Cisco Talos has uncovered a new Russian-speaking threat actor aggressively targeting victims across the United States and Europe.

Tracked as UAT-11795, the group has been active since June last year, and uses trojanized installers for legitimate software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT to steal credentials and cryptocurrency.

A staple of the threat actor’s activities lies in deployment of two previously undocumented tools: Starland RAT and WLDR agent. The first of these is a Python-based remote access tool, while WLDR agent is a PowerShell-based C2 memory implant.

WLDR agent runs entirely in-memory, and features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

Both are built to steal credentials, browser data, and cryptocurrency wallet assets while keeping persistent access to victim machines. The group even hides a fallback command-and-control channel in a Polygon smart contract, Cisco Talos said.

UAT-11795 targets victims' credentials and cryptocurrency wallet assets, establishing a persistent connection to the victims' machines from the C2 server, with the potential to deliver and execute further payloads.

How UAT-11795 operates

Most infections have been spotted in the US, according to Cisco Talos, although Germany, Romania, and Venezuela have also been hit.

UAT-11795 gains initial access to the victim machine through a ClickFix social engineering technique that entices the user to execute a command, which then stealthily downloads and executes a remotely hosted weaponized HTA file.

This runs an embedded VBScript that drops a Windows batch file into the user profile’s application temporary folder, containing instructions to first download and implant a trojanized installer from the attacker-controlled staging domain onto the victim machine.

Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, said the campaign is the latest in a string of attacks by hackers using “the very tools our remote and hybrid workers rely on”.

"By hiding the Starland RAT inside trusted software and likely utilising deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities."

Talos’ research also uncovered a private live Telegram channel called “stuk komanda”, controlled by the same threat actor, created last June, and with three unknown subscribers.

Exercise caution when using video conferencing tools

Gabrielle Hempel, security operations strategist at Exabeam, said while the campaign specifically targets popular video conferencing software, one needn't avoid using Zoom or WebEx.

They should, however, exercise caution. This includes making efforts to verify where software comes from, monitor for unexpected processes and persistence mechanisms.

Elsewhere, Hempel said users shouldn't assume that 'signed installer' means a program is safe.

"This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," she said.

"We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems. If your security program can’t answer 'where did this binary come from?' as quickly as it can answer 'is this CVE patched?' then you are behind on your threat model."

FOLLOW US ON SOCIAL MEDIA

A ransomware negotiator has been sentenced to 70 months in prison after secretly conspiring with hackers to extort clients.

Angelo Martino, 41, of Land O’Lakes, Florida, worked at US-based cyber incident response company DigitalMint in April 2023 when he started conspiring with the operators of the BlackCat ransomware group.

BlackCat paid Martino to provide confidential information about the negotiating position and strategy of his employer’s clients, along with the details of their ransomware insurance, to help maximize the ransoms paid.

Notably, Martino also conspired with two former cybersecurity professionals between April 2023 and November 2023.

Kevin Martin, 36, of Texas, was hired as Martino’s co-worker at DigitalMint after the conspiracy began. Ryan Goldberg, 41, of Georgia, was manager of incident response at Sygnia.

All told, Martino was found to have extorted five different victims as part of his collaboration with the cyber crime syndicate while the trio also worked to deploy BlackCat ransomware against victims across the country.

Assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division, said victims had shared “heartbreaking accounts of how their businesses were nearly destroyed” during the trail.

“Today’s sentence accounts for the harm Martino caused and demonstrates that the Department of Justice can and will identify and prosecute cybercriminals to the fullest extent of the law.”

Working with the enemy

After successfully extorting one victim for around $1.2 million in Bitcoin, the men split their share of the ransom three ways and laundered the funds through various means.

Jason A. Reding Quiñones, attorney for the Southern District of Florida, said more than $10 million in criminal proceeds have been seized. These assets include digital currency, vehicles, a food truck, and a luxury fishing boat.

A separate hearing has been set for September 17 to decide the amount of restitution to be ordered against Martino.

The Justice Department started working to bring down BlackCat three years ago, developing a decryption tool that allowed FBI field offices across the US and law enforcement partners around the world to help victims restore their systems.

The scheme has reportedly saved victims from paying out $99 million in ransom payments so far. The FBI also seized several BlackCat websites at the same time.

"This case sends a clear message: we will pursue the hackers who deploy ransomware, the insiders who enable them, and the money they steal from American victims,” Quiñones said.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

A teenager believed to be part of the Scattered Spider hacking group has been extradited from Finland to the United States.

Peter Stokes, 19, is the latest alleged member of the group to be nabbed by the FBI as part of Operation Riptide, an ongoing campaign targeting the criminals, infrastructure, and financial networks behind cyber crime.

Stokes, a dual citizen of the United States and Estonia, has been charged with conspiracy, computer intrusion, and fraud. He was arrested by Finnish authorities in April following an Interpol Red Notice, and extradited to the US last week. He made an initial appearance on Tuesday in federal court in Chicago.

“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division.

“The charges unsealed today are the result of years of work by the Criminal Division, the US Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.”

According to the complaint, Stokes and his fellow criminals breached a luxury jewellery retailer’s computer system, exfiltrated data, and made a ransom demand of around $8 million in cryptocurrency in May last year.

The firm managed to successfully evict the hackers from its computer network and no ransom was paid. However, it suffered a loss of at least $2 million due to business disruption, investigation, and threat mitigation.

The walls are closing in on Scattered Spider

The Scattered Spider group has been linked to more than 100 network intrusions, resulting in over $100 million in ransom payments and millions of dollars in damages to the victims.

The group targets companies across the US with social engineering and SIM swap attacks, encrypting data or exfiltrating it to remote servers. It then extorts cryptocurrency from the companies in return for the return of their data or to prevent it being disseminated.

Scattered Spider has rapidly grown to become one of the most notorious threat groups worldwide, having claimed responsibility for attacks on UK retailers Marks & Spencer and the Cooperative Group, as well as MGM Resorts in the US.

“Scattered Spider has repeatedly targeted US companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” said assistant director Brett Leatherman of the FBI’s Cyber Division.

“Through strong domestic and international partnerships, the FBI will continue to identify, disrupt, and hold cybercriminals accountable, no matter where they are located.”

While the group has been repeatedly hit by law enforcement takedowns, it keeps emerging in different forms, for example teaming up with overlapping threat groups ShinyHunters and LAPSUS$ to form a unified collective.

FOLLOW US ON SOCIAL MEDIA

Managed Service Providers (MSPs) were once viewed primarily as IT support partners. Today, they operate something far more critical: digital trust infrastructure.

MSPs manage identity systems, remote monitoring platforms, cloud environments, endpoint protection frameworks, and data backup architecture across dozens — sometimes hundreds — of client environments. In doing so, they have become central operational nodes in the digital economy.

That centrality also makes them strategically attractive to cybercriminals.

From service providers to trust custodians

Modern organizations depend on MSPs not just for operational efficiency, but for secure access management, infrastructure resilience, and regulatory alignment. MSP platforms sit at the intersection of customer networks, cloud services, SaaS applications, and identity environments.

This position makes MSPs stewards of inherited trust across entire business ecosystems.

When that trust is compromised, the consequences extend far beyond a single organization.

MSPs now operate critical digital infrastructure. When that trust is compromised, the impact multiplies across entire client ecosystems.

Why attackers are targeting MSP ecosystems

Threat actors increasingly mirror the scale economics of managed services themselves. Rather than targeting organizations individually, attackers focus on centralized service environments that provide multiplier effects across downstream clients.

The logic is simple: compromising one MSO can provide access to dozens, sometimes hundreds, of connected organizations.

Remote monitoring and management platforms, multi-tenant administration consoles, and aggregated identity systems have become high-leverage entry points. Once inside, attackers can move laterally, harvest credentials, conduct reconnaissance, and deploy payloads across multiple customer environments simultaneously.

Campaigns attributed to groups such as DragonForce demonstrate how exploitation of MSP tooling can enable credential theft, data exfiltration, and ransomware deployment at scale.

Attackers have adopted the same logic as manager services: centralize access, standardize operations, and scale efficiently.

The industrialization of cybercrime meets the managed services model

This convergence reflects a broader shift in cybercrime operations. Criminal groups now prioritize scalability, automation, and repeatable processes — principles that mirror the operational models used by MSPs.

Cybercrime has become industrialized, adopting structured affiliate programs, service platforms, and monetization strategies designed to maximize efficiency.

Managed service environments naturally align with this approach because they aggregate infrastructure, identities, and administrative access into centralized systems.

For attackers, this represents an opportunity. For MSPs, it raises the stakes of operational resilience.

Resilience maturity as a competitive differentiator

As threat exposure grows, resilience maturity is becoming a defining factor that separates strategic MSP partners from commodity service providers.

Customers are increasingly evaluating MSPs based on governance transparency, identity security controls, incident readiness, and third-party risk management practices. Regulatory frameworks such as NIS2 are further reinforcing expectations around operational accountability and supply-chain oversight.

Security is no longer just a technical feature; it is a business trust signal.

Resilience maturity is becoming the dividing line between strategic MSPs and commodity providers

Forward-looking MSPs are strengthening privileged access controls, monitoring behavioral anomalies across multi-tenant environments, segmenting client infrastructure, and conducting continuous supply chain risk assessments.

These measures do more than reduce exposure; they demonstrate strategic commitment to protecting customer ecosystems.

Intelligence-led defense in interconnected ecosystems

As digital environments grow more interdependent, reactive security models are proving insufficient. MSPs increasingly benefit from adversary-centric threat intelligence that tracks how specific attacker groups operate, which tools they exploit, and how campaigns typically unfold.

This approach enables earlier detection of suspicious behavior and faster disruption of attack chains before compromise spreads downstream.

Predictive threat intelligence also allows MSPs to anticipate emerging risks across their customer base, rather than responding only after incidents occur.

The future role of MSPs in digital trust

The role of MSPs will continue expanding as organizations seek partners capable of managing both operational complexity and cybersecurity risk.

That reliance reinforces the MSP’s position as a custodian of digital trust — a role that extends beyond service delivery into governance, resilience, and ecosystem-wide risk management.

The providers that succeed in this environment will be those that recognize this responsibility and invest accordingly.

MSPs are no longer just managing infrastructure. They are safeguarding the trust architecture that modern business depends upon.

The US Department of State is offering a reward of up to $10 million to anyone that can help it identify and locate members of the Russia-linked UNC5792 and UNC4221 hacking groups.

UNC4221 works on behalf of the Russian military services while UNC5792 is associated with the Russian Federal Security Service (FSB), and has carried out phishing campaigns targeting the Signal and WhatsApp accounts of US government officials, military leadership, and allied personnel.

"Using social engineering techniques, these malicious cyber actors exploit legitimate device-linking features in these secure messaging applications to gain unauthorized access to sensitive government communications, contact lists, and group conversations," said the US Department of State.

"After compromising an account, the malicious actors were also able to send messages and conduct additional phishing against other accounts using those same commercial messaging applications."

In some cases, UNC5792 actors altered legitimate group invite pages to redirect users to a malicious URL that linked a hacker-controlled device to the victim’s Signal account.

Officials said that while these activities did not exploit vulnerabilities in either platforms’ encryption standards, they successfully compromised “thousands of individual commercial messaging application accounts”.

Targets included US government officials, diplomatic personnel and foreign affairs officials, defense and national security personnel, policy analysts and advisors, NATO member-state officials and diplomats, and allied intelligence and defense partners.

The group also went after investigative journalists covering Russia, Ukraine, and international affairs, NGOs providing support and assistance to Ukraine, and academic researchers in security studies and Russian affairs.

Valuable intel

The announcement of the reward follows an advisory issued by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) last week, which warned of continued activity by the two groups as well as a change in tactics aimed at harvesting victims' backup recovery keys.

"If a victim inadvertently shares their backup recovery key, that same key remains valid even if they create a new account following the compromise using the same phone number," the advisory warned.

"Consequently, the actor could potentially use the compromised key to take over the new account in the future as well."

The department gives a list of what information it seeks, including:

• Names
• Locations
• Biographical information on UNC5792 members
• Affiliations with Russian intelligence services
• Identities of personnel providing technical support
• Contractors or third-party entities providing services

It’s also seeking information on domain names, server locations, hosting providers, data storage and processing infrastructure, and technical tools, frameworks, and software used in operations.

Elsewhere, officials are keen to hear about the financial side of operations, including:

• Funding sources
• Financial accounts and banking relationships
• Cryptocurrency wallets
• Payments for infrastructure
• Financial networks supporting operations

Anyone with dirt on either of the two groups can submit their tip here, uploading relevant files such as photographs, videos, and documents.

FOLLOW US ON SOCIAL MEDIA

Two young men have pleaded guilty to offenses under the Computer Misuse Act following a cyber attack on Transport for London (TfL) that caused months of disruption and millions in damages.

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested following raids by the National Crime Agency (NCA) and City of London Police in September 2025.

The duo are alleged members of the notorious Scattered Spider cyber crime collective, believed to be responsible for a string of attacks in recent years. The group claimed responsibility for attacks on UK retailers Marks & Spencer and the Cooperative Group, as well as MGM Resorts in the United States.

“The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider," said Paul Foster, deputy director of the National Crime Agency and head of the NCA National Cyber Crime Unit.

Flowers was first arrested in September 2024, at which point NCA officers found evidence that the networks of US healthcare companies SSM Health Care Corporation and Sutter Health had also been infiltrated and damaged.

Investigators found a number of devices at Flowers' home, including laptops, tower computers, hard drives, and USB sticks. One Acer laptop contained a screenshot showing network connectivity to TfL infrastructure.

Flowers had also accessed an online platform selling credentials compromised in previous cyber attacks and data breaches.

Notably, the laptop contained a number of videos that Flowers had recorded, which showed Jubair accessing TfL systems during the attack. At the same time, the pair were messaging each other over Telegram, as well as communicating via an online work collaboration tool.

What happened with the TfL cyber attack?

TfL’s network was infiltrated at the beginning of September 2024, forcing all 28,000 employees to attend a TfL office for a password reset. The cyber attack caused widespread disruption for the rail operator.

Data from TfL’s Oyster refunds system was accessed while its customer refund system was also affected. Elsewhere, the attack shut down the Oyster photocard application system for children and young people.

Around 10 million people are believed to have been affected by the attack, making it one of the UK’s most devastating cyber attacks to date.

Jubair and Flowers are due to be sentenced at Woolwich Crown Court on 16 July.

A lengthy investigation

Foster said the trial is the culmination of a “lengthy, highly complex and painstaking investigation” and hailed law enforcement colleagues for their role in apprehending the duo.

“The perseverance and meticulousness of our officers, and the work of our partner organizations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending," he commented.

“Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL’s systems shows it has real-world consequences and impacts hugely on the public. The attack caused millions of pounds in losses to a key part of the UK’s critical national infrastructure, and was a significant inconvenience for customers."

The NCA is urging victims of cyber crime to use the government’s Cyber Incident Signposting Site for direction on which agencies they should report incidents to.

“Today’s result would not have been possible if TfL had not engaged with law enforcement early, so I would urge any other organization to please do the same in such circumstances," said Foster.

The rise of youth hackers

Upon their arrest in September 2025, Jubair and Flowers were both teenagers, prompting concerns about a potential wave of youth-related cyber crime. As ITPro reported at the time, cybersecurity experts described the incident as a “wake up call” for law enforcement, educators, and society at large.

Anna Chung, principal researcher for EMEA at Palo Alto Networks, said these incidents highlight a failure to “properly engage a generation growing up in a digital-first world”.

“Young people don’t usually turn to online mischief out of malice - it’s often down to a mixture of boredom, technical skills, and a lack of boundaries,” she told ITPro at the time.

So what’s the solution? Chung urged schools and parents to make a concerted effort toward teaching digital ethics, making this a “part of core education”. This, she noted, could be crucial to preventing future incidents.

Chung’s warning over teen hackers is by no means the first, or likely last, that we’ll hear about in coming years.

Indeed, the UK’s Information Commissioner’s Office (ICO) published a report last year which highlighted a spate of cybersecurity incidents at schools across the country, with students bypassing network security controls and gaining access to management systems.

Nipping these types of activities in the bud are crucial, the ICO warned, largely as they have the potential to evolve into more nefarious activities.

FOLLOW US ON SOCIAL MEDIA

The global cyber threat landscape is undergoing a radical transformation, moving away from monolithic ransomware cartels toward highly volatile, fragmented splinter groups, a top UK police official has warned.

Speaking at Infosecurity Europe 2026, William Lyne, Head of Economic and Cybercrime at the Metropolitan Police Service, told IT and security leaders that the modern cyber crime ecosystem has evolved into a highly accessible space.

Lyne compared the underground landscape to a bar where threat actors can "get everything but a good drink."

"It felt like cyber threats were all quite stovepiped. You had hacktivists, you had hostile state actors," Lyne explained, reflecting on his early career. Today, however, those lines have blurred. "Those kind of stovepipes... no longer really exist."

Instead, Lyne described a blended ecosystem of products, goods, and services that has dramatically lowered the barrier to entry for prospective criminals.

This shift has been heavily accelerated by cryptocurrencies, which solved the traditional criminal bottleneck of "cashing out."

Previously, threat actors lost up to 75% of their profits navigating complex, expensive money-mule networks. Today, cryptocurrency allows them to realize illicit gains almost instantly and with very little risk.

Fragmentation and the 'post-trust' era

While massive international law enforcement operations have successfully dismantled groups like LockBit and disrupted phishing as a service (PhaaS) platforms, Lyne cautioned that the criminal underground is rapidly adapting.

"It's getting more diverse... [and] also much more fragmented," Lyne said. Following high-profile law enforcement crackdowns, cybercriminals have realized that operating as a massive, centralized brand or ransomware as a service scheme is "actually quite bad for business."

As a result, major ransomware operators are breaking off into smaller, independent factions.

This fragmentation is leading to a dangerous "post-trust" trend within the criminal ecosystem. Without the strict moderation and internal rules previously enforced by large cartel administrators, smaller threat actors are exhibiting more extreme, aggressive, and unpredictable behaviors.

The demographics of these attackers are also shifting. Lyne noted that the threat landscape is moving beyond traditional Russian-speaking hubs to include actors from Brazil, Türkiye, and English-speaking groups like the notorious Scattered Spider collective.

AI weaponizing hoarded data

Addressing the inevitable topic of AI, Lyne dispelled fears of autonomous systems launching end-to-end cyber attacks, but highlighted a pressing new risk for enterprise data privacy.

"These guys are generally not innovative," Lyne noted, explaining they only change their methods if they are “systematically earning less money... or they spy an opportunity to make more money."

Having stolen and hoarded petabytes of corporate data over the last decade, data that was rarely deleted even when victims paid the ransom, cyber criminals are now using AI tools to operationalize these massive "treasure troves" and mining historic datasets for new extortion and revenue streams.

Rewriting the law enforcement playbook

Faced with this agile, commoditized threat, the Met Police and its international partners are adopting aggressive new disruptive strategies.

"We can't arrest our way out of this problem," Lyne admitted, citing the jurisdictional complexities of cross-border cybercrime.

Instead, policing has shifted toward systemic disruption, psychological operations designed to undermine criminal trust, and targeting the foundational infrastructure of the cybercrime supply chain.

Crucially, this requires unprecedented collaboration with the private sector. Lyne emphasized that the Met Police is increasingly sharing intelligence with enterprise IT security teams and even naming industry partners who assist in operations on their site takedown pages.

"Ultimately, like, lots of these things just come down to trust," Lyne concluded, addressing the security professionals in the room.

"We want to have meaningful, both strategic and tactical collaboration with industry partners that we know hold some of the keys to... the challenges that we have in this space. The cultural change that we have undertaken, I think will continue so that we collaborate better moving forward."

FOLLOW US ON SOCIAL MEDIA

Hackers posing as IT experts are showing up in person at law firms, the FBI has warned.

In the past, the Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, sent phishing emails purportedly charging small 'subscription fees'. To cancel the fake subscription, the victim was instructed to call the threat actor, who then emailed the victim a link to download remote access software.

Now, though, the group is using phone calls and phishing emails to pose as IT support, gaining access to the victims' computers and exfiltrating data.

And while this is often done through legitimate remote access tools, the group has also been sending individuals in person to the victim company's location to gain physical access to machines.

"This is a pretty natural evolution of extortion operations. We spent years building detections around malware and exploits, and now attackers are shifting toward social engineering, trusted tooling, and physical access," commented Gabrielle Hempel, security operations strategist at Exabeam.

"Physical security fell by the wayside when organizations began to move their data to the cloud, but if your security model assumes that the threat actor is always on the other side of the internet, you have a problem."

The group's first step is to either directly call or send phishing emails urging employees to call 'IT support'. While on the phone, the SRG actor directs the employee to grant access to a remote desktop session.

If that attempt fails, though, SRG sends a threat actor to the victim's location to gain access and insert a storage device into the victim's computer. The hacker tells the victim they need to image the device or create a backup file to address potential impacts from the phishing email.

Once they've got access to the victim's device, they minimally escalate privileges and quickly pivot to data exfiltration without encryption, using Windows Secure Copy ( WinSCP) or a hidden or renamed version of 'Rclone'.

"SRG actors use the exfiltrated victim data to extort the victim by sending a ransom email threatening to sell or post the data online," the FBI said. "SRG actors also call employees or clients of a victim company to pressure the victim to begin ransom negotiations."

While SRG has hit companies in a number of sectors, including the insurance, finance, and healthcare industries, it's consistently been targeting US-based law firms since spring 2023.

"The group is leaning into trust by posing as IT support, walking employees through remote access, then moving quickly to steal data before anyone realizes something is wrong," warned Nick Tausek, lead security automation architect at Swimlane.

"That makes this especially dangerous for law firms. These environments hold sensitive client records, privileged communications, financial details, and case information. If that data is stolen, the damage does not stop at the victim organization. Clients can be pressured, legal strategies can be exposed, and employees can become targets for follow-up scams."

Security experts have issued a warning about the continued risk of Tycoon 2FA attacks, even after a law enforcement operation took down the phishing as a service (PhaaS) platform last month.

According to Barracuda, while attacks have since dropped by 77%, they still persist, with more than two million taking place each month.

Before the takedown, Tycoon 2FA was behind tens of millions of phishing messages, reaching over 500,000 organizations each month worldwide.

First spotted in August 2023, it used adversary in the middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

It was linked to more than 96,000 distinct phishing victims globally, including more than 55,000 Microsoft customers and around 5,350 in the UK, hitting sectors including education, healthcare, finance, and the public sector.

The takedown last month saw Microsoft seize 330 domains forming the core infrastructure of the criminal service, including phishing pages and control panels.

Yet Barracuda said its analysis shows the impact of the takedown has been largely restricted to Tycoon’s own brand name and visibility, along with a drop in the use of Tycoon-linked hosting and domain patterns.

"The ‘body’ of Tycoon: its tools and techniques, live on. They have migrated, been redistributed and diversified across competing platforms, or simply left where they are,” the company said in a blog post.

Pouncing on the Tycoon 2FA takedown

Notably, Barracuda found that other phishing kits have moved quickly to take Tycoon 2FA's place, with increased campaign activity involving the established platforms of Mamba 2FA and EvilProxy, as well as aggressive newcomers such as Sneaky 2FA and Whisper 2FA.

These kits have boosted their feature sets and infrastructure maturity, according to Barracuda, often leveraging tools formerly used by Tycoon 2FA.

"Tycoon 2FA was widely used by independent affiliates. This means that variants of Tycoon 2FA’s attack code that have been cloned or modified by individual adversaries continue circulating. It also means that independently hosted deployments remain active and that fragmented, low-volume campaigns persist," the firm said.

"For example, Barracuda recently detected a ‘device code’ phishing campaign that leveraged Tycoon’s stand-out features. Code similarities included Tycoon’s signature ‘noise’ of motivational style comments. In this incident, the comments all begin with the word ‘success’."

This campaign also featured Tycoon 2FA’s unique anti-analysis, anti-debugging and redirection capabilities.

Tycoon 2FA is still alive and kicking

Barracuda said the reasons for Tycoon 2FA’s persistence include the fact that attackers have reused and repurposed phishing code.

Meanwhile, attack domains remain active until expiry, backup hosting often evades immediate seizure, and some low-visibility phishing campaigns fall beneath alert thresholds.

Phishing frameworks have built-in redundancy, researchers noted, while the disruption of infrastructure doesn't necessarily revoke victim access.

Stolen session cookies may remain valid, OAuth abuse can enable extended cloud access, and organizations may remain compromised after the end of the phishing campaign.

"This does not mean the takedown operation failed. Rather, it shows what happens when disruption hits a maturing underground economy, and why security defenses need to look more broadly than individual players," said Barracuda.

"The Tycoon 2FA takedown accelerated ecosystem diversification. Defensive strategies therefore need to focus on models for identity-based attacks, session abuse and adversary economics. Tycoon 2FA as a branded service has declined, but the techniques it popularized are now more widely distributed than before."

Cyber crime whack-a-mole

Barracuda’s findings highlight a painful recurring theme for law enforcement agencies tackling cyber crime – these operations are very hard to kill outright.

While takedowns cripple infrastructure and hamper operations for a time, many groups simply dust themselves off and get back to it, and often in a far more aggressive way.

There have been repeated instances of cyber crime operations coming back from the dead in recent years despite hard crackdowns by industry stakeholders and law enforcement agencies.

Emotet ranks among the best examples of this. The botnet was used to facilitate an eye-watering volume of attacks over its lifespan before being taken down by a Europol-led operation in January 2021.

Less than a year later, however, the botnet was back up and running, with Analysis from November 2022 showing the cyber criminals behind the operation ramped up attacks to record levels.

Of course, that’s not to say law enforcement should just down tools and stop trying. The impact of these takedowns may have a limited shelf life, but they do provide a temporary reprieve for victims and deliver long-term benefits.

As ITPro reported in the wake of the RAMP hacking forum takedown last year, they enable law enforcement to gain vital intelligence on how these groups work and support other operations further down the line.

This cat and mouse game between hackers and law enforcement is as old as cyber crime itself, and shows no signs of slowing down.

FOLLOW US ON SOCIAL MEDIA

German police have identified two Russian hackers and are calling for help tracking them down.

The German Federal Criminal Police (BKA) said that 31-year-old Daniil Maksimovich Shchukin, who went by the handle 'UNKN', was behind the Russian ransomware groups GandCrab and REvil.

He is suspected of having carried out 130 incidents of gang-related extortion against German organizations, along with 43-year-old Anatoly Sergeevitsch Kravchuk, a Ukraine-born Russian citizen.

Kravchuk is accused of creating and further developing the dark web site used by the group to organize and manage extortion, as well as development of the malware itself.

Across 25 of the cases, the BKA said a total of €35.4 million was paid out in ransom payments.

"Based on investigations conducted so far, the wanted person is believed to be currently abroad, presumably in Russia. It is impossible to rule out potential travel," the BKA said.

"The police are interested in receiving a response to the following question: can you provide any information on the wanted person's current whereabouts?"

REvil mastermind

From the beginning of 2019 until at least July 2021, Shchukin acted as the head of one of the largest ransomware groups globally, known as GandCrab or, later, REvil.

"For the decryption and non-publication of data, the perpetrators demanded high ransoms," said the BKA. "In addition, in some cases, extensive data were also spied on and threatened with the publication of this, unless a ransom was paid."

GandCrab operated a ransomware as a service (RaaS) model, primarily through the use of spam emails. It's believed to have netted a total of more than $2 billion from ransomware attacks, before evolving into REvil, also known as Sodinokibi, in 2019.

“We are a living proof that you can do evil and get off scot-free,” GandCrab said as it bowed out. “We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.”

The group claimed to have been making $2.5 million per week.

"We personally earned more than 150 million dollars per year," Shchukin claimed. "We successfully cashed in this money and legalized it in various spheres of white business both in real life and on the internet."

In its next incarnation as REvil, the group targeted large organizations including IT management software firm Kaseya in a 2021 supply chain attack that saw as many as 1,500 organizations compromised.

Law enforcement agencies including the FBI were eventually able to infiltrate the group’s infrastructure and get hold of its decryption keys, which were then distributed to victims.

The US Justice Department also seized cryptocurrency worth more than $317,000 linked to wallets allegedly controlled by Shchukin.

FOLLOW US ON SOCIAL MEDIA

An international operation has taken down one of the largest networks of fraudulent platforms on the dark web, shutting down hundreds of thousands of websites.

Operation Alice, which kicked off in mid-2021, was led by German authorities and supported by Europol.

It initially focused on the dark web platform "Alice with Violence CP", which was found to be running more than 373,000 fraudulent websites advertising child sexual abuse material (CSAM) and cybercrime-as-a-service (CaaS) offerings.

The operation expanded after the identities of 440 customers who had used the operator's services were uncovered, leading to further examination; more than a hundred are still under investigation.

The team identified patterns among thousands of small and previously unnoticed dark web marketplaces that, individually, looked insignificant and which would normally evade detection. However, by correlating these sites with cryptocurrency transactions, analysts were able to join the dots to reveal a much larger, coordinated network that Europol said covered almost half of the dark web.

The person running the network has been identified as a 35-year-old man based in the People's Republic of China, who is now subject to an international arrest warrant. He's believed to have been running the sites since 2017 and to have made more than €345,000 in profits from around 10,000 customers worldwide.

Meanwhile, the websites have been shut down and 105 servers seized, along with electronic devices including computers, mobile phones and electronic data carriers.

"We are pleased to have disrupted this extensive dark web network," said Thomas Goger, representing the Bavarian authorities involved in the investigation.

"The perpetrator played a central role in a major criminal infrastructure. Dismantling this network marks a significant step forward in several respects: applying cutting-edge law enforcement technologies, prosecuting about 600 offenders and users, and, most importantly, protecting potential future victims."

Between February 2020 and July 2025, said Europol, the suspect advertised CSAM on different platforms, which were accessible through more than 90,000 onion domains. The "packages" on offer cost between €17 and €215, and promised data volumes ranging from a few gigabytes to several terabytes – but were never delivered.

Meanwhile, the sites promoted several cybercrime-as-a-service (CaaS) offerings, including credit card data and access to foreign systems - but again took payments without offering any service in return.

"Operation Alice sends a clear message: there is nowhere to hide for criminals when the international law enforcement community works hand in glove," said Europol executive director Catherine De Bolle.

"We will find them and hold them accountable. Europol will continue to protect children, support victims, and track down the perpetrators."

Fraud has evolved in leaps and bounds over the past few years, with new technology and more digitally native businesses than ever providing the ideal attack surface for fraudsters.

As attackers look to lure in business professionals with new tech such as deepfakes and AI scams, enterprise cybersecurity teams and cybersecurity vendors are faced with the task of combatting cyber fraud more effectively.

How can we combat this new frontier of cyber fraud?

In this episode, Jane is joined by Paul Weathersby, chief product officer, Identity, Fraud & Financial Crime Compliance at Experian, to explore the increasing sophistication of cyber crime and fraud campaigns.

Highlights

"I think the challenge that it creates for, say, financial institutions as an example, is it's becoming much harder to manage the fraud due to the rising threat of AI. The impact that that's having is it isn't necessarily making it more sophisticated. So what an average bank is now seeing is that the the odd sophisticated attack that they used to see is now happening on a regular basis. They might have seen something that was very well coordinated, very well orchestrated, happening once in a while. Now those types of attack are being replicated using AI and happening all of the time."

"So behavioral analytics plays a big part in understanding whether the behavior of the user is that of a person. So a genuine person, not being coerced into performing actions on behalf of someone else, and is actually a bot. So one of the very simple rules that you can look at, for example, is if the interaction with the user is from a phone, to make sure that the phone is held and used at an angle which would be normal."

"Now what we've seen is that AI has now been used to clone voices, which it can be done with as little as three seconds of audio of the from the genuine person to effectively clone the the voice pattern in order to get through those particular controls."

"What you actually see is sometimes these synthetic identities can be something which build up over years, so even sometimes as long as five years. So they look like real people, they transact like real people, and then on any given day, the fraudsters in control of these synthetic IDs decide to actually commit the fraud at that particular point."

Footnotes

• Interpol teams up with tech firms to seize 45,000 malicious IPs, servers in global cyber crime crackdown
• Is your new hire an AI clone? Microsoft says North Korean hackers are using AI to impersonate job seekers and steal company secrets
• Deepfake business risks are growing – here's what leaders need to know

Subscribe 

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn

Interpol has taken down more than 40,000 malicious IP addresses and servers as part of an international cyber crime operation targeting phishing, malware and ransomware activities.

Law enforcement bodies from 72 countries and territories took part in Operation Synergia III between July 2025 and the end of January this year, with 94 people arrested and another 110 still under investigation.

In all, 45,000 malicious IP addresses were taken down and 212 electronic devices and servers were seized.

“Cyber crime in 2026 is more sophisticated and destructive than ever before, but Operation Synergia III stands as a powerful testament to what global cooperation can achieve," said Neal Jetton, director of Interpol's Cybercrime Directorate.

"Interpol remains at the forefront of this fight, uniting law enforcement agencies and private sector experts to dismantle criminal networks, disrupt emerging threats and protect victims around the world.”

As investigations are still ongoing, some details are under wraps. However, the results include the identification of more than 33,000 phishing and fraudulent websites in Macau, China, related to fake casinos and critical infrastructure, such as official bank, government and payment service sites.

Victims are defrauded by topping up their accounts via the fraudulent sites, or by having their personal information and credit card details stolen.

Police in Togo, meanwhile, arrested 10 suspects operating a fraud ring from a residential area. Some specialized in technical crimes such as hacking social media accounts while others carried out social engineering schemes including romance scams and sextortion.

In Bangladesh, police arrested 40 suspects and seized 134 electronic devices related to a wide range of cyber crime schemes, including loan and job scams, identity theft, and credit card fraud.

Hot on the heels of Tycoon 2FA takedown

The operation follows the disruption last week of the the massive phishing as a service (PhaaS) platform, Tycoon 2FA.

This saw threat actors use adversary in the middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

In an international operation, 330 domains were seized, including parts of the core infrastructure, such as phishing pages and control panels.

Much like that action, Operation Synergia III was carried out in collaboration with a number of private sector organizations, including Trend Micro.

“This kind of international operation highlights the value of close collaboration between law enforcement and the cybersecurity community. Behind every malicious server or phishing kit sits a wider criminal ecosystem that needs to be mapped and understood before arrests become possible," said Robert McArdle, director of cybercrime research at Trend Micro business unit TrendAI.

"Our support for investigations such as Tycoon 2FA, and contributions to operations like this one led by Interpol, demonstrates how actionable threat intelligence can help authorities identify infrastructure, connect actors and disrupt cyber criminal networks at scale.”

FOLLOW US ON SOCIAL MEDIA

While much emphasis has been placed on the rise of youth cyber crime over the last two years, new research shows hacker activity peaks much later.

Orange Cyberdefense looked at the numbers and found that it's actually thirty- and forty-somethings that are the greatest threat.

The company’s intelligence team analyzed 418 publicly announced law enforcement activities between 2021 and mid-2025 and found that offenders’ activities peaked between the ages of 35 and 44. This age group, they said, accounted for 37% of cyber crime cases.

Put together, the combined age groups of 25-to-44 make up well over half (58%) of analyzed cyber crime cases.

Only one-in-five (21%) incidents were the work of 18-to-24-year-olds. Despite the bad press they get in movies and the news, 12-to-17s were behind fewer than 5% of cases.

“The surge in cyber offences committed by teenagers in recent years may be creating a false impression of the age of today's cyber criminals," said Charl van der Walt, head of security research at Orange Cyberdefense.

"The sensationalist interpretation of cyber crime's youthfulness makes for a good headline, but these findings appear to tell a different story."

Differing motives

One big difference between the kids and their elders is the underlying motivation behind attacks, researchers noted. As you might expect, younger hackers are frequently experimenting while the older cohort is in it primarily for financial gain.

Among 18-24-year-olds, cyber criminal activity is highly diverse, though there's a focus on hacking (30%) in particular, followed by selling stolen data and DDoS attacks (10% each).

Things start to change among offenders aged between 25 and 34, who tend to focus on more profitable activities such as selling stolen data (21%), cyber extortion (14%) and malware deployment (12%).

This trend continues among 35-to-44 year olds, where cyber extortion (22%) is the crime of choice, followed by malware (19%) and cyber espionage (13%), hacking (10%), and money laundering (7%).

"While younger, less experienced hackers engage in highly diverse – and often noticed and reported – actions, they may be less likely to engage in calculated, profit seeking activity," said van der Walt.

"Instead, cyber crime careers appear to peak much later into adulthood, accompanied by vastly more sophisticated and intentional techniques.”

Some of those teen-related activities are very high profile indeed. Late last year, for example, a 15-year-old was outed by security researcher Brian Krebs as a member of Scattered LAPSUS$ Hunters – the group responsible for the Jaguar Land Rover (JLR) and M&S cyber attacks.

Two teenagers, meanwhile, are set to face charges for the 2024 hack of Transport for London (TfL), while another pair have been arrested for the data breach of the Kido chain of children's nurseries.

FOLLOW US ON SOCIAL MEDIA

State-sponsored attackers are weaponizing legitimate software and infrastructure to lie in wait, shifting tactics away from data breaches to more sophisticated espionage and disruptive operations.

That's according to a new report from Cloudflare that walked through a series of attacks from Chinese hacks against Google Calendar to North Korean IT worker scams – including a tactic that makes use of AI.

In that attack, the hackers snuck past traditional perimeter defenses by finding credentials hidden in code using secret scanning tools, such as TruffleHog.

"Once these keys to the kingdom were harvested, the actor leveraged generative AI in real time to navigate unfamiliar, complex SaaS environments," the report said.

Examples like this underline how AI is supporting cyber crime operations, the report noted, making it easier for hackers to target legitimate tools and weaponize them against victims.

"The accessibility of generative AI large language models (LLMs) both increases unwitting user risk and significantly lowers the barrier to entry for highly effective operations," researchers said .

"Adversaries have moved beyond technically elegant code to 'offense by the system,' leveraging a victim’s own cloud, SaaS, and AI infrastructure to fund and scale missions."

Nation-state attackers shift tactics

Cloudflare said it has tracked four primary state actors over the last year, namely Russia, China, North Korea, and Iran. The security firm said it was seeing a blurring of strategic goals, with digital strikes increasingly backing up military actions in conflicts.

China, for example, has shifted away from bulk data theft to targeting legitimate infrastructure such as the cloud for longer-term compromises and strategic "pre positioning" tactics that are ideal for espionage and disruptive operations.

"By weaponizing legitimate enterprise ecosystems – such as FrumpyToad’s use of Google Calendar for C2 or PunyToad’s exploitation of F5 and VMware vCenter and ESXi – Beijing has created a resilient, living-off-the-cloud architecture that allows for rapid data exfiltration while remaining nearly invisible to standard perimeter defenses," the report noted.

Notorious Chinese state-backed hacker groups such as Salt Typhoon have employed living off the land techniques extensively over the last two years, most notably during attacks on US State National Guard networks and US congressional email systems.

Meanwhile, in Russia, groups like NastyShrew use "high-reputation cloud services" to mask their activities in order to continue targeting Ukrainian critical systems.

That includes tactical communication apps used by the Ukrainian military, and Cloudflare suggested that was "possibly in support of physical operations."

The rise of North Korean IT workers

Cloudflare has also observed what it calls the "industrialization" of a scheme run by North Korea in which AI and other tools are used to pose as American workers to get jobs as remote IT workers.

"These operatives infiltrate Western organizations by leveraging fraudulent identities and AI-driven deepfakes to bypass video interviews, ultimately funneling hundreds of millions of dollars in revenue back to the regime," the report notes.

Alongside using AI, threat actors often set up digital personas on LinkedIn and GitHub for more legitimacy – sometimes even "renting" the accounts of real American citizens.

Once employed, these North Korean workers use American-based "laptop farms" that are accessed via remote management and monitoring software from overseas.

As ITPro previously reported, the number of fake IT worker scams has surged over the last 18 months, prompting security agencies and the FBI to issue advisories on how to tackle the issue.

Cloudflare said it's possible to spot such behavior, however, and urged organizations to bolster identity checks.

"Despite these sophisticated tactics, several high-fidelity detection indicators have emerged, including 'impossible travel' login alerts, the presence of mouse-jiggling software, and specific video metadata micro-artifacts consistent with real-time deepfake rendering,” the company said.

Notably, Cloudflare advised shifting away from traditional perimeter defenses in favor of zero trust biometric verification and stricter geofencing for remote management tools.

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are using “modular malware components” to create custom campaigns and speed up attacks, according to new research from HP.

Findings from HP Wolf Security's latest Threat Insights Report show hackers are combining off-the-shelf malware components, usually purchased via cyber crime forums, to wage attacks against enterprises globally.

Researchers at the firm noted that while early-stage lures and final payloads typically change, attackers are “reusing the same intermediate scripts and installers”.

This means that threat actors are able to build, customize, and scale campaigns with little effort and at a rapid pace – and it’s a trend that’s gaining traction. HP said it has observed multiple unrelated groups using the same basic building blocks in several campaigns.

The emergence of this ‘flat-pack’ malware trend aligns closely with the increased use of AI among threat actors, according to HP. Findings from the Threat Insights Report show attackers are also using AI to automate malware delivery as part of a focus on ‘vibe-hacking’ techniques.

In one example cited by the company, threat actors used AI to create a fake invoice PDF which triggered a silent download from a compromised site. Thereafter, this redirected unsuspecting users to trusted platforms such as Booking.com to curb their suspicions.

Alex Holland, principal threat researcher at HP Security Lab, said the increased use of AI in malware operations, combined with the focus on ‘flat-pack’ components, shows threat actors are prioritizing faster attacks and cheaper costs.

“It’s the classic project management triangle - speed, quality, and cost,” he said. “You often sacrifice one of them. What we’re seeing is many attackers are optimizing for speed and cost, not quality.”

“They are not using AI to raise the bar; they’re using it to move faster and reduce effort.”

Holland further warned that although these campaigns are often basic in nature, the “uncomfortable reality is they still work”.

AI malware is taking off

The HP research comes in the wake of repeated warnings over the use of AI to build and fine-tune malware. As ITPro reported last month, research from Zscaler shows hackers are leveraging the technology to create more potent malware strains.

Google also warned that threat actors were found abusing its Gemini AI models to build malware in early February.

The use of AI in this instance also goes beyond building malware, however, with the technology also used during the early research and development stages.

Analysis from Trend Micro in September 2025 warned that hackers were ‘vibe coding’ malware by using AI to dissect publicly available threat intelligence reports.

This, Trend Micro noted, allowed threat actors to essentially reverse engineer malware strains based on technical blogs from industry stakeholders, create “partial malicious” code, and even mimic other group’s TTPs.

Ian Pratt, global head of security for personal systems at HP, said the firm’s research highlights the significant risks now posed by threat actors using AI.

“When attackers can generate and repackage malware in minutes, detection-based defences can’t keep up,” he said. “Instead of trying to spot every variant, organizations need to reduce exposure.”

Reducing exposure in this sense can be as simple as “containing high-risk activities” such as warning staff not to open untrusted attachments or clicking unknown links - typical advice given by most enterprises yet often still the source of breaches.

Separate analysis from the firm showed 14% of email threats identified by HP Sure Click bypassed one or more email gateway scanners, underlining the increasing success rates of threat actors.

FOLLOW US ON SOCIAL MEDIA

The Chinese-backed hacking group known as Salt Typhoon has waged successful espionage campaigns against an array of organizations across Norway, according to the Norwegian Police Security Service.

No details have been published on which companies were targeted or how long the attackers were able to maintain access.

However, the report warned Chinese security and intelligence services are increasingly carrying out intelligence operations in Norway, including cyber operations and the collection of human intelligence.

"In 2026, China will collect intelligence, reconnoiter Norwegian digital infrastructure and threaten groups and individuals to prevent them from criticizing the Chinese Communist Party," the report reads.

"An increasing number of operations are likely to be carried out by commercial cybersecurity contractors and individuals who are not trained intelligence personnel but act on behalf of Chinese security and intelligence services."

Norwegian authorities warned any organizations holding sensitive information to be on the alert, particularly those operating in national infrastructure domains.

Salt Typhoon has mainly focused on targets in the US and Canada, but analysis shows the group is expanding operations globally. In September last year, the FBI warned the group had hit organizations in as many as 80 countries altogether.

The US Cybersecurity and Infrastructure Security Agency (CISA) said it was mainly targeting telecommunications, government, transportation, lodging, and military infrastructure networks.

Salt Typhoon typically targets large backbone routers of major telecommunications providers and network infrastructure companies, as well as provider edge (PE) and customer edge (CE) routers.

They also leverage compromised devices and trusted connections to pivot into other networks, modifying routers to maintain persistent, long-term access to networks.

Salt Typhoon is getting bolder

Pete Luban, Field CISO at AttackIQ, warned the group is becoming “more dangerous with each successful infiltration” and has established itself as a key adversary for national security agencies globally.

Salt Typhoon gained notoriety after compromising email systems belonging to “very senior” US political figures as part of an intelligence gathering campaign.

These long-running campaigns have become a hallmark of the group, which also managed to avoid detection in US National Guard networks for nearly a year.

"Continued access into internal systems allows threat actors to establish long-term surveillance and position themselves to carry out destructive attacks with little to no advanced warning," Luban said.

"However, breaches like these also deal indirect damage by undermining the security of intelligence sharing networks. If Salt Typhoon can sow seeds of doubt into these networks, it could force allies to limit or restrict information sharing, ultimately weakening collective security."

Organizations are advised to identify where vulnerabilities might exist in their infrastructure and mitigate them before threat actors can exploit them.

These networks should be segmented from internet-facing systems, while enforcement of zero-trust access controls can also help contain any damages caused by Salt Typhoon if defenses are breached.

The report also warned that Chinese intelligence services are recruiting Norwegian nationals to gain access to sensitive and classified information.

Often, those being recruited don't know they're working for Chinese intelligence, thinking they're employed by a think tank, an international company, a consultancy firm or similar.

"Sources are initially asked to provide non-public information in exchange for payment, such as details on the activities or plans of companies, public sector organisations of political institutions," it said.

FOLLOW US ON SOCIAL MEDIA

The FBI has seized the clearnet and dark web domains of the RAMP underground hacking forum, used by Ransomware as a Service (RaaS) gangs and other cyber criminals.

While there's no official statement as yet, the domains now display banners reading "The Federal Bureau of Investigation has seized RAMP."

The notice adds that the action was carried out in coordination with the US Attorney's Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice.

The takedown also appears to be confirmed by "Stallman", said to be one of RAMP's owners, in an XSS hacking forum post translated from Russian and shared on X.

"With regret, I inform you that law enforcement agencies have gained control over the Ramp forum," it reads.

"Despite the fact that I no longer control Ramp and will not be creating a new forum from scratch, I will continue to buy accesses,” the statement adds. “My core business remains unchanged. If you have something you can offer me, the terms are listed in my signature, message me in private messages, and we will exchange via Jabber/Tox."

What you need to know about RAMP

RAMP - which originally stood for Russian Anonymous Marketplace - was a highly popular dark web forum that catered mainly for Russian-speaking cyber criminals, including RaaS gangs and initial access brokers.

It billed itself as the “only place ransomware allowed", and ransomware groups including Qilin, LockBit, DragonForce, RansomHub, and ALPHV/BlackCat promoted their RaaS services there.

The site also included discussion groups and cyber attack tutorials.

"The reason for its success was that it offered criminals a marketplace supporting the entire attack chain, from the ability to buy stolen credentials, promote malware or sell and purchase ransomware services," said Ben Clarke, SOC manager at CybaVerse.

Will the takedown stick?

Clarke added that while the takedown will affect criminal activity for a while, the long-term impact could be minimal.

"Anything to disrupt this activity is a positive step for defenders. But we would be naive to believe it will a tangible impact on cyber crime," he said. "New marketplaces will be formed to take RAMP’s place, while threat actors will navigate to other platforms to buy and sell services."

Law enforcement takedowns in recent years have achieved mixed results. While they do disrupt operations, forums are often revived, as with the Emotet botnet takedown in 2022. In this instance, the botnet returned with a vengeance.

This doesn't mean that these operations are futile, however. Daniel Wilcock, threat intelligence analyst at Talion, said takedowns are still a key tactic for law enforcement to stifle cyber criminal activities and gain vital intelligence.

"While this doesn't signal the end of ransomware, law enforcement will be able to gain valuable information from the seizure around the threat actors using the services, such as their emails and IP addresses plus access to the financial transactions that took place on the market," he said.

"This could support further law enforcement action against the threat actors that used the site, but given that RAMP was heavily used by Russian criminals it's highly unlikely we will see many actual arrests."

FOLLOW US ON SOCIAL MEDIA

Notorious cyber crime marketplace RedVDS is no more after a Microsoft strike knocked the Cybercrime as a Service community offline.

While the name of the site may not be familiar, its impact has been felt widely across the globe in recent years. Microsoft said activity linked to RedVDS infrastructure had compromised more than 191,000 organizations globally since September, enabling $40 million in fraud in the US alone since March 2025.

RedVDS was an online subscription service that let hackers launch attacks using virtual computers – often running unlicensed versions of Windows.

Steven Masada, assistant general counsel for Microsoft’s Digital Crimes Unit, said the online community made fraud “cheap, scalable, and difficult to trace”.

"Services like these have quietly become a driving force behind today’s surge in cyber‑enabled crime, powering attacks that harm individuals, businesses, and communities worldwide,” Masada said in a blog post confirming the takedown.

What was RedVDS?

RedVDS started operations in 2019, offering hackers low-cost virtual services on a marketplace via a subscription service, with prices as low as $40 dollars in some instances.

"RedVDS is an infrastructure service that facilitated malicious activity, but unlike malware, it did not perform harmful actions itself; the threat came from how criminals used the servers after provisioning," Microsoft said.

Criminals used tools available via RedVDS for spam and phishing emails to route traffic to evade detection or access criminal forums, and to run scripting or automation tools.

"In these schemes, attackers gain unauthorized access to email accounts, quietly monitor ongoing conversations, and wait for the right moment, such as an upcoming payment or wire transfer," Masada explained.

"At that point, they impersonate a trusted party and redirect funds, often moving the money within seconds."

Microsoft said it spotted plenty of legitimate tools being used on RedVDS hosts by criminals to build their malicious campaigns, including VPNs, remote admin tool AnyDesk, and AI tools such as ChatGPT and even its own Copilot.

"RedVDS is frequently paired with generative AI tools that help identify high‑value targets faster and generate more realistic, multimedia message email threads that mimic legitimate correspondences," Masada said.

"In hundreds of cases, Microsoft observed attackers further augment their deception by leveraging face-swapping, video manipulation, and voice cloning AI tools to impersonate individuals and deceive victims."

RedVDS victims consider legal action

A host of major companies worldwide have been impacted by RedVDS in its seven-year history. Victims include H2-Pharma, an American pharmaceutical company that lost $7.3m.

Meanwhile, the Gatehouse Dock Condominium Association in Florida lost $500,000 in a scam. Both are plaintiffs in the civil action against RedVDS, Microsoft noted.

The takedown is the result of a far-reaching operation which saw coordinated legal action in the US and UK. The tech giant said it worked closely with law enforcement agencies such as Europol in the effort.

Microsoft and its partners have taken over "key malicious infrastructure", including two domains that host the marketplace.

How Microsoft cracked the case

RedVDS operated similarly to various other Cybercrime as a Service schemes. According to Microsoft, the site offered unlicensed Windows-based Remote Desktop Protocol (RDP) servers with full administrator control and no usage limits.

Hackers behind the service boasted that its system could set up a fresh host within minutes — offering scalability to its clients.

Notably, the scheme was blown open after Microsoft investigators found a “single, cloned Windows host image” that was being reused across the service. This, researchers explained, left “unique technical fingerprints that defenders could leverage for detection."

Microsoft noted that RedVDS provided virtual Windows cloud servers, but all were generated from a single Windows Server 2022 image via RDP – another mistake that gave researchers vital clues.

"All RedVDS instances identified by Microsoft used the same computer name, WIN-BUNS25TD77J, an anomaly that stood out because legitimate cloud providers randomize hostnames," Microsoft added.

RedVDS didn't own any data centers for its operations, instead renting servers from five hosting companies in the US, Canada, UK, France and Netherlands. That allowed RedVDS to offer services in different regions, helping to evade security filters, and more easily blend attacks with normal data centre traffic, Microsoft noted.

Microsoft said efforts were underway to identify the individuals who ran the site, but said it tracks the threat actor as Storm-2470.

How can enterprises protect themselves?

What can businesses do to avoid being subject to such attacks? Microsoft noted that most of RedVDS-related attacks involved social engineering, phishing operations, and business email compromise (BEC).

To defend against phishing and BEC attacks, Microsoft said to focus on primary gateways such as email and authentication by hardening credentials and cloud identities, and to invest in user awareness training such as phishing simulations.

"Simple steps can significantly reduce risk, including slowing down and questioning urgency, calling points of contact back using numbers that are already known to you, verifying payment requests using additional contact information, enabling multifactor authentication, watching carefully for subtle changes in email addresses, keeping software up to date, and reporting suspicious activity to law enforcement," Masada added.

FOLLOW US ON SOCIAL MEDIA

A London council has written to hundreds of thousands of residents to warn them that criminals may use details leaked via a cyber attack last year to target them for scams.

At the end of November, Kensington and Chelsea was one of a trio of west London councils that suffered an outage that was quickly attributed to a cyber attack.

A week later, the council confirmed that personal data was likely leaked, though it stressed it was only "historical data".

Now, a spokesperson for the council has said the attackers had "criminal intent", with the council's website adding that sensitive data and personal information that could impact residents had been accessed by the attackers.

Council leader Elizabeth Campbell said the "serious" breach required action from the council, with an update in the middle of December saying 100,000 households had already been contacted with warnings following the attack.

A spokesperson told ITPro the letters were sent out at the beginning of December, and the message references the attack of "two weeks ago".

"We decided to go out immediately and say to people this is what's happened, this data has been copied and it has been taken and you should be aware therefore you are at risk," she told the BBC.

Written warning

In a copy of the letter shared with ITPro by the council, recipients are advised to be wary of scam messages, check online accounts for unusual activity, and report any suspicious activity to the National Cyber Security Centre (NCSC).

"Like any local authority, it was always possible that our systems could come under attack and therefore we had invested significantly in our digital, data and technology services over many years," Campbell said in the letter.

"This meant that we had a cyber defence system that was able to spot this attack quickly and protect much of our infrastructure, and the infrastructure of others, as best as possible."

Campbell added: "Despite this, we do believe that some data has been copied and taken. It is important to say we still have access to this information, but it is possible a copy could end up in the public domain. As a priority we are checking if this contains any personal or financial details of residents, customers, and service users. This may take months and we will update residents at every step."

The council is now "going through all the documentation" to spot any specific risks and will contact individuals directly if affected, though it noted that work may take months.

Similarly, the local authority said it was checking which details in files may have been accessed, admitting that work may yield nothing, but said "we want to make sure we turn over every stone."

What happened

The attack began on the morning of 24 November, and was immediately spotted by staff at Kensington and Chelsea, who took steps to isolate systems.

A week later, that council admitted some data had been accessed, including sensitive information; however, it stressed the data wasn't encrypted by the attackers, such as in a ransomware attack, and therefore remained accessible to the council.

Hammersmith and Fulham Council and Westminster City Council were the other two local authorities hit by the outage, as the three organizations share some systems.

Hammersmith has said it so far appears its systems were not compromised, while Westminster earlier this month confirmed that "limited data" had been breached.

Keven Knight, CEO of Talion, told ITPro last year that councils are a prime target for cyber criminals, largely due to the scope of personal and financial information they hold on residents.

"This is the type of information that can’t be changed easily. This means it's now in the hands of a threat actor, and victims will be exposed to an increased risk of phishing," he said.

The Information Commissioner's Office (ICO) has been informed of the incident, and the Metropolitan Police and NCSC are investigating. So far, there's no indication who is behind the attack.

"The Met is leading an investigation and we are working alongside them with the national cyber security centre and the NCC Group," a spokesperson for Kensington and Chelsea council said.

"We are taking steps to work through the data in accordance with ICO and legal rules."

FOLLOW US ON SOCIAL MEDIA

Notorious cyber crime group Scattered LAPSUS$ Hunters has been left red-faced after boasting about a data breach that turned out to be a honeypot.

The group posted screenshots on Telegram, which have since been taken down, claiming to have gained full access to systems belonging to cybersecurity firm Resecurity.

As reported by DataBreaches, the post claimed Scattered LAPSUS$ Hunters had gained access to all internal chats and logs, employee data such as names and email addresses, as well as threat intelligence and client lists.

"They go around telling companies they will 'protect' them from cyber attacks, sell expensive services, act like experts... but in the end, just like we did with CrowdStrike and the FBI, they got fully owned :(((," crowed the group.

The gloating by the cyber crime group was short-lived, however, with Scattered LAPSUS$ Hunters having fallen victim to a honeypot campaign conducted by researchers at Resecurity.

How the honeypot worked

In November, the company detected a threat actor attempting to conduct malicious activity, sniffing around various publicly facing services and applications. It also targeted one of the company's employees who had no sensitive data or privileged access.

"Understanding that the actor is conducting reconnaissance, our team has set up a honeytrap account. This led to a successful login by the threat actor to one of the emulated applications containing synthetic data," said the company in a blog.

"While the successful login could have enabled the actor to gain unauthorized access and commit a crime, it also provided us with strong proof of their activity."

The honeypot scheme used synthetic data – purposely generated data with the patterns and characteristics of real-world data, but that doesn't contain any actual proprietary information.

In this case, this data included more than 28,000 synthetic consumer records and over 190,000 synthetic payment transaction records.

"In the context of threat hunting, previously breached data can be highly effective for designing deception models that appear extremely realistic and attract threat actors," said Resecurity.

"For example, a purposely planted honeypot — containing realistically looking (but practically useless) records — can motivate threat actors to attempt to steal it."

Patience is a virtue

Researchers at Resecurity waited, and on December 12 the group resumed activity, making more than 188,000 requests attempting to dump the synthetic data over the next two weeks. It then aimed to scrape the data using malicious automation.

At one point, the threat actor inadvertently disclosed their real IP addresses. This misstep, along with other mistakes, allowed Resecurity to identify the exact servers being used for automation, despite the use of lists of residential IP proxies to spoof the source.

"The group called ShinyHunters, previously profiled by Resecurity, fell into a honeypot," Resecurity said. "In fact, we are dealing with their rebranded version, which calls itself "Scattered Lapsus$ Hunters," due to the alleged overlap between the threat actors ShinyHunters, Lapsus$, and Scattered Spider."

According to Resecurity, information on the threat actors acquired through the campaign has been provided to law enforcement agencies investigating the group.

FOLLOW US ON SOCIAL MEDIA

Two US cybersecurity experts have pleaded guilty to using ALPHV BlackCat ransomware to extort businesses across the USA during a seven-month campaign in 2023.

40-year-old Ryan Goldberg of Georgia and 36-year-old Kevin Martin of Texas, admitted conspiring to obstruct, delay, or affect commerce through extortion in a federal district court in the Southern District of Florida.

Goldberg was an incident response manager at the time he and Martin, as well as one other unnamed individual, turned their skills to nefarious activities. Martin, meanwhile, was a ransomware threat negotiator.

Their campaign, which ran from April to December 2023, saw the trio turn to ALPHV BlackCat ransomware as a service operators, who they agreed to pay 20% share of any ransoms received in exchange for access to the ransomware and extortion platform

They then successfully used the malware against numerous US targets, including a pharmaceutical company based in Maryland, an engineering company based in California, a drone manufacturer in Virginia, and a medical company from Florida, where the case was heard.

One victim paid the equivalent of $1.2 million in Bitcoin in order to put an end to the attack, with the proceeds split three ways between the conspirators after they had given the ALPHV BlackCat administrators their cut.

Assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division said: “These defendants used their sophisticated cybersecurity training and experience to commit ransomware attacks — the very type of crime that they should have been working to stop.”

Millions of dollars saved following ransomware disruption

ALPHV BlackCat was active for 18 months before the FBI developed a decryption tool for the ransomware, extorting millions of dollars from businesses primarily in the US before going dark in December 2023. The law enforcement agency estimates it saved victims in the order of $99 million in ransomware payments.

“The FBI remains committed to working alongside its law enforcement partners to disrupt and dismantle criminal enterprises involved in ransomware attacks and to hold accountable not only the perpetrators but also anyone who knowingly enables or profits from them,” said special agent in charge Brett Skiles of the FBI Miami Field Office.

US attorney Jason A Reding Quiñones, representing the Southern District of Florida, said: “Goldberg and Martin used trusted access and technical skill to extort American victims and profit from digital coercion.”

“Their guilty pleas make clear that cybercriminals operating from within the United States will be found, prosecuted, and held to account,” he added.

The pair are set to be sentenced on 12 March 2026 and face a maximum penalty of 20 years in prison.

Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations that go way beyond today’s ransomware and phishing campaigns.

In a new report, the cybersecurity firm predicted that agentic AI will massively increase attack volume, with automated phishing, fraud, and breach exploitation becoming continuous background operations.

Criminal ecosystems will move from a traditional Cybercrime as a Service model to what Trend Micro called 'Cybercrime as a Servant’, relying on chained AI agents and autonomous orchestration layers to run criminal businesses end-to-end.

“Agentic AI gives criminals a ready-made arsenal that scales, adapts, and keeps working even when the humans disappear. The real risk is not a sudden AI-fueled explosion of crime, but the slow, unstoppable automation of attacks that used to require skill, time, and effort. This shift is already underway,” said Robert McArdle, director of forward-looking threat research at Trend Micro.

“We will see an optimization of today’s leading attacks, the amplification of attacks that previously had poor ROI, and the emergence of brand new ‘Black Swan’ cybercrime business models.”

Researchers said they expect to see more attacks on enterprise cloud and AI systems, as these provide cyber criminals scalable power, compute, AI capabilities, storage, and access to valuable information they can use to run their agentic architecture.

This, the company warned, will introduce new kinds of attacks – many of which are unprecedented, or expected to grow in scale. Meanwhile, agentic cyber crime will influence the overall setup of today’s criminal ecosystem, giving rise to new or enhanced criminal business models and trends.

Looking ahead, Trend Micro said defensive platforms and security solutions will need their own orchestrators and autonomous agents to counter the shift, or risk being overwhelmed.

“For enterprises, this means reassessing security strategy now as well as investing in automation and AI-driven defence," McArdle said.

"Organizations also have to ensure resilience before criminals industrialize their own use of AI, or risk trying to catch up in an exponential arms race that will quickly separate those who were prepared and those were not.”

Agentic AI security warnings ramp up

Trend Micro is by no means the first firm to warn of the looming threat of agentic AI-related cyber crime.

In September, for example, Anthropic admitted that its AI tools had been "weaponized" by hackers to conduct serious attacks against organizations.

The company warned agentic AI is being used across cyber criminal operations, particularly to identify victims, analyze stolen data, and to create ransomware and malware strains.

In a blog post detailing its findings, Anthropic pointed to examples where cyber criminals used Claude Code to automate reconnaissance practices, harvest victim credentials, and penetrate networks at 17 organizations in the healthcare, emergency services, and government sectors.

A similar study from Malwarebytes in early 2025 also highlighted the growing threat posed by agentic AI in cyber criminal operations.

The company’s 2025 State of Malware report said this latest iteration of the technology will “further revolutionize cyber criminal tactics” and enable threat actors to create more potent malware strains.

While warnings over the use of agentic AI among cyber criminals are growing, the use of the technology by defenders offers huge potential, industry stakeholders claim.

AWS CISO Amy Herzog, for example, recently told ITPro that agents will herald a radical shift for cybersecurity practitioners, enabling them to react to attacks in a more efficient manner.

MORE FROM ITPRO

• ‘Slopsquatting’ is a new risk for vibe coding developers
• Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malware
• Agentic AI carries huge implications for security teams

Security researcher Brian Krebs has unmasked one of the apparent culprits behind the Jaguar Land Rover and M&S cyber attacks as a Jordanian teenager.

Krebs approached the 15-year-old, who had been using the pseudonym ‘Rey’ on Telegram and confirmed his real identity.

The teenager said he has been in contact with various international law enforcement agencies, such as Europol, and hasn’t carried out any hacking activities since September.

“I’m already cooperating with law enforcement,” he said. “In fact, I have been talking to them since at least June,” he told Krebs.

Krebs noted that he was unable to confirm these details following contact with the individual.

Scattered LAPSUS$ Hunters, of which 'Rey' is just one of three administrators, has been behind numerous extortion attempts. According to Krebs, he was previously an administrator of the data leak website for Hellcat, a ransomware group involved in attacks on Schneider Electric, Telefonica, and Orange Romania.

The teenager was also an administrator of the latest incarnation of English-language leak site, BreachForums.

While cyber crime groups like this are often portrayed as being part of organized crime, 'Rey' is one of a growing number of hackers who turn out to be normal teenagers.

How Krebs snared ‘Rey’

According to Krebs, a series of mistakes enabled him to track him down. While operating under the Telegram username @wristmug, Rey accidentally revealed his password in a screenshot - a password that Krebs was able to link to the email address cybero5tdev@proton.me.

Data from Spycloud then indicated that Rey’s computer was a shared Microsoft Windows device located in Amman, Jordan, and also used by other family members.

It's not clear what will happen now. But, Alon Gal, co-founder and CTO at Hudson Rock questioned why “no apparent action” had been taken by law enforcement.

“Rey is one of the most prolific threat actors of the past few years,” he wrote in a post on LinkedIn. “I genuinely don’t understand how they let him continue if the dox proves to be accurate."

In any case, Rey told Krebs: "I don’t really care, I just want to move on from all this stuff even if its going to be prison time or whatever they gonna say.”

The rise of teen hackers

It's not unusual for hackers - especially in the various groups associated with Scattered Spider - to turn out to be extremely young. In September, for example, 19-year-old Thalha Jubair and Owen Flowers, 18, were charged in the UK for their involvement in an attack on TfL last year.

Speaking to ITPro at the time, security experts said the uptick in youth-related cyber crime is a serious cause for concern and requires swift action from industry, academia, and law enforcement.

Anna Chung, principal researcher for EMEA at Palo Alto Networks, said the trend should be a “wake up call” for authorities and called for efforts to encourage tech-savvy teens toward legitimate careers in cybersecurity.

According to the UK's Information Commissioner’s Office (ICO), the biggest cybersecurity risk faced by schools comes from the pupils themselves, with around 5% of all 14-year-old boys and girls admitting to ‘hacking’ in some capacity.

William Wright, CEO of Closed Door Security, said the group boasts close ties to Russian threat actors, which has enabled it to wreak widespread havoc.

"There will be a lot of concern among the general public around how a 15-year-old could cause so much damage to some of the biggest organisations in the UK. But in reality, it's not so simple. Rey was collaborating with Russian threat actors, using their infrastructure to execute highly sophisticated attacks," he said.

"Rey claims to be working with law enforcement now, which is causing trouble across the Scattered Lapsus$ Hunter Telegram channel. This could lead to other members of the gang being identified, but Rey may get off lightly if he supports law enforcement enough."

MORE FROM ITPRO

• Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK'
• M&S reveals massive financial hit from cyber attack
• Hackers behind Jaguar Land Rover announce their 'retirement' – should we believe them?

As a business leader, you’d like to believe that your staff are entirely trustworthy. Effective enterprises run on workforce confidence – but in some cases, that trust can be misplaced.

In November, CrowdStrike admitted one of its own employees had provided screenshots of internal systems to hackers in exchange for a sizable payout. Industry experts have told ITPro the incident should act as a wake up call to the all-too-serious risk of insider threats.

Earlier in the month, websites all over the world went offline after a major outage at the content delivery network service provider Cloudflare. What was the cause of the incident: had Cloudflare fallen victim to the kind of DDoS attack it’s famous for preventing?

In this episode, Jane and Rory welcome back Ross Kelly, ITPro’s news and analysis editor, to explore some of November’s biggest stories.

Highlights

"The individual was believed to have been paid around $25,000 for this, which all things considered, I think, is quite low when you're risking being fired and, you know, a potential jail sentence in the aftermath of this. So these were leaked on Telegram. CrowdStrike, obviously, was made aware of this and they reacted pretty swiftly like we mentioned. That person has since been dismissed, I don't think it was too much of an issue for HR in that situation."

"A lot of organizations still lack formal insider threat programs. It's something that's just not really on their radar because a lot of the time, the headlines are based around you ransomware attacks, malware, etc, etc. And so, you know, when you have an individual in your company that's potentially at risk, how do you deal with that?"

“An outage at Cloudflare, I think, is a worst case scenario for a lot of organizations, a lot of online services."

“The outage itself was a result of a bug in its bot management software. So, the software that essentially allows websites to allow bots onto their individual sites, or prevent bots from accessing their sites, a bug in that service and that software caused this, which created somewhat of a cascading effect where a lot of websites essentially just were bricked for a good couple of hours."

Footnotes

• If you're not taking insider threats seriously, then the CrowdStrike incident should be a big wake up call
• Nearly 700,000 customers impacted after insider attack at US fintech firm
• AI means cyber teams are rethinking their approach to insider threats
• ‘Insiders don’t need to break in’: A developer crippled company networks with malicious code and a ‘kill switch’ after being sacked – and experts warn it shows the huge danger of insider threats
• Everything you need to know about Cloudflare
• The Cloudflare outage explained: What happened, who was impacted, and what was the root cause?
• Cloudflare says AI companies have been “scraping content without limits” – now it’s letting website owners block crawlers and force them to pay
• Security experts issue warning over the rise of 'gray bot' AI web scrapers
• Cloudflare is fighting back against AI web scrapers
• Nearly half of all digital initiatives still fail – here’s how you can learn from the ‘digital vanguard’ and deliver success

Subscribe 

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Join us on LinkedIn

The UK, US, and Australia have imposed sanctions on a Russian cyber crime group offering so-called 'bulletproof' hosting services for hackers worldwide.

Media Land provides online infrastructure to support ransomware and phishing operations, and is believed to have played a key role in a spate of devastating cyber attacks in recent years.

Ransomware victims of the outfit include UK critical national infrastructure organizations and it's also been used for malware and phishing campaigns targeting UK taxpayers.

In the US, Media Land infrastructure has been used in distributed denial of service (DDoS) attacks against companies and critical infrastructure. Meanwhile, in Australia, the group has helped criminals to carry out attacks against financial institutions, businesses, their customers, and critical infrastructure.

"Cyber criminals think that they can act in the shadows, targeting hard working British people and ruining livelihoods with impunity," said UK foreign secretary Yvette Cooper.

"But they are mistaken – together with our allies, we are exposing their dark networks and going after those responsible."

The measures target Media Land’s ringleader, Alexander Volosovik, also known as Yalishanda, who has been active since at least 2010 and is known to have worked with some of the most notorious cyber criminal groups, including Evil Corp, LockBit, and Black Basta.

Also sanctioned is Kirill Zatolokin, a Media Land employee responsible for collecting payment from customers and coordinating with other cyber actors, as well as Yulia Pankova, who has helped Volosovik with legal issues and handled his finances.

Sanctions target Media Land sister outfits

The sanctions also target ML Cloud, a Media Land sister company whose technical infrastructure is often used in conjunction with Media Land, including in ransomware and DDoS attacks.

Hypercore, a UK company registered and utilized by Aeza Group, has also been targeted in the international campaign.

The sanctions block access to any assets held in the sanctioning countries, and bar businesses and individuals there from engaging with the listed entities or people. Financial institutions that violate these restrictions can face penalties themselves.

"These sanctions don’t just impose costs on criminals, they dismantle the infrastructure that enables cyber crime," said Australian deputy prime minister Richard Marles.

"By disrupting these networks, we make it harder for others to launch attacks and it strengthens Australia’s resilience against future threats."

Will the sanctions work?

The move marks the latest in a string of actions by governments to crack down on cyber crime-related hosting services.

In July this year, the US Treasury announced plans to impose sanctions on Azea Group, another bulletproof hosting service for its activities. US officials revealed the group has been selling access to specialized services and infrastructure used in a series of ransomware and infostealer malware campaigns.

While this fresh crackdown has been welcomed by security industry stakeholders, John Binns, partner and head of the sanctions practice at BCL Solicitors, said these typically have a limited effect.

"The evidential threshold for designation under the regulations is significantly lower than any in the criminal process, and the real-world impact on sophisticated actors operating primarily in hostile jurisdictions can be modest," he said.

"While sanctions are undoubtedly a valuable addition to the law-enforcement toolkit against transnational cyber crime, they deliver a form of administrative rather than criminal justice and are best viewed as potentially complementing - rather than supplanting - efforts to secure arrests, prosecutions, and asset forfeiture through the courts."

MORE FROM ITPRO

• Russia is targeting unpatched vulnerabilities – what can tech leaders do to shore up defenses?
• Are we in a cyber awareness crisis?
• Enterprises need to acknowledge the importance of basic cyber hygiene

In the latest stage of its Operation Endgame campaign, Europol has seriously disrupted the Rhadamanthys infostealer, VenomRAT, and Elysium botnet malware operations.

More than 1,000 servers used by the groups to infect hundreds of thousands of victims worldwide with malware were last week taken down.

Law enforcement searched one location in Germany, one in Greece, and nine in the Netherlands, seizing 20 domains. One arrest, related to the VenomRAT tool, has been made in Greece.

"The dismantled malware infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials. Many of the victims were not aware of the infection of their systems," Europol said.

"The main suspect behind the infostealer had access to over 100,000 crypto wallets belonging to these victims, potentially worth millions of euros."

These hadn't yet been used to steal assets, Europol said. However, it's recommended checking politie.nl/checkyourhack and haveibeenpwned.com to find out whether computers have been hacked and learn what to do.

The Rhadamanthys infostealer harvests browser-resident data, including credentials, browser data, autofill information, and cryptocurrency wallet artifacts from browsers, password managers, and crypto wallets.

According to Proofpoint, it costs between $300 and $500 a month, with options for a higher price point for customized uses. The firm said it appears that the threat actor behind Rhadamanthys was not only facilitating information stealer operations but also stealing sensitive data from Rhadamanthys affiliates.

"In addition to the infrastructure disruption, it’s likely that this operation will also negatively affect the criminals’ reputation, leading affiliates to mistrust them," the firm pointed out.

According to the Shadowserver Foundation, which assisted in the operation, Rhadamanthys has grown to become one of the leading infostealers since Operation Endgame 2.0 disrupted the infostealer landscape earlier this year.

"It is important to note that Rhadamanthys may have been used to drop additional malware on infected systems, so other malware infections may also be active on these systems and require further local remediation efforts," the Shadowserver Foundation warned.

"These victim systems may also have been used in historic or recent intrusions and ransomware incidents."

VenomRAT, which first appeared in 2020, generally arrives through malicious email attachments or links, also using fake antivirus pages.

It gives its operators remote desktop-style control, allowing the theft of files, browser data, cryptocurrency wallets, credit card details, account passwords, and authentication cookies.

While it's mainly been used to target Latin American organizations, it has also claimed victims in North America and Western Europe.

The Elysium botnet meanwhile, carries out data theft, payload delivery and other tasks.

Operation Endgame, launched in 2024, has now led to total seizures of more than €21 million. This latest action follows an Operation Endgame raid in May that saw 300 servers taken down and 650 domains seized, along with €3.5 million.

MORE FROM ITPRO

• Botnets are being sold on the dark web for as little as $99
• What is polymorphic malware?
• Everything you need to know about Malware as a Service

Latvian police have arrested seven people over a cybercrime as a service operation that had been defrauding thousands of victims across Europe.

The group had set up technically sophisticated infrastructure for a series of fraud schemes, offering telephone numbers registered to people from more than 80 countries for use in criminal activities.

Fraudsters set up almost 50 million fake accounts for social media and communications platforms, which were then used for a range of different cybercrimes.

The law enforcement operation, codenamed SIMCartel, was carried out by authorities from Austria, Estonia, Finland, Europol and Eurojust and took place on 10 October. Law enforcement took down five servers and seized 1,200 SIM box devices and 40,000 active SIM cards.

Two websites that had been offering the illegal service – gogetsms.com and apisim.com – have now been taken over by law enforcement, while €431,000 ($374,500) in bank accounts and $333,000 in crypto accounts has also been frozen.

Law enforcement also seized four luxury vehicles as part of the operation.

Europol said the outfit was professionally organized, featuring a sophisticated website and an efficient logistics operation.

"The criminal network offering this service enabled its clients to commit a multitude of serious crimes that would not have been possible at all without masking the perpetrators’ identities," said Europol.

The service was mainly used for phishing and smishing, with some perpetrators specializing in fraud on second-hand marketplaces. They used the SIM card service to create a vast number of fake accounts, which then served as starting points for social engineering campaigns.

Other frauds include the daughter-son scam – persuading victims that their child needs financial help – along with investment fraud. Fake investment websites were set up, and, once serious investors showed interest, they were encouraged to pay large sums for alleged good business opportunities.

The criminals also set up fake online shops and fake bank websites, even impersonating police officers with the use of forged IDs, personally collecting funds from the victims.

"Other offences facilitated by this criminal service include fraud, extortion, migrant smuggling and the distribution of child sexual abuse material," Europol added.

More than 1,700 people in Austria fell victim to the scams, with losses of around $5.3 million, along with more than 1,500 in Latvia, who lost a total of $490,000 .

"Measured by volume, more than 49 million online accounts were created on the basis of the illegal service provided by suspects. The damage caused by the renters of the telephone numbers to their victims amounts to several million euros," said Europol. "The true scale of this network is still being uncovered."

MORE FROM ITPRO

• 77% of security leaders say they'd fire staff who fall for phishing scams, even though they've done the same thing
• Thousands of exposed civil servant passwords are up for grabs online
• Been offered a job at Google? Think again. This new phishing scam is duping tech workers looking for a career change

Cybercrime continues to make headlines, with major brands and institutions recently forced to suspend online operations in the wake of attacks. Bad actors can exploit the Domain Name System (DNS) in schemes like phishing and ransomware, using fraudulent or lookalike domains to deceive consumers and carry out malicious activity.

The DNS is the backbone of the internet and enables everything from website access to email and other forms of digital communication. Securing the DNS is critical to protecting the digital infrastructure we depend on. Yet, a recent report revealed that 72% of companies have implemented fewer than half of the recommended DNS security measures.

These gaps leave businesses vulnerable, and cybercriminals are always looking to exploit internet users by launching phishing campaigns, distributing malware, and carrying out other malicious activities. To combat this, strengthening DNS defenses is no longer optional; it’s essential.

Identifying the risks and attack methods aimed at the DNS

Cybersecurity threats that exploit domains and the DNS are not new, yet limited awareness among business leaders and everyday internet users continues to create vulnerabilities. When coupled with the common tendency for organizations to underestimate the scope of their digital footprint, these gaps can leave the door wide open to significant security risks.

When attackers target a domain, their objective is often to deceive individuals into revealing sensitive information through tactics such as phishing or spoofing. Two prevalent forms of DNS-related cybercrime include:

• Domain hijacking – An unauthorized party gains control of a domain by altering its DNS records, often by exploiting weak credentials or tricking a registrar into transferring ownership.
• Subdomain hijacking – Cybercriminals seize control of legitimate but abandoned or overlooked subdomains, enabling them to exploit trusted brand identities to distribute malware or conduct phishing campaigns.

Businesses are continually being targeted

The consequences of a successful cyberattack can be severe, as recent incidents demonstrate. For example, the “Scattered Spider” group launched phishing attacks that compromised Marks & Spencer's domain, ultimately leading to a ransomware breach. The attack forced the temporary suspension of online operations, exposed customer data, and caused a significant drop in sales.

Such incidents can cause lasting damage to a brand, eroding customer trust and straining critical business relationships. While cyberattacks can affect any organization, the risk is particularly high for companies that rely on secure digital infrastructure to operate.

The good news: there are practical, DNS-focused measures businesses can take today to strengthen their defenses.

Practical strategies to strengthen DNS security

Effectively mitigating against cybercrime is a collective effort, but businesses can strengthen their defenses by taking several key actions:

• Enable multifactor authentication (MFA) through your domain registrar and request a domain lock to prevent unauthorized transfers or changes.
• Use strong, unique passwords to protect credentials and reduce the risk of data breaches.
• Educate employees on domain-related threats and attack methods to improve organizational awareness and resilience.
• Monitor DNS traffic for anomalies, spikes, or unusual behavior to detect and mitigate potential threats early.
• Adopt advanced security protocols like DNSSEC, which adds cryptographic verification to DNS queries to guard against spoofing and tampering.

By implementing these steps, businesses can significantly reduce their exposure to cybercrime and enhance resilience against threats that could disrupt operations and damage their reputation.

Vigilance begins with awareness

Cybercrime is an issue that can affect any internet user, meaning that everyone should improve their awareness of the dangers. This includes businesses taking a full 360-degree view of their digital footprint and their digital defenses.

By taking straightforward but high-impact steps like educating workforces, providing unique passwords, monitoring, and adopting the latest security systems, companies can significantly strengthen their defenses. With better awareness, we can all benefit from a safer internet.

A cybersecurity expert has warned that an uptick in cyber attacks conducted by youths should be a “wake-up call” after two teens were charged following an attack on TfL last year.

Thalha Jubair, 19, and Owen Flowers, 18, were arrested following raids by the National Crime Agency (NCA) and City of London Police earlier this week.

The duo appeared at Westminster Magistrates Court on Thursday and were charged under the Computer Misuse Act for their alleged targeting of the rail operator..

TfL fell victim to a cyber attack last year which severely disrupted systems and cost the rail operator upwards of £31 million in damages. In a statement coinciding with the arrests this week, the NCA said it believes the attack was carried out by the notorious cyber crime group, Scattered Spider.

“Today’s charges are a key step in what has been a lengthy and complex investigation,” said Paul Foster, deputy director and head of the NCA’s National Cyber Crime Unit.

“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure. Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.”

Jubair and Flowers have both been remanded in custody and are set to appear at Southwark Crown Court at a later date.

Tech-savvy teens need a positive outlet

Anna Chung, principal researcher for EMEA at Palo Alto Networks, said the arrests should serve as a “wake-up call” for authorities and highlights a failure to “properly engage a generation growing up in a digital-first world”.

“Young people don’t usually turn to online mischief out of malice - it’s often down to a mixture of boredom, technical skills, and a lack of boundaries,” she said.

“They’re driven by a desire for challenge, recognition, and control. And if no one offers them a positive outlet, the internet becomes their playground—and eventually, their battlefield. So, how do we break the cycle?”

Chung said a concerted effort toward teaching young people digital ethics and making it a “part of core education” will be crucial to preventing future incidents.

“Give them a mission,” she said. “Channel their curiosity into something meaningful: ethical hacking challenges, capture-the-flag competitions, and open source contributions. Let them see that their skills have real value.”

Schools are dealing with a wave of kid hackers

Gupta’s call to action comes just weeks after a report from the Information Commissioner's Office (ICO) warned tech-savvy kids have caused havoc at schools across the country.

A report by the data protection watchdog highlighted security failings across the education sector, but emphasized that many incidents were caused by kids themselves.

The ICO found students were using techniques to bypass security and network controls. In one incident, three Year 11 students accessed a secondary school’s information management system which held personal information on around 1,400 students.

Another saw a student access a college’s information management system then viewed, amended and deleted personal information. The system stored details on more than 9,000 staff, students, and applicants.

Echoing Gupta’s comments, Heather Toomey, principal cyber specialist at the ICO, warned the trend ultimately has the potential to snowball into more nefarious activities further down the line.

“What starts out as a dare, a challenge, a bit of fun in a school setting can ultimately lead to children taking part in damaging attacks on organizations or critical infrastructure."

MORE FROM ITPRO

• The best online cybersecurity courses to kickstart your career
• Cybersecurity certification vs degree: Which is best for your career?
• Want to get into coding? Here's our top picks for free online bootcamps

Conor Brian Fitzpatrick, the founder and admin of the BreachForums, has been resentenced to three years in prison after his earlier sentence was overturned in January this year.

Fitzpatrick, who operated under the alias Pompompurin, created the notorious forum after an FBI sting operation took down RaidForums in 2022.

In March 2023, Fitzpatrick identified himself as Pompompurin and admitted to running the forum following his arrest. In July that year, the BreachForums founder pleaded guilty to conspiracy to commit access device fraud, access device solicitation, and possession of child sexual abuse material.

While prosecutors originally pursued a sentence of more than 15 years, Fitzpatrick was handed a sentence of 17 days (time served) and 20 years of supervised release.

According to the US Department of Justice (DOJ), this latest development came after a US appeals court vacated his prior sentence and remanded the case for resentencing.

“Today’s sentence demonstrates the Justice Department’s unwavering commitment to bringing to justice those who seek to sell stolen data to the highest bidder,” said acting assistant attorney general Matthew R. Galeotti of the Justice Department’s Criminal Division.

“To those seeking to operate a similar forum, take note: we will tirelessly investigate those who commit these crimes.”

BreachForums quickly became a haven for cyber criminals after RaidForums was taken down in 2022, boasting over 330,000 members and selling stolen data to the highest bidder.

Data hosted on the site included an array of personal information according to court documents, including bank account details, social security numbers, and usernames and passwords for various online accounts.

“BreachForums also maintained and offered access to at least 888 dataset of stolen information containing over 14 billion individual records of PII,” according to the DOJ.

Analysis of data hosted on the site was found to include a database containing the names and contact information for around 200 million users of a “major US-based social networking site”.

Another, the DOJ said, included details on over 87,000 members of InfraGard, an information sharing partnership between the FBI and private sector organizations.

MORE FROM ITPRO

• Best online cyber security courses
• Hacking is not a crime, criminal activity is
• The best malware removal tools

Jaguar Land Rover was forced to shut down production systems over the weekend after being hit with a cyber attack, the company has revealed.

The car manufacturer said it acted immediately to mitigate the attack by proactively shutting down systems in a move that thwarted attackers.

"We are now working at pace to restart our global applications in a controlled manner," JLR said in a statement. "At this stage there is no evidence any customer data has been stolen but our retail and production activities have been severely disrupted."

According to the BBC, the attack took place on Sunday, with employees at the company's plants in Halewood, Merseyside, and Solihull in the West Midlands sent home or told not to come into work the following day.

"JLR's decision to proactively shut down global manufacturing suggests this attack may have been targeting their operational systems, not just customer data," said Oakley Cox, director of operational technology of product at Darktrace.

"The speed of their response is telling - you don't typically halt production across multiple sites unless there's genuine concern about operational impact."

The attack appears to have been carefully timed, coming just as new registration plates are launched - the company's busiest time of year. Attacking over the weekend, meanwhile, meant that Jaguar Land Rover was less likely to able to respond and contain the threat.

No ransomware group has claimed responsibility. However, the automotive sector is becoming a highly attractive sector for hackers, thanks to increasing digitization and growing integration between IT and operational technology (OT).

According to Upstream Security’s 2025 Automotive & Smart Mobility Cybersecurity report, attacks against the automotive sector are on the rise - and getting bigger. The number of 'massive-scale' incidents, impacting millions of vehicles, more than tripled between 2021 and 2023, rising from 5% to 19%.

Jaguar Land Rover “did the right thing”

Nivedita Murthy, senior security consultant at Black Duck, said Jaguar Land Rover “did the right thing” by shutting down IT systems, which likely helped prevent the attack from spreading further and causing additional damage.

“As part of the post-incident activity, they would be able to identify how the attackers were able to access the systems and take advantage of them,” Murthy added.

Conversely, Nick Tausek, lead security automation architect at Swimlane, said the move raises serious questions about how organizations should react to security incidents.

"It is tentatively reassuring to see that, as of yet, no impact on customer data has been reported. However, entirely shutting down production and retail operations is not a sustainable countermeasure for cyber attacks," he said.

"JLR, as well as other automobile manufacturing organizations, should use this as a lesson in the importance of proactive cybersecurity."

This isn’t the first time the car manufacturer has fallen victim to a cyber attack. Earlier this year, it was hit by a breach that saw the theft of several gigabytes of sensitive data.

That particular incident exposed more than 700 proprietary documents, along with source code and employee and partner data.

"It raises the question of whether vulnerabilities from the prior attack still exist and were exploited to breach the company this time around," suggested Tausek.

MORE FROM ITPRO

• Ransomware attack on IT supplier disrupts hundreds of Swedish municipalities
• Google says 'claims of a major Gmail security warning are false' following recent media reports
• Warning issued to Salesforce customers after hackers stole Salesloft Drift data

Anthropic admits its AI tools have been "weaponized" by hackers to conduct serious attacks against organizations – and security experts warn it's a sign of things to come as cyber criminal groups flock to the technology.

The AI developer revealed the details as part of a trio of case studies in its Threat Intelligence report, highlighting an employment scam by fake North Korean IT workers, as well as "large-scale extortion" using Claude Code and vibe-coded ransomware for sale on the dark web.

"Agentic AI has been weaponized," the company said in a blog post. "AI models are now being used to perform sophisticated cyber attacks, not just advise on how to carry them out."

Anthropic said AI is being used throughout hacking operations, including finding victims, analyzing stolen data, and creating personas to hide behind — as well as creating ransomware.

Crucially, the post warned that the technology is lowering the barriers of entry for up-and-coming hackers, enabling criminals with few or even no technical skills to conduct major operations, create dangerous ransomware strains, or simply get a job at an American company.

Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University, said the admission from Anthropic shows “just how quickly AI is changing the threat landscape”.

"It is already speeding up the process of turning proof-of-concepts – often shared for research or testing – into weaponized tools, shrinking the gap between disclosure and attack,” he said.

"The bigger issue is accessibility. Innovation has made it easier than ever to create and adapt software, which means even relatively low-skilled actors can now launch sophisticated attacks," Curran added.

"At the same time, we might see nation-states using generative AI for disinformation, information warfare and advanced persistent threats."

AI has sparked a cyber crime renaissance

Anthropic laid out details of three different instances of its systems being used in cyber criminal activities.

The first saw 17 organizations targeted across healthcare, emergency services, and government, with criminals threatening to leak stolen data if a ransom wasn't paid.

This particular hacker used Claude Code to "an unprecedented degree”, allowing them to automate reconnaissance practices, harvest victims’ credentials, and penetrate networks.

"Claude was allowed to make both tactical and strategic decisions, such as deciding which data to exfiltrate, and how to craft psychologically targeted extortion demands,” the blog post noted.

“Claude analyzed the exfiltrated financial data to determine appropriate ransom amounts, and generated visually alarming ransom notes that were displayed on victim machines."

While the Anthropic post sounds almost impressed with the efforts, it was quick to not only ban the accounts used in the attacks, but also develop ways to prevent similar use in the future, rolling out screening tools and a new detection method.

It's no surprise that attackers are turning to AI and automation to improve the success of their criminal endeavors, noted Nivedita Murthy, senior security consultant at Black Duck.

"In this case, it is interesting to note that Claude Code had a wealth of information on which organizations were vulnerable and where," Murthy said. "It also freely gave away this information in the form of an attack vector."

That suggests that companies may feeding too much internal data into the AI tools they're currently using.

"What organizations need to really look into is how much the AI tools they use know about their company and where that information goes," Murthy said.

"While AI usage has been highly beneficial to all, organisations need to understand that AI is a repository of confidential information that requires protection, just like any other form of storage system.

"Accountability and compliance are core requirements of doing business. While embracing AI at scale, these two factors need to be kept in mind."

AI is hard at work...for North Korea

Alongside large-scale automated attacks, Anthropic also detailed an operation run by North Korean hackers, who used Claude secure roles at Fortune 500 companies in the US, working as front-end developers and in programming more widely.

"This involved using our models to create elaborate false identities with convincing professional backgrounds, complete technical and coding assessments during the application process, and deliver actual technical work once hired," the post said.

The chatbot was used to conduct mock interviews, but also to answer questions in actual interviews, create personas, as well as to complete the actual work once hired.

This particular scam wasn't designed to fool those companies, however. Instead, it was designed to earn money by doing the work.

"These employment schemes were designed to generate profit for the North Korean regime, in defiance of international sanctions," the post said. "This is a long-running operation that began before the adoption of LLMs, and has been reported by the FBI."

The report noted that such work is worth hundreds of millions of dollars for North Korea annually. Previously, North Koreans hoping to get jobs overseas would need to actually train to do the technical work, stifling the effort to dodge sanctions.

However, AI has "eliminated this constraint”, the blog post added.

"Operators who cannot otherwise write basic code or communicate professionally in English are now able to pass technical interviews at reputable technology companies and then maintain their positions. This represents a fundamentally new phase for these employment scams."

Anthropic has since banned the accounts and improved how it spots such scams.

Vibe-coded ransomware

In another incident, a criminal turned to Claude to create Ransomware as a Service (RaaS) variants complete with evasion capabilities, encryption, and anti-recovery tools, selling them on the dark web for $100 to $1,200 each.

"This actor appears to have been dependent on AI to develop functional malware," Anthropic said in its blog post. "Without Claude’s assistance, they could not implement or troubleshoot core malware components, like encryption algorithms, anti-analysis techniques, or Windows internals manipulation."

Anthropic has since banned the account and implemented new ways to detect malware generation.

"While specific to Claude, the case studies presented below likely reflect consistent patterns of behaviour across all frontier AI models," the report noted, adding further reports on the topic would be forthcoming.

Indeed, OpenAI has released a similar report, laying out how cyber criminals are making use of its AI — and how the company is proactively stopping such attacks.

MORE FROM ITPRO

• AI security blunders have cyber professionals scrambling
• Why cybercriminals are turning to generative AI
• AI means cyber teams are rethinking their approach to insider threats

The true scale of the Allianz Life data breach has been laid bare, with leaked credential notification site Have I Been Pwned putting the number of affected accounts at 1.1 million.

The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.

Data exposed in the incident is believed to include dates of birth, email addresses, genders, names, phone numbers, and physical addresses. According to Allianz, Social Security numbers were also taken.

More than seven-in-ten of the exposed email addresses had already been affected by previously-disclosed data breaches.

When the breach was first confirmed, Allianz Life said that 'most' of its North American customers had been affected, but that its core network and policy administration systems didn't appear to have been accessed.

The insurer said it would provide a full consumer notice once it has finished identifying and contacting affected individuals.

Jon Abbott, CEO of ThreatAware, described the scale of the breach as “significant”, noting that the data leaked represents a treasure trove of information to target victims.

"The sensitive and valuable information held in CRM tools is exactly why it’s targeted by attackers,” he said. “The data can be used by other cyber criminals for identity theft and phishing campaigns."

What happened with the Allianz Life data breach?

The breach, which took place on July 16 and was discovered a day later, is believed to have involved a social engineering attack that involved impersonating IT support staff.

This saw hackers ask employees to accept a connection to a Salesforce Data Loader, which was then used to exfiltrate data from the CRM system.

The attackers used malicious OAuth applications to infiltrate Salesforce instances, before downloading the company databases.

The attack has since been claimed by the notorious ShinyHunters threat group, which is believed to overlap with the Scattered Spider and Lapsus groups. They are now believed to be preparing a data leak site to pressure Allianz and other victims into making a ransom payment.

The group, which first emerged in 2020, is also believed to be responsible for attacks on Salesforce systems at several retailers, as well as at Google, Cisco, Qantas, Santander, Ticketmaster, Tokopedia, AT&T and most recently Workday.

Workday confirmed it had fallen victim to an attack last week, warning customers that exposed information could then be used in follow-up social engineering attacks - a common tactic for threat actors.

"Groups such as ShinyHunters rely on fast moving social engineering tactics – this typically involves calling and emailing employees of the victim organization and attempting to extort them. If this does not work, they then launch a leak site with the aim of pressuring victims into payment," said Abbott.

"This pattern in their attacks is why the security fundamentals are so important. Accurate asset inventories, tamper-proof identity verification and hardened service desk processes are all essential.”

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Cheap cyber crime kits can be bought on the dark web for less than $25

Researchers at cybersecurity firm CloudSEK have issued a warning about a Pakistan-based malware syndicate carrying out infostealer attacks on millions of victims worldwide.

The group commands a sprawling network of operators, affiliates, and infrastructure, according to CloudSEK, adding up to a multi-million-dollar cyber crime business.

With many operators sharing the same family surname, researchers even suggested the group could be a multi-generational, family-run cyber crime outfit.

Their roles appear to be divided between primary operators - network management and finances - affiliates, generating traffic via warez sites, and financial facilitators handling payouts and settlements.

The group lures its victims in through Search Engine Optimization (SEO) poisoning and spam posted on legitimate online forums. Alongside this, the operators also ran paid ads through legitimate traffic services to drive even more users to malicious domains.

Blending malicious activity with normal web marketing traffic also made detection and takedown more difficult.

Links to cracked versions of high-demand software — such as Adobe After Effects and Internet Download Manager (IDM) — also led users to malicious WordPress sites.

“This investigation shows that cyber crime today is no longer a dark-web-only phenomenon," said Nivya Ravi, director of products at CloudSEK.

"It’s hiding in plain sight, using SEO, legitimate payment processors and publicly accessible forums, to operate with alarming efficiency."

The WordPress sites distributed commodity infostealers, including Lumma Stealer, Meta Stealer, and, more recently, AMOS, all of which were concealed inside password-protected archives to evade detection.

Once installed, the malware exfiltrated credentials, browser data, cryptocurrency wallets, and other sensitive information — data that was later monetized through resale and secondary fraud.

A sprawling malware network

The CloudSEK research revealed that the network involved 5,239 registered affiliates operating 3,883 malware distribution sites. Its lifetime revenue is estimated to be at least $4.67 million - although it may well be more, thanks to undocumented 'off-ledger' settlements.

Between May and October 2020 alone, the network paid out $130,560 to affiliates at an average Effective Cost Per Install (eCPI) of $0.0693. Payments were made via Payoneer in two-thirds of cases, with Bitcoin accounting for almost all the rest.

CloudSEK believes that the network may have hit 10 million victims worldwide.

"This is not a small-time hacking group — it’s an industrial-scale cybercrime enterprise that has been operating for years, infecting millions of devices across the globe," said Ravi.

"By hijacking the demand for pirated software, they have turned unsuspecting users into a steady revenue stream."

The group launched a big campaign ahead of India’s Independence Day this month, with coordinated attacks targeting the government, finance and defense sectors and including phishing, fake websites, data breaches, and scams.

CloudSEK recommends a multi-pronged disruption strategy combining domain takedowns targeting the 383 long-haul sites, as well as a financial ban in collaboration with Payoneer and other payment processors.

Similarly, the company urged for search engine de-indexing of warez sites hosting malware and user education campaigns warning about cracked software risks.

"The scale and sophistication of this network underscore the urgent need for coordinated, cross-border action to dismantle such operations before they cause irreversible damage to individuals, businesses, and critical infrastructure,” said Ravi.

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• Devs face a torrent of malware threats as malicious open source packages surge 188%
• The best malware removal tools for businesses in 2025

While many businesses are still trying to understand how to use generative artificial intelligence (AI) to drive productivity and efficiency, malicious actors have moved rapidly. Their approach is not theoretical; it's increasingly practical and dangerously effective. One of the clearest examples of this shift is GhostGPT, an AI-powered chatbot that was discovered in late 2024 and is already reshaping the cyber threat landscape.

GhostGPT is not a general-purpose AI tool. It has been explicitly developed, or more likely, repurposed for criminal activity. Unlike public-facing large language models (LLMs) such as ChatGPT, which are constrained by security safeguards and ethical restrictions, GhostGPT operates free from such boundaries. It is widely believed to be a “wrapper” around a jailbroken LLM or an open-source model that has had its safety features stripped out. This enables it to respond freely to prompts for malware, phishing content, and attack strategies, effectively putting offensive cyber capabilities in the hands of anyone with a web browser and an illicit link.

More concerning still is the fact that GhostGPT deliberately avoids logging user interactions. This makes attribution extremely difficult and adds a further layer of anonymity for cybercriminals. Notably, mainstream tools like OpenAI’s ChatGPT are bound by usage policies and traceability, whereas GhostGPT is being marketed and seemingly used as a ‘black box’ for illegal digital activity.

Phishing in seconds

One of the key threats presented by GhostGPT is its ability to produce high volumes of convincing phishing content in just seconds. This is not limited to generic spam. GhostGPT can create personalized email messages that mimic internal tone, corporate templates, and even the linguistic quirks of specific individuals. Where previous phishing attempts relied on crude templates and clumsy spelling errors, generative AI enables far more persuasive messaging, tailored to the target and delivered at unprecedented speed.

According to the UK government’s Cyber Security Breaches Survey 2024, phishing remains the most commonly identified type of cyber-attack affecting British organizations. Among those that detected a breach or attack in the past 12 months, 84% of businesses and 83% of charities cited phishing as the root cause. The report notes that phishing is particularly disruptive due to its sheer volume and the investigative effort required to respond.

Cyber experts are now suggesting we face such an intense barrage of critical national infrastructure attacks, too - it’s now a case of not if such attacks happen, but when.

Add tools like GhostGPT to the equation, and the scale and sophistication of these campaigns are likely to increase sharply.

In parallel, GhostGPT can also be used to create highly realistic fake login portals. These spoofed web pages, generated in response to basic prompts, are nearly indistinguishable from genuine ones, especially when paired with email lures or SMS phishing (smishing) tactics. Once victims enter their credentials, attackers can gain access to critical systems or sell the data on underground markets.

Lowering attack barriers

Perhaps even more worrying is GhostGPT’s ability to generate malicious code. It allows users to request ransomware samples, write scripts to exfiltrate data, or even build polymorphic malware, a type of software that continually changes its code to evade detection. Polymorphic malware has been around for over a decade, but its creation previously required technical expertise. Now, with AI’s help, that barrier has been drastically lowered.

Cybersecurity specialists have long warned of the risks associated with AI-generated malware. A 2023 study by IBM’s X-Force team demonstrated that LLMs can be prompted to create viable malicious code with only a few lines of instruction, even on public models with supposed safeguards. GhostGPT, lacking any ethical brakes, removes those barriers entirely.

Attacks - now with detailed instructions

Beyond content and code generation, GhostGPT also offers step-by-step attack advice. Security researchers have observed it providing detailed instructions for setting up command-and-control infrastructure, bypassing endpoint detection systems, and exploiting specific software vulnerabilities. While such information has long been accessible via dark web forums, the difference here is the ease of access and contextualization. Instead of searching static posts, users can ask GhostGPT direct questions and receive real-time responses adapted to their goals.

This development fundamentally changes the economics of cybercrime. In the past, launching sophisticated attacks required coordination, specialized knowledge, and sometimes a team of actors. Now, with a tool like GhostGPT, a lone individual with a limited technical background can initiate campaigns that previously required weeks of preparation.

For UK organizations, particularly small and medium-sized businesses (SMEs) with limited internal cybersecurity resources, the risks are significant. According to the Department for Science, Innovation and Technology’s 2024 Cyber Security Breaches Survey, 32% of businesses reported being attacked at least once in the previous 12 months. As threat actors continue to adopt AI tools, the real figure may rise considerably, especially if firms are slow to adapt.

What to do

So, what can be done? While no single technology can neutralize the threat, there are measures that organizations can adopt to reduce their exposure.

First, the basics matter more than ever: regular software patching, the use of multi-factor authentication (MFA), and employee awareness training are essential. The sophistication of phishing emails may be increasing, but so too can the ability of staff to detect them if properly trained.

Beyond these fundamentals, it’s increasingly important to deploy AI-enhanced defensive tools. Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) systems are capable of identifying anomalous behaviors that signal compromise, even if the initial attack evades traditional defenses. DNS filtering, too, can reduce exposure to malicious links embedded in phishing emails or messaging apps.

Threat intelligence is also crucial. As tools like GhostGPT proliferate, staying ahead of the curve requires real-time awareness of tactics, techniques, and procedures (TTPs) used by attackers. Security providers and their channel partners must be capable of feeding this intelligence into automated systems that can act in near real time.

A shift in the cyber threat landscape

The emergence of GhostGPT signals a shift in the cyber threat landscape. Generative AI is no longer the exclusive domain of innovation labs or marketing departments; it has been weaponized. As this technology becomes more accessible, the lines between state-backed threats, organized cybercrime, and amateur experimentation will continue to blur.

For the UK channel community, this is both a challenge and an opportunity. Clients will increasingly look to service providers not just for protection, but for clarity. Understanding how tools like GhostGPT work and how to defend against them will become a differentiator. As ever, those who stay informed will be best placed to lead.

Romanian police have arrested 13 people believed to have been behind a phishing campaign on HM Revenue and Customs (HMRC) that cost millions in bogus tax refunds.

The men and women, aged between 23 and 53, are suspected of having stolen data then used to submit millions of pounds worth of fraudulent PAYE claims, as well as VAT repayments and child benefit payments.

The arrests were carried out by criminal investigators from HMRC, together with more than 100 Romanian police officers, in the Romanian counties of Ilfov, Giurgiu, and Calarasi.

“These arrests show we work across borders with our international partners to combat tax crime in all its forms. We have a number of live criminal investigations, and we are grateful to our Romanian partners for their support," said Simon Grunwell, operational lead in HMRC’s Fraud Investigation Service.

“We have already acted to protect customers after identifying attempts to access a very small minority of tax accounts, and we continue to work with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.”

Two other men, aged 27 and 36, were arrested in Bucharest in November on suspicion of cyber crime and fraud offences, with investigations still ongoing.

Last month, HMRC revealed that scammers had apparently netted £47 million by compromising around 100,000 taxpayer accounts. The tax office revealed a 38-year-old man has been arrested in Preston, apparently in connection with that attack.

“This was organized crime phishing for identity data outwith of HMRC systems, so stuff that banks and others will also unfortunately experience, and then trying to use that data to create PAYE accounts to pay themselves a repayment and/or access an existing account,” said HMRC chief executive, John-Paul Marks.

What happened with the HMRC campaign?

The attack, which took place last year, was only revealed in June - drawing criticism from treasury select committee chair Dame Meg Hillier, who told HMRC that its failure to report details of the breach was ‘unacceptable’.

HMRC said it wrote to those affected in June and that it had locked down affected accounts and deleted login credentials - including Government Gateway user ID and passwords - to prevent future unauthorized access.

The tax office also revealed it removed any incorrect information from tax records.

"Tax scams are one of the biggest risks to citizens in the UK as criminals are adopting tactics to make them highly convincing, often using a mix of emails, post and SMS to send out fraudulent comms," said William Wright, CEO of Closed Door Security.

"The correspondence often looks genuine and it takes a very savvy consumer to question its authenticity, especially as criminals often hijack on key tax dates, such as the self-assessment deadline in January."

MORE FROM ITPRO

• Hackers are using PDFs to impersonate big brands in a new threat campaign
• Phishing tactics: The top attack trends
• Employee phishing training is working – but don’t get complacent

Qantas has become the latest airline to suffer a cyber attack, with data belonging to around six million customers potentially exposed in the incident.

In a statement confirming the breach, the airline said compromised data includes some customer names, email addresses, phone numbers, dates of birth, and frequent flyer numbers.

The company insists that no credit card details, passport information, or assorted financial details have been exposed. Similarly, no account passwords, PIN numbers, or login details have been accessed.

On Monday, Qantas spotted unusual activity on a third-party platform used by a Qantas airline contact center. The airline said it took immediate action upon discovery and is now implementing additional security measures to further restrict access.

Qantas said it has notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner, as well as the Australian Federal Police.

“We sincerely apologize to our customers and we recognize the uncertainty this will cause. Our customers trust us with their personal information and we take that responsibility seriously," said Qantas Group CEO Vanessa Hudson.

“We are contacting our customers today and our focus is on providing them with the necessary support."

Who’s behind the Qantas cyber attack?

While there's no official word on which group carried out the attack, cybersecurity experts told ITPro all eyes will likely be pointing toward the notorious Scattered Spider group.

Scattered Spider has caused havoc in the retail sector in recent months, targeting UK retailers including Harrods, Co-op and Marks & Spencer (M&S).

The group now appears to be shifting its attention, however. An FBI advisory last week warned the group is now targeting organizations in the aviation industry.

The ransomware gang is believed to be responsible for recent attacks on Hawaiian Airlines and Canada's WestJet.

Toby Lewis, global head of threat analysis at Darktrace, said the Qantas attack bears all the hallmarks of the group so far.

"The attack follows their typical playbook: steal legitimate login credentials to walk into systems where critical security protections often aren't enabled by default, while operating from Western countries to appear as legitimate users and bypass standard security filters," Lewis told ITPro.

"Expect the stolen customer data - names, emails, birthdates, frequent flyer numbers - to fuel convincing phishing campaigns targeting loyalty programs and tricking customers with fake payment requests using real booking details."

It's not known whether Qantas has received a ransom demand - and, if so, whether it's paying up.

MORE FROM ITPRO

• Hackers are using fake tool installers to dupe victims
• Criminal records, financial data exposed in cyber attack on Legal Aid Agency
• Cyber attacks are costing UK firms billions every year

Marks & Spencer (M&S) expects its online operations to be fully restored within the next four weeks as the retailer continues its recovery from a major cyber attack in April.

Speaking at the company’s annual general meeting, CEO Stuart Machin said the company hopes to have the “vast majority” of the incident’s impact resolved by August, the BBC reported.

The attack, which the company has attributed to “human error” and estimated will cost around £300 million in lost profit, forced M&S to halt online sales and has significantly disrupted its supply chain, including operations at its key Castle Donington distribution centre. The breach also resulted in the theft of customer personal data.

The announcement is the latest step in a multi-month recovery process. As ITPro has reported, the crisis first unfolded in April when M&S was forced to suspend all online orders.

M&S later confirmed in May that customer personal data had been compromised, linking the breach to a supply chain partner. By June, the full financial scale of the incident was revealed, with the warning of a £300 million profit hit and continued operational disruption.

While the main e-commerce site for Great Britain has partially resumed service, key functions like click-and-collect and next-day delivery remain offline.

The recovery timeline provides a critical update for a breach that has had a sustained operational and financial impact on one of the UK’s best-known retailers.

M&S fallout may continue beyond planned restoration date

Julius Cerniauskas, CEO of web intelligence firm Oxylabs, told ITPro that the incident highlights the persistent threat of social engineering.

“Investment alone isn’t a silver bullet," he said. "Attackers are constantly evolving their techniques, and social engineering – tricking people rather than systems – is still one of the most effective entry points.”

Cerniauskas noted that while a full operational recovery by August would be a “solid achievement,” the business impact can continue long after technical systems are restored.

"It’s not a question of if you'll be targeted - but when,” he added.

The fallout from the incident may also affect executive remuneration. According to reports from the Evening Standard, chairman Archie Norman confirmed that any drop in performance caused by the attack "will be taken into account with regards to incentive pay".

Norman added that the recovery is progressing, with "new systems coming back" each week.

MORE FROM ITPRO

• Financial impact of cyber attacks on UK retailers laid bare in new report
• Harrods hit by cyber attack as UK retailers battle threats
• Cyber attacks have rocked UK retailers – here's how you can stay safe

A disgruntled IT worker has been jailed after costing his employer £200,000 - and its good reputation - by exploiting his privileged network access.

West Yorkshire man Mohammed Umar Taj was suspended from his job in Huddersfield in July 2022, and began taking revenge within hours.

According to West Yorkshire Police, he went back to the company’s premises and accessed its computer systems, altering login credentials to disrupt the firm’s day to day activities.

A day later, he went further, changing access credentials and the company’s multi-factor authentication (MFA) - causing big problems for the firm’s clients both in the UK and overseas in Germany and Bahrain.

However, Taj wasn’t exactly covert, having kept recordings of his activities and discussing the attack on the phone. These calls and recordings were later accessed by West Yorkshire Police’s cyber team and played a vital role in the case.

He has now been sentenced to seven months and 14 days in custody for committing unauthorized acts with intent to impair the operation of or hindering access to a computer.

“Taj set out to get revenge on his employer following his suspension from work. He did so by targeting their IT system, which he had privileged access to. By doing this he created a ripple effect of disruption far beyond the shores of the UK," said detective sergeant Lindsey Brants of West Yorkshire Police’s Cyber Crime Team.

“Protecting your network prevents data loss and costly cyber attacks. It also maintains trust with clients and stakeholders. We urge all businesses to look at their network security.”

Why you should always be wary of insider threats

According to a recent survey of more than 400 IT and cybersecurity professionals by Gurucul, 48% experienced a rise in insider attacks in the previous 12 months, with 51% having six or more attacks in that time.

When it came to the cost of remediation, 32% said it was between $100,000 and $500,000 while 27% put it at anywhere between $500,000 and $1 million.

Companies are starting to take the risk seriously, however. Alternative research from DTEX Systems found that organizations are spending 16.5% of their annual IT security budget on insider risk management – up from 8.2% in 2023.

More than eight-in-ten now have - or are planning to introduce - an insider risk management program. Of those that do, 65% said their program was the only security strategy that enabled them to pre-empt a data breach by detecting insider risk early.

"Insider-driven security incidents result in significant financial and reputational costs," said DTEX Systems CEO Marshall Heilman.

"However, organizations investing in dedicated insider risk management programs are achieving faster containment or preventing incidents entirely — a decisive win in the fight against data loss."

MORE FROM ITPRO

• An employee at a US industrial firm deleted backups and locked IT admins out of workstations
• Developer crippled company networks with malicious code and a ‘kill switch’ after being sacked
• North Korean insider attacks are skyrocketing – dozens of US firms didn't spot the hacker in their midst

A British man believed to be the notorious ‘IntelBroker’ hacker has been charged in the US following their arrest in France earlier this year.

Kai West, 25, also known as Kyle Northern, is accused of carrying out a years-long hacking scheme, conspiring with an online group to steal data from a telecommunications company, a municipal health care provider, an internet service provider, and more than 40 other victims.

The group offered the data - which included customer lists and company marketing information - for sale online for more than $2 million, and is believed to have caused more than $25 million in damage.

"The IntelBroker alias has caused millions in damages to victims around the world,” said US attorney Jay Clayton.

“This action reflects the FBI’s commitment to pursuing cyber criminals around the world. New Yorkers are all too often the victims of intentional cyber schemes and our office is committed to bringing these remote actors to justice.”

Between around 2023 and 2025, the FBI said West offered stolen data for sale more than 40 times and offered to distribute this data for free around 117 times.

On some occasions, stolen data was also offered in exchange for credits on the internet forum he and his co-conspirators used, according to the FBI.

In one case, West sold data from a telecommunications firm that he'd illegally accessed via a misconfigured server.

In another, he offered patient data from a municipal healthcare provider which included names, Social Security numbers, dates of birth, genders, health plan information, employer information, and more.

An advisory from cybersecurity firm Kela earlier this year noted that IntelBroker “distinguishes himself in the cyber crime underworld by combining technical expertise with a strong emphasis on operational security”.

"His approach involves exploiting vulnerabilities as a primary attack vector, while simultaneously utilizing advanced anonymity tools to maintain operational secrecy, solidifying his reputation as a trusted figure within the community,” the company added.

IntelBroker sting the latest blow for cyber criminals

After first making an entrance on hacking forum BreachForums, IntelBroker worked as a ransomware operator, later taking over BreachForums. Over the years, he is believed to have breached organizations including HPE, Cisco, Nokia, Ford, AMD, Zscaler, and Europol.

"The arrest of the alleged British hacker known as IntelBroker and the recent takedown of BreachForums admins highlight a critical truth about cybersecurity: data theft is rarely a one-off event," Darren Guccione, CEO and co-founder of Keeper Security.

"The details of this story aptly demonstrate how once stolen, credentials and information can circulate, be aggregated and weaponized for months or even years in some cases."

"In this instance, the global criminal network’s sustained activity through dark web forums provides a pertinent example of how attackers rely on long-term access, collaboration and shared trust within illicit marketplaces.

West is charged with conspiracy to commit computer intrusions, which carries a maximum sentence of five years in prison and conspiracy to commit wire fraud, which carries a maximum sentence of 20 years in prison.

He is also accused of accessing a protected computer to obtain information, which carries a maximum sentence of five years in prison, and wire fraud, with a maximum sentence of 20 years.

MORE FROM ITPRO

• State-sponsored cyber groups are flocking to the 'ClickFix' social engineering technique
• NCSC expert urges businesses to follow geopolitics as defensive strategy
• This new hacker group is targeting software developers with phony job offers

Cyber attacks against M&S and Co-op earlier this year cost anywhere between £270 million to £440m, according to analysis by the Cyber Monitoring Centre.

In April, British retailers were targeted with a series of ransomware attacks, with M&S taking down online sales and later admitting customer data was stolen. Co-op shut down aspects of its own IT system to limit disruption when it was attacked in a similar way.

Alongside those two, Harrods and other retailers were impacted by cyber incidents, but the CMC didn't include them in its assessment due to a lack of information. The attacks are believed to be the work of "Scattered Spider" hackers.

The mooted figures include the financial impact on M&S and Co-op, as well as their partners and suppliers, taking in lost sales as well as incident response, IT restoration and legal costs.

"Although both of the targeted companies suffered business disruption, data loss, and costs for incident response and IT rebuild, business disruption drives the vast majority of the financial cost," the CMC said in a statement.

M&S managed to return to limited online sales late last month after several weeks of disruption. According to the CMS, the financial impact of the incident amounted to around £1.3 million in losses per day.

"This is less than the total loss in turnover as it takes into account reductions in orders, stock that can be resold later, and not having to pay other variable costs," CMC said.

“We have not included any ransom payments as there is no evidence at this point that a ransom was paid or not paid."

M&S said last month that it expected the incident to cost £300m this year, but that would be reduced through "management of costs, insurance and trading actions."

Narrow and deep impact

Despite the high cost of the incident, the CMC only rated it as a "category 2 systemic event," with the worst possible rating being category five.

The organization noted that while the implications were significant, the impact was largely limited to the targeted companies and their partners, making it a "narrow and deep" event.

For comparison, last year's CrowdStrike outage would be considered a "shallow and broad" event, as many businesses were hit, but the impact to each was smaller.

"We are yet to see a deep and broad category four or category five event impact the UK," the CMC noted in its analysis.

"Had there been further widespread disruption in the sector, the categorization could have been higher, but because the impact was confined to two companies and their partners, it is judged to be at the lower end of severity on the CMC’s scale."

Additional disruptions

CMC noted that M&S' own brand labelling added complexity, as such goods couldn't be rerouted to other retailers to sell before expiration dates, especially for prepared food and meats which have tightened regulations around packaging.

Another challenge was remote and rural areas, CMC noted, with Co-op one of the only food retailers in some regions. In the Scottish Highlands, for example, residents reported widespread disruption to food supply chains in the wake of the incident.

"Service disruption in these regions illustrates the broader societal impact cyber events can trigger through concentrated retail supply chains," CMC said. "Co-op are said to have prioritized supplying these stores."

More generally, CMC highlighted the risks of disruption to modern retail models.

"The event underscores retail sector vulnerabilities tied to just-in-time stock systems, lack of back-end storage, and high dependency on IT-driven order flows," the analysts said. "When systems fail, it is challenging to revert to manual processes."

The analysis recommended retail businesses stress-test their business continuity plans — including a fallback to manual ordering and inventory control as well as plans to maintain financial stability and be able to pay suppliers — and create a response plan for ransomware attacks.

To avoid such incidents, CMC said it was time to improve "cyber hygiene" across service providers and IT supply chain, in particular support desks — which are believed to be how the attackers accessed networks, using compromised credentials and "abuse of IT help desk processes."

MORE FROM ITPRO

• Cyber attacks have rocked UK retailers – here's how you can stay safe
• North Face, Cartier among latest retail cyber attack victims
• Why DragonForce is growing in prominence – with retailer attacks boosting its reputation

Cybersecurity experts have issued an alert over a new cyber espionage network that’s believed to have compromised thousands of devices globally.

Dubbed 'LapDogs' by researchers at SecurityScorecard, the campaign has focused on the US, Japan, South Korea, Taiwan, and Hong Kong.

The use of Mandarin in developer notes within the startup script, along with the tools, techniques, and procedures (TTPs) used and the choice of targeted regions means it is likely to be run by a China-based group.

Victims recorded so far include ISPs, hardware vendors, and specific organizations in several sectors, including IT, networking, real estate, and media.

The campaign appears to have been running since September 2023, with infections remaining undetected for months, allowing for long-term surveillance and exploitation.

It involves stealthy, long-term intrusion campaigns, and exploits IoT devices and Small Office/Home Office (Soho) routers, including legacy devices from vendors such as Ruckus Wireless and Buffalo Technology.

Unlike traditional botnets, researchers said the campaign leverages sophisticated Operational Relay Boxes (ORBs) — malicious nodes that route traffic through legitimate devices without triggering alarms, thereby masking the attackers' activities.

"This campaign shows a surging interest from China-Nexus threat actors in using ORB Networks to conduct covert intrusion campaigns both around the globe and tailored to specific victims of interest," researchers warned.

"With an increasing interest in this approach, security teams should be on alert that China-Nexus threat actors are disrupting traditional playbooks for IOC tracking, response, and remediation."

A custom Linux- and Windows-compatible backdoor called ‘ShortLeash’ enables silent control, persistence, and lateral movement inside networks, researchers noted.

ShortLeash also generates TLS certificates that are spoofed as being signed by the Los Angeles Police Department (LAPD) to further obscure its origin.

The LapDogs campaign is expanding at pace

Researchers warned that LapDogs has been spreading methodically, with attackers using it both to anonymize their operations and to establish beachheads into broader infrastructure, including enterprise networks.

“LapDogs reflects a strategic shift in how cyber threat actors are leveraging distributed, low-visibility devices to gain persistent access,” said Ryan Sherstobitoff, chief threat intelligence officer at SecurityScorecard.

“These aren’t opportunistic smash-and-grab attacks—these are deliberate, geo-targeted campaigns that erode the value of traditional IOCs (Indicators of Compromise).”

While there are similarities with PolarEdge, another China-linked ORB network, LapDogs operates independently and its TTPs do differ.

Researchers said they identified 162 discrete intrusion sets, with around a third sharing a common geographical location or ISP. This, they added, suggests that the operators are highly focused on several specific locations and that LapDogs is a goal-oriented actor.

"Overall, LapDogs is a vast, prolonged intrusion operation with clear intent and planning, emphasizing the need for vigilance in securing embedded devices," the researchers warned.

MORE FROM ITPRO

• China cyber threats: What businesses can do to protect themselves
• Warning issued after Chinese hacker group breaches telco firms in "dozens of countries"
• Why government email servers are top targets for state-backed hackers

China and the US were hardest-hit by the LockBit ransomware group between December 2024 and April this year, research shows, with affiliates targeting 156 organizations in all.

Trellix Advanced Research Center has released its analysis of the LockBit SQL database dump it observed in May, noting that China was probably the greatest focus because of its large industrial base and manufacturing sector.

"Unlike BlackBasta and Conti RaaS groups that occasionally probe Chinese targets without encrypting them, LockBit appears willing to operate within Chinese borders and disregard potential political consequences, marking an interesting divergence in their approach," the researchers said.

Meanwhile, affiliates such as BaleyBeach, umarbishop47, and btcdrugdealer were active in the US, where attacks appeared to be more spread out among affiliates, suggesting a more opportunistic approach rather than specialized targeting.

Taiwan was the third most-targeted country, followed by Brazil and Turkey. One group, Swan, had a broad geographic reach, targeting multiple European countries including Austria, Czech Republic, and Switzerland.

This, researchers pointed out, indicates sophistication in the group's ability to navigate different regulatory environments.

"The victimology data reveals some unexpected targeting patterns. It's particularly surprising to see such a concentrated effort on Chinese and Taiwanese organizations," the researchers said.

"Unlike other ransomware groups that might shy away from such politically sensitive targets, LockBit appears to have operated with a different calculus."

LockBit affiliates are diversifying targets

Manufacturing was the most frequently targeted sector, followed by consumer services, the finance sector, and government services.

After analyzing LockBit negotiation chats, Trellix researchers discovered 18 confirmed payments to cryptocurrency wallets believed to be under the control of LockBit affiliates, netting them around $2,337,000.

"The data paints a picture of varying strategies, with initial ransom demands ranging from modest to exorbitant. What’s clear is that substantial discounts were the norm, often between 10% and 80%, highlighting the haggling that goes on behind the scenes of these cyber extortion attempts," researchers said.

"Affiliate success within LockBit varied significantly, indicating differences in skill and potentially specialization in specific familiar industries and/or countries."

The LockBit owner appears to have been charging affiliates 20% of ransom payments, adding up to around $456,000 over the period.

It made a lot less from auto-registration invitations, though - around $10,000 to $11,000.

"The assertion made by LockBit on the RAMP underground forum, which claimed monthly earnings of $100,000 from auto-registration, is thus considered to be significantly exaggerated," the researchers said.

LockBit is still causing havoc

LockBit was once one of the most prolific and successful ransomware-as-a-service groups, but was disrupted early last year by international law enforcement bodies.

Since then, a number of group members and affiliates have been arrested.

The group's exaggerated claims of earnings, researchers said, shows how cyber criminals are inclined to hype up their successes and downplay their failures.

"What this leak truly shows is the complex and ultimately less glamorous reality of their illicit ransomware activities," they said.

"While profitable, it’s far from the perfectly orchestrated, massively lucrative operation they’d like the world to believe it is."

MORE FROM ITPRO

• Building ransomware resilience to avoid paying out
• CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
• UK government officials consider banning ransomware payments

While new for cybersecurity, disinformation is not new to the world overall. We’ve had misinformation, disinformation and propaganda for centuries, and ‘social engineering’ is an evolution of this with a cybersecurity bend.

People have been creating fake or falsified videos and images for as long as we’ve had cameras and editing software, notes Daniel Ayoub, senior director analyst at Gartner. He adds the challenge is growing thanks to the ease with which technology can now be used to enhance or perform these actions with high quality and low barriers to entry.

“Being able to imitate anyone’s voice with only a few seconds of audio or create a nefarious video of someone with only a few pictures found online – that’s the scary part.”

Enterprise vulnerabilities

Businesses, and enterprises in particular, are vulnerable to disinformation due to their reliance on public trust, reputation and digital infrastructure.

As Lisa Venture, a member of BCS, The Chartered Institute for IT and founder of the Cyber Security Unity community explains, an enterprise’s online presence creates multiple attack surfaces ripe for exploitation. This can include its social media platforms, websites, and digital marketing channels.

Additionally, organizations often operate in competitive environments where rivals or adversaries may seek to gain an edge by spreading false or misleading information.

“Their complex supply chains and partnerships also increase exposure, as disinformation campaigns may target associated entities, creating a cascading effect of reputational harm,” she says.

Insider threats

Employees can be another weak link, Venture adds, especially when phishing attacks, fake internal communications or impersonation campaigns exploit their access to sensitive data or systems.

Social media remains a major vector, where employees may unknowingly encounter and/or share false information about their organization, leadership or industry developments. Messaging apps and collaboration tools, such as Slack and Microsoft Teams, have also emerged as internal disinformation conduits.

“This trend is amplified by remote and hybrid work environments, where digital interactions dominate, making it easier for disinformation to blend seamlessly into regular communications channels,” Venture says.

Disgruntled employees can also have an impact, as it may not be possible to stop them from spreading disinformation. “Rumor mills will always exist within large organizations, exposing them to risk. These echo chambers of disinformation can amplify false narratives and erode employee confidence,” notes Amanda Finch, CEO at the Chartered Institute of Information Security (CIISec).

The impact of disinformation on businesses

Disinformation can pose a significant threat to companies of all sizes as, if left unchecked, it has the ability to damage reputations and operational integrity.

One of the biggest challenges is the speed and scale false information can spread, as the perpetrators create fake accounts and leverage bots to amplify their narrative across a variety of digital platforms.

These kinds of campaigns can undermine consumer confidence and trust, causing significant damage to a brand’s reputation. “At worst, cybercriminals can spread misleading and inaccurate information about share prices and financial results, which can have severe consequences for a company’s bottom line,” notes Finch.

“We’ve seen major consumer brands become the victims of boycotts due to mis- or disinformation campaigns online eroding their revenue and impacting share prices,” continues Ayoub. “We’ve also seen targeted disinformation attacks, like deepfakes, lead to tens of millions of dollars in fraud from just a single incident.”

One example is that of the CEO of advertising group WPP, who was the victim of a deepfake campaign where his likeness and voice were cloned to deceive customers into making payments and divulging personal details. Although this was unsuccessful, other companies haven’t been so lucky. Take Arup, for example, which saw one employee tricked into transferring approximately £20m of company funds to cybercriminals via an AI-generated video call.

How businesses can fight disinformation

We’re still in the early stages of disinformation campaigns, says Ayoub, with attacks originating from both in- and outside a business. But there are several ways organizations can fight back.

In terms of technology, Gartner is seeing three main tools being adopted. The first is media monitoring, or narrative intelligence, which looks at how information is being spread online.

“Monitoring internal systems and tools to increase resilience is something most organizations are aware of, however less obvious is monitoring external sources that are outside the organization’s control. We’re seeing new tools emerging which aim to close these gaps, but the market is still in early stages,” Ayoub says.

“Narrative intelligence builds on sentiment analysis techniques that would normally be used by marketing teams to gauge customer satisfaction and instead combines knowledge gaps, bot management and large language models to track what’s being said, by whom, where and how it’s being spread.”

Then there’s trust assessment, which builds upon fact checking but goes beyond to correlate information based on multiple public and private sources. “It also works with generative AI to prevent hallucinations or giving responses that are untrue,” Ayoub adds.

Lastly, there’s deepfake detection, which can be used to determine whether audio, video or images were created using generative AI to imitate real/authentic content.

While employees can often be the cause of disinformation, they can also be the solution to this problem. Just as companies prioritize employee training to defend against cyber attacks, says Finch, businesses should also equip their teams to recognise disinformation and how to respond effectively to minimise harm.

This focus on education should also extend to customers, she points out. “Banks serve as a strong example of how industries can tackle disinformation, offering clear and actionable guidance, such as instructing customers to never share personal information over the phone. If customers fall victim to disinformation, the resulting loss of trust can be as harmful to an organization as direct financial losses.

“Ultimately, governments will need to step in to regulate disinformation, particularly on platforms like social media, which often serve as testing grounds for malicious actors,” she adds.

Time to prepare

Disinformation is poised to evolve as a more pervasive and sophisticated cybersecurity threat in the next five years says Venture, driven by technological advancements and the increasing integration of digital ecosystems.

The good news, however, is that by 2030, Ayoub expects that a lot of the low hanging fruit, or easy gaps to be addressed, will be introduced within existing tools and platforms, making it harder to pull off these kinds of attacks.

Experts predict security-orientated features like digital watermarking, authenticated and secure communications, secret safety passphrases and sentiment analysis will fully penetrate the market, while at the same time governments and regulatory bodies are likely to respond with stricter frameworks.

The threat from disinformation may be growing but so are the necessary tools to safeguard reputations and operations. As these continue to become more readily available, now’s the time for enterprises to take a proactive approach to protecting their organisation.

OpenAI has taken down a host of ChatGPT accounts linked to state-sponsored threat actors as it continues to tackle malicious use of its AI tools.

The ten banned accounts, which have links to groups in China, Russia, and Iran, were used to support cyber crime campaigns, the company revealed late last week.

"By using AI as a force multiplier for our expert investigative teams, in the three months since our last report we’ve been able to detect, disrupt, and expose abusive activity including social engineering, cyber espionage, deceptive employment schemes, covert influence operations and scams," OpenAI said in a blog post detailing the takedown.

Four of the campaigns appear to have originated in China, generating posts in English, Chinese, and Urdu that were then posted on social media sites including TikTok, X, Reddit, and Facebook.

Topics included Taiwan, specifically targeting Reversed Front, a video and board game that depicts resistance against the Chinese Communist Party, along with posts on Pakistani activist Mahrang Baloch, who has publicly criticized China’s investments in Balochistan and the closure of the US Agency for International Development (USAID).

Meanwhile, a group of ChatGPT accounts apparently operated by a Russian-speaking threat actor were banned. OpenAI said these were being used to develop and refine malware strains aimed at targeting Windows devices.

Threat actors also used the chatbot to debug code in multiple languages and to set up their command-and-control infrastructure.

Other China-linked accounts - dubbed Uncle Spam - were used to create social media posts on US politics, particularly tariffs.

"We banned ChatGPT accounts that were generating short recruitment-style messages in English, Spanish, Swahili, Kinyarwanda, German, and Haitian Creole.” the company said. “These messages offered recipients high salaries for trivial tasks — such as liking social media posts —and encouraged them to recruit others."

Sam Rubin, SVP of Unit 42 at Palo Alto Networks, said the report aligned with what its own cybersecurity specialists have been seeing in recent months.

Threat actors are increasingly flocking to AI tools to support and ramp up operations and activities, he noted.

"Attacker use of LLMs is accelerating, and as these models become more advanced, we can expect attacks to increase in speed, scale, and sophistication. It’s no surprise that threat actors — from profit-driven cybercriminals to state-sponsored groups like those aligned with China — are embracing LLMs,” Rubin commented.

“They lower the barrier to entry and dramatically improve the believability of malicious content. In one model we tested, 51 out of 123 malicious prompts slipped past safety filters — a 41% failure rate that makes it clear today’s guardrails aren’t holding the line."

MORE FROM ITPRO

• AI-enabled cyber attacks exacerbated by digital divide in UK
• Agentic AI could be a blessing and a curse for cybersecurity
• Executives think AI can supercharge cybersecurity teams – analysts aren’t convinced

Business leaders need to stay up to date with geopolitics to keep their cybersecurity strategies up to date and mitigate the risks posed by state-backed hacker groups.

This is the message that Paul Chichester, director of operations at the UK’s National Cyber Security Centre (NCSC), delivered to attendees at a keynote session of Infosecurity Europe 2025.

The call to action from Chichester came as states known to support threat actors and engage in cyber attacks of their own step up efforts to disrupt critical infrastructure

Chichester said Russia’s cyber capabilities in particular have improved in recent years, with its invasion of Ukraine used as an opportunity to hone offensive cyber techniques. Along with Russia, Chichester focused on the threat China-backed groups pose to both public and private organizations.

“I'll come back to this a few times, but states don't do hacking for fun,” Chichester said.

“They do not do things for the sake of it. There is always a reason. We might not know the reason sometimes and that's quite a challenge for us, but we shouldn't assume that they're just doing it because they can.”

Chichester urged businesses who are being targeted by a state APT to carefully consider why and to assess how geopolitics feeds into their defensive strategies.

“At the end of the day, cyber isn't really just, or even, a technical thing. It's a tool that somebody uses, be it a criminal, be it a state. How does that risk manifest itself for you?”

The past few years have seen a number of high-profile attacks by state-sponsored groups on organizations to achieve ideological and military aims. Chichester said Russia is increasingly targeting supply chains which feed into Ukraine, with defense, energy, and logistics companies firmly in its crosshairs.

In 2022, for example, Microsoft warned the Russia-backed group Seashell Blizzard was using the Prestige ransomware strain to target organizations involved in the supply or transport of humanitarian aid and military shipments to Ukraine.

This is also coming from within the GRU military intelligence service, and Chichester cited the example of Unit 29155. This Russian military sabotage unit is known for its role in the 2018 Skripal poisonings, but it is now using cyber attacks to carry out its aims.

“Ultimately, if you want to target something in the real world, you need to understand them in the cyber world. You need to understand how they operate, you need to understand their movements, you need to understand what's going where,” Chichester explained.

“And we're seeing that merger of that real world sabotage being joined with that cyber espionage piece as well – and also cyber sabotage.”

Russia launched a major cyber attack on Viasat, a US communications company, on 24 February 2022, the same day it invaded Ukraine. This triggered a widespread outage, impacting Ukrainian military command and control and causing knock-on outages for several thousand internet-connected German wind turbines.

Chichester said the attack was carefully-timed to hit hardest in the first 24-48 hours of the invasion and “might have been a deciding factor” in the war had events on the ground gone differently.

Despite the apparently unintentional effects on EU-based companies, Chichester used the attack as an example of how states are increasingly targeting private businesses to achieve military or ideological aims.

China is also heavily implicated in attacks on critical national infrastructure, with cyber experts Kevin Mandia and Nicole Perlroth having recently warned the nation state has ramped up its cyber aggression.

Chichester said attacks by Volt Typhoon, an advanced persistent threat (APT) that successfully breached the US electric grid for almost a year, as well as Salt Typhoon which carried out major attacks on US telcos in 2024, show groups ‘pre-positioning’ themselves inside critical infrastructure.

As warned by CISA, this could enable undetected groups to carry out devastating attacks in the event of conventional war in the long-term.

For-profit attacks remain king

Despite the growing threat posed by state-backed groups pursuing ideological and military aims, evidence suggests that businesses will still largely contend with traditional threat actors.

In a separate keynote talk at the event, James Lyne, office of the CEO at the SANS Institute and Ciaran Martin, director of CISO network at the SANS Institute and former head of the NCSC, balanced the real threat of state-backed groups with those of profit-motivated groups.

“Most people are interested in fraud,” said Lyne. “Most of this stuff is about making money, the average obsession of the average criminal gang is far more mundane.”

“I think that's probably largely going to continue to be the case,” he added.

Lyne noted that, like the German wind farm operators inadvertently impacted by Russia’s attack on Viasat, some serious cyber attacks are mere “collateral damage” from campaigns aimed at other targets.

Martin said this was seen in the worst period of his time at the NCSC: the six-week period in 2017 in which North Korea launched the WannaCry ransomware attack, while suspected Russian groups hit Ukrainian banks and other organizations with the NotPetya malware.

“Between them, they [did] north of $10 billion of destruction and in my, sadly, favorite example from NotPetya, they’re attacking Ukrainian tax software and they end up stopping production at Cadbury’s chocolate factory in Tasmania, off the south coast of Australia.”

MORE FROM ITPRO

• The Iran cyber threat: Breaking down attack tactics
• Why government email servers are top targets for state-backed hackers
• State-sponsored cyber crime is officially out of control

A mysterious leaker going by the alias GangExposed has been revealing the identities of individuals linked to the Conti and Trickbot ransomware groups.

The data includes aliases, photos, and videos of several group members and their front companies, along with thousands of chat logs, personal videos, and ransom negotiations with victims.

The Register has spoken to the whistleblower via Signal, who said the leaks were a "fight against an organized society of criminals known worldwide", adding, "I take pleasure in thinking I can rid society of at least some of them."

GangExposed claimed that Stern - the leader of TrickBot and Conti - is actually 36-year-old Russian national Vitaly Nikolaevich Kovalev. This was later confirmed by German police.

Another major player, Professor, has been named as 39-year-old Russian Vladimir Viktorovich Kvitko, who allegedly lives in Dubai.

"Kvitko maintains a modest lifestyle, with known property in Moscow and several vehicles registered to family members," GangExposed said.

"Income mostly originates from RM RAIL Management Company and Rosselkhozbank. In contrast, other Conti leaders (e.g., 'Target') display significant luxury assets, including a Moscow City apartment, Ferrari, and 2 multiple Maybach vehicles."

The Trickbot ransomware group, also known as Wizard Spider, has been active since at least 2016 and has used a number of other malware variants as well as the Trickbot malware after which it was named.

Conti, meanwhile, was first observed in 2019, and is believed to have merged with Trickbot in the last two years.

GangExposed claims to have obtained the leaked data via semi-closed databases, dark web services, and purchased information. Similarly, the individual reportedly has access to a leaked FSB border control database being sold on the dark web.

He said he plans to expose around 50 gang members in all.

GangExposed leaks could have major repercussions

David Sancho, senior threat researcher at Trend Micro, said the leaks could have serious repercussions for members of the notorious ransomware groups.

"The GangExposed leak will have serious reverberations for those who led the Conti group in its active years. The individual behind the leaks is either an insider from the group or has managed to hack the inner circle," Sancho said.

"Either is damaging. If the individuals unmasked as key Conti figures are still in Dubai as the leak claims, then they will either be plotting their way back to Russia or already on their way. Past law enforcement action against cyber criminals has shown how Dubai can be cooperative with Western law enforcement."

Sancho added that the leak is likely to attract attention and follow-up from the authorities.

"Law enforcement isn’t always a fast-moving animal but when this kind of information is leaked, wheels start moving and law enforcement is unrelenting in tracking individuals down and making arrests," he said.

MORE FROM ITPRO

• INSERT STORY LINK
• INSERT STORY LINK
• INSERT STORY LINK

An international law enforcement operation has disrupted an online software crypting syndicate which helps cyber criminals protect their malware from detection.

Four domains and their associated server offering counter-antivirus (CAV) tools have been seized by the FBI Houston Field Office, working with law enforcement partners in the Netherlands and Finland and the US Secret Service.

When used with crypting services that make malware difficult for antivirus programs to detect, CAV allows criminals to obfuscate the malware, making it undetectable and enabling unauthorized access to computer systems.

"Cyber criminals don’t just create malware; they perfect it for maximum destruction," said FBI Houston special agent in charge Douglas Williams.

"By leveraging counter antivirus services, malicious actors refine their weapons against the world’s toughest security systems to better slip past firewalls, evade forensic analysis, and wreak havoc across victims’ systems."

The operation targeted AVCheck, one of the largest Counter Antivirus (CAV) services used by cybercriminals around the world.

The investigators made undercover purchases from seized websites and analyzed the services, confirming they were designed for cyber crime. They also reviewed linked email addresses and other data connecting the services to known ransomware groups that have targeted victims both in the US and other countries.

Meanwhile, as well as taking down AVCheck, the Netherlands' High Tech Crime Team has made wider interventions, including creating a fake login page to deter users of AVCheck. Authorities said the investigation has also yielded 'key evidence' on the administrators and users of AVCheck and its related services Cryptor.biz and Crypt.guru.

"Modern criminal threats require modern law enforcement solutions. As cybercriminals have become more sophisticated in their schemes, they have likewise become more advanced in their efforts to avoid detection," said US attorney Nicholas J Ganjei.

"As such, our law enforcement efforts must involve striking not just at the individual fraudster or hacker, but the enablers of these cybercriminals as well. This investigation did exactly that. With this syndicate shut down, there is one less provider of malicious tools for cybercriminals out there."

The seizures were made as part of Operation Endgame, a multinational law enforcement initiative aimed at dismantling cyber criminal services.

This latest effort follows another Operation Endgame move last week in which hundreds of servers were taken down as part of an international operation against ransomware groups. Three hundred servers were taken down, 650 domains neutralized, and nearly two dozen international arrest warrants issued.

"Cyber criminals are often hard to track down, so it is important to invest in a broad approach so the authorities can keep a step ahead," said Matthijs Jaspers, team lead of the Netherlands' High Tech Crime Team.

"Joint interventions by national, international, and public-private partnerships are becoming increasingly important to prevent victims, stop crimes, and stop online crime in its tracks."

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• What is polymorphic malware?
• Infostealer malware: What’s the threat to businesses?