The State Department will restrict visas for cybercriminals like scammers to sextortionists, and in some cases even their family members, Secretary of State Marco Rubio said Thursday.

The Trump administration has sought to make a crackdown on foreign-based scams one of the signature issues of his second term. An executive order that the president signed in March indicated that visa restrictions would be on the table as one response.

“By restricting visa issuance to those who are responsible for or complicit in these criminal enterprises, we are sending a clear message: The United States will go after those who prey on our citizens,” Rubio said.

Other departments have also made efforts to reduce foreign-run scams. In June, the Department of Justice seized infrastructure used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate tied to one of the world’s most prolific criminal marketplaces used to commit cyber scams and other crimes.

Rubio authorized the visa restrictions under a 1952 law that gives the State Department the ability to deport or rule as inadmissible someone who poses “potentially serious adverse foreign policy consequences.”

Critics have accused the Trump administration of abusing that provision of the law for political purposes.

Rubio’s statement on the visa restrictions mentions “individuals responsible for, or complicit in, cybercrime and cyber-enabled crime, such as those involved in cyberscams, and sextortion.”  Furthermore, he said, “Immediate family members of individuals engaged in such illicit activities may also be subjected to visa restrictions.”

Betsy Cooper, Founding Director of the Aspen Policy Academy, said the visa restrictions on cybercriminals could be valuable, but offered a caveat.

“Scamming people is a growing global enterprise, and it is a laudable goal to penalize those who scam and defraud people since they so rarely suffer consequences for their actions,” she said in a statement to CyberScoop. “So long as the new visa controls are used narrowly and deployed only against verified scammers and fraudsters, this is a positive step toward combatting cyber-enabled crime.”

While some cyber experts have questioned how much visa restrictions, prosecutions and other punishments of cyber miscreants who are based overseas will affect them, others maintain that it can serve as a deterrent to those who would consider getting into the line of work but want freedom to travel the globe.

FightCyberCrime.org, a nonprofit that seeks to help cybercrime victims, applauded the restrictions on the cybercriminals.

“We welcome efforts to hold cybercriminals accountable across borders. Cryptocurrency investment scams, romance scams, and sextortion cause devastating financial and emotional harm to victims,” it said in a statement to CyberScoop. “Meaningful disruption of these transnational criminal networks is an essential part of the response.”

But there’s still a long way to go in the fight, the statement continued.

“At the same time, we must invest more in victim support, prevention, and recovery resources,” the organization said. “Accountability is critical, but ensuring victims have access to trauma-informed support and resources is equally important.”

The post Rubio restricts visas for sextortionists, cyber scammers appeared first on CyberScoop.

Authorities arrested more than 5,800 alleged cybercriminals and seized $293 million in a global operation targeting social-engineering scams and money laundering across 97 countries, Interpol said Thursday.

The anti-fraud crackdown, dubbed Operation First Light, identified more than 142,000 victims, including people, businesses and governments, officials said. 

“Social engineering scams continue to pose a significant threat to our society. Criminal syndicates exploit human psychology to manipulate their targets, and no nation can stay safe unless all countries are equipped and committed to jointly fighting back,” Tomonobu Kaya, director of Interpol’s Financial Crime and Anti-Corruption Centre, said in a statement.

Police identified more than 15,500 cybercrime suspects during the operation, which spanned more than three months ending in late April, according to Interpol. Officials also analyzed more than 152,800 cases of cybercrime, including business email compromise, sextortion, romance scams, impersonation and investment schemes. 

Interpol said nearly 24,000 cases of cybercrime were solved and investigators blocked more than 31,000 bank accounts linked to malicious activity during the crackdown.

Authorities involved in the globally coordinated operation seized a high volume of devices and other equipment used to allegedly facilitate cybercrime. 

In Eswatini, police seized a replica of a Brazilian police station, including fake uniforms, signage and equipment that cybercriminals allegedly used to deceive targets into thinking they were victims of a crime, duping them into transferring funds.

While uncovering a romance scam money laundering operation in Thailand, investigators identified a 20-year-old suspect that allegedly processed more than $122.5 million in 10 months, according to Interpol. Officials in Palau identified and deported 22 people allegedly involved in a pair of scam centers operating from hotels.

“Interpol is dedicated to supporting member countries in building a comprehensive, coordinated strategy to tackle cyber-enabled financial crimes, organized criminal networks and the money laundering that fuels them,” Kaya said.

The post Interpol cybercrime crackdown nets 5,800 arrests across 97 countries appeared first on CyberScoop.

A San Antonio man who sexually exploited children while leading 8884, an offshoot of the notorious violent extremist collective 764, was sentenced to 40 years in prison in federal court Wednesday, the Justice Department said. 

Alexis Aldair Chavez began associating with 764 as a child in 2022 when a co-conspirator introduced him to 7997, one of many 764 offshoots affiliated with the Com. The sprawling nihilistic network of thousands of people, typically between 11 and 25 years old, seek to foster social unrest by destroying civilized society through the corruption and exploitation of children and other vulnerable populations.

The 19-year-old, also known as “Zack” and “Zack8884,” attempted to coerce a girl to commit suicide and blackmailed another girl into self-mutiliation, animal torture and illicit content production in late 2023, according to court records. He later worked with multiple co-conspirators and blackmailed some of his victims to coerce other girls to degrade themselves on camera and produce child sexual abuse material (CSAM).

Chavez was arrested and has been detained without bail since October 2024. He pleaded guilty to multiple crimes involving the sexual exploitation of children in December 2025 and faced up to 60 years in prison for racketeering, distribution and possession of CSAM.

“Chavez’s crimes reveal the ruthless exploitation and manipulation at the core of nihilistic violent extremist groups,” John A. Eisenberg, assistant attorney general for national security, said in a statement. 

“These organizations target children as part of their broader mission to spread terror. These groups ultimately seek nothing less than the destruction of our society,” he added. “The National Security Division will use every resource at its disposal to identify and prosecute 764-linked criminality and to protect the most innocent among us from these predators.”

The indictment filed against Chavez in the U.S. District Court for the Western District of Texas details a series of horrifying crimes he committed with co-conspirators and some of his victims. 

Prosecutors said Chavez and a co-conspirator coerced a girl to cut her tongue, and torture and kill a cat on a live video call in late 2023. He and co-conspirators also, that same month, groomed and extorted several other girls to commit self harm and degrade themselves on camera.

Allison Nixon, chief research officer at Unit 221B, told CyberScoop the sentence is appropriate even if people understandably dislike imprisoning young people. 

“In this space, a certain personality profile is highly predictive of who will risk a prison sentence like this: an obsession with maximizing harm,” she said. 

“Reoffending after release is a huge problem. All major global hacking incidents from the Com are done by serial reoffenders — all obsessed with harmfulness, some graduated from the 764 sextortion space,” Nixon added.

Too many jurisdictions are naive in how they handle cases involving members or associates of the Com, allowing these criminals to go home to parents who won’t supervise them, she said.

Officials pressed on this in their reaction to Chavez’s sentencing as well. “Parents need to know what their children are doing online and must stay engaged, ask difficult questions, and not fall into the trap of believing their child is ‘just playing games’ or ‘just talking with their friends,’” Justin R. Simmons, U.S. attorney for the Western District of Texas, said in a statement. 

“There is darkness present within many people in this world that want nothing more than to see the United States and western civilization fail. There is no limit to the actions these individuals will take to accomplish that goal, including torturing and abusing children,” Simmons added.

Chavez, who was also ordered to pay $10,000 in restitution and serve lifetime supervised release, joins other 764 members already serving long sentences for similar crimes. Bradley Chance Cadenhed, who founded 764 as a 15-year-old in 2021, was arrested later that year and sentenced to 80 years in prison in 2023. 

When the FBI executed a search warrant at Chavez’s residence in July 2024, prosecutors said he came out the backdoor and threw his phone over a neighbor’s fence in an attempt to hide evidence.

Chavez’s sentencing follows a period of heightened law enforcement activity, which has netted arrests of multiple alleged 764 leaders and members. Some of the alleged 764 members arrested since 2025  include: Leonidas Varagiannis and Prasan Nepal, Baron Cain Martin, Tony Christopher Long, Erik Lee Madison, Zachary Sweeney and Aaron Corey. 

“True rehabilitation is the best outcome, but no one knows how,” Nixon said. 

“The total number of offenders who fit this harm-obsessed profile is vanishingly small. Giving them maximum sentences won’t overflow jails,” she added. 

Law enforcement and judges have to be realistic about what it takes to prevent the victimization of children, and handing down lifelong or lengthy prison sentences strikes the right balance between the rights of the offender and society, Nixon said.

FBI officials and agents who track these offenders and gather evidence on their crimes draw similar conclusions. 

“Nothing is more abhorrent than those who prey on children and other vulnerable members of our society and this defendant will pay a steep price for doing just that,” Coult Markovsky, acting assistant director of the FBI’s counterterrorism division, said in a statement.

“This sentencing demonstrates the FBI’s unwavering resolve to identify, hunt down, investigate, and prosecute criminals like Chavez who prey on children through violent online networks, including 764, and orchestrate horrific, unspeakable acts of exploitation and violence,” Daniel Faith, special agent in charge of the FBI San Antonio field office, said in a statement. 

“These predators use social media, messaging apps, gaming platforms, chat rooms, and video services to groom vulnerable children,” Faith added. “Staying engaged in your child’s online life, maintaining open communication, recognizing the warning signs, and reporting suspicious online activity to law enforcement are critical to stopping these offenders.”

The post 764 splinter group leader sentenced to 40 years in jail appeared first on CyberScoop.

A Tennessee man accused of abusing and sexually exploiting children while actively participating in 764, a sprawling online nihilistic violent extremist collective affiliated with The Com, pleaded not guilty Thursday to a series of charges that could keep him locked up for 50 years.

Zachary Sweeney has allegedly victimized multiple children, on numerous occasions grooming and coercing minors to produce child sexual abuse material that he distributed and sometimes sold, the Justice Department said. One of the 30-year-old’s alleged victims later died of an overdose.

Sweeney has been the subject of multiple FBI investigations, which uncovered extensive crimes against children dating back to at least 2022, prosecutors said. His alleged involvement in 764 and, by extension, The Com, underscores the growing, multi-faceted threat of physical violence, cybercrime, extortion and the pursuit of criminal underground notoriety posed by thousands of members typically between 11 and 25 years old.

Victims of these crimes are often young, vulnerable and degraded or traumatized for years with life-altering impact.

“Violent extremists who victimize vulnerable children online are among the worst predators in our community and across the country,” Braden Boucek, U.S. attorney for the Middle District of Tennessee, said in a statement.

Members of 764 and related groups commit crimes in the United States and engage with other extremists globally to foment social unrest and destroy civilized society through the corruption and exploitation of vulnerable people, the Justice Department said.

Police arrested Sweeney Thursday and charged him with three counts of sexual exploitation and attempted sexual exploitation of a minor and three counts of receiving visual depictions of CSAM. Prosecutors said they intend to request Sweeney remain detained at his next court appearance June 3. 

Sweeney allegedly traveled to New York, Indiana, Missouri and Georgia to meet numerous victims in person. Officials received reports from some of his alleged victims and online platforms, triggering FBI interviews with some of his alleged victims as early as 2023. 

One of his alleged victims, who began interacting with Sweeney when she was a teenager, told investigators she degraded herself and participated in virtual self-harm group video calls with a group of people she described as friends of his in The Com. Sweeney alleged raped her and streamed the crime online. 

She died of an overdose in 2024, approximately ten days after FBI agents interviewed her. 

Sweeney allegedly drugged and raped other victims and shared videos of those acts online, according to court records.

The FBI searched Sweeney’s residence in St. Louis in September 2023, more than two months after Meta sent a pair of tips to the National Center for Missing and Exploited Children that linked him to Instagram chats containing CSAM.

Agents seized devices containing evidence of 99 possible CSAM images and videos, but encryption and passwords prevented authorities from conducting further examination, according to court records.

Sweeney moved to Tennessee in the summer of 2024 and allegedly continued to travel out of state to meet victims in person and coerce other victims to produce CSAM through at least the summer of 2025.

Authorities accuse Sweeney of boasting about his crimes and sharing blackmail material, sexual assault and CSAM depicting underage female victims.

Authorities have arrested multiple members of 764 during the past year, reflecting heightened law enforcement activity targeting the violent extremist collective and other offshoots affiliated with The Com.

Two alleged leaders of 764, Leonidas Varagiannis and Prasan Nepal, were arrested and charged for directing and distributing CSAM in April. Alexis Aldair Chavez, of San Antonio, pleaded guilty in December to multiple crimes involving the sexual exploitation of children while acting as an administrator and leader of 8884, a splinter group of 764.

“This operation puts every child predator on notice: the FBI will hunt you down and bring you to justice,” Terence Reilly, special agent in charge of the FBI Nashville Field Office, said in a statement. “Removing violent extremists from our streets protects our most innocent and vulnerable members of society.”

You can read the indictment below.

The post Tennessee man linked to 764 accused of series of crimes against children dating back to 2022 appeared first on CyberScoop.

A prolific data ransom gang that calls itself Scattered Lapsus ShinyHunters (SLSH) has a distinctive playbook when it seeks to extort payment from victim firms: Harassing, threatening and even swatting executives and their families, all while notifying journalists and regulators about the extent of the intrusion. Some victims reportedly are paying — perhaps as much to contain the stolen data as to stop the escalating personal attacks. But a top SLSH expert warns that engaging at all beyond a “We’re not paying” response only encourages further harassment, noting that the group’s fractious and unreliable history means the only winning move is not to pay.

Unlike traditional, highly regimented Russia-based ransomware affiliate groups, SLSH is an unruly and somewhat fluid English-language extortion gang that appears uninterested in building a reputation of consistent behavior whereby victims might have some measure of confidence that the criminals will keep their word if paid.

That’s according to Allison Nixon, director of research at the New York City based security consultancy Unit 221B. Nixon has been closely tracking the criminal group and individual members as they bounce between various Telegram channels used to extort and harass victims, and she said SLSH differs from traditional data ransom groups in other important ways that argue against trusting them to do anything they say they’ll do — such as destroying stolen data.

Like SLSH, many traditional Russian ransomware groups have employed high-pressure tactics to force payment in exchange for a decryption key and/or a promise to delete stolen data, such as publishing a dark web shaming blog with samples of stolen data next to a countdown clock, or notifying journalists and board members of the victim company. But Nixon said the extortion from SLSH quickly escalates way beyond that — to threats of physical violence against executives and their families, DDoS attacks on the victim’s website, and repeated email-flooding campaigns.

SLSH is known for breaking into companies by phishing employees over the phone, and using the purloined access to steal sensitive internal data. In a January 30 blog post, Google’s security forensics firm Mandiant said SLSH’s most recent extortion attacks stem from incidents spanning early to mid-January 2026, when SLSH members pretended to be IT staff and called employees at targeted victim organizations claiming that the company was updating MFA settings.

“The threat actor directed the employees to victim-branded credential harvesting sites to capture their SSO credentials and MFA codes, and then registered their own device for MFA,” the blog post explained.

Victims often first learn of the breach when their brand name is uttered on whatever ephemeral new public Telegram group chat SLSH is using to threaten, extort and harass their prey. According to Nixon, the coordinated harassment on the SLSH Telegram channels is part of a well-orchestrated strategy to overwhelm the victim organization by manufacturing humiliation that pushes them over the threshold to pay.

Nixon said multiple executives at targeted organizations have been subject to “swatting” attacks, wherein SLSH communicated a phony bomb threat or hostage situation at the target’s address in the hopes of eliciting a heavily armed police response at their home or place of work.

“A big part of what they’re doing to victims is the psychological aspect of it, like harassing executives’ kids and threatening the board of the company,” Nixon told KrebsOnSecurity. “And while these victims are getting extortion demands, they’re simultaneously getting outreach from media outlets saying, ‘Hey, do you have any comments on the bad things we’re going to write about you.”

In a blog post today, Unit 221B argues that no one should negotiate with SLSH because the group has demonstrated a willingness to extort victims based on promises that it has no intention to keep. Nixon points out that all of SLSH’s known members hail from The Com, shorthand for a constellation of cybercrime-focused Discord and Telegram communities which serve as a kind of distributed social network that facilitates instant collaboration.

Nixon said Com-based extortion groups tend to instigate feuds and drama between group members, leading to lying, betrayals, credibility destroying behavior, backstabbing, and sabotaging each other.

“With this type of ongoing dysfunction, often compounding by substance abuse, these threat actors often aren’t able to act with the core goal in mind of completing a successful, strategic ransom operation,” Nixon wrote. “They continually lose control with outbursts that put their strategy and operational security at risk, which severely limits their ability to build a professional, scalable, and sophisticated criminal organization network for continued successful ransoms – unlike other, more tenured and professional criminal organizations focused on ransomware alone.”

Intrusions from established ransomware groups typically center around encryption/decryption malware that mostly stays on the affected machine. In contrast, Nixon said, ransom from a Com group is often structured the same as violent sextortion schemes against minors, wherein members of The Com will steal damaging information, threaten to release it, and “promise” to delete it if the victim complies without any guarantee or technical proof point that they will keep their word. She writes:

A key component of SLSH’s efforts to convince victims to pay, Nixon said, involves manipulating the media into hyping the threat posed by this group. This approach also borrows a page from the playbook of sextortion attacks, she said, which encourages predators to keep targets continuously engaged and worrying about the consequences of non-compliance.

“On days where SLSH had no substantial criminal ‘win’ to announce, they focused on announcing death threats and harassment to keep law enforcement, journalists, and cybercrime industry professionals focused on this group,” she said.

Nixon knows a thing or two about being threatened by SLSH: For the past several months, the group’s Telegram channels have been replete with threats of physical violence against her, against Yours Truly, and against other security researchers. These threats, she said, are just another way the group seeks to generate media attention and achieve a veneer of credibility, but they are useful as indicators of compromise because SLSH members tend to name drop and malign security researchers even in their communications with victims.

“Watch for the following behaviors in their communications to you or their public statements,” Unit 221B’s advisory reads. “Repeated abusive mentions of Allison Nixon (or “A.N”), Unit 221B, or cybersecurity journalists—especially Brian Krebs—or any other cybersecurity employee, or cybersecurity company. Any threats to kill, or commit terrorism, or violence against internal employees, cybersecurity employees, investigators, and journalists.”

Unit 221B says that while the pressure campaign during an extortion attempt may be traumatizing to employees, executives, and their family members, entering into drawn-out negotiations with SLSH incentivizes the group to increase the level of harm and risk, which could include the physical safety of employees and their families.

“The breached data will never go back to the way it was, but we can assure you that the harassment will end,” Nixon said. “So, your decision to pay should be a separate issue from the harassment. We believe that when you separate these issues, you will objectively see that the best course of action to protect your interests, in both the short and long term, is to refuse payment.”