Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label FBI. Show all posts
Hacker attack
Account security AI Phishing Attacks Browser VPN Security consent Credential Phishing Cyber Attacks cybercriminals FBI Hacker attack

OAuth Phishing Attacks Bypass Passwords by Turning User Consent Into a Security Threat

 

Cybercriminals are targeting something more difficult to protect with traditional password advice: the user consent. New phishing techniques called OAuth consent phishing allow the intruders to gain persistent access to the targeted accounts without stealing their passwords, according to a recent FBI warning. The bureau’s Internet Crime Complaint Center described the technique in a September 1 public service announcement, noting that it has been observed since late 2025 and is targeting prominent individuals and their families and personal contacts. 

The FBI describes OAuth consent phishing as accessing accounts without requiring the user’s password. OAuth is the framework that allows the services to use the familiar “Sign in with” or “Continue with” authentication options. It allows the legitimate third-party applications to request access to the resources like emails, calendars, files, and cloud storage without requiring the users to share their passwords. 

The attackers are taking advantage of the legitimate procedure to get account access. The attack typically starts with sending a message that appears to be sent from a trusted contact or service. The victim clicks on the link and enters their credentials on a real login page of a trusted site. The user is then directed to an app authorization screen asking to allow specific permissions such as reading emails or accessing files. 

If the victim approves the request, the intruder receives an OAuth authorization token with the permissions granted. This changes the response needed to compromise. Unlike with traditional credential phishing, changing the password will not eliminate the malicious OAuth token. The FBI recommends that the victims revoke the unauthorized authorization through their application security settings. Changing the credentials or using a new MFA code will not remove the granted access. The campaigns can also scale. 

In recent months, security researchers have documented 10 to 15 new operations of this type every 24 hours in recent months, with several million attacks recorded during a single four-week period earlier this year. Phishing kits such as Kali365 and EvilTokens have further lowered the technical barrier for attackers. Security tools can help address some of the attack steps, without preventing the user from voluntarily approved malicious permission request. 

The network can block known phishing domains, malicious redirectors, and scam infrastructure before the victim reaches them. Dark web monitoring can also alert users if their email addresses appear on cybercrime forums after an account compromise. The change highlights a shortcoming in traditional account-security advice: protecting passwords and MFA remains important, but users must scrutinize the applications and permissions they authorize.
Read more »
foreign cyber espionage
CISA Cyber Security department of energy FBI foreign cyber espionage

Foreign Hackers Got Into Two Colorado Water Systems, Messed With Pump Controls and Killed the Alarms

 




Foreign actors broke into the industrial control systems of two small private water utilities in Colorado last month, altered pumping cycles, changed equipment settings, and shut off the alarms that would have told operators something was wrong. The state confirmed the incidents on Friday. It has not named the utilities or the attackers.

Both systems are privately owned and serve fewer than 200 people each. The intrusions happened in late August. According to the governor's office, the attackers disabled remote access, switched off alarms, and changed how water was being pumped before operators caught on and regained control. Water quality and treatment were not affected at either location.

"These were brief incidents and the risks were quickly addressed by the providers themselves, who subsequently alerted the state," said Ally Sullivan, a spokeswoman for Governor Jared Polis. "To our knowledge, treatment processes and water quality were not impacted at either provider."

Colorado officials did not name a suspect. Sullivan said the office "cannot confirm what foreign actors may have been involved," but pointed to a CISA-tracked Iranian-backed group that has been working to access drinking water and wastewater systems across the country. Federal authorities have made no formal attribution in the Colorado case.


Part of Something Bigger

Colorado is the latest state in a list that has now reached at least 12 reporting intrusions into water system controls this year. The EPA says more than 100 drinking water and wastewater systems have been hit in 2026, most accessed through programmable logic controllers, or PLCs, connected to the open internet via cellular modems, often without the utilities realizing it.

The summer's single worst episode came on July 26 and 27, when attackers hit more than 30 communities in Minnesota in what state IT officials called a coordinated assault. At least four cities publicly confirmed disruptions. One plant went offline entirely; others dropped to manual operation. In Georgia, hackers took down a pump station, cutting pressure enough that residents were advised to boil water before using it. No one reported getting sick.

The FBI and EPA issued a joint warning on July 30 describing attackers who remotely changed IP addresses and passwords on exposed controllers, locking operators out. In some cases, the intrusions created conditions where untreated groundwater could have entered distribution pipes.

CISA said it tracked attacks against more than 100 internet-exposed water sector systems in July alone, the majority accessed through PLCs attached directly to cellular modems.


The Group Investigators Are Watching

The most scrutinized suspect is CyberAv3ngers, a threat group formally tied to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command. The U.S. Treasury sanctioned six of its senior officials in February 2024. The State Department has offered $10 million for information on the group's activities.

The group has run through four documented phases since 2020. It started by exploiting default passwords on Israeli-made water utility controllers, moved on to deploying custom malware called IOCONTROL against industrial and IoT devices, and this year shifted to actively exploiting an authentication bypass flaw in Rockwell Automation's widely used Logix PLCs. No vendor patch exists for that vulnerability.

Six federal agencies, CISA, the FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command, warned jointly on April 7 that Iranian-affiliated actors were actively hitting internet-facing PLCs across water, energy, government, and manufacturing sites.


Congress and Industry Push Back

Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act in August, which would give the EPA authority to audit utilities and mandate corrective action. The bill authorizes $300 million annually through existing water infrastructure funds.

At DEF CON, the National Rural Water Association launched the Water Watch Center, pairing five managed security firms with small utilities at no cost. The program targets systems serving under 10,000 people, which make up 91 percent of the country's roughly 50,000 community water systems.

Denver Water, which supplies about 1.5 million people across the metro area, told Axios it evaluated the threat after the Colorado disclosure and found its systems unaffected. Federal investigators are working with state officials to determine how the two utilities were accessed.

Read more »
NightmareStresser
Cyber Security DDOS Attacks FBI NightmareStresser

FBI Seizes NightmareStresser DDoS-for-Hire Domains in Global Crackdown

 

The U.S. Department of Justice has announced the court-authorized seizure of internet domains linked to “NightmareStresser,” one of the world’s longest-running Distributed Denial of Service (DDoS) for-hire services. The operation, led by the FBI Anchorage Field Office with support from the Royal Canadian Mounted Police, targets so-called “booter” and “stresser” platforms that enable paying customers to launch powerful cyberattacks against individuals, organizations, and critical online infrastructure across Alaska and globally. 

According to the seizure warrant affidavit, NightmareStresser was used to carry out hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022. These services lower the barrier to entry for cybercrime by allowing users with minimal technical expertise to disrupt internet connections, knock targeted devices offline (“booting”), and degrade or completely interrupt access to websites and online services. Victims have included schools, government agencies, gaming platforms, and millions of everyday users whose connectivity was affected by these coordinated attacks.

The takedown forms part of Operation PowerOFF, an ongoing international law enforcement initiative aimed at dismantling criminal DDoS-for-hire infrastructures and holding both administrators and users accountable. Over the past eight years, federal prosecutors and investigators in Anchorage and Los Angeles have charged twelve defendants involved in facilitating DDoS-for-hire services and seized more than 100 associated domains. This latest action expands on those efforts by targeting all known booter sites, shutting down as many as possible, and coupling enforcement with a public education campaign on the harms caused by illegal DDoS activity. 

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney are prosecuting the case in the District of Alaska. The Justice Department emphasizes that booter and stresser services not only harm direct targets but also undermine broader internet reliability and safety. As digital dependence grows, such crackdowns signal a sustained push to disrupt the ecosystem enabling low-cost, high-impact cyberattacks—and to deter would-be offenders by removing the domains and infrastructure these services rely on to operate.
Read more »
Hacker attack
Cyber Attacks cybersecurity threats FBI FBI FBI cyberattack Gulf Coast Hacker attack

Cyberattack on Tanker Prompts Coast Guard-FBI Security Boarding

 

A tanker crossing the Gulf of Mexico was boarded by U.S. Coast Guard and FBI personnel last month after its onboard network came under attack from hackers, the Coast Guard has confirmed. The confirmation followed a Wall Street Journal report indicating that at least two U.S.-bound tankers had been targeted in separate cyber incidents. Bloomberg News named one of the affected vessels as VL Prosperity, while Iran's state-backed outlet Mehr reported the ship went dark for a day and a half after losing its communications systems. Neither the FBI nor several other federal agencies contacted for comment addressed the incident directly, instead referring inquiries to the Coast Guard. 

A spokesperson there said the boarding was carried out to verify that the ship's technology systems remained intact after signs emerged that the network had been infiltrated by actors operating from outside the country. The operation took place on August 21 and involved a joint team: Coast Guard law enforcement officers, a cyber protection unit, a vessel inspector, and cyber specialists from the FBI. The spokesperson emphasized that no disruptions to the ship's operations, structural stability, crew safety, or the surrounding environment had been identified so far. Coast Guard officials declined to elaborate on how the breach occurred, who may have been responsible, or whether the tanker boarded that day was in fact VL Prosperity. 

A second vessel was reportedly boarded three days later, on August 24, per the Journal's reporting. Mehr's account places the origin of the attack earlier, on August 7, while the Liberian-flagged VL Prosperity was passing through the Strait of Gibraltar en route from Egypt to a U.S. port. One crew member described to Mehr how the intruders were reportedly able to remotely increase engine speed and shut down tanks holding fuel and engine oil. Analysts cited by the outlet, without offering direct evidence, tied the episode to broader tensions between the U.S. and Iran, though no group has publicly claimed involvement. Bloomberg later placed the tanker off the Texas coastline. The Coast Guard said it remains in contact with port operators, ship owners, and regional maritime partners to keep operations running smoothly. 

A separate incident struck just a day earlier, when North Carolina Ports disclosed that an external hacker or group had breached its IT infrastructure, pushing staff to switch to manual processes. The organization said it activated emergency protocols and looped in both state agencies and the Coast Guard. Maritime infrastructure worldwide has increasingly become a target for ransomware operators over the past several years, a trend tied to the sector's growing reliance on connected systems. 

The Port of Seattle famously refused to pay hackers who disrupted its airport and seaport operations around Labor Day in 2024. Similar attacks hit European ports and shipping firms Royal Dirkzwager and DNV in 2023, while Oiltanking and Mabanaft both declared force majeure after 2022 cyber incidents. Freight company Expeditors International also spent months recovering operational systems following its own attack.
Read more »
KrebsonSecurity
Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

 



The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Read more »
vulnerabilities and exploits
China Linked Threats FBI Hacking Lumen security QScan QTFY vulnerabilities and exploits

FBI Disrupts QTFY Hacking Network Targeting U.S. Organizations




The U.S. Department of Justice (DoJ) and Federal Bureau of Investigation (FBI) have disrupted two hacking platforms operated by a China-linked threat group that were used to conduct reconnaissance, compromise vulnerable systems and conceal attacks against U.S. government agencies, critical infrastructure and other sensitive organizations.

The platforms, QScan and QTRouter, have been attributed to QTFY, a Chinese state-sponsored hacking group linked to Nanjing Xinjiuwei Network Technology Company. According to U.S. authorities, QTFY activity has targeted organizations including NASA, the Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health and the U.S. Senate.

Lumen Black Lotus Labs, which tracked the infrastructure for more than 18 months, said QTFY activity dates back to at least May 2018. The researchers described the group as an infrastructure "quartermaster" that developed reusable systems for reconnaissance, exploitation and traffic obfuscation.


QScan automated reconnaissance and exploitation

QScan formed the reconnaissance component of the operation. The platform scanned internet-connected systems and IoT devices for vulnerabilities before automatically compromising susceptible devices and incorporating them into the QTRouter network.

The FBI said QScan was also used to identify vulnerabilities in victim networks. Its infrastructure included servers responsible for distributing scanning tasks to worker nodes and collecting completed results.

The scale of the operation allowed QTFY to conduct reconnaissance across large numbers of systems. Lumen identified scanning activity spanning more than 130 countries, with targets including government, defense, aerospace, healthcare, financial, energy and research organizations.


QTRouter concealed attackers' origins

Compromised devices identified through QScan were subsequently used by QTRouter as proxy nodes. The network combined hacked IoT devices with commercial proxy services and leased virtual private servers (VPSs), allowing malicious traffic to pass through multiple intermediary systems.

This architecture made an intrusion originating from China appear to come from an internet connection located elsewhere. In some cases, QTRouter could route traffic through systems geographically close to the targeted organization, making the activity appear more consistent with legitimate local traffic.

QTRouter operated on routers running customized OpenWrt software and used the Clash proxy framework to establish connections. Operators could select available nodes and chain them together, creating multiple layers between themselves and their targets.

The FBI said this combination of compromised IoT devices and legitimate commercial proxy infrastructure made malicious traffic difficult to distinguish from normal internet activity.


Attackers exploited new and older vulnerabilities

QTFY's attack chain involved both recently disclosed and long-standing vulnerabilities. The vulnerabilities identified by investigators included flaws in Ivanti Connect Secure, Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange Server, F5 BIG-IP, Kentico CMS, Apache Log4j, Atlassian Confluence, Check Point Quantum Gateway, CrushFTP and BeyondTrust Remote Support.

After obtaining initial access, QTFY actors used remote access trojans, web shells and legitimate credentials to maintain persistence.

The infrastructure could subsequently provide concealed access into victim networks through nearby compromised IoT devices. QTBotnet also allowed operators to control infected systems, execute commands and conduct distributed denial-of-service attacks.


Four-part infrastructure supported QTFY operations

Lumen identified QScan and QTRouter as part of a larger architecture that also included Fast Labyrinth and QTProxy.

Fast Labyrinth incorporated commercial proxy infrastructure into encrypted relay paths, while QTProxy managed operational nodes and allowed operators to configure routes toward selected targets.

The researchers compared the architecture to an operational relay box, or ORB, network. Such systems use compromised devices and leased infrastructure as rotating relay points, making traditional IP blocklists and location-based defenses less effective.

Lumen said the infrastructure demonstrated an increasingly industrialized model of China-linked cyber operations, in which reusable and shared services can provide reconnaissance and anonymity at global scale.


FBI seized domains used by the platforms

The disruption targeted domains hard-coded into QScan and QTRouter, including infrastructure used to distribute scanning tasks and administer proxy connections.

By seizing these domains through court-authorized action, U.S. authorities disrupted communication between the platforms and their operators, causing the systems to cease functioning.

Investigators also linked QTFY to Chinese cyber-brokering networks where exploits, malware and access to compromised organizations were allegedly traded. Nanjing Xinjiuwei was described by U.S. authorities as an enabling company with relationships across China's cyber ecosystem and connections to former People's Liberation Army personnel.

QTFY activity reportedly continued into June 2026, when actors targeted a U.S. election system.

The disruption demonstrates how China-linked threat actors are increasingly relying on distributed infrastructure rather than fixed attacker-controlled servers. While domain seizures can interrupt an operation, the reuse of compromised IoT devices, commercial proxies and leased servers means defenders will need to monitor behavior and network relationships rather than rely solely on static IP-based blocking.

Read more »
WiFi
Credential stealing fake network FBI Hotel Wi-Fi Attacks https MFA Phishing travel VPN WiFi

Think Hotel Wi-Fi Is Safe? Hackers Have Several Ways to Prove You Wrong

 



For many travelers, connecting to hotel Wi-Fi is one of the first things they do after checking in. But while some guests use the network for banking and work, others avoid sensitive activity unless they are connected through a VPN.

So, how safe is hotel Wi-Fi?

Cybersecurity experts say the answer is more nuanced than simply calling public Wi-Fi dangerous. Modern encryption has reduced many of the risks associated with public networks, but hotel Wi-Fi can still expose travelers to rogue networks, phishing attacks, poorly configured infrastructure and vulnerable devices.

In many cases, the biggest risk may not be the network itself, but how the user connects to and behaves on it.


The first risk can come from a fake network

Security analyst Udaya Vemuri advises travelers to be cautious about joining a network simply because its name appears to belong to the hotel.

Attackers can create fake Wi-Fi networks with names almost identical to legitimate hotel networks. The technique, known as an "evil twin" attack, can trick guests into connecting to an attacker-controlled access point.

The FBI's Internet Crime Complaint Center warned about this threat in a 2020 advisory, noting that criminals can create networks resembling legitimate hotel Wi-Fi and potentially monitor activity or redirect victims to fraudulent login pages. The agency also warned that hotel guests have limited control over the security of the infrastructure they are using, which may prioritize convenience over stronger security practices.

Travelers should therefore confirm the exact Wi-Fi name with hotel staff before connecting rather than selecting the network that merely looks familiar.


Simply sharing a network does not mean you are compromised

Dahvid Schloss, chief operating officer of cybersecurity firm Suzu Labs and a former government hacker who has security-tested hotel chains, takes a less alarmist view.

Schloss compares hotel Wi-Fi with other public networks, such as those in coffee shops. In his assessment, the likelihood of being attacked simply because another malicious user is connected to the same network is low.

That distinction matters because the common image of hackers automatically reading passwords from public Wi-Fi is outdated.

The Federal Trade Commission says most websites now use encryption, meaning information sent between a device and a legitimate website is generally protected even when the underlying network is public. HTTPS can therefore provide substantial protection against traffic interception.

However, HTTPS does not prove that a website is legitimate. Attackers can create encrypted fraudulent websites and use phishing or redirection to persuade victims to submit credentials.

This means a traveler can still be exposed even when the connection itself appears encrypted.


Fake hotel portals can steal credentials

Hotels commonly use captive portals that redirect guests to a webpage after they connect to Wi-Fi. These pages may request a room number, surname, email address or access code.

Because travelers expect this process, attackers can imitate it.

A rogue network may display a fake hotel login page or redirect users to a fraudulent Microsoft 365, email or banking page. In such cases, the attacker does not necessarily need to break encryption. The victim may simply be tricked into providing the information.

This makes phishing and social engineering an important part of the hotel Wi-Fi threat.


Network security is not a perfect guarantee

Recent research also shows why travelers should not assume that network-level protections make public Wi-Fi completely secure.

Researchers at the University of California, Riverside reported in February 2026 that weaknesses in Wi-Fi client isolation can, under certain conditions, allow attackers to bypass protections designed to prevent devices on the same network from interacting with one another.

Their AirSnitch research demonstrated techniques that could potentially allow an attacker to intercept or manipulate traffic despite client isolation.

The findings do not mean every hotel network is vulnerable, but they reinforce an important point: users should not rely entirely on the security mechanisms implemented by a public network.


Your device can be the weakest link

Both experts place considerable emphasis on user behavior.

Schloss argues that laptops can be particularly vulnerable to poor security habits because they are frequently used to download files, install software and access corporate systems. Smartphones are not immune, but their operating systems often impose stronger application restrictions.

The FBI recommends updating operating systems and applications before travel, keeping security software current, backing up important data, disabling Bluetooth when unnecessary and preventing devices from automatically reconnecting to public networks.

Automatic reconnection is particularly important because a device may join a previously saved network without the user consciously verifying that it is legitimate.

Browser warnings should also never be ignored. A certificate warning, unexpected redirect or request to install software can indicate that something is wrong with the connection or destination.


Use cellular data for sensitive activity

Vemuri takes a more cautious approach when handling sensitive information. For banking, work systems and other private activity, he uses a mobile hotspot instead of hotel Wi-Fi. When hotel Wi-Fi is unavoidable, he keeps devices updated, enables multifactor authentication and avoids sensitive tasks.

The FBI similarly recommends using a phone's hotspot instead of hotel Wi-Fi when possible, particularly for sensitive activity and telework.

A cellular hotspot is not completely immune to cyber threats, but it removes the user from the hotel's shared wireless environment and reduces exposure to risks associated with public Wi-Fi.


A VPN and MFA can add protection

For travelers who need to use hotel Wi-Fi, a reputable VPN can provide another layer of security by encrypting traffic between the device and the VPN provider. The FBI recommends reputable VPNs for telework over hotel Wi-Fi.

A VPN is not a substitute for other security measures, however. It cannot prevent phishing, malware downloads or users from voluntarily entering credentials into fraudulent websites.

Multifactor authentication can limit the damage if a password is compromised. The FBI recommends MFA for sensitive accounts and advises users to enable login notifications so suspicious activity can be detected quickly.

Travelers should configure MFA before leaving home rather than waiting until they are already on the road.


What travelers should do

Before connecting to hotel Wi-Fi, users should:

  1. Confirm the legitimate network name with hotel staff.
  2. Update their operating system, browser and applications.
  3. Disable automatic connection to public networks.
  4. Enable MFA and account security alerts.
  5. Use a cellular hotspot for banking and highly sensitive activity where possible.
  6. Use a reputable VPN for sensitive work when hotel Wi-Fi is unavoidable.
  7. Verify the website address and HTTPS before entering credentials.
  8. Avoid unfamiliar downloads or software updates prompted by Wi-Fi portals.
  9. Disable Bluetooth when it is not needed.
  10. Never bypass browser security warnings.


So, is hotel Wi-Fi safe?

Hotel Wi-Fi is not automatically dangerous, but it should not be treated as a trusted network either.

Simply sharing a network with an attacker does not mean a modern device will automatically be compromised, particularly when legitimate services use encryption. At the same time, rogue access points, fake captive portals, phishing, vulnerable devices and weaknesses in network isolation can create opportunities for attackers.

For routine browsing, an updated device using legitimate HTTPS websites can be reasonably protected. For banking, corporate systems and other highly sensitive activity, using a cellular hotspot remains the more cautious option.

The practical rule for travelers is simple: do not panic about hotel Wi-Fi, but do not trust it blindly either. Verify the network, secure your devices and accounts, and keep sensitive activity off shared networks whenever possible.

Read more »
RaaS
ALPHV BlackCat Ransomware Cyber Attacks DigitalMint FBI RaaS

Former DigitalMint negotiator sentenced to 70 months for conspiring with BlackCat ransomware affiliates

 



A former ransomware negotiator who was hired to help organizations respond to cyber extortion incidents has been sentenced to 70 months in federal prison after admitting he secretly worked with BlackCat ransomware affiliates, using confidential client information to increase ransom payments while participating in additional ransomware attacks.

The U.S. Department of Justice said Angelo Martino, 41, abused his position at incident response firm DigitalMint by sharing privileged information obtained during ransomware negotiations with BlackCat, also tracked as ALPHV. Prosecutors said the information allowed the ransomware group to negotiate from a stronger position while victims remained unaware that details intended to protect them had been disclosed to the attackers.

As part of his role, Martino managed active ransomware cases for organizations seeking assistance after cyberattacks. His work gave him access to confidential information that companies typically share only with trusted negotiators, including cyber insurance policy limits, internal assessments of how much they were prepared to pay, and negotiation strategies developed during incident response.

According to court documents, Martino began providing that information to BlackCat operators in April 2023. Prosecutors said he communicated with the group through multiple channels connected to BlackCat's extortion platform. While one conversation took place through the standard negotiation interface used during ransomware incidents, he also relied on an intermediary chat feature within the group's panel and the encrypted messaging application Tox to exchange information directly with the attackers outside the victims' view.

Federal prosecutors said those private communications were intended to help BlackCat maximize ransom demands. In exchange for sharing confidential information, including insurance coverage limits and the negotiating positions of victim organizations, Martino received a portion of the cryptocurrency paid by ransomware victims.

The Justice Department said five organizations whose cases were handled by Martino collectively paid more than $75 million to BlackCat affiliates between April and September 2023. Prosecutors argued that access to confidential negotiation data enabled the attackers to demand higher payments than they otherwise might have secured. The affected organizations operated in the financial services, healthcare, retail, hospitality, and nonprofit sectors, with several experiencing operational disruption alongside the financial losses associated with the attacks.

Investigators also determined that Martino later became an active participant in BlackCat's ransomware operation. In May 2023, he obtained affiliate access to the ransomware-as-a-service platform, permissions generally granted to trusted partners responsible for compromising victim networks and deploying the malware.

Court filings state that Martino shared those affiliate credentials with Kevin Martin and Ryan Goldberg, both cybersecurity professionals. The three men subsequently carried out additional ransomware attacks and agreed to divide ransom proceeds among themselves while paying 20% of each payment to BlackCat's administrators in exchange for continued access to the group's malware and extortion infrastructure.

One attack targeted a medical device manufacturer that ultimately paid approximately $1.2 million in ransom. Other organizations refused to pay but still incurred costs associated with business interruption, system recovery, and incident response following the attacks.

Prosecutors said Martino received millions of dollars in cryptocurrency through the conspiracy. Federal investigators recovered and seized more than $10 million in assets connected to the case, although authorities said some proceeds had already been used to purchase residential properties, vehicles, and a boat. As part of his sentence, Martino must forfeit assets linked to the criminal activity and pay 10% of his future income following his release from prison.

Before sentencing, Martino requested a reduced 24-month prison term, citing his cooperation with investigators during the prosecution of his co-conspirators. Martin and Goldberg were each sentenced to four years in prison earlier this year after pleading guilty for their involvement in the BlackCat attacks.

"Angelo Martino sold out the very victims he was hired to represent, handing their confidential negotiating positions to BlackCat actors to drive up ransoms and enrich himself," FBI Cyber Division Assistant Director Brett Leatherman said following the sentencing.

BlackCat operates as a ransomware-as-a-service platform, providing malware and extortion infrastructure to affiliates that compromise organizations and share a percentage of ransom payments with the group's administrators. The FBI has linked the operation to more than 1,000 victims and at least $300 million in ransom payments through September 2023. Although law enforcement disrupted parts of the group's infrastructure and previously released a decryptor for some victims, affiliates continued launching attacks after those actions.

DigitalMint said it was unaware of Martino's conduct until it was contacted by the Department of Justice and described itself as another victim of the scheme. The company said the employees involved were terminated immediately after the allegations came to light and that it fully cooperated with investigators throughout the criminal investigation.

The company also said Martino deliberately bypassed internal safeguards by communicating with threat actors through unauthorized channels that were not visible within its monitoring systems. According to DigitalMint, its security controls aligned with industry practices, but the unauthorized communications were intentionally concealed from the company's oversight mechanisms.

Read more »
signal
Backup CISA Cyber Security FBI Phishing signal

FBI Warns Russian-Linked Hackers Have Shifted Signal Phishing Campaign to Steal Backup Recovery Keys

 


The U.S. Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued an updated public service announcement warning that Russian intelligence-linked threat actors have expanded an ongoing phishing campaign targeting Signal users. Rather than attempting to intercept authentication codes alone, the attackers are now seeking victims' Signal Backup Recovery Keys, enabling them to restore encrypted cloud backups and gain access to historical conversations.

The latest advisory builds on an alert released in March 2026, when the agencies disclosed that Russian-backed operators were targeting users of commercial messaging applications, particularly Signal, through carefully crafted phishing campaigns. Those earlier attacks focused on compromising accounts by deceiving users into handing over verification codes, account PINs, or linking unauthorized devices to their Signal accounts, instead of defeating the application's end-to-end encryption.

According to the FBI, the threat actors have refined their social engineering techniques by impersonating automated Signal support accounts and introducing a new objective: convincing users to disclose the recovery keys that protect their encrypted backups.

The agencies said the campaign continues to concentrate on individuals considered to be of intelligence value, including current and former U.S. government officials, government personnel from allied nations, military members, political figures, journalists, and officials located in Ukraine.

The activity has been attributed to Russian Intelligence Services (RIS), including officers associated with Russia's Federal Security Service (FSB) Border Guards and additional actors operating on behalf of the Russian military. Security researchers publicly track the activity under the designations UNC5792 and UNC4221.

Phishing campaign evolves beyond account hijacking

The updated advisory describes a notable change in the attackers' methods. Earlier phishing attempts largely sought one-time verification codes, Signal PINs, or persuaded victims to connect attacker-controlled devices to their accounts. The current campaign instead attempts to obtain the cryptographic recovery key used by Signal's Secure Backups feature.

To begin the attack, the operators pose as Signal's support team and distribute fraudulent messages claiming the messaging platform is introducing mandatory two-factor verification following an alleged increase in attacks carried out by hackers from Iran and post-Soviet countries. The messages falsely state that the security changes require users to configure Signal Backups in order to avoid losing conversations and media files.

Victims are instructed to navigate through the application's backup settings, enable Secure Backups, reveal the Backup Recovery Key, copy it to the clipboard, and complete what appears to be a legitimate setup process.

Signal's Secure Backups feature allows users to store encrypted copies of conversations on the company's cloud infrastructure. Those backups remain protected through end-to-end encryption, with the Backup Recovery Key serving as the only credential capable of decrypting and restoring the archived data. Because Signal does not retain this key, anyone who obtains it can restore the encrypted backup onto another device.

After victims complete the initial steps, the attackers send a second phishing message while continuing to impersonate Signal support. This follow-up communication claims the user's account is experiencing a synchronization problem and warns that stored messages and media could be permanently lost unless immediate action is taken.

The fraudulent notification instructs users to revisit the backup settings, copy the Backup Recovery Key once again, and paste it directly into the conversation under the pretense of preventing data loss.

If victims comply, the attackers obtain the recovery key and use it to restore the encrypted backup on devices under their control. This grants access to previously archived communications, including private conversations and group chats.

The FBI emphasized that these attacks do not compromise Signal's encryption itself. Instead, they rely entirely on social engineering techniques that manipulate users into voluntarily surrendering the credentials needed to decrypt their own backups.

Compromised recovery keys remain a risk even after creating a new account

The updated advisory also highlights a recovery scenario that affected users may easily overlook.

According to the FBI, creating a new Signal account with the same phone number does not invalidate a Backup Recovery Key that has already been stolen. If attackers previously acquired the key, they may still be able to access any encrypted backups downloaded before the compromise was discovered.

To prevent future backup restorations using a compromised credential, users should generate a new Backup Recovery Key through Signal's backup settings. Creating a replacement key invalidates the previous one for subsequent backup downloads. However, the agencies cautioned that this action cannot revoke access to backups that attackers have already restored using the stolen key.

Agencies urge users to remain cautious of unsolicited support messages

The FBI and CISA reminded users that legitimate messaging platform support teams communicate only through official company email channels. They do not request verification codes through the application itself, nor do they send unsolicited messages instructing users to verify accounts, restore backups, or disclose recovery credentials.

Anyone who believes they may have interacted with the phishing campaign is encouraged to report the incident to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office, or CISA.

The advisory accentuates the fact that well-designed encryption remains effective only when the credentials protecting it remain under the user's control. Rather than attempting to break modern cryptography, state-sponsored threat actors are increasingly directing their efforts toward manipulating trusted users into revealing the keys that unlock their own protected data.

Read more »
sim swap
CBZC cryptocurrency Cyber Crime FBI Poland sim swap

Poland arrests four suspects in international SIM-swapping operation linked to multimillion-dollar cryptocurrency thefts

 



Polish law enforcement authorities have arrested four suspected members of an organized cybercrime group accused of orchestrating intricate SIM-swapping attacks that allegedly enabled the theft of millions of dollars in cryptocurrency from victims. The coordinated operation was led by Poland's Central Bureau for Combating Cybercrime (CBZC) with operational assistance from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI), highlighting the cross-border nature of the investigation.

According to investigators, the group combined technical intrusions with social engineering techniques to compromise organizations working alongside telecommunications providers. By infiltrating partner infrastructure and gaining unauthorized access to employee email accounts, the suspects allegedly obtained sensitive information that enabled them to perform fraudulent SIM-swapping attacks.

A SIM-swap attack involves transferring a victim's mobile phone number to a SIM card controlled by an attacker. Once the transfer is completed, the attacker can intercept SMS messages, one-time verification codes, password reset requests, and other communications that rely on the victim's phone number for authentication.

Authorities allege that after taking control of victims' mobile numbers, the cybercriminals intercepted SMS-based authentication messages and email communications before using that access to seize control of cryptocurrency exchange accounts. The attackers then transferred digital assets from compromised accounts before attempting to conceal the proceeds through an extensive laundering operation.

Investigators estimate that the criminal scheme generated millions of U.S. dollars in stolen cryptocurrency. The illicit proceeds were allegedly moved through a distributed financial network consisting of multiple domestic and international bank accounts, international payment platforms, and multi-currency digital wallets in an effort to obscure the origin of the funds. Polish authorities estimate that the total amount laundered exceeded tens of millions of Polish złoty, equivalent to at least approximately US$5 million based on current exchange rates.

In a statement describing the operation, CBZC said the suspects relied on specialized software together with social engineering techniques to gain unauthorized access to infrastructure belonging to organizations cooperating with telecommunications operators, as well as employee email accounts. Investigators said the information obtained during those compromises enabled the illegal cloning and takeover of victims' phone numbers through SIM-swapping attacks.

Authorities further stated that the suspects allegedly treated the criminal enterprise as a continuous source of income, repeatedly moving stolen assets across numerous financial accounts and cryptocurrency wallets located in multiple jurisdictions to complicate financial tracing efforts.

All four suspects have been placed in pre-trial detention. They face allegations including participation in an organized criminal organization, unauthorized access to information systems to facilitate theft, and money laundering. If convicted, the offenses carry penalties of up to 25 years' imprisonment under Polish law.

While Polish authorities have not publicly identified the individuals arrested because of the ongoing international investigation, blockchain investigator ZachXBT claimed that one of the detainees is Wojtek Kulisz, also known online by the alias "Merry." The identification was reportedly based on items visible in official footage released during the police operation. Authorities have not independently confirmed that claim.

Investigators have also declined to disclose which cryptocurrency exchanges were affected or identify the victims, citing the continuing international investigation. Law enforcement agencies say efforts to identify additional victims, trace stolen assets, and pursue further investigative leads remain ongoing.

The case stresses the urgency of the risks associated with SMS-based authentication. Security professionals have long advised cryptocurrency investors and organizations to replace SMS-based two-factor authentication with authenticator applications or hardware security keys whenever possible, as SIM-swapping attacks remain an effective method for bypassing text message verification when attackers successfully compromise telecommunications systems or manipulate carrier processes.

Read more »
rapid7
Cyber Crime Digital Fraud Extortion FBI FTSE IABs ransomware rapid7

Ransomware Revenues Climb as Criminal Networks Expand and Adapt like unwanted vines

 




Ransomware operators continue to generate substantial profits, with new research from Rapid7 indicating that several cybercrime groups are recording revenue growth that outpaces many publicly traded businesses.

According to the cybersecurity firm's analysis, ransomware groups collectively received an estimated $529.2 million during the first quarter of 2026. That figure represents a 39% increase compared with the same period a year earlier. Rapid7 noted that none of the companies within the FTSE 350 index reported year-over-year revenue growth exceeding 30% during that quarter, placing ransomware operators among the fastest-growing entities examined in the study.

Several well-established ransomware operations appear to be benefiting from this trend. Rapid7 estimates that the Qilin ransomware group generated approximately $193 million between July 2025 and March 2026. During the same period, the Gentleman group is estimated to have collected roughly $52 million in ransom payments.

Rapid7 researchers argue that modern ransomware operations bear little resemblance to the stereotype of small groups of hackers working independently. Instead, many function through interconnected networks of specialists who focus on specific stages of an attack. Some actors gain access to victim networks, others develop malware, while separate teams handle extortion demands and payment negotiations.

A major factor behind this growth is the emergence of Initial Access Brokers, or IABs. These actors specialize in obtaining access to corporate networks and then selling that access to other criminals. As a result, launching a ransomware attack no longer requires extensive technical expertise. Access to compromised systems, attack tools, and even managed cybercrime services can now be purchased through underground marketplaces.

Researchers say this division of labor has created a more structured criminal economy. Different groups contribute individual services, allowing ransomware campaigns to operate through networks that resemble commercial supply chains rather than isolated criminal crews.

The study also highlights the resilience of these operations. Infrastructure used by ransomware groups, including servers, data leak platforms, and victim negotiation portals, can often be restored quickly after disruptions. Law enforcement agencies, meanwhile, frequently require lengthy investigations and international coordination before conducting enforcement actions. This difference in speed allows many criminal networks to continue operating even when portions of their infrastructure are removed.

Rapid7 CTO EMEA Thom Langford said ransomware groups have demonstrated an ability to continue generating revenue despite disruptions because their operations are designed to function even when individual components are taken offline. In many cases, the removal of a single server or criminal group does not significantly affect the broader ecosystem supporting ransomware activity.

The findings come amid continued financial losses linked to cybercrime. According to the FBI's Internet Crime Complaint Center, organizations and individuals reported more than $16 billion in cybercrime losses during 2024, reflecting the growing economic impact of digital fraud, extortion, and network intrusions.

To reduce ransomware risk, Rapid7 recommends that organizations continuously review their exposed systems and identify weaknesses that could provide attackers with an entry point. Particular attention should be given to misconfigured services, overlooked assets, and internet-facing systems, which are frequently targeted by Initial Access Brokers seeking access to corporate environments.

The company also advises security teams to make greater use of threat intelligence to understand how attackers operate, including the infrastructure, tools, and access methods commonly used during intrusions. Researchers further recommend strengthening identity security through tighter access controls, least-privilege policies, and monitoring for signs that employee credentials have been stolen, resold, or abused.

According to Rapid7, disrupting ransomware attacks before attackers establish access remains one of the most effective defensive strategies. By identifying weaknesses early and restricting opportunities for credential theft, organizations may be able to prevent ransomware incidents before they progress to the extortion stage.

Read more »
W3LL Phishing
Cyber Crime FBI Indonesian Police Joint Operation W3LL Phishing

FBI and Indonesian Police Dismantle W3LL Phishing Network in Major Cybercrime Bust

 

In a landmark international operation, the U.S. Federal Bureau of Investigation (FBI) collaborated with the Indonesian National Police to dismantle the W3LL phishing network, a sophisticated cybercrime platform responsible for over $20 million in attempted fraud.Authorities seized critical infrastructure, including key domains, and detained the alleged developer, identified as G.L., marking the first joint U.S.-Indonesia effort to shut down a hacking platform.

The FBI's Atlanta division led the charge, emphasizing that the takedown severs a vital tool cybercriminals used to steal account credentials from thousands of victims worldwide. The W3LL phishing kit, sold for around $500, empowered even low-skilled hackers by providing ready-made templates mimicking legitimate login pages for banks and services like Microsoft 365. This phishing-as-a-service (PhaaS) model allowed attackers to deploy fake sites that harvested credentials, hijacked session cookies, and bypassed multi-factor authentication (MFA) via adversary-in-the-middle (AitM) techniques.

First documented by Group-IB in 2023, W3LL operated through an underground "W3LL Store" serving about 500 threat actors with tools for phishing, business email compromise (BEC), and stolen data sales. Active since 2017, the network's developer previously created spam tools like PunnySender and evolved W3LL into a full-service ecosystem, reselling over 25,000 compromised accounts from 2019 to 2023. Even after the W3LL Store shuttered in 2023, operations persisted via encrypted messaging, rebranding the kit and targeting over 17,000 victims in 2023-2024 alone. French firm Sekoia noted code reuse in other kits like Sneaky 2FA, highlighting W3LL's enduring influence in the cyber underground. 

FBI Atlanta Special Agent in Charge Marlo Graham hailed the bust as a strike against "full-service cybercrime," underscoring ongoing partnerships to protect the public. This operation disrupts a key resource for global fraud, but experts warn that cracked versions and similar kits continue circulating, perpetuating threats.For users in India and Asia, where phishing surges amid rising digital banking, the case spotlights the need for vigilance against PhaaS proliferation. 

As cybersecurity evolves, such takedowns signal stronger global enforcement, yet the low barrier to entry for phishing tools demands proactive defenses like direct URL typing and advanced MFA. This victory reinforces international cooperation's role in combating cybercrime, potentially deterring similar networks while urging organizations to bolster detection.
Read more »
Temu
Android Users Apps CapCut China data access Data Breach FBI Temu

FBI Warns Smartphone Users About Risks Linked to Foreign Apps, Especially Chinese Platforms

 



The Federal Bureau of Investigation has issued a fresh alert cautioning users about potential security and privacy threats posed by mobile applications developed outside the United States, particularly those linked to China. The advisory emphasizes that while the concern may seem obvious, many users continue to download such apps without fully understanding the risks.

In its public notice, the agency highlighted that a significant number of widely used and top-earning apps in the U.S. market are owned or operated by foreign companies. Many of these are tied to Chinese firms, raising concerns due to China’s legal framework governing data access.

At the center of the warning are provisions within China’s National Intelligence Law. Under Article 7, individuals and organizations are required to assist state intelligence efforts and maintain secrecy around such cooperation. Article 14 further allows authorities to demand support, data, or cooperation from entities and citizens. Together, these provisions create a legal pathway through which user data collected by apps could be accessed by the Chinese state.

Despite raising these concerns, the FBI has not published a formal list of high-risk apps. Instead, it has urged users to evaluate all foreign-developed applications before installing them. Media reports, including analysis referenced by outlets such as New York Post, suggest that popular platforms like CapCut, Temu, SHEIN, and Lemon8 fall into this broader category of concern.

Further analysis by TechRadar indicates that several of these apps rank highly in download charts across both Android and iOS platforms. On Android, for example, TikTok Lite appears among the most downloaded, alongside TikTok and Temu. Some apps are linked to developers based in Hong Kong or operate through complex international structures, making origin tracing less transparent. While Android devices face higher exposure due to sideloading capabilities, iPhone users are not entirely shielded from such risks.

Notably, platforms like TikTok, CapCut, and Lemon8 currently operate in the U.S. under TikTok USDS LLC, a joint venture backed by Oracle Corporation, with majority U.S. ownership. This structure means their U.S. operations are treated differently from their global counterparts, even though their origins remain tied to Chinese development.

The FBI stresses that its advisory is not a blanket ban on Chinese apps. Rather, it encourages users to be more vigilant. One key concern is the type of permissions users grant during installation. Many individuals overlook privacy policies, allowing apps to continuously gather sensitive data such as contact lists, location details, and personal identifiers.

This data can be used to build detailed social networks, which may later support targeted cyberattacks or social engineering campaigns. Some applications also include features that encourage users to invite contacts, enabling developers to collect additional personal data such as names, email addresses, phone numbers, and physical addresses.

Another major concern is data storage. Certain apps explicitly state that collected information may be stored on servers located in China for extended periods. In some cases, users cannot access app functionality unless they agree to such data-sharing practices.

Beyond privacy risks, the FBI also warns about potential cybersecurity threats. Some foreign-developed apps may include hidden malicious components capable of exploiting system vulnerabilities, collecting unauthorized data, or establishing persistent backdoor access on devices.

The advisory highlights that installing apps from unofficial sources significantly increases these risks. This is particularly relevant for Android users, where sideloading is more common. While official app stores conduct security checks to detect harmful code, third-party sources may bypass these safeguards. Companies like Google have taken steps to limit installations from unknown developers, though risks remain.

To mitigate exposure, the FBI recommends several precautionary measures:

• Install applications only from official app stores

• Review terms of service and user agreements carefully

• Restrict unnecessary permissions and data sharing

• Regularly update passwords

• Keep device software up to date

In a parallel development stressing upon global regulatory tensions, China recently ordered the removal of a decentralized messaging application created by Jack Dorsey from its local app store. Authorities claimed the app violated national internet regulations, reinforcing how governments worldwide are tightening control over digital platforms.

The larger takeaway is that app-related risks are no longer limited to malware alone. Increasingly, they are shaped by legal frameworks, data governance policies, and geopolitical dynamics. For everyday users, this makes informed decision-making around app downloads more critical than ever.

Read more »
Malware attacks
Airport WiFi Security Cyber Attacks cybersecurity threats FBI FBI FBI warning Hacker attack Internet Routers Malware attacks

FBI Warns Outdated Wi-Fi Routers Are Being Targeted in Malware and Botnet Attacks

 

Cybersecurity risks could rise when outdated home routers stop getting manufacturer support, federal agents say. Devices from the late 2000s into the early 2010s often fall out of update cycles, leaving networks open. Without patches, vulnerabilities stay unaddressed - making intrusion more likely over time. Older models reaching end-of-life lack protection upgrades once available. This gap draws attention from officials tracking digital threats to household systems. 

Older network equipment often loses support as makers discontinue update releases. Once patching ends, weaknesses found earlier stay open indefinitely. Such gaps let hackers break in more easily. Devices like obsolete routers now attract criminals who deploy malicious code. Access at admin level gets seized without owners noticing. Infected machines may join hidden networks controlled remotely. Evidence shows law enforcement warning about these risks repeatedly. 

Built from hijacked devices, botnets answer to remote operators. These collections of infected machines frequently enable massive digital assaults. Instead of serving legitimate users, they route harmful data across the web. Criminals rely on them to mask where attacks originate. Through hidden channels, wrongdoers stay anonymous during operations. 

Back in 2011, Linksys made several routers later flagged as weak by the FBI. Devices like the E1200, E2500, and E4200 came under scrutiny due to security flaws. Earlier models also appear on the list - take the WRT320N, launched in 2009. Then there is the M10, hitting shelves a year after that one. Some routers come equipped with remote setup options, letting people adjust settings using web-connected interfaces. 

Though useful, such access may lead to problems if flaws are left unfixed. Hackers regularly search online for devices running open management ports, particularly ones stuck on old software versions. Hackers start by spotting weak routers, then slip through software gaps to plant harmful programs straight onto the machine. Once inside, that hidden code opens the door wide - giving intruders complete control while setting up secret talks with remote hubs. 

Sometimes, these taken devices ping those distant centers each minute, just to say they’re still online and waiting. Opened network ports on routers might let malware turn devices into proxies. With such access, attackers send harmful data across infected networks instead of launching attacks directly. Some even trade entry rights to third parties wanting to mask where they operate from. What makes router-based infections tricky is how hard they are to spot for most people. 

Since standard antivirus tools target laptops and phones, routers often fall outside their scope. Running within the router's own software, the malware stays hidden even when everything seems to work fine. The network keeps running smoothly, masking the presence of harmful code tucked deep inside. Older routers without regular updates become weak spots over time. 

Because of this, specialists suggest swapping them out. A modern replacement brings continued protection through active maintenance. This shift lowers chances of intrusions via obsolete equipment found in personal setups.
Read more »
malware
ATM jackpotting Bank Security FBI Financial crime malware

ATM Jackpotting Malware Triggers Record Global ATM Heists in 2025

 

ATM jackpotting attacks surged dramatically in 2025, with cybercriminals using specialized malware to force cash machines to spit out money on command, often without touching any customer account. This new wave of attacks exposed serious weaknesses in how banks protect the physical and digital components of their ATM fleets. 

According to FBI figures, there have been about 1,900 reported ATM jackpotting cases in the United States since 2020, and more than 700 of those incidents occurred in 2025 alone, causing over 20 million dollars in losses. The attacks rely heavily on malware families such as Ploutus, which has been around for over a decade but continues to evolve. Instead of targeting customer accounts, Ploutus directly compromises the ATM’s operating system, allowing crooks to drain cassettes in minutes before anyone notices something is wrong. 

To execute a jackpotting operation, attackers first need physical access to the machine’s internals. The FBI notes that gangs often use widely available “generic” keys to open the service panel, then remove or connect to the hard drive or USB ports. Once inside, they either load malware onto the existing drive or swap in a pre‑infected disk that boots a compromised operating system capable of issuing unauthorized dispense commands. In many cases, a mule returns later, enters a secret code or connects a device, and collects the cash as the ATM empties itself.

What makes these operations so dangerous is that the malware can bypass normal bank authorization checks and trigger cash withdrawals without a card, PIN, or even a linked account.Because the machine behaves as if it is performing legitimate transactions, banks often only discover the theft after reconciling cash levels and seeing large, unexplained shortages. The U.S. Justice Department has already charged dozens of suspects in jackpotting schemes, including crews tied to transnational criminal groups accused of stealing millions of dollars from victim banks and credit unions. 

In response, the FBI and regulators are urging financial institutions and ATM operators to harden both physical and software defenses. Recommended steps include replacing standard locks, reinforcing ATM cabinets, keeping systems fully patched, and closely monitoring machines for signs of tampering or unexpected restarts. As 2026, ATM jackpotting has become a priority threat for the banking sector, underlining the need for continuous security upgrades and better coordination between banks, law enforcement, and cybersecurity teams.
Read more »
Scam
Bangladesh Cybersecurity FBI Identity Fraud Privacy Scam

U.S. Authorities Shut Down Online Network Selling Fake Identity Templates

 



United States federal authorities have taken down an online operation accused of supplying tools used in identity fraud across multiple countries. The case centers on a Bangladeshi national who allegedly managed several websites that sold digital templates designed to imitate official government identification documents.

According to U.S. prosecutors, the accused individual, Zahid Hasan, is a 29-year-old resident of Dhaka. He is alleged to have operated an online business that distributed downloadable files resembling authentic documents such as U.S. passports, social security cards, and state driver’s licenses. These files were not physical IDs but editable digital templates that buyers could modify by inserting personal details and photographs.

Court records indicate that the operation ran for several years, beginning in 2021 and continuing until early 2025. During this period, the websites reportedly attracted customers from around the world. Investigators estimate that more than 1,400 individuals purchased these templates, generating nearly $2.9 million in revenue. Despite the scale of the operation, individual items were sold at relatively low prices, with some templates costing less than $15.

Law enforcement officials state that such templates are commonly used to bypass identity verification systems. Once edited, the counterfeit documents can be presented to banks, cryptocurrency platforms, and online services that rely on document uploads to confirm a user’s identity. This type of fraud poses serious risks, as it enables financial crimes, account takeovers, and misuse of digital platforms.

The investigation intensified after U.S. authorities traced a transaction in which Bitcoin was exchanged for fraudulent templates by a buyer located in Montana. Following this development, federal agents moved to seize multiple domains allegedly connected to the operation. These websites are now under government control and no longer accessible for illegal activity.

The case involved extensive coordination between agencies. The FBI’s Billings Division and Salt Lake City Cyber Task Force led the investigation, with support from the FBI’s International Operations Division. Authorities in Bangladesh, including the Dhaka Metropolitan Police’s Counterterrorism and Transnational Crime Unit, also assisted in tracking the alleged activities.

A federal grand jury has returned a nine-count indictment against Hasan. The charges include multiple counts related to the distribution of false identification documents, passport fraud, and social security fraud. If convicted, the penalties could include lengthy prison sentences, substantial fines, and supervised release following incarceration.

The case is being prosecuted by Assistant U.S. Attorney Benjamin Hargrove. As with all criminal proceedings, the charges represent allegations, and the accused is presumed innocent unless proven guilty in court.

Cybersecurity experts note that the availability of such tools highlights the growing sophistication of digital fraud networks. The case is an alarming call for the importance of international cooperation and continuous monitoring to protect identity systems and prevent large-scale misuse of personal data.



Read more »
Password Security
Compromised Passwords Cyber Security Cyberattacks CyberCrime Data Theft FBI FBI Alert Password Security

FBI Discovers 630 Million Stolen Passwords in Major Cybercrime Investigation

 

A newly disclosed trove of stolen credentials has underscored the scale of modern cybercrime after U.S. federal investigators uncovered hundreds of millions of compromised passwords on devices seized from a single suspected hacker. The dataset, comprising approximately 630 million passwords, has now been integrated into the widely used Have I Been Pwned (HIBP) database, significantly expanding its ability to warn users about exposed credentials. 

The passwords were provided to HIBP by the Federal Bureau of Investigation as part of ongoing cybercrime investigations. According to Troy Hunt, the security researcher behind the service, this latest contribution is particularly striking because it originates from one individual rather than a large breach aggregation. While the FBI has shared compromised credentials with HIBP for several years, the sheer volume associated with this case highlights how centralized and extensive credential theft operations have become. 

Initial analysis suggests the data was collected from a mixture of underground sources, including dark web marketplaces, messaging platforms such as Telegram, and large-scale infostealer malware campaigns. Not all of the passwords were previously unknown, but a meaningful portion had never appeared in public breach repositories. Roughly 7.4% of the dataset represents newly identified compromised passwords, amounting to tens of millions of credentials that were previously undetectable by users relying on breach-monitoring tools. 

Security experts warn that even recycled or older passwords remain highly valuable to attackers. Stolen credentials are frequently reused in credential-stuffing attacks, where automated tools attempt the same password across multiple platforms. Because many users continue to reuse passwords, a single exposed credential can provide access to multiple accounts, amplifying the potential impact of historical data leaks. 

The expanded dataset is now searchable through the Pwned Passwords service, which allows users to check whether a password has appeared in known breach collections. The system is designed to preserve privacy by hashing submitted passwords and ensuring no personally identifiable information is stored or associated with search results. This enables individuals and organizations to proactively block compromised passwords without exposing sensitive data. 

The discovery has renewed calls for stronger credential hygiene across both consumer and enterprise environments. Cybersecurity professionals consistently emphasize that password reuse and weak password creation remain among the most common contributors to account compromise. Password managers are widely recommended as an effective countermeasure, as they allow users to generate and store long, unique passwords for every service without relying on memory. 

In addition to password managers, broader adoption of passkeys and multi-factor authentication is increasingly viewed as essential. These technologies significantly reduce reliance on static passwords and make stolen credential databases far less useful to attackers. Many platforms now support these features, yet adoption remains inconsistent. 

As law enforcement continues to uncover massive credential repositories during cybercrime investigations, experts caution that similar discoveries are likely in the future. Each new dataset reinforces the importance of assuming passwords will eventually be exposed and building defenses accordingly. Regular password audits, automated breach detection, and layered authentication controls are now considered baseline requirements for maintaining digital security.
Read more »
Subscribe to: Posts (Atom)