Three men concocted an elaborate, yearslong scheme that defrauded companies of at least $129 million by using AI to impersonate executives and lawyers, tricking targeted victims into transferring large payments to criminal-controlled accounts, the Justice Department said Thursday.

Jacob Soall, Sharon Hazan and Guy Sheetrit allegedly used AI to impersonate the voices and images of chief executive officers at companies and lawyers at major international law firms. The trio are accused of targeting thousands of victims between July 2024 and February 2026, according to court records.

Victims include a U.K.-based financial tech company that lost almost $11.6 million, a Florida-based pet food company that lost $5.2 million, a Missouri-based hospital system that lost $4.8 million, a Massachusetts-based mutual fund company that lost $4.6 million, a California-based hospital system that lost nearly $3 million, a New York-based investment company duped out of $2.8 million, and a Rhode Island-based bank that transferred nearly $2.7 million.

The trio’s scheme typically started by targeting accounting staff, pretending to be the CEO, and requesting help on a financial transaction, officials said. Using AI to create deepfakes pretending to be CEOs, the crew allegedly directed employees to contact attorneys who they would also impersonate to trick the employee into thinking the financial transaction was legitimate.

Prosecutors said the men and their co-conspirators identified and targeted employees who had sufficient authority to authorize large wire transfers. 

The scheme typically began with an email from an e-signature company, wherein the impersonated CEO claimed they were working on a “confidential financial transaction” that required the victim employee to sign a non-disclosure agreement before contacting the purported attorney at a victim law firm, according to an unsealed indictment.

Soall, Hazan, Sheetrit and their co-conspirators allegedly impersonated attorneys at some of the 50 largest law firms globally. 

“Super intelligence technology offers tremendous potential, but the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

Prosecutors said the wire transfers were sent to bank accounts controlled by co-conspirators around the world, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. The crew allegedly converted the funds to cryptocurrency and distributed the illicit proceeds amongst themselves and their co-conspirators.

Soall, a 41-year-old from Marbella, Spain, was arrested in Spain on June 17. He allegedly primarily impersonated attorneys from the United Kingdom, reading from a handwritten script designed to dupe targeted victims.

Hazan, a 54-year-old from Israel, was arrested in Spain on Aug. 5. He allegedly boasted that he had been laundering money since 1994, including more than $400 million in the past three years, and was previously convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008.

Sheetrit, a 42-year-old from Israel and the United Arab Emirates, was arrested in the United Kingdom on Sept. 7 and allegedly laundered funds from the scheme.

The trio are charged with conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The seven counts carry a maximum sentence of 104 years in prison.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” James C. Barnacle Jr., assistant director in charge of the FBI New York field office, said in a statement.

“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”

After initial publication of this story, Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, emailed a statement to CyberScoop saying their client “has no connection to this matter and has had no involvement in it whatsoever.”

“Mr. Sheetrit is a businessman with extensive expertise and professional experience in cybersecurity and technology,” wrote Nahari and Shorer. “In the course of his work, he provides professional advisory services to a range of clients. Working in cybersecurity, possessing specialist expertise or providing advisory services cannot, in themselves, establish complicity in or involvement in the alleged conduct.”

“Our client maintains his complete innocence and, like everyone else, is entitled to the presumption of innocence,” the statement continued. “We are confident that, once the facts have been established and the evidence fully examined, it will become clear that there is no basis for holding him criminally responsible.”

UPDATE: Nov. 6, 2026; 8:25 p.m.: This story has been updated to include a statement from attorneys representing Guy Sheetrit.

The post Authorities accuse trio of using AI deepfakes to defraud $129M from businesses appeared first on CyberScoop.

Two Canadian men broke into the networks of multiple U.S. universities, stole credentials and implanted malware on compromised computers to commandeer processing power for a cryptocurrency mining operation, the Justice Department said.

Ryan James Roach and Mathiew James Stubbings allegedly compromised the networks of at least four universities in New York, Tennessee, North Carolina and Massachusetts between mid 2016 and late 2019, according to an unsealed indictment. 

Roach, a 35-year-old from Saskatchewan, Canada, was extradited to the United States on Oct. 28 and arraigned Tuesday in the U.S. District Court for the Western District of New York. Prosecutors said they are still seeking the extradition of Stubbings, a 41-year-old from Ontario, Canada.

A grand jury previously indicted the Canadian nationals in April 2022. The men are charged with multiple cybercrimes and face up to 10 years in prison and up to a $250,000 fine, if convicted.

Prosecutors accuse the men of researching and identifying potential victims with supercomputers containing vulnerabilities they could exploit. The men breached networks and deployed malware on compromised machines to take over systems, officials said. 

Roach and Stubbings allegedly rented virtual private servers based in Europe and the United States under false identities to conceal traffic, deploy rootkits, steal credentials and data, and transmit cryptocurrency mining software to compromised computers.

“The defendants caused at least one supercomputer to mine cryptocurrency on their behalf, which caused much of the supercomputer’s processing speed and power to become unavailable to its legitimate owner,” prosecutors wrote in the indictment.

Officials didn’t say how much cryptocurrency the pair allegedly mined for financial gain as part of the conspiracy.

If convicted, Roach and Stubbings are also ordered to forfeit an assortment of networking and data storage devices, and any property or proceeds obtained through the alleged crime spree.

The post Officials extradite Canadian man to US for alleged cryptomining spree appeared first on CyberScoop.

Authorities arrested seven people allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, Europol said Tuesday. Officials said the operation caused estimated losses of at least $4.5 million. 

The takedown effort involved searches across 17 countries Tuesday and netted the seizure of more than 100 servers, according to Europol.

Officials targeted the scheme run by a company that allegedly provided cybercrime groups a series of trading websites and an assortment of call centers tasked with tricking victims into transferring their savings. 

The company, operated from Cyprus and Israel, was linked to call centers in Albania, Kosovo and North Macedonia, officials said. 

“The scheme promised substantial, quick returns from trading in cryptocurrencies, foreign currencies or stocks,” Europol wrote in a news release. “Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more.”

The investment scam’s operators used affiliate marketing to target potential victims with advertisements that led them to fraudulent investment platforms. Cybercrime groups running the call centers purchased data collected through those ads to contact potential victims, officials said.

Operators duped victims by displaying fictitious profits and pressured victims to transfer large sums of money. “When victims asked to withdraw their money, the operators used delaying tactics to block payments. Eventually, contact ceased, leaving victims unable to recover their funds,” Europol wrote. 

Authorities were tipped off to the investment scam in 2022 when a German couple reported they couldn’t withdraw funds invested in an online trading platform. Authorities arrested two people allegedly involved in the scheme that year and seized evidence that eventually led to further arrests and seizures in 2025.

The joint investigation and takedown effort was supported by officials in Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia and Poland. The seven people arrested Tuesday, who were not identified, are facing extradition to Germany to face charges, Europol said.

The post Europol dismantles investment scheme that impacted potential victims in 50 countries appeared first on CyberScoop.

Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday. 

Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold. Those backdoors established XCPE, an expansive botnet that cybercriminals used to conduct ad fraud, steal data and route malicious traffic through residential proxy networks, according to a Google Threat Intelligence Group report.

Google took legal action to shut down the domains and servers Videostrong used to control the botnet. The company also took down command-and-control domains that more than a dozen malware families ran as modules through the XCPE backdoor, claiming it disrupted access to at least 10 million additional compromised devices from various manufacturers.

Videostrong sold Android devices with pre-installed malware for years, slipping by Google’s security tests by loading the malicious code after the device’s first boot. “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder, head of disruption operations at GTIG, told CyberScoop.

Snyder declined to say when or how Google first became aware of the approved vendor running a botnet on Android-powered devices. 

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google researchers wrote in the report. “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”

Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activities in the future. Yet, Snyder said the company isn’t sharing specifics on these changes because it doesn’t want to provide threat actors insights that might help them circumvent these additional protections.

Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs. 

“Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors,” researchers wrote in the report. “This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices.”

The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers. Nearly 44,000 infected devices were based in the United States between June and October.

Google also partnered with Japan’s National Police Agency, Lumen Technologies, Human Security, Plume and Synthient to study and disrupt the botnet. 

The company said the dismantling of XCPE “seriously impacted over a dozen malicious actors,” yet it warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.

The post Google shuts down global botnet running on certified Android devices appeared first on CyberScoop.

A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike. 

The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a threat report Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines. 

CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion. 

Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently. 

“This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop.

Hands-on-keyboard activity tracked by CrowdStrike for the past 15 years typically involved up to 40 commands per hour. “Now, with ARTEX, we could see it exceed 1,500 commands an hour,” Meyers said.

“If you diversify that across 200 targets, it costs them very little to run a mass-exploitation campaign and drop a websell,” he added. “They can hit more targets in a faster period of time.”

Vapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy.

“I would characterize it as a diverse operational mission that tends to focus on sectors and geographies that Beijing considers economically or politically important,” Meyers said.

The active campaign attributed to Vapor Panda is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, including a supply-chain attack targeting ConnectWise customers. 

Adversarial use of AI is relatively new, yet also quickly becoming the new normal, Meyers said. “We’re scrambling because we’re seeing so many of these agentic adversaries.”

Agentic AI use for malicious purposes is growing month-over-month at a rate of almost threefold. CrowdStrike observed roughly 45 agentic adversary attacks in September and it’s already at 126 for October, and climbing.

Adversarial use of agentic AI isn’t an intractable problem, but rather another reminder that organizations need visibility into their endpoints, identities and cross-domain capabilities, Meyers said. 

These attacks aren’t showcasing anything new, “it’s just doing it at a speed and scale that we’re unaccustomed to,” he said. “It’s not hopeless, but you’ve got to take action. You can’t put your head in the sand.”

The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.

A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 

John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.

The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.

The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.

His identity was also used to gain employment as a software engineer at a Ventura, California-based company to work on a generative AI project for a component of the U.S. military. The company sent a laptop to Kurrle’s residence in Gainesville, Virginia, where he received and hosted laptops shipped by multiple victim companies, enabling co-conspirators to remotely access the devices from outside the United States.

Yet, during a video call to verify employment eligibility, the company noticed that the person who appeared on the video call did not match Kurrle’s age or physical characteristics, according to court records. The unnamed company terminated the employment of Kurrle’s co-conspirator before he did any work on the military contract and Kurrle shipped the laptop back to the company. 

The company paid Kurrle’s co-conspirator almost $2,200 for 32 hours of onboarding, which Kurrle is now ordered to pay in restitution along with the $4,800 received from the other company. 

Kurrle also, as part of his plea agreement, admitted to using the identity of a third person, without their consent, to apply for some remote work positions. He doesn’t dispute that the scheme likely benefitted North Korea, but claims he wasn’t aware of the connections to North Korea during the duration of his involvement in the conspiracy.

Michael Barnhart, nation state investigator at DTEX, said researchers previously identified Kurrle as a facilitator for North Korea’s remote worker scheme. Yet, until recently, he wasn’t sure if Kurrle was a victim or impersonated. 

The case underscores North Korea’s efforts to gain access to roles with a strategic intelligence requirement, as it focuses on contractor roles because those present the path of least resistance.

Kurrle joins a growing list of people who have been charged or jailed for supporting the North Korea regime’s scheme that generates hundreds of millions of dollars annually for the country’s military and organizations involved in its weapons programs.

Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting U.S.-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives. 

Some of that money is also funneling through a web of front companies and intermediaries, including sanctioned entities, that partly fund Russia’s war effort against Ukraine, DTEX said in a report in July. This includes manufacturing weapons and supplying them to Russia’s military, according to the security firm.

The countermeasures are stacking up, but the scheme is widespread and has infiltrated an undetermined number of businesses, including hundreds of Fortune 500 companies.

Federal judges previously sentenced other people to prison for their involvement in the scheme, including Matthew Issac Knoot and Erick Ntekereze Prince; Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar and Alexander Paul Travis; Oleksandr Didenko and Christina Chapman. 

Kurrle pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison upon sentencing, which is currently scheduled for Jan. 28, 2027.

The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.

Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

“Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

“Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

The post Officials seize domain of top bulletproof hosting provider Virtualine appeared first on CyberScoop.

Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report.

The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023. 

The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said. 

“Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”

Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.

“The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who also was the lead researcher on the report.

The nation-state group’s investment in operational security and preserving access is remarkable, according to Black Lotus Labs.

“We observed infrastructure assembled in under two minutes, sessions averaging roughly four hours, extensive cleanup, compartmentalization and continued development of new access vectors,” Horka said. “That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace.”

Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, researchers said. Earlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.

The reach of those efforts is extensive and ongoing. Volt Typhoon has exploited and abused more than 27 device classes in Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies. 

“The diversity matters, but the discipline matters even more,” Horka said. “Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities.”

The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said. Black Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. 

“The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” Black Lotus Labs researchers wrote in the report. “Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”

Silent Train’s ephemerality and operational discipline means it can’t be measured in size. These attributes also make it “fundamentally difficult to disrupt because there isn’t one network to take down,” Horka said. 

“What exists today will be completely different tomorrow,” he added. “You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve.”

The post Researchers uncover Volt Typhoon’s covert, ephemeral network appeared first on CyberScoop.

A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.

Artem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms. He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Stryzhak pleaded guilty to multiple cybercrimes in late 2025. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.

Attacks involving Nefilim ransomware caused millions of dollars in losses from extortion payments and damage to victim networks, officials said. Stryzhak and his co-conspirators allegedly customized executable ransomware files for each victim, creating unique decryption keys and unique ransom notes.

The ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data. The crew researched companies after it broke into their networks to determine their net worth, size and contact information.

Stryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri and an international eyewear company. 

Stryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said. 

Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”

The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.

Alarm bells ratcheted up yet again about an AI-discovered vulnerability that could — if exploited in the wild — destabilize vast stretches of the internet. 

The critical defect — CVE-2026-111497 — affects the Google-developed Brotli decompression library that’s bundled into many components, applications and cloud services riding on open-source software. The buffer overflow vulnerability, which OpenAI Codex Security discovered and Node.js disclosed in a Oct. 21 security advisory, can trigger system crashes and remote code execution. 

Researchers haven’t observed any active exploitation of the defect in real networks, but concerns are mounting. Multiple vendors and software packages, including Microsoft and Python, that rely on vulnerable versions of Brotli have rushed emergency patches out to address the risk of exploitation in their respective systems.

Wiz researchers warned that “91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances.”

The attack surface is “extremely broad and vast, but much of the impact of exploitation depends entirely on its implementation and how it is used within that piece of software,” said Jake Knott, head of threat intelligence at watchTowr.

Christiaan Beek, vice president at Rapid7 Intelligence, said the Brotli vulnerability is especially concerning because it’s effectively hiding out in the open, as are many open-source software libraries.

“Most businesses have no idea how deeply components like Brotli are embedded in their technology. A vulnerability in a compression library sounds almost boring until you realize it could affect applications your business depends on every day,” he said. “That’s the uncomfortable reality of modern software: a small component can create a very large business risk.”

The defect, dubbed “Node2Shell” or “Broccoli2Shell,” is the latest in a series of vulnerabilities that have provoked an emergency response. Defenders and researchers were on heightened alert last week over a pair of critical PHP vulnerabilities dubbed “PHP2Shell” that also have yet to be exploited in the wild as of Monday afternoon.

These cyclical and increasingly recurring so-called emergencies are putting organizations and defenders at a significant disadvantage. 

“After being part of numerous channels and message threads full of defenders trying to discern what’s real and what’s BS over the past several months — and especially the past week — I can say unequivocally that the human cost of these events is real, pronounced, and will have downstream impacts far beyond what the community can immediately predict,” Caitlin Condon, vice president of research at VulnCheck, told CyberScoop.

“None of this — high-profile vulnerability disclosures, the overblown exploitability assumptions, the community arguments, the race to weaponize — is new,” she added. 

“What’s changed now is that AI is pumping out complex — and often not clearly explained — finds at a much higher rate, exponentially increasing noise levels and making it much more difficult both to debunk overhyped vulnerability discoveries and to determine which vulnerabilities are broadly exploitable in real-world production configurations.” 

Researchers acknowledge the additional stress defenders and organizations are in because of this always-in-emergency mode.

“We’ve reached a point where everything seems to be an emergency. And when everything is critical, businesses risk losing sight of what actually matters,” Beek said. “The real cost isn’t just patching. It’s the constant disruption to operations, the diversion of resources, and the difficult decisions about which business systems deserve immediate attention.”

Experts also consider this the new normal as more high-impact vulnerabilities with far-reaching potential consequences are found. 

“We suspect in the very near future, defenders may lose the ability to tell what is a true emergency versus a loud and prevalent vulnerability in a ubiquitous product or library,” Knott said. 

Experts advise organizations to focus on their specific risk, weighing the Brotli vulnerability’s potential impact in their environment. 

“Attackers don’t care about CVSS scores,” Beek said. “They care about what they can compromise, disrupt, or monetize and that’s exactly how we should prioritize our defenses.”

The post Experts temper emergency-level alarms over critical Brotli defect appeared first on CyberScoop.

A 44-year-old Chinese national was extradited to the United States and arraigned in federal court for his alleged involvement in a sweeping investment scam network that tricked at least 174 U.S. residents out of nearly $37 million, the Justice Department said Friday. 

Zheng Zhao was extradited from the Netherlands to the United States to face a conspiracy to commit money laundering charge that could keep him in prison for 20 years. 

Prosecutors accuse Zhao and his co-conspirators of operating a global cryptocurrency investment scheme out of multiple countries, including scam centers in Cambodia. 

The cybercrime ring allegedly reached out to U.S.-based victims proactively via social media, phone calls, text messages and online dating sites to establish a deceitful relationship and build trust. Eventually, Zhao and his co-conspirators promoted cryptocurrency investments to the victims and directed them to send funds through fake sites that resembled legitimate trading platforms.

Victims were told their investments were growing in value, yet they were already transferred from U.S. bank accounts controlled by the co-conspirators to an account at Deltec Bank in the Bahamas, officials said. The crew allegedly converted the victim funds to Tether before transferring the assets to a digital wallet controlled in Cambodia.

The stolen funds were ultimately distributed to leaders of scam networks throughout the region, officials said.

Eight of Zhao’s co-conspirators previously pleaded guilty participating in the investment scam conspiracy, including Shengsheng He and Jingliang Su, who were sentenced to 51 months and 46 months in prison, respectively. 

Joseph Wong, a co-conspirator living in California, managed a network of money launderers in Los Angeles who registered shell companies, opened U.S. bank accounts and transferred stolen victim funds to international bank accounts.

“This case should serve as a warning to scammers in every corner of the world: there is nowhere to hide,” Todd Bratz, special agent in charge of the U.S. Secret Service Criminal Investigation Division, said in a statement. “Secret Service investigators and our law enforcement partners remain unwavering in their commitment to identify those who operate scam centers, disrupt their financial infrastructure and bring them to justice.”

The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.

Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.

“As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog post Wednesday. 

The nation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. 

Storm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service. During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.

During that short campaign, Microsoft observed more than 151,000 failed logon attempts, peaking at 2,900 failures per minute. Storm-0940 set its sights on ConnectWise the next day, using AI agents and the same malicious infrastructure to compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 environments. 

Storm-0940 gained significant advantages in the ConnectWise supply-chain campaign by using ARTEX to accelerate scanning, conduct password-spray attacks and abuse OAuth applications in downstream victims, according to Microsoft. 

“In some of these environments, the AI agents (on behalf of the threat actor) progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles,” researchers wrote. “Microsoft identified multiple customer environments with evidence of follow-on activity, highlighting how a compromised third-party application with high privileges could provide access beyond its originally intended purpose.”

Microsoft Threat Intelligence said multiple threat actors from various regions are using ARTEX to strengthen capabilities and speed up the tempo of attacks. 

The open-source penetration testing framework works with any AI model to automate various offensive security workflows, the company said. “ARTEX is a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.”

In the ConnectWise campaign, Microsoft said “Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace that leaves defenders with little time to detect and respond.”

Microsoft did not say how many customers were compromised, adding that successful authentication doesn’t necessarily indicate Storm-0940 accessed or stole data. Yet, researchers said the threat group’s AI agents could also gain persistent access and establish backdoors by modifying credentials in targeted victims’ environments. 

ConnectWise, which temporarily shut down services Saturday in the wake of the attacks, said it began restoring services in phases Wednesday. The company advised customers to keep connections disabled and said it expects the recovery process to take several days.

“Since early October, a wave of AI-driven cyberattacks has been ongoing,” Igor Tsyganskiy, executive vice president at Microsoft, wrote in a LinkedIn post Wednesday. The ConnectWise supply-chain attack is just “one of many,” he added.

The post Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group appeared first on CyberScoop.

A 45-year-old U.S. citizen pleaded guilty to running a widespread identity theft and fraud scheme that defrauded thousands of U.S. servicemembers and veterans while living in the Philippines, the Justice Department said Tuesday.

Robert Wayne Boling Jr. exploited stolen personally identifiable information (PII) to compromise victims’ bank accounts and steal their money and veterans’ benefits during a five-year period ending in July 2019, according to court records. He pleaded guilty to conspiracy to commit wire fraud and money laundering and faces up to 40 years in prison upon sentencing. 

“Those who courageously served our nation deserve our gratitude and protection — not to become targets for criminals seeking to profit from their sacrifice,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “This defendant betrayed our country by exploiting personal information belonging to thousands of military-affiliated individuals, including elderly and disabled veterans, in a calculated scheme to steal from those who have given so much.”

Boling was arrested in May in Los Angeles after he was deported by the Philippines to the United States to face charges related to the scheme, officials said.

He was originally indicted in July 2019 along with four co-conspirators, and a warrant issued for his arrest in October 2022. Two of Bolling’s co-conspirators — Frederick Brown and Trorice Crawford — previously pleaded guilty and were sentenced to 151 months and 46 months in prison in 2021 and 2020, respectively. Other alleged co-conspirators Jongmin Seok and Allan Albert Kerr remain at large.

Prosecutors describe Boling as the “principal orchestrator of the scheme.” He received PII of thousands of military-affiliated individuals from Brown, who worked as a contractor medical records administrator for the U.S. Army in South Korea from 2010 to 2015, officials said. 

Boling used the sensitive data to compromise various accounts belonging to U.S. servicemembers and veterans. 

Officials said the crew also worked with dozens of money mules in the United States who provided bank accounts to deposit stolen funds into and sent a portion of the funds to the Philippines. 

Prosecutors said they’ve worked for years to bring Boling to the United States to face charges. He was raised in South Korea as a U.S. military dependent and lived in Angeles City, Philippines, according to the indictment.

“This defendant and his fellow fraudsters served themselves by stealing from those who selflessly serve our country,” Justin R. Simmons, U.S. attorney for the Western District of Texas, said in a statement. “We will always work tirelessly to fully prosecute those who prey on others in this manner, especially when the victims of those crimes are servicemembers.”

The post Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers appeared first on CyberScoop.

A 40-year-old Nigerian national was sentenced to eight years in prison for running a years-long hacking, tax fraud and investment scheme, the Justice Department said Monday.

Chukwuemeka Victor Amachukwu enriched himself from 2019 to 2023 by hacking into U.S.-based tax preparation businesses, filing false tax returns with federal and state authorities using identities stolen from victim organizations and enticing victims to send him money for investments that did not exist, according to court records.

Amachukwu pleaded guilty to conspiracy to commit computer intrusions and wire fraud in April. He was arrested in France in July 2023 and extradited to the United States in August 2025.

“Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

“Amachukwu took part in sophisticated schemes to hack into U.S. businesses, steal and use stolen identity information of victims, and commit fraud,” McDonald added. “These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant.”

The financial penalties imposed on Amachukwu for his crimes accentuate the damage he inflicted at scale. A federal judge ordered him to pay nearly $3.65 million in restitution to his many victims and forfeit almost $10.85 million.

Prosecutors said Amachukwu and his alleged co-conspirators obtained more than $7 million in fraudulent investment schemes, about $2.5 million in fraudulent tax returns and $819,000 in fraudulent payouts from the Small Business Administration’s Economic Injury Disaster Loan program. 

Amachukwu, his alleged co-conspirator Kingsley Uchelue Utulu and other alleged Nigeria-based co-conspirators also stole the tax and personal data of at least 800 business customers after hacking into tax businesses based in New York, Texas and elsewhere, according to court records.

In one of those attacks, in May 2021, members of the conspiracy sent a spearfishing email to an employee of a New York-based tax preparation business, which infected the firm’s computer systems with malware.

The FBI, Justice Department’s Office of International Affairs and the U.S. Marshals Service assisted the investigation, which led to Amachukwu’s arrest and extradition from France.

The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop.

A portion of ConnectWise’s customers have been adrift for days, and hundreds are compromised, as the company’s efforts to restore its Cloud Backup service remain underway with no confirmed timeline for when customers can regain access.

The company temporarily shut down multiple services Saturday after a threat actor gained access to a highly sensitive credential that allowed its customers to connect the vendor’s application with Microsoft 365 environments. 

The threat actor, which hasn’t been identified, used the application programming interface (API) secret to compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.

Researchers observed an initial wave of attacks Friday, and by late Saturday Huntress “had seen sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 of those sign-ins appearing to succeed,” Jonathan Semon, principal security operations analyst at Huntress, told CyberScoop.

The cybersecurity company, which primarily supports small- to mid-sized businesses, confirmed unauthorized sign-ins in 162 tenants and said additional compromises beyond its telemetry are likely. 

ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services about two days after researchers observed an initial wave of unauthorized sign-ins. 

“ConnectWise is continuing its investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick,” a company spokesperson wrote in an email.

“We are monitoring our entire environment around the clock,” the company said in a security advisory. “Since mitigations began on October 17 at 05:00 UTC, we have not observed successful threat activity in the environments we monitor. This does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review.”

Microsoft Threat Intelligence said it observed broad successful sign-ins from a malicious IP address on Oct. 15. “Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor,” the company said in a LinkedIn post. 

The root cause of the breach and ensuing fallout remains under investigation, and the company declined to answer questions about how attackers obtained the credential for ConnectWise Cloud Backup.

Researchers at Huntress and Todyl, which conducted its own investigation, characterized the secret and its chain of command as critical.

“Because it’s a multi-tenant application, anyone holding that credential can request access tokens in any tenant where the application is installed, without any action by the customer,” Semon said.

Sign-ins, which were performed by an automated tool, also gave the attacker the technical ability to read and write mail and files across various Microsoft 365 applications, Todyl wrote in a blog post. 

Highly privileged access granted by the credential for ConnectWise Cloud Backup allowed attackers to bypass security controls, including multi-factor authentication, and establish additional access.

“In the tenants where we saw post-compromise activity, the account associated with the application elevated its own privileges and added new credentials to other applications in the tenant. That would let someone keep access even after the original application was disabled,” Semon said.

ConnectWise and researchers haven’t attributed the attacks to any known threat actors and none have publicly claimed responsibility. The company said restoration efforts remain underway, but it hasn’t provided a timeline for when customers can regain access.

ConnectWise and researchers shared indicators of compromise to help potentially exposed customers hunt for malicious activity in their systems. Yet, the vendor and third-party companies responding to confirmed attacks, encouraged customers to disable any affected applications even if they don’t see anything unusual in their logs.

The post ConnectWise customers hit by supply-chain attack linked to compromised API secret appeared first on CyberScoop.

Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August. 

Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and evade detection. 

The same threat group has repeatedly exploited a series of defects in Ivanti products since 2023, a Citrix NetScaler zero-day widely known as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell time of 400 days — all resulting in sweeping attack sprees.

“We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure,” Kelli Vanderlee, senior analyst at Google Threat Intelligence Group, said in an email.

Mandiant warned organizations to “prepare for potential widespread exploitation,” adding that Armory Castle and other threat groups previously conducted broad, opportunistic exploitation following public vulnerability disclosures.

Mandiant and GTIG released their analysis of Armory Castle and its latest campaign as BeyondTrust publicly disclosed the vulnerability in its Remote Support product Thursday. The company’s security said it released a patch for the exploited defect for self-hosted customers Oct. 8 and automatically applied the update to cloud-based versions of the product that same day.

BeyondTrust, which conducted its own investigation and coordinated with Mandiant on an investigation involving a self-hosted customer that was compromised, noted Armory Castle’s prowess.

“This threat actor rotates its infrastructure and tooling for every victim, so attribution here rests on behavior. The indicators from one intrusion rarely survive to the next,” the company’s security team wrote in a blog post. “The threat actor has historically demonstrated a high degree of operational security awareness, professional practices, and tradecraft.”

A BeyondTrust spokesperson declined to answer questions about how many customers are already compromised or why it didn’t publicly disclose the actively exploited zero-day sooner, and instead referred back to its security advisory. 

The company said the first known instance of zero-day exploitation occurred Aug. 29, which it detected and contained Sept. 28. 

BeyondTrust also said it detected the malicious activity after zero-days were confirmed to be exploited in another security vendor’s product Sept. 27. That timing matches a round of zero-days Citrix NetScaler disclosed, following nearly two days of rampant worry and unconfirmed rumors. 

BeyondTrust did not say if there is any link or overlap between the attacks targeting Citrix NetScaler, which went undetected for more than three weeks, and its remote access product. 

GTIG researchers said there isn’t enough evidence to assess an overall targeting trend, but encouraged all potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity. 

The threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.

“Armory Castle remains one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple industries and regions, and its continuously expanding and evolving arsenal of tools,” said Dan Perez, technical lead at GTIG.

“This is a well-established pattern for Armory Castle,” Vanderlee said. “Targeting edge devices, which typically do not support endpoint detection and response (EDR), allows the threat actor to minimize opportunities for detection and maintain stealthy, persistent access to targeted networks.”

The post Prolific Chinese espionage group exploits BeyondTrust zero-day appeared first on CyberScoop.

Authorities in the Republic of North Macedonia filed charges against the alleged administrator of OLVX, a cybercrime marketplace that sold stolen personal data, credentials and malicious tools for attacks since 2023.

The 20-year-old citizen of North Macedonia, who officials identified as “E.A.” in a news release, is accused of commiting computer fraud, misuse of personal data, and production and distribution of child sexual abuse material. 

The arrest comes six months after authorities dismantled the cybercrime platform, arrested the alleged administrator and searched their home in April, according to European authorities. Officials at that time said the cybercrime platform’s sales exceeded $500,000 and a seized server contained a database with more than 2,600 customer accounts.

The FBI provided intelligence to North Macedonian authorities and aided in the joint investigation into OLVX. “The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use,” the FBI Cyber Division said in a LinkedIn post Wednesday. 

“This disruption marks the first-ever cyber operation coordinated between the FBI and North Macedonia, and reflects the FBI’s commitment to working with partners around the world to protect the American people in cyberspace,” the agency added.

Officials said evidence gathered during the investigation revealed that the suspect allegedly offered more than 1,500 sets of stolen credentials for sale. The suspect, who was charged in the village of Golema Rečica near Tetovo, also allegedly administered domains and sites associated with the OLVX platform, which they used to sell stolen data, malicious tools and services between 2023 and 2025.

More recently, including earlier this year, authorities accused the alleged cybercriminal of running an online group on Telegram where illegal services and software were sold to facilitate various forms of cybercrime, including fraudulent refund schemes.

The post Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia appeared first on CyberScoop.

Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday, containing 1,413 defects affecting the company’s various enterprise products and services. 

The monthly batch of patches surpassed the company’s previous annual record of 1,261 common vulnerabilities and exposures (CVEs) set in 2020. 

“Hundreds of CVEs in a single release used to be the exception — now it’s the baseline,” Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, wrote in an email. AI is partly to blame, he added, but it “isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.”

Yet, for defenders understandably overwhelmed by the surge of defects found in Microsoft products, actively exploited zero-day vulnerabilities aren’t growing in kind.

“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack,” Childs wrote in a blog post. “If you go back to the hot 0-day summer of 2023, there were 17 Microsoft 0-days between January and October as opposed to 15 this year during the same period.”

Microsoft disclosed one actively exploited zero-day affecting Windows Shell — CVE-2026-96951 — that allows unauthorized attackers to bypass a security feature. The high-severity defect is the third Windows Shell vulnerability exploited this year, according to Satnam Narang, senior staff research engineer at Tenable. 

“There have been 26 Windows Shell vulnerabilities patched in 2026 through October, a staggering figure compared to previous years, with only 3 Windows Shell CVEs in 2025 and just one in 2024 and 2022,” he added.

The vast majority of defects Microsoft disclosed in this month’s security update affect Windows, its ubiquitous operating system , spanning 1,102 vulnerabilities combined. The update also included 134 vulnerabilities in Office, 61 in various developer tools and 36 in SharePoint Server. 

Microsoft tried to address the toll this monthly flood of vulnerabilities has on its customers by introducing “risk cohorts.” These groups of vulnerabilities don’t necessarily share a root cause or severity rating, but generally require a similar customer assessment that could guide prioritization efforts, the company said. 

“The volume isn’t the real story anymore,” Childs added. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.”

The full list of vulnerabilities addressed this month is available in Microsoft’s Security Response Center.

The post Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities appeared first on CyberScoop.

Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday.

Since the start of the year, a vast collection of customized phishing kits developed and sold by Chinese-speaking threat actors — a cluster Microsoft tracks as Storm-2990 — have delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. More than three-quarters of those malicious messages targeted Microsoft customers, the company said.

Cybercriminals purchased the phishing kits, tools and infrastructure from an interconnected network Microsoft and Japanese authorities started investigating in early 2025. The kits were used to target individuals and organizations in healthcare, financial services, logistics and IT predominantly in the United States and Japan.

Microsoft said it and Health-ISAC, working with a federal court order, seized and redirected domains that powered the underlying infrastructure of these cybercrime tools and services known as YAM Store, CoGUI and Iron Man. 

The company said it also disabled more than 20,000 accounts connected to YAM Store and continues to disrupt the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

“Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue. The details may change, but the goal is the same: to get someone to click, share personal information, or pay,” Steven Masada, general counsel and general manager of Microsoft’s Digital Crimes Unit, wrote in a blog post.

“These messages are relentless,” he added. “Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open. What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The phishing kids included templates impersonating legitimate brands that cybercriminals used to facilitate high-volume campaigns. Researchers said similar infrastructure and overlapping activity suggested the tools shared development origins, code reuse or close collaboration among developers.

Microsoft said cybercriminals used the phishing kits to steal credentials, financial data and abuse the device code authentication process to obtain authentication tokens and access compromised accounts. Researchers said cybercriminals primarily used the tools for financial fraud, typically using stolen payment data to make fraudulent purchases of high-end goods or transactions on legitimate financial platforms. 

Resecurity, which aided the investigation, gained access to Iron Man’s infrastructure and found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries. Cloudflare, Oracle, Proofpoint and TRM Labs also provided research and investigative support.

“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world,” Masada wrote. 

“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” he added. “The scam message is often the only part victims see. The businesses behind it are what make it possible.”

The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.

Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products. 

Volexity researchers, which discovered in-the-wild exploitation earlier this month, said attackers actually exploited three zero-days in a chain that allowed them to bypass authentication, execute code remotely and escalate privileges. 

Ivanti disclosed and issued a patch for the authentication bypass and remote-code execution components of the exploit chain as a single vulnerability in Ivanti Connect Secure. The company said it initially discovered a portion of the high-severity vulnerability — CVE-2026-104935 — during internal security checks in June.

A threat actor, which Volexity tracks as UTA0576, exploited the defects before Ivanti addressed them and issued a patch.

“Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote in response to questions.

“Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path,” the spokesperson added. “We are also developing additional updates to address the remaining vulnerability and further strengthen product security.”

The full scope of compromise remains under investigation. The company, in a security advisory, said a “limited number of customers” were already compromised prior to disclosure. 

The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog Tuesday.

Sean Koessel, vice president of professional services at Volexity, said the earliest confirmed instance of exploitation occurred Oct. 1. Yet, “it wouldn’t surprise us if there was activity toward the end of September,” he added.

Volexity researchers observed a series of post-exploitation activities during an investigation involving a customer’s compromised Ivanti Connect Secure VPN appliance earlier this month. “UTA0576 repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it,” the company wrote in a blog post. 

The threat actor extracted credentials stored on the device, dumped and stole Active Directory metadata, and deployed multiple custom and malicious tools capable of facilitating follow-on attacks, credential testing and hunting for administrator passwords, recovery keys and other passwords.

“Based on Volexity’s observations, UTA0576 primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance,” the company added.

Ivanti encouraged potentially vulnerable customers to act immediately by upgrading to the latest version of software, running the company’s Integrity Checker Tool regularly, and reviewing indicators of compromise published by Volexity.

CISA also urged Ivanti customers to patch the vulnerability quickly, as it dissuaded customers from relying on the company’s Integrity Checker Tool.

“Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation,” the agency said in an alert Tuesday. “Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.”

Ivanti products, including Ivanti Connect Secure, are a frequent target for attackers of various motivations in the network edge space. 

CISA has flagged 36 Ivanti defects on its known exploited vulnerabilities catalog since late 2021. At least 6 defects across Ivanti products have been exploited since late January.

“Edge devices are a valuable initial foothold and often enable attackers to pivot further into targeted networks,” Koessel said. “It would be fair to expect widespread exploitation, this is a common theme with most vulnerabilities in edge devices.”

Other researchers also expect exploitation to pick up rapidly. 

“Given the history of attacker attention and focus Ivanti Connect Secure has previously drawn — and the trivial nature of the authentication bypass — widespread, indiscriminate exploitation is inevitable as attackers begin reviewing patches and public information,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.

“The race condition required for code execution offers little resistance, as an unauthenticated attacker can repeatedly attempt exploitation until it succeeds,” he added.

The post Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day appeared first on CyberScoop.