N0n Ransomware Uses AI and Victim Inflation to Rise to the Top

A ransomware attack discovered Monday at Vanderbilt University in Nashville, Tennessee appears to have compromised vast amounts of student and employee personal data, prompting the university to take several digital services intermittently offline as it continues responding to the incident.

As of Tuesday morning, the university shared an update that select campus-wide systems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint. Students, faculty and staff were also allowed to resume use of Vanderbilt devices, following orders to shut them down Monday. 

“Vanderbilt Information Technology continues to work with government agencies and other partners to manage this situation, and we will continue to send updates today and throughout this week for as long as necessary,” the update said. 

A ransomware group known as BYOD has taken responsibility for the attack, according to a post on the group’s leak blog. The group, which emerged in September, has since taken credit for several attacks targeting academic and health care institutions including one last month on the University of New Mexico Health Sciences Center that caused system outages, disrupted patient care and impacted academics.

The group claims to have more than one million Social Security numbers from the attack on Vanderbilt.

In a video posted to YouTube, a computer from Vanderbilt University plays an audio message announcing that a system has been compromised by BYOD. 

In its original notice on social media, the university warned community members on Monday to remain vigilant, shut down university devices and disconnect from campus Wi-Fi as the IT team was “actively investigating and working to contain the situation.”

The university urged users to take immediate action if they notice unusual or suspicious activity on their accounts or devices, including unexpected pop-ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms; unexpected file movement, deletion, renaming or modification; unfamiliar applications, messages or prompts; or unexpected requests to enter passwords, approve authentication requests or provide login credentials.

In an interview with The Hustler, Vanderbilt University’s student publication, Student Government President Simran Fitzpatrick and Vice President William Dean said they met with Vanderbilt Student Affairs to express student frustrations and concerns about the university’s handling of the cybersecurity attack, and lack of communication. 

“Students are concerned about the cyberattacks and extortion threats, particularly what information was stolen, how it may be used, and how it could affect them personally,” Fitzpatrick and Dean said. “We are frustrated by the university’s lack of clear communication, and our priority is ensuring that students receive timely updates and are not academically penalized for circumstances beyond their control.

However, in the update on Tuesday morning, the university acknowledged that its efforts to contain and respond to the incident had disrupted normal communications.

“The cyberattack is like a building that just exploded and we are trying to gather the pieces,” a Vanderbilt IT representative said, according to the Hustler. 

The post Vanderbilt University reels following ransomware attack claimed by BYOD group appeared first on CyberScoop.

John Rupolo reports: University of New Mexico Health is addressing concerns after a cyberattack on Monday, with reports surfacing this week that a ransomware group claimed responsibility for the incident. “So what I can say is we’re also aware of those claims by that group,” said Chris Ramirez, communications director for UNMH. The community’s top...

Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

“Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

“Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

The post Officials seize domain of top bulletproof hosting provider Virtualine appeared first on CyberScoop.

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks.

The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.

Artem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms. He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Stryzhak pleaded guilty to multiple cybercrimes in late 2025. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.

Attacks involving Nefilim ransomware caused millions of dollars in losses from extortion payments and damage to victim networks, officials said. Stryzhak and his co-conspirators allegedly customized executable ransomware files for each victim, creating unique decryption keys and unique ransom notes.

The ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data. The crew researched companies after it broke into their networks to determine their net worth, size and contact information.

Stryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri and an international eyewear company. 

Stryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said. 

Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”

The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.

The Office of the National Cyber Director has rolled out its second regional cyber pilot program, this one focused on rural hospitals.

National Cyber Director Sean Cairncross visited South Carolina on Monday to debut the six-month program, Project Lifeline 250, which connects industry with rural hospitals. The concept is similar to the first pilot program in Texas that connected industry with the water sector.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said in a statement.

The health care sector had a record year for breaches last year, with 804 large breaches reported to the Health and Human Services Department’s Office for Civil Rights that affected more than 140 million people. The FBI identified the sector as the top target for ransomware and other hackers in 2025.

Rural hospitals, like the water sector, lack resources compared to other kinds of critical infrastructure.

Besides industry and the ONCD, the effort is a project that draws in the South Carolina Critical Infrastructure Cybersecurity program, the South Carolina Law Enforcement Division and local governments in the state.

“Cyber threats are a rising challenge to our nation’s security, and we must remain vigilant to protect the systems our communities depend on,” said South Carolina Gov. Henry McMaster. “Project Lifeline 250 is another important step toward ensuring South Carolina’s rural hospitals have the resources they need to defend against cyberattacks and continue providing critical care.”

Some of the same companies involved in providing free services in the Texas pilot are involved in the South Carolina pilot, too, along with some new participants. Among the participating firms: Abnormal AI, Cisco, Cyera, Microsoft, Rilian Partners, Trellix and Zscaler.

“The stakes for critical infrastructure are getting higher and higher,” said Yotam Segev, cofounder and CEO of Cyera. “There’s real urgency in bringing cyber expertise from some of the world’s largest and most complex enterprises to rural hospitals through Project Lifeline 250. When a hospital knows where its patient data lives and who can reach it, it can reduce the leverage behind ransomware. Every community should have that clarity, no matter the size of the hospital or its IT team.”

Members of Congress also have introduced legislation designed to aid rural hospital cybersecurity.

The ONCD hasn’t said what will happen at the end of the six-month pilots. And so far it has only partnered, or publicly discussed partnering with, GOP-led states.

The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.

On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organizations in the prior two months. A water utility and a telecommunications provider were among them, along with a regional government body and a university. This all occurred in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.

The likely way in was on-premises Microsoft SharePoint. The researchers believe the group still carries the ToolShell flaws it exploited in July 2025, the same month Microsoft shipped the fixes, alongside newer SharePoint flaws. An exploit for a bug patched more than a year ago is still worth packing. Somewhere, a server is still waiting for its fix.

Before I ran a security company, I ran its finances. The habit I kept is reading the assumption under every number. Equipment is expected to keep producing. Inventory is expected to sell. When the assumption breaks, the asset gets written down.

Security budgets carry one too, and almost nobody writes it down. It is that the tools on the books will still be running when the attack arrives. Warlock’s operators went after that assumption directly.

Nine days in, 2 hours to disarm

One intrusion, against a critical infrastructure operator, shows the pattern.

On July 22, the attackers planted a web shell on a SharePoint server. Over the following week, they mapped the domain, set up covert remote access and added an account, apparently named to pass as a SharePoint service account, to local administrator groups. Then, for about a day, the only recorded activity was one piece of planted code running in the background.

In the early hours of July 31, they moved. First came a tool built to disable security software. Its execution was recorded on at least 40 hosts within about two hours. Next, they staged Warlock in the domain’s SYSVOL share, a folder Windows replicates to every domain controller and makes readable across the domain, and let ordinary replication carry it to at least 33 hosts. On each one, the researchers found, the ransomware showed up almost as soon as the protection was gone.

Do the arithmetic. Roughly 40 hosts in 120 minutes averages out to one machine losing its protection every three minutes.

The attackers targeted the tools watching the data before the data itself.

A line item the adversary can switch off

On the researchers’ facts, this is a patching story and an Active Directory story first. Patching and endpoint detection and response remain essential. Patching closes the door this group most likely walked through, and detection is often the only reason a team learns something is wrong. A utility that cuts either one to fund something else has made a bad trade. Tamper protection and blocking known vulnerable drivers belong switched on everywhere, too. They make the kill step harder.

But a control the adversary can switch off is worth less than its line item says.

Accountants would call it an impairment. When an event suggests an asset can no longer deliver the value it is carried at, you test it. If it fails the test, you write it down. The asset still has value. The books simply overstated it. Most security spend is expensed rather than capitalized, so no auditor will make you run this test. Run it anyway.

Warlock is that event for a lot of security budgets. Most detection spending depends on a sequence of things going right at the worst possible moment, with a sensor staying alive, a console receiving what it reports and a person reading it in time. Take away the sensor and the rest has nothing to work with. The spend remains in the budget, but the machine is left without protection.

Thinly staffed utilities carry more of that gap than their boards realize. The Congressional Research Service noted in August that 81% of the nearly 49,500 community water systems in the United States are classified as small, serving 3,300 people or fewer. Larger systems, the report says, have more capacity to hire security specialists. That likely means fewer people watching, and more hours when nobody is.

All of the victims in this latest round were outside the United States. The playbook needs no passport.

And in the early hours, when the sensors go quiet, silence looks exactly like safety.

Prevention that does not wait for the sensor

If switching off whatever is watching comes right before the payload, the protection that matters has to be in place well before then. It cannot depend on a cloud connection holding, an analyst reading an alert or a sensor surviving the night.

Start with the limit. A tool that loads a vulnerable signed driver works at the deepest level of the machine and can end any security software it finds, including the kind I am about to describe.

That is why timing is the key factor. Here the kill step came after nine days inside. Before it, the attackers had to exploit a server, load their own code into memory through sideloading and work their way to rights across the domain. Each of those steps was a chance to stop them with a control that never had to survive the kill switch, because the attacker would not have gotten close enough to use one.

One way to build that control works in memory. Much of the code an intruder loads along the way depends on finding applications laid out in memory the way it expects. Change that layout each time an application loads, and code relying on those expectations should fail at the moment it runs, on endpoints and on servers, whether or not a sensor is reporting to anyone. The decision happens on the machine.

The impairment test for a utility board

Boards already run this review for every other asset. For security, it comes down to one question. What still holds once the monitoring stops?

Ask management to split the security budget into two piles. The first is protection that depends on a sensor staying online and a person responding. The second is protection that makes its decision on the machine, without waiting on a console or a person, and acts before the attacker has earned the rights to turn it off. Then ask who would learn that the sensors went quiet, and from what, since the attacker turns off the obvious messengers first.

If the second pile is empty and nobody would be told, write that in the risk register in those words. The share of the first pile that would not survive that night is the impairment. Better to book it in a board meeting than to read about it in an incident report.

40 machines went dark in two hours. Budget for the attacker who brings a switch.

The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.

The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Hackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France. As those original members were arrested or jailed one by one, control over the ShinyHunters brand eventually passed to “Rey,” identified last year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers and home addresses, and information about each employee’s unit and specialization.

The FBI jobs site hack has prompted the agency to move with uncommon speed to arrest, detain and question people who had any communications with Rey or other ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating with the FBI.

Rey was able to assume control over the hacking group because one of its alleged senior members had just been nabbed. On the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters suspect Pepijn van der Stap. Dutch police reportedly used flash-bang grenades in an effort to stun and apprehend Van der Stap as he was logged in to various online accounts.

According to a source close to the investigation, the authorities arrested Van der Stap while he was using his Signal instant messaging account, which allowed them to read recent communications with frequent contacts — including ransomware negotiators based in Canada and the United States.

Multiple sources with knowledge of the matter told KrebsOnSecurity that Van der Stap’s messages were the key to unraveling a murder-for-hire plot that emerged immediately following his arrest. The Dutch news outlet RTL reported last month the two murders were allegedly to be committed abroad, and that there are indications Van der Stap gave the order for the attacks (there is no indication those orders were ever carried out).

On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity executive named Edward Dubrovsky in connection with the ShinyHunters investigation. Dubrovsky, who recently published a book on handling cyber extortion that recommended always engaging with the hackers, was charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records. Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records related to his case remain under seal.

A source close to the investigation told KrebsOnSecurity that Van der Stap’s Signal messages showed he had frequent conversations with Mr. Dubrovsky and with at least one executive at a large U.S.-based consulting firm, and that these executives often knew the details about new ShinyHunters victims before the victims themselves had even learned of the breach.

That source shared another potentially explosive finding by federal investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had stolen highly sensitive data from FBI servers, and that he never informed the bureau of the data breach prior to ShinyHunters threatening on Twitter/X to publish the agency’s deeply personal personnel files.

SHINYWIRE

KrebsOnSecurity has learned from two sources close to the ShinyHunters probe that FBI investigators believe at least one executive at a U.S.-based consulting firm played an active role in operating the now-defunct ShinyHunters victim extortion website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. company or the suspected executive(s) for now because they have not yet been charged with a crime, but it is a prestigious firm with more than 1,000 associates.

The Shinywire website was active from approximately May 3, 2026 until October 16 and had entries for nearly 100 organizations hacked by ShinyHunters. Each entry urged victims to engage with the cybercrime group and discuss terms for payment. The pages also included samples of stolen files and promised those files would be published online if the victim ignored their demands.

The following screenshot shows a cached portion of the Shinywire extortion page for Intuitive Surgical, an American medical technology company that was breached in March 2026 after an employee fell for a targeted phishing email.

Victim organizations that refused to engage or negotiate after seven days would find all of their stolen data published on the ShinyHunters victim shaming blog (a website that is only reachable via the anonymity network Tor).

In a story published October 15, The Globe and Mail wrote that a few months before Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity executive alleged in court documents he had become collateral damage in a campaign by a former business partner to “destroy” another industry executive.

The story noted that Dubrovsky filed the lawsuit in Ontario this year against Daniel Tobok, the former chief executive of Cypfer, a cybersecurity firm founded in Toronto with offices in the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two first became business partners in 2017 and later developed Cypfer together, where Mr. Dubrovsky was a managing partner and chief operating officer. But by 2024, the two had a falling out, with Dubrovsky accusing Tobok of gradually excluding him from business matters and making “increasingly capricious business decisions.”

Mr. Tobok reportedly denied the allegations and filed a counterclaim, accusing Mr. Dubrovsky of accessing confidential information and unfairly competing with Cypfer through work at another firm called CyberSteward Inc. He also said Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

GHOSTBYTE

According to interviews with several former colleagues of Mr. Tobok, as far back as eight years ago he was known to ransomware purveyors by a particular nickname: Ghostbyte. In 2018, a Canadian company was hacked by Dharma, a prolific Russian-language ransomware affiliate program that first surfaced in 2016. The victim company told the Dharma ransomware representative they were leaning toward paying because some of the files were unrecoverable after being locked, but that they needed a better guarantee that Dharma would keep their word if paid.

A redacted copy of the Dharma rep’s reply is pictured below, and it shows the ransomware group urged the victim to contact a person at a Canadian IT firm that helps companies seeking such guarantees. The Dharma rep recommended the victim contact the email address ghostbyte@tutanota.com.

“If you want guarantees, you can write to the IT company,” the Dharma reply advised. “Take the phone and negotiate with them. This IT company often solves such problems in Canada. You can contact them and sign a contract for services. You’ll still have to pay.”

It’s unclear if Mr. Tobok ever used that Ghostbyte address offered by the Dharma representative, and he has not responded to multiple requests for comment. However, the breach tracking service Constella Intelligence finds an email address Mr. Tobok has frequently used — dtobok@me.com — is associated with two online accounts where the chosen username was “ghostbyte,” including a Snapchat account.

Incidentally, Constella also finds the Dharma rep’s email address luckygoodlucky@tuta.io is associated with a cryptocurrency address that processed 38 transactions totaling 43 bitcoin, ~$3.5 million at today’s value (the most recent transaction for this wallet is dated February 2019).

In a statement shared on October 14, Cypfer said the company’s business does not include making or facilitating ransomware payments, and that Cypfer learned of Dubrovsky’s arrest when the news first broke in the media.

“We had no prior knowledge of Mr. Dubrovsky’s arrest,” a spokesperson told KrebsOnSecurity via email. “CYPFER has not received any outreach from law enforcement and, to our knowledge, is not the target of any law enforcement investigation.”

The statement said CyberSteward and Cypfer are separate companies with no officers, directors or employees in common, and that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner.

CONFLICTING INTERESTS

It is not illegal in the United States to pay hackers for an encryption key to unlock servers infected with ransomware, or in exchange for a promise to delete any stolen files and refrain from publishing them online. While victim organizations can land in legal hot water if they pay a ransom to a group that is sanctioned by the U.S. Treasury Department, ShinyHunters is not among the ransomware groups currently sanctioned by the United States or by any other government.

Experts say ransomware victims are typically directed by their insurance provider to work with a specific incident response firm. But not all cyber forensics and breach response companies will agree to facilitate payments to ransomware groups on behalf of their clients. As a result, once victim firms make a decision to pay, the firms that eschew rewarding extortionists are invariably replaced by companies that have no such qualms.

In December 2024, ShinyHunters began extorting the education technology company PowerSchool, stealing private information on 62 million students and 9.5 million teachers in the U.S. and Canada. PowerSchool reportedly paid a $2.85 million ransom demand, and a “frequently asked questions” statement (PDF) about the breach says PowerSchool was assisted in that effort by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to four years in prison for his admitted role in the PowerSchool hack).

But that ransom payment did not stop future extortion attempts using the same stolen data. By May 2025, individual school districts were reportedly receiving separate ransom demands using samples of the same stolen files. While nobody has alleged ShinyHunters was behind the second wave of extortion against PowerSchool users, the incident drives home the reality that there is no technical way to verify the threat actors have deleted the stolen data as promised, or prevent others from abusing the same records.

A number of leading cyber incident response firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” victim data is often kept, resold or used to extort the company’s clients directly later on.

The FBI echoed those sentiments in an alert on May 15, 2026 advising victims against paying the ShinyHunters group. Meanwhile, ShinyHunters members have been harassing and threatening employees at Coveware and Unit 221B for offering this advice.

The following screenshots show just how annoyed the ShinyHunters leaders were with Coveware’s relentless advice against paying the group. The first image is from a conversation on May 6, 2026 that took place between the group’s main account on Telegram and a co-conspirator. In that chat, snippets of which were shared with KrebsOnSecurity by a trusted source, ShinyHunters complained that Coveware was harming the group’s payment rates.

“Go on my website, majority of those companies would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters account wrote. “Someone (100% Coveware) is going out of their way to make sure i am not paid.”

In another conversation on April 11, 2026, the ShinyHunters Telegram account privately said they were trying to “eliminate the problem,” which they said was Coveware. Coveware declined to comment for this story.

“I’m sure the company will pay but in this specific case I am aware of Coveware and their involvement, and I’ve probably been not getting a lot of other negotiations mostly likely because Coveware keeps getting involved,” the ShinyHunters account bemoaned.

Mark Camillo is chief executive at CyberAcuView, an industry group founded in 2021 by a consortium of major cyber insurance carriers. Camillo said some firms charge a flat retainer fee, while those that specialize in helping companies negotiate a ransom payment tend to charge a percentage of the total ransom amount paid.

That latter dynamic, he said, is an inherent conflict of interest, as the negotiator has every incentive to make things more favorable to the attackers because they are financially incentivized to negotiate and pay out, and to not negotiate down on the price.

“It has come to the industry’s attention that many of the ransomware payers charge a percentage of the final payment which may or may not be disclosed,” Camillo said. “This makes no sense if they are also the negotiator. There needs to be more transparency in the process as no one in the ecosystem should be profiting purely on the size of the ransomware transaction or payment itself.”

Camillo said the firms doing this work would argue the fees are needed because there may be unexpectedly higher costs to secure larger quantities of cryptocurrency or more risk carrying the float, and because cryptocurrency exchanges may charge higher fees for high risk transactions.

“There definitely needs to be more visibility around the transaction and clarity on the increasing value of the crypto and the exchange’s percent in the transaction to get to the bottom of this and remove any misaligned incentives,” he said.

In recent months, the U.S. Department of Justice has prosecuted a number of ransomware negotiators alleged to have conspired with cybercriminals to defraud their clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, with wire fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers. According to charging documents, Pinhasi secretly went behind his customers’ backs and paid hackers anyway, paying ransomware groups $8 million while charging customers $19 million.

In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for conspiring with the Blackcat/ALPHV ransomware group to extort multiple victims. According to the DOJ, Martino was paid by BlackCat attackers to provide confidential information about the negotiating position and strategy of his employer’s clients and enable the ransomware actors to maximize the ransoms paid by the victims.

[CRITICAL] | CVSS 10.0 (CVE-2026-105134, per VulDB) | Active exploitation confirmed, listed in CISA KEV | Patch immediately

Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday.

Edward Dubrovsky, 54, is a former employee of CYPFER, a firm that helps organizations negotiate with ransomware operators. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed. 

While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. FBI Director Kash Patel said in a social media post that the bureau had arrested “another suspected co-conspirator” of the group, but did not name the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

When asked for further comment, the FBI pointed CyberScoop to Patel’s social media post. 

Dubrovsky’s LinkedIn page touts him as the chief operating officer and ex-founder of CYPFER. However, a firm representing CYPFER told CyberScoop that his role was Managing Director from May 2022 through Dec. 2025.

Dubrovsky “had no affiliation, operational role or relationship with CYPFER since that time, and contrary to certain reporting, was never a founder or co-founder of the company,” the firm wrote in an email to CyberScoop.

Dubrovsky’s LinkedIn page also makes reference to an affiliation with CyberSteward, which is described as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month, Dubrovsky released a book covering how to deal with ransomware negotiations. 

Dubrovsky did not return CyberScoop request for comment. 

The FBI breach has drawn widespread attention. The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson. 

Brett Leatherman, the FBI’s assistant director for cyber, said a review found the breach resulted from a third-party platform, where a contractor had not installed a security patch issued for the system. Reuters reported that the contractor worked for Accenture.

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. Additionally, a teenager, which Reuters identified as Saif Al-din Khader, had been detained and was cooperating with investigators. 

Dubrovsky’s case docket states that the case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled. 

UPDATE: 10/13/2026, 11:25 a.m.: This story has been updated with comment from CYPFER.

The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop.

Authorities accuse the owner of a so-called ransomware remediation company of swindling clients victimized by ransomware attacks into paying the company inflated fees under false pretenses.

Zohar Pinhasi, owner and operator of MonsterCloud, claimed he could decrypt and recover victims’ data with specialized, proprietary tools and avoid paying cybercriminals. Yet, no such tool existed, the Justice Department said Wednesday. 

Pinhasi allegedly used MonsterCloud clients’ fees to pay off cybercriminals and recover encrypted data without telling clients ransom payments were made on their behalf. The dual U.S.-Israeli national is accused of charging hundreds of clients more than $19 million and paying more than $8 million in ransom payments during a five-year period ending in 2023.

“It baffles me that companies fall for this,” Jon DiMaggio, principal researcher at Arkem Cyber, told CyberScoop. “I mean, they just got hacked and they go straight to a shady source.”

Pinhasi’s alleged criminal acts illustrate how the ransomware economy attracts money-seeking professionals of all types.

Ransomware response and remediation occurs in the shadows, providing cover for cybercriminals who fuel the scourge of extortion and, sometimes, those hired by victims to help put one of their worst days behind them. 

A trio of former ransomware negotiators were sentenced to prison earlier this year for deceiving their employers’ clients and conspiring with ransomware affiliates to extort those organizations — effectively playing both sides and victimizing clients’ twice over. 

Prosecutors charged Pinhasi with two counts of wire fraud and one count of wire fraud conspiracy. He pleaded not guilty Wednesday in a federal court in Brooklyn, N.Y., and was released on a $2 million bond.

The Florida resident, where MonsterCloud is also based, faces up to 60 years in prison. A federal judge granted a one-month delay on trial proceedings, noting that attorneys are engaged in plea negotiations. Pinhasi’s lawyer did not immediately respond to a request for comment.

“By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Pinhasi and one of his co-conspirators, an employee at MonsterCloud, allegedly drew clients into their scheme with an initial exploratory fee between $2,500 and $10,000. Pinhasi or an employee at MonsterCloud then obtained the ransom note sent to their client and a sample of encrypted files on the client’s system, according to the indictment.

After this “analysis phase,” Pinhasi allegedly provided encrypted samples to the prospective client as proof MonsterCloud could decrypt the files.

“However, in many instances, Pinhasi had actually shared the sample files with the cybercriminal and obtained decryption samples without informing or revealing to the client that MonsterCloud had not employed any proprietary technology,” prosecutors wrote in the indictment.

This preliminary phase reinforced Pinhasi’s false claims and “induced clients to contract for full ransomware recovery — a more expensive service, costing up to two or more times the ransom,” prosecutors added. 

In August 2023, Pinhasi charged a client approximately $150,000 and allegedly made a ransom payment of about $8,200 to recover the organization’s data. He allegedly used the monikers “Zack Silver” and “Zack Green” in some of his communications with cybercriminals. 

Officials said MonsterCloud’s contracts noted that the company would contact a cybercriminal after exhausting all other options, but dealing with cybercriminals was often Pinhasi’s first step in accessing encrypted files and the typical way he obtained proof of recovered data and decryption keys. 

MonsterCloud landed deals with hundreds of companies based in the United States and Canada. The company still has an active site with a contact form for prospective clients, packaged with testimonials from law enforcement agencies and a former FBI official.

Pinhasi and MonsterCloud reportedly operated this scheme for years. An exposé in ProPublica in 2019 detailed how the company professed to use its own data recovery methods but instead paid ransoms without informing victims, including law enforcement agencies.

“Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim’s crisis into his own profit center,” James C. Barnacle Jr., assistant director of the FBI, said in a statement. “This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help.”

You can read the full indictment below.

The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop.

A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “Rey,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines.

On October 3, Reuters cited three unnamed sources saying a suspected ShinyHunters member in Amman named Saif Al-din Khader was detained by Jordanian authorities and was cooperating with the FBI. KrebsOnSecurity identified Rey as Khader in a November 2025 profile, in which the young man admitted working with multiple ransomware groups.

Rey was featured again in a September 28 exclusive about the Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding in data thefts and extortions by ShinyHunters. The story noted that immediately following the Dutchman’s arrest on the evening of September 15, Rey assumed control over the ShinyHunters brand and boasted publicly about stealing highly sensitive data from the FBI and extorting the ransomware group Cl0p.

Rey taunted both the FBI and Cl0p with memes posted to his longtime account on Twitter/X, while simultaneously including images of the avatar used by Van Der Stap’s former hacker alias “Umbreon” in an apparent attempt to frame the Dutchman for both hacks.

As noted in our September 28 report, ShinyHunters gained access to the FBI site and other victims by exploiting a vulnerability (CVE-2026-35273) in PeopleSoft, a software-as-a-service platform from the tech giant Oracle that is broadly used by companies to manage hiring and human resources, benefits and payroll. Oracle quickly issued a fix for CVE-2026-35273, which ShinyHunters first began exploiting as a zero-day in June, and at the time Mandiant released web application firewall rules intended for organizations that couldn’t apply the security update quickly enough.

ShinyHunters told BleepingComputer in June that the original goal behind exploiting the PeopleSoft vulnerability was to breach the FBI’s own PeopleSoft database, but the hackers said those attacks were unsuccessful for some reason. In recent weeks, however, ShinyHunters turned to a well-known URL-encoding trick to bypass Mandiant’s suggested web application firewall rules.

In a report released Sept. 25, security experts at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters had mass-exploited the PeopleSoft vulnerability to steal data from dozens of systems across a range of industries, including higher education, technology, healthcare, agriculture, transportation and government.

Reuters reported October 5 that the FBI has removed a contractor at Accenture over their failure to patch the FBI recruitment website hacked by ShinyHunters, which exposed sensitive data on more than 5,000 FBI personnel, including each’s person’s unit and specialization, as well as medical and psychiatric records.

‘REY’ MEANS KING, AS IN ROYAL

According to two sources familiar with the ShinyHunters investigation, a navigation and digital aviation unit recently divested by the global aerospace company Boeing was among the victims that ShinyHunters was in the process of extorting when Rey was apprehended by Jordanian authorities.

Those sources said the FBI’s investigation into ShinyHunters gained renewed urgency with the group’s attempted extortion of the former Boeing unit, which allegedly included the theft of sensitive information that sources said could pose operational safety and security risks.

In a brief statement shared with KrebsOnSecurity, Boeing acknowledged the extortion attempts by ShinyHunters, and said the incident concerned data stolen from Jeppesen ForeFlight, a subsidiary that Boeing sold in November 2025 to the private equity firm Thoma Bravo for $10.55 billion.

“We are aware of claims by a threat actor regarding data allegedly associated with Boeing and our former subsidiary Jeppesen ForeFlight,” a Boeing spokesperson shared. “We are actively reviewing the matter with the Jeppesen ForeFlight team.”

A spokesperson for Jeppesen ForeFlight shared a written statement in response to questions, saying the company has seen no impact on their end. “Based on our investigation to date into this claim and proactive security posture, there was no impact to our operations or products.”

Rey’s alleged involvement in attempting to extort the former Boeing unit is noteworthy because there is strong evidence that his father works for Royal Jordanian Airlines, which is mostly controlled by the Jordanian government and operates its long-haul fleet on passenger planes built by Boeing. Rey claimed on Telegram in early 2025 that his father was an airline pilot, although that could not be independently confirmed.

However, as noted in our November 2025 profile of Rey, his family’s shared computer was at one point compromised by password-stealing malware, and the data collected by that malware clearly shows Rey’s father used the same credentials to log in at multiple online portals for Royal Jordanian Airlines employees.

Royal Jordanian Airlines has not yet responded to a request for comment. In advance of our September 28 story, KrebsOnSecurity once again emailed Rey’s father to seek comment and update him on his son’s alleged activities. Neither of the Khaders have responded. But just hours after that request was sent, Rey began deleting his various social media accounts, including the Twitter/X account he previously used to taunt the FBI, Cl0p, and other ShinyHunters victims.

Rey may have nixed many of his social media profiles, but his cybersecurity blog on GitHub somehow escaped the purge, and it shows that Rey was fixated on the leaders of the Cl0p ransomware group. In March 2026, Rey’s blog featured a lengthy post that identified two Russian men as the core developers and hackers behind Cl0p.

MURDER FOR HIRE?

Meanwhile, news outlets in the Netherlands reported explosive new allegations leveled at Van der Stap, whose supposed personal transformation from convicted to reformed hacker has been widely covered in the tech news media. The Dutch daily RTL reported on Sept. 29 that investigators suspect Van der Stap tried to orchestrate at least two murders. According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks.

Van der Stap was released from prison after serving the better part of a four year sentence for data theft and extortion activity that prosecutors said netted between €1.5 million and €2.7 million. In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company Neo Security, saying the job involved probing client networks for security vulnerabilities.

Neo Security’s owner Benjamin Korper told Reuters he has hired an outside firm to investigate whether Van der Stap had hacked Neo Security or its customers, but that so far investigators have found no evidence he acted against his employer or clients. Korper said Dutch forensic investigators visited his office on September 15, the night Van der ⁠Stap was arrested in a dramatic police raid that reportedly involved flash bang grenades.

Prior to his first arrest in 2023, Van der Stap was working as a software engineer at the Amsterdam-based cybersecurity startup Hadrian, while volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD) — even as he was hacking into and extorting a number of large organizations.

When asked in a recent interview why anyone should believe the word of a self-described “reformed” cybercriminal who had so casually deceived countless friends, co-workers and journalists for years, Van der Stap replied that his work spoke for itself and there was nothing he could say that would convince his worst critics.

“You can throw a bunch of nice words at someone, but you can’t convince them if they don’t want to be convinced,” Van der Stap told KrebsOnSecurity on Sept. 9. “I’m doing what I can to repay victims, and that’s all I can do. If someone doesn’t want to believe me, then that’s on them.”

FRANCHISING AND BURNING A BRAND

Cybercriminals aligned with ShinyHunters have been responsible for dozens of data breaches involving billions of stolen records, and breaches claimed by the group stretch back to at least 2019. But experts say the people recently operating behind the ShinyHunters name are not the same core members that populated the group in its early days, most of whom are French citizens who have been arrested (if not also imprisoned) on at least one prior occasion for alleged cybercrime activity.

More to the point, ShinyHunters has become something of a franchise. Think the Dread Pirate Roberts character in the 1980s cult movie classic “The Princess Bride,” only succession by death is replaced with succession by arrest, and there can be multiple simultaneous Dread Pirate Robertses. Sources close to the investigation say the FBI is focusing on a remaining handful of cybercriminal freelancers or affiliates who have been feeding the group stolen credentials to various software-as-a-service (SaaS) platforms used by major companies in exchange for a cut of any data ransoms later paid by victims.

In the days after the news broke of Van der Stap’s arrest, a cybercrime-focused chat server on Telegram that was allegedly operated by Rey erupted with hot takes, with most participants heaping ridicule on the teenage hacker after he publicly backed down from threats against the FBI and Cl0p, and again when the ShinyHunters’s darknet website suddenly went offline. Several commentators accused Rey of resurrecting the ShinyHunters brand after its core members were rounded up in France, and making a mockery of the group’s name and reputation ever since.

“He bought the old forum PGP key and used it to make new Breachforum websites and Telegram channels larping as ShinyHunters to ransom companies and then sell the used data or resell his forum when he goes broke,” one member recounted.

A relatively new Telegram channel called “The Battle” has been doxing and needling Rey and other alleged ShinyHunters members for several weeks, and it has gained a considerable readership among the cybercrime communities operating on Telegram. One of the coordinators of that harassment campaign repeatedly portrayed Rey as clueless greenhorn who sought to ride the coattails of a cybercriminal brand that has long enjoyed a reputation for ruthlessly selling or publishing data stolen from victim companies who refuse to give in to extortion demands.

“Rey (Saif Al-Din Khader) made a serious mistake when he started pretending to be a member of ShinyHunters,” wrote the administrators of The Battle server on Telegram. “That group had already been dismantled, with many of its members either arrested or imprisoned, yet Rey still chose to use its name while carrying out his crimes. We’re aware of claims that [Rey] caused over $200 million in damages and helped around 5–6 friend groups in the community make money by using Shiny Hunters group aliases to negotiate deals for a 25–30% cut over the past few months.”

In an interview with The Register, ShinyHunters claimed they hacked the FBI to counter the agency’s narrative in a May 2026 alert that advised victims against paying a ransom to the group, which came off looking unprofessional and capricious in the FBI’s advisory.

The public notice warned the group has been known to pursue a number of different victim harassment strategies, from sending threatening text messages and phone calls to victims and their family members to in some cases swatting victims. The FBI warned ShinyHunters members “may also falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.”

The hackers told The Register their attack on the FBI “demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers.” At the same time, the group’s leaders seemed to acknowledge that the FBI’s warning materially harmed their prospects for convincing victims to pay, saying “this was fundamentally a public relations and marketing initiative for our business.”

The individual was detained in May and has been extradited to Germany to face hacking charges.

The post Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany appeared first on SecurityWeek.

FortiBleed, a credential compromise campaign targeting Fortinet firewalls and VPN gateways, is an ongoing threat that can lock users out of their Fortinet accounts and also lead to ransomware attacks, the FBI and Secret Service said in an alert published Tuesday.

“Affected organizations may find themselves locked out of their systems if threat actors disable accounts or change passwords, requiring remediation steps beyond standard patching and password resets,” the alert states. “In addition, the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates.”

When it was first uncovered earlier this year, SOCRadar verified more than 86,644 compromised devices across 194 countries. Ensar Seker, chief information security officer of the company, told CyberScoop that “in our later investigation, we identified more than 400,000 or 450,000 firewalls targeted by the wider operation.”

There are different aspects of the operation that make comparisons imprecise over time, but overall the numbers “show the campaign is broader and more serious than we understood at the beginning,” Seker said.

The attackers can disable accounts or change passwords to lock users out with the access they gain, making standard password resets and patching insufficient, the government alert reads.

The alert also warns that initial access brokers are making use of the FortiBleed attack to provide access to ransomware affiliates, including INC/Lynx and Payload.

The government warning provides additional confirmation about the most worrisome elements of FortiBleed, Seker said.

“What stands out for me is that FortiBleed is still an active threat, and attackers are using stolen credentials to access the exposed Fortinet devices, create new administration accounts, and in some cases, lock the real owners out,” he said. “The FBI and the Secret Service also confirm that the success can lead to ransomware attacks as well.” 

The FBI and Secret Service recommend that Fortinet customers restrict external management or remove internet administration entirely, reset credentials, set up multifactor authentication, review firewall and VPN users for unauthorized changes, review logs for potential lateral movement, and enable secure credential storage.

The agencies are seeking any information and indicators of compromise that organizations can share, including IP addresses and any usernames the attackers use.

The post Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks appeared first on CyberScoop.

Hackers stole patient information from Clover Health Investments and AngMar Management Services in July.

The post 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms appeared first on SecurityWeek.

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025.

The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek.

Europol published the results of Operation KillSwitch on the first day of October 2026, following a targeted action against the KillSec ransomware group. The day prior, law enforcement took control of the group’s leak site and also brought five central servers under police control.

Authorities arrested the alleged leader and two additional members of KillSec, a data extortion group primarily run by teenagers that successfully compromised about 500 organizations since 2024, Europol and the Justice Department said Thursday.

Investigators said the alleged leader of the group is 16 years old, but declined to name them. One of the group’s accused members, Fouad Eltibrizi, was arrested Wednesday in the United Kingdom and awaits extradition to the United States, the Justice Department said. 

The Dutch national, who is accused of acting as a negotiator for the group, was indicted last month in Puerto Rico and faces up to 10 years in prison for unauthorized computer access conspiracy. Europol said a suspected developer involved in the group committed multiple crimes before they turned 18 in August.

The arrests were part of “Operation KillSwitch,” a globally coordinated operation aided by 10 countries and private cybersecurity companies. Officials seized KillSec’s data-leak site and at least 110 terabytes of data, including information on the group’s criminal proceeds.

Law enforcement’s accumulated actions targeting KillSec’s infrastructure and people involved “imposed serious cost and degraded the adversary’s core capabilities,” the FBI’s Cyber Division said in a statement on X.

“We have undermined the group’s ability to rebuild, limited their operational reach and reduced the likelihood of future attacks,” the FBI added.

Europol said investigators gained control of domains and five central servers, including infrastructure the group used to manage its activities and store stolen data.

The cybercrime group, which was also known as Kill Security Ransomware Group, exploited various defects to intrude victims’ computers or cloud-based network infrastructure and steal sensitive data for extortion demands. Officials said the group obtained substantial ransom payments in some cases. 

Officials from the United States and Europe searched eight residences in Spain, Greece, the United Kingdom and Romania, and investigators are looking through evidence seized during those raids to identify other potential members of the group. 

Some of the group’s victims were identified by initials and the location and date of the attack in the indictment filed against Eltibrizi. This list includes I.D.O. in Puerto Rico in March 2025, U.S.B.L. in Washington state in March 2025 and A.A. in Louisiana in September 2025.

Three of those victims align with organizations that were listed on KillSec’s data-leak site for Instituto de Ojos, US BioTek Laboratories and Accelerated Academy. 

Prosecutors accuse Eltibrizi, who allegedly participated in the conspiracy from at least March through November 2025, of placing calls as a KillSec representative in at least one of those extortion demands. 

“The defendant and his co-conspirators carried out targeted intrusions against multiple companies and organizations, stealing highly sensitive information and attempting to extort their victims for substantial sums of money,” Héctor Ramírez‑Carbó, acting U.S. attorney for the District of Puerto Rico, said in a statement.

“Ransomware remains a serious and evolving threat to all sectors of our economy, from critical infrastructure to small businesses,” he added.

The post Authorities seize KillSec extortion group infrastructure, arrest 3 alleged members appeared first on CyberScoop.