an “IT guy,” it just observed patterns that other people missed.

"My toolkit includes classical intelligence analysis, logic, factual research, OSINT methodology, stylometry (I am a linguist and philologist), human psychology, and the ability to piece together puzzles that others don't even notice," the leaker said.

"I am a cosmopolitan with many homes but no permanent base — I move between countries as needed. My privacy standards are often stricter than most of my investigations' subjects."

Leaked bought info to expose IDs

To expose the IDs of infamous threat actors, GangExposed used information received via “semi-closed databases, darknet services,” and through purchases. It has “access to the leaked FSB border control database.” GangExposed claims it purchased the database from the dark web for $250,000.

GangExposed could have gotten at least $10 million in bounty from the FBI if it wanted to, but it has decided not to demand money. This suggests the leakers may be resentful of former members looking for revenge, while some experts think taking the bounty would make them criminal as well.

CySecurity had earlier reported on this incident, you can read the full story about the international crackdown on cybercrime gangs here.

FBI Warns of Silent Ransom Group Using Phishing and Vishing to Target U.S. Law Firms



 

Ransomwares

Advanced Social Engineering Cyber Attacks cybercriminal group data security FBI FBI cybersecurity advisory Law Firms Luna Moth phishing techniques ransomware attacks Ransomwares

FBI Warns of Silent Ransom Group Using Phishing and Vishing to Target U.S. Law Firms

The FBI has issued a warning about a sophisticated cybercriminal group known as the Silent Ransom Group (SRG), also referred to by aliases like Luna Moth, Chatty Spider, and UNC3753. This group has been actively targeting U.S.-based law firms and related organizations through advanced phishing techniques and social engineering scams. The group, which has been operational since 2022, is known for using deceptive communication methods to gain unauthorized access to corporate systems and extract sensitive legal data for ransom demands. In the past, SRG’s activities spanned across industries such as healthcare and insurance.

However, since the spring of 2023, its focus has shifted to legal entities, likely because of the highly confidential nature of the data managed by law firms. The group commonly uses a method called callback phishing, also known as reverse vishing. In this approach, victims receive emails that appear to originate from reputable companies and warn them of small charges for fake subscriptions. The emails prompt users to call a phone number to cancel the subscription. During these calls, victims are instructed to download remote access software under the guise of resolving the issue. Once the software is installed, SRG gains control of the victim’s device, searches for valuable data, and uses it to demand ransom.

In March 2025, SRG has adapted their strategy to include voice phishing or vishing. In this new approach, the attackers call employees directly, posing as internal IT staff. These fraudulent callers attempt to convince their targets to join remote access sessions, often under the pretext of performing necessary overnight maintenance. Once inside the system, the attackers move swiftly to locate and exfiltrate data using tools like WinSCP or a disguised version of Rclone. Notably, SRG does not prioritize escalating privileges, instead focusing on immediate data theft. The FBI noted that these voice phishing methods have already resulted in multiple successful breaches.

SRG reportedly continues to apply pressure during ransom negotiations by making follow-up calls to victim organizations. While the group does maintain a public site for releasing stolen data, its use of this platform is inconsistent, and it does not always follow through on threats to leak information. A significant concern surrounding these attacks is the difficulty in detection. SRG uses legitimate system management and remote access tools, which are often overlooked by traditional antivirus software. The FBI advises organizations to remain vigilant, particularly if there are unexplained downloads of programs such as AnyDesk, Zoho Assist, or Splashtop, or if staff receive unexpected calls from alleged IT personnel.

In response, the FBI urges companies to bolster cybersecurity training, establish clear protocols for authenticating internal IT requests, and enforce two-factor authentication across all employee accounts. Victims of SRG attacks are encouraged to share any information that might assist in ongoing investigations, including ransom communications, caller details, and cryptocurrency wallet data.

Undercover Operation Shuts Down Website Helping Hackers Internationally



 

Operation Endgame

Anti Virus Dark Web FBI Internet malware Operation Endgame

Undercover Operation Shuts Down Website Helping Hackers Internationally

Hackers used AVCheck to see malware efficiency

International police action has shut down AVCheck, an anti-virus scanning website used by threat actors to check whether their malware was detected by mainstream antivirus before using it in the attacks. The official domain “avcheck.net” now shows a seizure banner with the logos of the U.S. Secret Service, the U.S. Department of Justice, the FBI, and the Dutch Police (Politie).

The site was used globally by threat actors

According to the announcement, AVCheck was a famous counter antivirus (CAV) website globally that enabled hackers to check the efficiency of their malware. Politie’s Matthijs Jaspers said, “Taking the AVCheck service offline marks an important step in tackling organized cybercrime." With the collaborative effort, the agencies have disrupted the “cybercriminals as early as possible in their operations and prevent victims."

The officials also discovered evidence linking AVCheck’s administrators to encrypting services Cryptor.biz (seized) and Crypt.guru (currently offline). Crypting services allow threat actors to hide their payloads from antivirus, blending them in the ecosystem. Hackers also use a crypting service to hide their malware, check it on AVCheck or other CAV services to see if is detected, and finally launch it against their targets.

Details about the operation

Before the shutdown of AVCheck, the police made a fake login page warning users of the legal risks when they log in to such sites. The FBI said that “cybercriminals don't just create malware; they perfect it for maximum destruction.” Special Agent Douglas Williams said threat actors leverage antivirus services to “refine their weapons against the world's toughest security systems to better slip past firewalls, evade forensic analysis, and wreak havoc across victims' systems."

Operation Endgame

The undercover agents exposed the illegal nature of AVCheck and its links to ransomware attacks against the U.S. by purchasing these services as clients. According to the U.S. DoJ, in the “affidavit filed in support of these seizures, authorities made undercover purchases from seized websites and analyzed the services, confirming they were designed for cybercrime.”

The crackdown was part of Operation Endgame, a joint international law enforcement action that captured 300 servers and 650 domains used in assisting ransomware attacks. Earlier, the operation cracked down on the infamous Danabot and Smokeloader malware operations.

FBI Cracks Down on Dark Web Drug Dealers



 

operation raptor

Cyber Crime Dark Web Drug Trafficking FBI operation raptor

FBI Cracks Down on Dark Web Drug Dealers

A major criminal network operating on the dark web has been disrupted in a large international operation led by the FBI. Over 270 individuals have been arrested for their involvement in the online trade of dangerous illegal drugs such as fentanyl, meth, and cocaine. This operation involved law enforcement teams from the United States, Europe, South America, and Asia.

What is the dark web?

The dark web is a hidden part of the internet that isn’t available through standard search engines or browsers. It requires special tools to access and is often used to hide users’ identities. While it can offer privacy to those in danger or under surveillance, it is also known for being a place where criminals carry out illegal activities — from drug dealing to selling stolen data and weapons.

What was Operation RapTor?

The FBI’s mission, called Operation RapTor, focused on stopping the sale of illegal drugs through online black markets. Authorities arrested hundreds of people connected to these sites — not just the sellers, but also the buyers, website managers, and people who handled the money.

One of the most alarming parts of this case was the amount of fentanyl recovered. Authorities seized more than 317 pounds of it. According to FBI estimates, just 2 pounds of fentanyl could potentially kill about 500,000 people. This shows how serious the danger was.

Why this matters

These drug sellers operated from behind screens, often believing they were untouchable because of the privacy the dark web provides. But investigators were able to find out who they were and stop them from doing more harm. According to FBI leaders, these criminals contributed to drug addiction and violence in many communities across the country.

Aaron Pinder, a key official in the FBI’s cybercrime unit, said the agency has improved at identifying people hiding behind dark web marketplaces. Whether someone is managing the site, selling drugs, moving money, or simply buying drugs, the FBI is now better equipped to track them down.

What’s next?

While this operation won’t shut down the dark web completely, it will definitely make a difference. Removing major players from the drug trade can slow down their operations and make it harder for others to take their place — at least for now.

This is a strong reminder that the dark web, no matter how hidden, is not out of reach for law enforcement. And efforts like these could help save many lives by cutting off the supply of deadly drugs.

FBI Busts 270 in Operation RapTor to Disrupt Dark Web Drug Trade



 

FBI. Cyberespionage

Cyber Security CyberCrime cybercrime awareness Dark Web Dark web marketplace Dark Web Monitoring FBI FBI. Cyberespionage

FBI Busts 270 in Operation RapTor to Disrupt Dark Web Drug Trade

Efforts to dismantle the criminal networks operating on the dark web are always welcome, especially when those networks serve as hubs for stolen credentials, ransomware brokers, and cybercrime gangs. However, the dangers extend far beyond digital crime. A substantial portion of the dark web also facilitates the illicit drug trade, involving some of the most lethal substances available, including fentanyl, cocaine, and methamphetamine. In a major international crackdown, the FBI led an operation targeting top-tier drug vendors on the dark web.

The coordinated effort, known as Operation RapTor, resulted in 270 arrests worldwide, disrupting a network responsible for trafficking deadly narcotics. The operation spanned the U.S., Europe, South America, and Asia, and confiscated over 317 pounds of fentanyl—a quantity with the potential to cause mass fatalities, given that just 2 pounds of fentanyl can be lethal to hundreds of thousands of people. While the dark web does provide a secure communication channel for those living under oppressive regimes or at risk, it also harbors some of the most heinous activities on the internet.

From illegal arms and drug sales to human trafficking and the distribution of stolen data, this hidden layer of the web has become a haven for high-level criminal enterprises. Despite the anonymity tools used to access it, such as Tor browsers and encryption layers, law enforcement agencies have made significant strides in infiltrating these underground markets. According to FBI Director Kash Patel, many of the individuals arrested believed they were untouchable due to the secrecy of their operations. “These traffickers hid behind technology, fueling both the fentanyl epidemic and associated violence in our communities. But that ends now,” he stated.

Aaron Pinder, unit chief of the FBI’s Joint Criminal Opioid and Darknet Enforcement team, emphasized the agency’s growing expertise in unmasking those behind darknet marketplaces. Whether an individual’s role was that of a buyer, vendor, administrator, or money launderer, authorities are now better equipped than ever to identify and apprehend them. Although this operation will not completely eliminate the drug trade on the dark web, it marks a significant disruption of its infrastructure.

Taking down major players and administrators sends a powerful message and temporarily slows down illegal operations—offering at least some relief in the fight against drug-related cybercrime.

Governments Release New Regulatory AI Policy



 

Technology

AI ChatGPT CISA FBI GenAI NSA Technology

Governments Release New Regulatory AI Policy

Regulatory AI Policy

The CISA, NSA, and FBI teamed with cybersecurity agencies from the UK, Australia, and New Zealand to make a best-practices policy for safe AI development. The principles laid down in this document offer a strong foundation for protecting AI data and securing the reliability and accuracy of AI-driven outcomes.

The advisory comes at a crucial point, as many businesses rush to integrate AI into their workplace, but this can be a risky situation also. Governments in the West have become cautious as they believe that China, Russia, and other actors will find means to abuse AI vulnerabilities in unexpected ways.

Addressing New Risks

The risks are increasing swiftly as critical infrastructure operators develop AI into operational tech that controls important parts of daily life, from scheduling meetings to paying bills to doing your taxes.

From foundational elements of AI to data consulting, the document outlines ways to protect your data at different stages of the AI life cycle such as planning, data collection, model development, installment and operations.

It requests people to use digital signature that verify modifications, secure infrastructure that prevents suspicious access and ongoing risk assessments that can track emerging threats.

Key Issues

The document addresses ways to prevent data quality issues, whether intentional or accidental, from compromising the reliability and safety of AI models.

Cryptographic hashes make sure that taw data is not changed once it is incorporated into a model, according to the document, and frequent curation can cancel out problems with data sets available on the web. The document also advises the use of anomaly detection algorithms that can eliminate “malicious or suspicious data points before training."

The joint guidance also highlights issues such as incorrect information, duplicate records and “data drift”, statistics bias, a natural limitation in the characteristics of the input data.

U.S. Shuts Down LummaC2 Malware Network in Major Takedown



 

Microsoft

cyberattacks trending news cybercrime news FBI malware Microsoft

U.S. Shuts Down LummaC2 Malware Network in Major Takedown

In a major crackdown on cybercrime, the U.S. Department of Justice (DOJ), in coordination with the FBI and Microsoft, has dismantled a global malware operation known as LummaC2 by seizing five internet domains used to deploy the infostealer malware. LummaC2, notorious for stealing personal and financial data such as browser history, login credentials, and cryptocurrency wallet information, had compromised at least 1.7 million systems worldwide.

The takedown occurred over three days in May 2025, with two domains seized on May 19, followed by the rapid seizure of three additional domains after the malware operators attempted to restore access. These domains acted as user panels for cybercriminals leasing or buying access to the malware, allowing them to deploy it across networks and extract stolen data.

FBI Assistant Director Bryan Vorndran said, “We took action against the most popular infostealer service available in online criminal markets. Thanks to partnerships with the private sector, we were able to disrupt the LummaC2 infrastructure and seize user panels.”

DOJ Criminal Division head Matthew R. Galeotti added, “This type of malware is used to steal personal data from millions, facilitating crimes such as fraudulent bank transfers and cryptocurrency theft.” In a parallel move, Microsoft launched a civil legal action to take down 2,300 more domains believed to be linked to LummaC2 actors or their proxies.

Emphasising the value of collaboration, Sue J. Bai, chief of the DOJ’s National Security Division, said, “Today’s disruption is another instance where our prosecutors, agents, and private sector partners came together to protect us from the persistent cybersecurity threats targeting our country.”

The operation, led by the FBI’s Dallas Field Office and supported by several DOJ divisions, forms part of a broader U.S. strategy to counter cyber threats, including a State Department programme offering up to $10 million for information on individuals targeting U.S. critical infrastructure.

Global Operation Dismantles Lumma Malware Network, Seizes 2,300 Domains and Infrastructure



 

takedown

CloudFlare Cybersecurity DOJ Europol FBI Infostealer Lumma malware Microsoft takedown

Global Operation Dismantles Lumma Malware Network, Seizes 2,300 Domains and Infrastructure

In a sweeping international crackdown earlier this month, a collaborative operation involving major tech firms and law enforcement agencies significantly disrupted the Lumma malware-as-a-service (MaaS) operation. This effort resulted in the seizure of thousands of domains and dismantling of key components of Lumma's infrastructure across the globe.

A major milestone in the operation occurred on May 13, 2025, when Microsoft, through legal action, successfully took control of around 2,300 domains associated with the malware. Simultaneously, the U.S. Department of Justice (DOJ) dismantled online marketplaces used by cybercriminals to rent Lumma’s services, while Europol’s European Cybercrime Center (EC3) and Japan’s Cybercrime Control Center (JC3) helped take down Lumma’s infrastructure in their respective regions.

"Between March 16, 2025, and May 16, 2025, Microsoft identified over 394,000 Windows computers globally infected by the Lumma malware. Working with law enforcement and industry partners, we have severed communications between the malicious tool and victims," said Steven Masada, Assistant General Counsel of Microsoft's Digital Crimes Unit.

Cloudflare, one of the key players in the effort, highlighted the impact of the takedown.

“The Lumma Stealer disruption effort denies the Lumma operators access to their control panel, marketplace of stolen data, and the Internet infrastructure used to facilitate the collection and management of that data. These actions impose operational and financial costs on both the Lumma operators and their customers, forcing them to rebuild their services on alternative infrastructure,” Cloudflare stated.

The operation saw contributions from companies like ESET, CleanDNS, Bitsight, Lumen, GMO Registry, and law firm Orrick. According to Cloudflare, the Lumma malware misused their platform to mask server IP addresses that were used to siphon off stolen credentials and sensitive data.

Even after suspending malicious domains, the malware managed to bypass Cloudflare’s interstitial warning page, prompting the company to reinforce its security measures.

"Cloudflare's Trust and Safety team repeatedly flagged domains used by the criminals and suspended their accounts," the company explained.

“In February 2025, Lumma’s malware was observed bypassing Cloudflare’s interstitial warning page, which is one countermeasure that Cloudflare employs to disrupt malicious actors. In response, Cloudflare added the Turnstile service to the interstitial warning page, so the malware could not bypass it."

Also known as LummaC2, Lumma is a sophisticated information-stealing malware offered as a subscription-based service, ranging from $250 to $1,000. It targets both Windows and macOS systems, enabling cybercriminals to exfiltrate data from browsers and apps.

Once installed, Lumma can extract a broad range of data, including login credentials, credit card numbers, cryptocurrency wallets, cookies, and browsing history from popular browsers like Google Chrome, Microsoft Edge, Mozilla Firefox, and other Chromium-based platforms. The stolen data is packaged and sent to attacker-controlled servers, where it is either sold on dark web marketplaces or used in follow-up cyberattacks.

Initially spotted in December 2022 on cybercrime forums, the malware quickly gained traction. Cybersecurity firm KELA reported its rapid rise in popularity among cybercriminals.

IBM X-Force’s 2025 threat intelligence report revealed a 12% year-on-year increase in the number of stolen credentials being sold online, largely driven by the use of infostealers like Lumma. Phishing campaigns delivering such malware have surged by 84%, making Lumma the most dominant player in this threat landscape.

Lumma has been linked to major malvertising campaigns affecting hundreds of thousands of users and has been used by notorious groups such as the Scattered Spider cybercrime collective.

Recently, stolen data linked to Lumma has played a role in high-profile breaches at companies like PowerSchool, HotTopic, CircleCI, and Snowflake. In some cases, infostealer malware has been used to manipulate internet infrastructure, such as the Orange Spain RIPE account hijacking incident that disrupted BGP and RPKI configurations.

On the day of the crackdown, the FBI and CISA jointly issued a security advisory outlining indicators of compromise (IOCs) and detailing the tactics, techniques, and procedures (TTPs) employed by threat actors using Lumma malware.

FBI Warns Consumers to Replace Outdated Routers Hijacked by TheMoon Malware



 

Routers Threat

Cyber Security FBI FBI cybersecurity advisory FBI warning Malware Threat Malwares Router Hacking Router vulnerability Routers Routers Threat

FBI Warns Consumers to Replace Outdated Routers Hijacked by TheMoon Malware

The FBI has issued an urgent warning to American consumers and businesses: replace outdated internet routers immediately or risk becoming an unwitting accomplice in cybercrime. According to the agency, cybercriminals are actively targeting “end-of-life” routers—older models that no longer receive security updates from manufacturers—and infecting them with a sophisticated variant of TheMoon malware. Once compromised, these routers are hijacked and repurposed as proxy servers that enable criminals to mask their identities while conducting illegal activities online.

These include financial fraud, dark web transactions, and cyberattacks, all executed through unsuspecting users’ networks. Because these routers lack updated firmware and security patches, they are especially vulnerable to remote infiltration and control. TheMoon malware, which first emerged in 2014, has evolved into a more potent threat. It now scans for open ports and installs itself without requiring a password. Once embedded, it silently operates in the background, routing illicit activity and potentially spreading to other devices within the network. The malware’s stealthy behavior often leaves users unaware that their home or business network has become part of a criminal infrastructure.

The FBI specifically warned that routers manufactured in 2010 or earlier are particularly at risk—especially if features like remote administration are still enabled. Older Linksys models such as E1200, E2500, E1000, E4200, E1500, E300, E3200, WRT320N, E1550, WRT610N, E100, M10, and WRT310N are listed among the most vulnerable devices. Signs of a compromised router may include overheating, unexplained changes to settings, or erratic internet connectivity. In many cases, users may not even realize their equipment is outdated, making them easy targets for attackers seeking anonymous access to the web.

To defend against these threats, the FBI strongly advises replacing unsupported routers with modern, secure models. Users should also disable remote access functions, install the latest security patches, and use complex, unique passwords to further protect their networks. If anyone suspects their router has been hijacked or detects suspicious activity, they are encouraged to file a report with the FBI’s Internet Crime Complaint Center (IC3).

As cybercriminals become more innovative, relying on outdated technology increases exposure to serious digital threats. This latest alert is a stark reminder that cybersecurity begins at home—and that even something as common as a router can become a gateway for criminal exploitation if not properly secured.

Coordinated Action Targets DDoS-for-Hire Empire with Arrests and Seizures



 

Targeted DDoS

Cyber Arrest Cyber Security CyberCrime Cyerhackers FBI IP Address seizure Targeted DDoS

Coordinated Action Targets DDoS-for-Hire Empire with Arrests and Seizures

The Polish authorities have succeeded in dismantling a sophisticated criminal network offering distributed denial-of-service (DDoS) for-hire services to hit the cybercrime infrastructure hard. As the result of a coordinated operation, four people were arrested who were suspected of operating a number of illegal platforms which helped facilitate thousands of cyberattacks in the world.

It is believed that the accused was responsible for six different stressors and booters, namely Cfxapi, Cfxsecurity, Neostress, Jetstress, Quickdown, and Zapcut, which allowed users to launch DDoS attacks at a minimum of €10. During the period 2022-2025, these platforms were designed with ease of use in mind, so that any individual, regardless of their level of technical expertise, could be able to carry out large-scale cyberattacks.

A user was only required to enter a target IP address, choose the type and duration of an attack, and then submit payment. The service would then flood that system with excessive traffic, disrupting or disabling access to websites and digital infrastructure.

An extensive range of targets had been compromised in these attacks, including educational institutions, governmental organizations, private companies, and servers that hosted online video games. With the enforcement action, the international community has made a major strides in curbing the growing threat of for-hire cyberattack services, which continues to pose significant risks to the security and stability of the Internet.

When the suspects were arrested, authorities were able to reveal that they were directly connected to six DDoS-for-hire services, which are alleged to have enabled thousands of cyberattacks since the year 2022. An extensive range of targets were targeted by these attacks, including educational institutions, government organizations, private businesses, as well as online gaming platforms around the world.

In response to an international coordinated takedown, the platforms were taken down in the form of Cfxapi, CfxSecurity, NeoStress, JetStress, QuickDown, and ZapCut. Even though these services are often promoted as legitimate stress testing tools on the dark web and underground hacking forums, they are primarily exploited to carry out malicious distributed denial of service attacks (DDoS) against websites and servers.

With the help of such attacks, websites, servers, or networks are overwhelmed with an excessive amount of fake traffic that renders them inaccessible to genuine users, causing significant financial losses and disruptions to businesses. As a result of a collaborative effort among law enforcement agencies from Poland, Germany, the Netherlands, and the United States, the takedown operation highlighted the growing commitment globally to the dismantling of cybercrime networks and protecting digital infrastructure to prevent cybercrime.

In all, six illicit DDoS-for-hire platforms have been accused of operating by those arrested, aged between 19 and 22 years old. These platforms include Cfxapi, CfxSecurity, NeoStress, JetStress, QuickDown, and ZapCut. As a result of these services, individuals could access powerful distributed denial-of-service (DDoS) attacks for as little as €10. Using these platforms, anyone could disrupt any digital infrastructure with little effort on their part.

Since their introduction in 2022, these platforms have been implicated in attacks that have targeted schools, government websites, private companies, and gaming networks. As per the Central Cybercrime Bureau of Poland (CBZC), the suspects could end up serving a prison sentence of up to five years. It has been reported that law enforcement officers conducted coordinated raids throughout the country, in which a range of digital and physical assets, including computer equipment, mobile phones, SIM cards, payment cards, cryptocurrency wallets containing approximately $30,500 in digital currency, as well as cash and several vehicles, have been seized.

In contrast with conventional botnet-based attacks, these "booter" or "stresser" services utilize rented infrastructure instead of conventional botnets, allowing users who lack technical expertise to launch disruptive attacks simply by entering the target's IP address and submitting payment, without any additional technical expertise or training.

In consequence of this streamlined model, cybercriminals have had a significant drop in the barrier to entry, and the frequency and scale of attacks have increased as well. As part of the global crackdown Operation Poweroff spearheaded by Europol and the FBI, as well as participation from law enforcement agencies from several countries, the arrests are part of the latest phase of this crackdown. Authorities seized nine domains that were associated with illegal DDoS-for-hire services as part of the latest phase.

During a December 2024 operation, a total of 27 such platforms across 15 countries were shut down, 300 users were identified, and three administrators in France and Germany were arrested for using these platforms. In recent years, there has been a marked increase in both the level of technical sophistication and the operational scale of the DDoS-for-hire platforms.

A notable example is QuickDown's botnet add-on, released in 2023, which allows users to rent compromised networks, thus increasing their attack capabilities significantly. It is becoming increasingly common for platforms like QuickDown to deploy hybrid infrastructures that combine botnets of infected Internet of Things (Iot) devices with proxy networks built on the cloud, dedicated offshore servers, and geo-rotating IP addresses.

It is well known that the multifaceted architecture of the Internet greatly increases the intensity and duration of attacks, but it also complicates attempts to trace their sources in a very significant manner. There have been several documented instances in which targeted organisations have been subjected to sustained DDoS attacks lasting for days on end. It is common for these campaigns to use a combination of attack vectors to overload and deplete systems' resources, targeting DNS servers, firewalls, and web application firewalls (WAFS) in succession.

Despite their complexity and persistence, these types of attacks are still posing a significant threat to organizations, which is why it is so important to be prepared for them. Taking down major DDoS-for-hire platforms is a significant victory for international law enforcement, however experts warn that the victory is mostly tactical in nature, rather than a comprehensive one. There is no doubt that it disrupts the criminal infrastructure and serves as a deterrent, but the broader challenge remains.

Despite the fact that these platforms can be easily recreated, often operating across multiple jurisdictions, and there are new domains popping up every day to take their place from those that have been shut down, cybercriminals are constantly adapting and their infrastructure is decentralised, which is why they are outpacing current enforcement efforts. However, even though this operation represents a significant victory, it is just one step in what has been a long-term campaign against an increasingly agile cyber threat landscape that is constantly evolving.

The coordinated crackdown included the issuance of cease-and-desist orders by law enforcement agencies across the globe to users of DDoS-for-hire services. Among the warnings was the fact that they made it clear that participating in or enabling cyberattacks would result in legal consequences, as well as dispelling the myth that users could be anonymous by using cryptocurrencies and virtual private networks, as these technologies are not meant to protect individuals from identification.

This operation has been widely praised by cybersecurity professionals, who view it as an important step in weakening the infrastructure that supports DDoS-for-hire companies. A key component of the enforcement effort is the targeting of both service providers and end users, disrupting the broader supply chain of cybercrime.

An analyst from the Polish threat intelligence community noted that "Every seized domain, every arrested administrator, and every dismantled digital wallet adds friction to these illicit operations," thus indicating that "this initiative is not only a means of deterrence but also a means of enforcement." There has been a reaffirmation by authorities that sustained action is essential, and Europol and the Polish Central Cybercrime Bureau have indicated that more arrests and domain seizures will likely take place as investigations advance.

Furthermore, organizations worldwide are being urged to improve their strategies for addressing DDoS attacks and to report any suspected cyberattacks as soon as possible. A significant milestone in the battle against cybercrime has been reached with the takedown of this DDoS-for-hire operation, but continued vigilance and international cooperation remain crucial to counteract the ever-evolving threat landscape.

For the future, the dismantling of this DDoS-for-hire operation will likely serve as a wake-up call for government entities and private businesses alike to reevaluate the cybersecurity postures they have in place and invest proactively in robust digital defences. The role of law enforcement in disrupting cybercriminal infrastructure is critical, but for a system to be long-lasting resilient to such threats, it requires a shared responsibility approach—one in which governments, technology providers, business organizations, and end users all work in tandem to identify vulnerabilities, share threat intelligence, and implement timely countermeasures promptly.

Whenever an incident occurs, organisations must respond immediately rather than wait for it to escalate. The solution must be to adopt a proactive approach to incident response and recovery, which includes conducting regular risk assessments of the company, deploying adaptive DDoS mitigation tools, educating employees about how to respond to attacks, and establishing clear protocols for incident responses and recovery.

Moreover, the regulatory environment must evolve at the same time as the threat landscape so that legal loopholes can be closed and cross-border cooperation can be conducted swiftly. As digital systems become increasingly interconnected and vital to everyday functioning of a society, complacency has become a necessity. There is a key opportunity here, not just in celebrating tactical victories, but also in thinking about collective strategies in order to build a more secure, resilient, and safe ecosystem for the future that is based on cyber-security and resilience.

FBI Shares Details of 42,000 LabHost Phishing Domains



 

User Privacy

Data Breach Domain Provider FBI LabHost PHaas User Privacy

FBI Shares Details of 42,000 LabHost Phishing Domains

The LabHost cybercrime platform, one of the biggest worldwide phishing-as-a-service (PhaaS) platforms, was shut down in April 2024, but the FBI has disclosed 42,000 phishing domains associated with it. In order to raise awareness and offer signs of compromise, the published domains—which were registered between November 2021 and April 2024, when they were seized—are being shared.

Operations and removal of LabHost

LabHost is a significant PhaaS platform that sells access to a large number of phishing kits aimed at US and Canadian banks for $179 to $300 per month. It featured numerous customisation options, innovative 2FA bypass mechanisms, automatic SMS-based interactions with victims, and a real-time campaign management panel. Despite its launch in 2021, LabHost became a major player in the PhaaS market in late 2023/early 2024, surpassing established competitors in popularity and attack volume.

It is estimated that LabHost stole over 1,000,000 user credentials and over 500,000 credit card details. In April 2024, a global law enforcement campaign supported by investigations in 19 nations resulted in the shutdown of the platform, which had 10,000 customers at the time.

During the simultaneous searches of 70 residences, 37 people suspected of having links to LabHost were arrested. Although the LabHost operation is no longer active, and the shared 42,000 domains are unlikely to be used in malicious operations, the information remains valuable to cybersecurity firms and defenders. First, the domain list can be used to generate a blocklist, reducing the likelihood of attackers recycling or re-registering any of them in future attacks.

The list can also be used by security teams to search logs from November 2021 to April 2024 in order to detect earlier connections to these domains and find previously unknown breaches. Finally, the list can assist cybersecurity experts in analysing domain patterns in PhaaS systems, improving attribution and intelligence correlation, and providing realistic data for phishing detection model training. The list is shared with the warning that it has not been vetted and may contain errors.

"FBI has not validated every domain name, and the list may contain typographical or similar errors from LabHost user input," notes the FBI ."The information is historical in nature, and the domains may not currently be malicious. The FBI also noted that investigation of this list may show additional domains tied to the same infrastructure, therefore the list may not be exhaustive."

Hitachi Vantara Takes Servers Offline Following Akira Ransomware Attack



 

Ransomware

Akira Attack Breach Cloud Cybersecurity Data Encryption Extortion FBI Hitachi malware Ransomware

Hitachi Vantara Takes Servers Offline Following Akira Ransomware Attack

Hitachi Vantara, a subsidiary of Japan's Hitachi conglomerate, temporarily shut down several servers over the weekend after falling victim to a ransomware incident attributed to the Akira group.

The company, known for offering data infrastructure, cloud operations, and cyber resilience solutions, serves government agencies and major global enterprises like BMW, Telefónica, T-Mobile, and China Telecom.

In a statement to BleepingComputer, Hitachi Vantara confirmed the cyberattack and revealed it had brought in external cybersecurity specialists to assess the situation. The company is now working to restore all affected systems.

“On April 26, 2025, Hitachi Vantara experienced a ransomware incident that has resulted in a disruption to some of our systems," Hitachi Vantara told BleepingComputer.

"Upon detecting suspicious activity, we immediately launched our incident response protocols and engaged third-party subject matter experts to support our investigation and remediation process. Additionally, we proactively took our servers offline in order to contain the incident.

We are working as quickly as possible with our third-party subject matter experts to remediate this incident, continue to support our customers, and bring our systems back online in a secure manner. We thank our customers and partners for their patience and flexibility during this time."

Although the company has not officially attributed the breach to any specific threat actor, BleepingComputer reports that sources have linked the attack to the Akira ransomware operation. Insiders allege that the attackers exfiltrated sensitive data and left ransom notes on infiltrated systems.

While cloud services remained unaffected, sources noted that internal platforms at Hitachi Vantara and its manufacturing arm experienced disruption. Despite these outages, clients operating self-hosted systems are still able to access their data.

A separate source confirmed that several government-led initiatives have also been impacted by the cyberattack.

Akira ransomware first appeared in March 2023 and swiftly became notorious for targeting a wide range of sectors worldwide. Since its emergence, the group has reportedly compromised more than 300 organizations, including high-profile names like Stanford University and Nissan (in Oceania and Australia).

The FBI estimates that Akira collected over $42 million in ransom payments by April 2024 after infiltrating over 250 organizations. According to chat logs reviewed by BleepingComputer, the gang typically demands between $200,000 and several million dollars, depending on the scale and sensitivity of the targeted entity.

Keywords: ransomware, cybersecurity, Hitachi, Akira, cloud, breach, data, FBI, malware, attack, encryption, extortion, hacking, disruption, recovery, infrastructure, digital, protection

US Targets Chinese Hacker with $10 Million Bounty.



 

Salt Typhoon

Cyber Security CyberCrime Cyberhackers CyberThreat FBI Million Dollar MPS Salt Typhoon

US Targets Chinese Hacker with $10 Million Bounty.

There has been a rare and pointed move by the Federal Bureau of Investigation (FBI), which highlights the growing threat of state-sponsored cyberespionage. This was announced through a public announcement earlier this week, stating they would offer a reward of $10 million for credible information that could lead to the identification or capture of individuals linked to the highly sophisticated cyberespionage group Salt Typhoon, which is headquartered in China.

It is an unprecedented move within the US justice and intelligence communities to counter foreign cyber operations directly targeting the nation's critical infrastructure in a way that signals a growing urgency in the fight. As reported in an official statement released by the FBI, Salt Typhoon is suspected of orchestrating a series of covert cyber intrusions over the past year.

The attackers gained access to sensitive data from multiple telecommunications networks in the United States, gaining an unauthorised level of control. It has been reported that the group had been able to monitor internal communications, gather classified data, and possibly disrupt essential services as a result of these operations, posing a serious threat to national security and public trust in the reliability of American digital infrastructure.

In this announcement, the U.S. State Department announced a reward for individuals who participated in the In the United States, the Rewards for Justice program is an important part of a comprehensive strategy to deter and expose those who are engaged in cybercrime on behalf of foreign governments. Analysts point out that the publicising of the bounty represents a significant shift in the U.S.'s approach to dealing with persistent cyber threats, particularly those emanating from China.

A strong diplomatic message is also sent by this act: the government will not tolerate state-sponsored cyber attacks and will aggressively pursue those responsible for them through international cooperation, intelligence sharing, and criminal prosecution. Among the ongoing global battles for cyberspace dominance, where technology, geopolitics, and national defence increasingly intersect, this move by the FBI marks a significant turning point.

There is a clear indication that the U.S. is adamant about raising the costs and consequences of cyberwarfare against digital infrastructure, as it becomes increasingly important to economic stability and national security. During the past six months, a series of high-impact cyberattacks has led to the establishment of the Chinese state-sponsored cyber-espionage group known as Salt Typhoon, which has emerged as one of the most prominent and dangerous hacking collectives on the global stage.

The Salt Typhoon cyber-attack is associated with multiple cyber-intrusions targeting the U.S. national interest. Salt Typhoon is allegedly under the authority of China's Ministry of State Security. As well as compromising a presidential campaigning device of a candidate for president, and exploiting critical vulnerabilities within the nation's telecommunications network, a number of critical vulnerabilities were exploited as well.

It has been widely recognised that Salt Typhoon is a highly sophisticated persistent threat (APT) group, but it has also acquired other aliases in cybersecurity circles as FamousSparrow, Ghost Emperor, and UNC2286, all of which are indicative of the complex and deceptive organisational structure of the group. Due to these escalating threats, the Federal Bureau of Investigation (FBI) has officially announced a $10 million reward for information that leads to the identification or arrest of individuals involved with Salt Typhoon as a result of this escalating threat.

The reward part of the U.S Department of State's Rewards for Justice program is specifically aimed at foreign governments or their agents who take part in malicious cyber activities that violate the Computer Fraud and Abuse Act and pose a threat to critical infrastructure in the United States. An FBI security advisory issued by the FBI encourages members of the general public and cybersecurity professionals to share any information they may have about Salt Typhoon's operations.

Specifically, it emphasizes that the specific individuals behind the campaigns should be identified in order to prevent further crime. In order to learn more about the criteria for eligibility and reporting relevant information, the Rewards for Justice platform should be consulted. This strategic move represents the renewed commitment of the United States authorities to take aggressive action against cybercriminals backed by state entities and strengthen the nation's digital defences.

According to the U.S. government, three indictments are now on public display, making it clear how widespread and coordinated China's state-sponsored cyber operations are. Eighteen people have been charged with operating a vast campaign of cyber-espionage against American interests in three different cases. A total of three groups of accused have been identified, including two members of the China Ministry of Public Security (MPS) as well as two employees of a nominally private Chinese company, Anxun Information Technology Co Ltd (also known as i-Soon), and eight suspected members of the APT27 group, an advanced persistent threat group.

In cybersecurity circles, this group is referred to as Bronze Union, Emissary Panda, Lucky Mouse, Iron Tiger, Silk Typhoon, and Threat Group 3390, all of which are aliases associated with China's Ministry of State Security (MSS), which reflect its covert and multifaceted operations. It has been confirmed by the Department of Justice that the i-Soon technicians were in charge of performing unauthorised computer intrusions on behalf of the MPS and the MSS, according to the Department of Justice.

It has been revealed by the indictments that these actors have not only carried out state-directed attacks, but they have also committed independent data thefts to gain a personal advantage. As a result of the large financial payment made, the stolen information was turned over to the Chinese authorities in exchange for the payment. Throughout China's broader espionage ecosystem, it is becoming increasingly difficult to distinguish between government-backed cyber operations and contractor-led cyber operations. In light of the revelations, the U.S. government is continuing to work on exposing and deterring foreign cyber actors who are posing a threat to the country's security.

In addition to these initiatives, the State Department's Rewards for Justice program is offering financial incentives to those who provide information that could lead to the identification and arrest of those engaged in such activities. Washington is taking steps to hold cybercriminals accountable and safeguard critical American infrastructure from sustained foreign intrusion, regardless of their affiliation or geographical location, with the indictments and corresponding public appeals.

As the global cyber landscape grows increasingly volatile, the United States is taking a stronger stance to counter the increasing threats that are coming from state-sponsored organisations. As a result of coordinated legal action, information disclosure, and strategic financial incentives, U.S. authorities are serving notice that hostile cyber operations, particularly those employed by foreign governments, will face tangible consequences if they are not stopped. As a result of the unsealing of indictments, which were accompanied by a substantial bounty of $10 million, not only does this demonstrate the seriousness of the threat from groups like Salt Typhoon and APT2 but also highlights the need for increased international collaboration in tracking such actors and neutralising them.

It is with great significance that one takes note of how modern conflict is evolving as digital infrastructure is both a battlefield and a target. Public awareness and cooperation must play an important role in the broader defence strategy as the FBI and the Department of State intensify their efforts to expose and disrupt these cyber-espionage networks.

Even though many people are concerned about the threat of state-sponsored intrusions, it is highly urged that government agencies, private sector companies, and cybersecurity professionals remain vigilant and proactive in reporting suspicious activities. The threat of cyber warfare is becoming more and more prevalent with the emergence of more cyberterrorist attacks around the world. There can be no effective protection against such attacks without collective effort.

Cybersecurity Alert Says Fake PDF Converters Stealing Sensitive Information



 

Privacy

Cyberhackers Cybersecurity CyberThreat Fake PDF FBI information stealer PDF Exploits Privacy

Cybersecurity Alert Says Fake PDF Converters Stealing Sensitive Information

Online PDF converters provide efficient conversions of documents from one file format to another, and millions of individuals and businesses use these services to do so. However, this free service also poses significant cybersecurity risks despite its convenience. According to the Federal Bureau of Investigation's (FBI) advisory issued a month ago, cybercriminals have been increasingly exploiting online file conversion platforms to spread malware to consumers and businesses.

As a result of the threat actor's embedding of malware into seemingly legitimate file conversion processes, data, financial information, and system security are being put at serious risk as a result. As the popularity of these services grows, so does the potential for widespread cyberattacks. Thus, users must exercise heightened caution when choosing tools for managing digital assets online and adhere to best practices when protecting their digital assets when selecting online tools.

Among the many concerns regarding cyber threats that have recently erupted in the form of a report by a cybersecurity firm, a sophisticated malware campaign has been discovered that takes advantage of counterfeit PDF-to-DOCX conversion platforms to compromise users and expose their data.

Using highly capable malware, this campaign can steal a wide variety of sensitive data, such as passwords, cryptocurrency wallets, and other confidential personal data from websites. This threat emerged in a matter of time following a public advisory issued by the Denver division of the FBI, warning the public of the increase in malicious file conversion services being used to spread malware. As a result of the findings of cybersecurity firm, cybercriminals have meticulously developed deceptive websites like candyxpdf[.]com and candyconverterpdf[.]com, which imitate the appearance and functionality of the legitimate file conversion service pdfcandy.com, to exploit the public.

PDFcandy.com's original platform, well-known for its comprehensive PDF management tools, is reportedly attracting approximately 2.8 million visitors per month, making it a prime target for threat actors seeking to exploit its user base as a means of gaining a competitive advantage. A significant aspect of the platform is the significant number of users based in India, where 19.07% of its total traffic comes from, equivalent to approximately 533,960 users per month. As a result of this concentration, cybercriminals operating fraudulent websites have an ample pool of potential victims to exploit.

According to data collected in March of 2025, the impersonating sites fetched approximately 2,300 and 4,100 visitors from unsuspecting users, indicating an early but concerning growth among those unaware of the impersonating sites. A growing number of sophisticated threats are being employed by threat actors, as indicated by these developments. They emphasize the need for heightened user vigilance and strong cybersecurity measures at all levels.

An FBI report has highlighted the growing threat posed by fraudulent online document conversion tools, which have been issued by the Federal Bureau of Investigation (FBI). This is in response to an alert recently issued by the FBI Denver Field Office, which warns of the increasing use of these seemingly benign services not just by cybercriminals to steal sensitive user information, but also to install ransomware on compromised devices, in more severe cases. As a result of an alarming rise in reports concerning these malicious platforms, the agency issued a statement in response.

There has been an increase in the number of deceptive websites offering free document conversion, file merging, and download services by attackers, as indicated in the FBI's advisory. It is important to note that although these tools often perform the file conversions promised, such as converting a .DOC file into a. A PDF file or merging multiple .JPG files into one.PD, the FBI warns that the final downloaded files may contain malicious code. It can be used by cybercriminals to gain unauthorised access to the victim’s device, thereby putting the victim in an extremely dangerous position in terms of cybersecurity.

The agency also warns that documents that are uploaded to these platforms may contain sensitive information such as names, Social Security numbers, cryptocurrency wallet seeds and addresses, passphrases, email credentials, passwords, and banking information, among others. In addition to identity theft, financial fraud, and subsequent cyberattacks, such information can be exploited to steal identities, commit financial fraud, or commit further cyberattacks.

The FBI Denver Field Office confirmed in a report that complaints were on the rise, with even the public sector reporting incidents recently in the metro Denver area. During her remarks, Vicki Migoya, FBI Denver Public Affairs Officer, pointed out that malicious actors often use subtle methods to deceive users. For instance, malicious actors alter a single character in a website URL or substitute suffixes such as “INC” for “CO” to create a domain name that is very similar to legitimate ones. Additionally, as search engine algorithms continue to prioritise paid advertisements, some of which may lead to malicious sites, users searching for “free online file converters” should be aware of this warning, as they may be particularly vulnerable to threats.

Despite the FBI's decision to withhold specific technical details so as not to alert threat actors, the agency confirmed that such fraudulent tools remain a preferred method for spreading malware and infecting unsuspecting computer users. Upon investigating the malware campaign further, the FBI discovered that the deceptive methods employed by the fraudulent websites to compromise users were deceptively deceptive.

When a user visits such websites, he or she is required to upload a PDF document to convert it into Word format. It is then shown that the website has a loading sequence that simulates a typical conversion process, to give the impression that the website is legitimate. Additionally, the site presents users with a CAPTCHA verification prompt as well, a method of fostering trust and demonstrating that the website complies with common security practices seen on reputable websites. Nevertheless, as soon as the user completes the CAPTCHA, they are deceptively instructed to execute a PowerShell command on their system, which is crucial to begin the malware delivery process.

After the user clicks on Adobe. A zip file is then installed on the user's device and contains a malware infection called ArechClient, a family of information-stealing malware which is associated with the Sectopratt malware family. Known to be active since 2019, this particular strain of malware is specifically designed to gather a wide range of sensitive data, including saved usernames and passwords, as well as cryptocurrency wallet information and other important digital assets.

Some of these malicious websites have been taken offline by authorities in recent weeks, but a recent report by a known cybersecurity firm states that over 6,000 people have visited these websites during the past month alone. Clearly, cybercriminals are actively exploiting this vulnerability at scale and with a high degree of frequency. Users must verify the legitimacy of any online conversion service they use due to the increasing sophistication of such attacks.

During the time of a web-based search, it is essential to make sure that the website is legitimate, not a phoney copy that is being manipulated by hackers. If an unknowing compromise has taken place on a device, action must be taken immediately, such as isolating it and resetting all the associated passwords, to minimise any damage done. For sensitive file conversions, cybersecurity experts recommend using trustworthy offline tools whenever possible to reduce their exposure to online attacks.

As cyber threats to online file conversion services have become increasingly sophisticated, users must be increasingly vigilant and security-conscious when conducting digital activities. For all individuals and organisations to feel comfortable uploading or downloading any files to a website, they are strongly encouraged to check for its authenticity before doing so. Among the things that users should do is carefully examine URLS for subtle anomalies, verify a secure connection (HTTPS), and favour trusted, well-established platforms over those that are less-known or unfamiliar.

In addition, users should avoid executing any unsolicited commands or downloading unexpected files, even when the website seems to be a genuine one. It is crucial to prioritise the use of offline, standalone conversion tools whenever possible, especially when dealing with sensitive or confidential documents. If it is suspected that a compromised device or computer has been compromised, immediate steps should be taken to isolate the affected device, reset all relevant passwords, and contact cybersecurity professionals to prevent a potential breach from taking place.

In the age of cybercriminals who are constantly enhancing their tactics, fostering a culture of proactive cyber awareness and resilience is no longer optional, but rather a necessity. To combat these evolving threats, it will be imperative for organisations to consistently train staff, update security protocols, and effectively use best practices. Users need to exercise greater caution and make informed decisions to prevent themselves as well as their organisations from the far-reaching consequences of cyberattacks in the future.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Showing result(s) for

Popular Posts

Pages

Menu Item

Stern doxxed

About GangExposed

Leaked bought info to expose IDs

Hackers used AVCheck to see malware efficiency

The site was used globally by threat actors

Details about the operation

Operation Endgame

Regulatory AI Policy

Addressing New Risks

Key Issues