There’s mounting evidence of spyware attacks growing more indiscriminate, leading to more everyday citizens being hit as opposed to traditionally “high-value” targets.

The AdFection spyware attacks, which could infect anyone visiting a website that had advertising on it, represented the most recent revelation. And iVerify published a report Tuesday analyzing customer infections and threat notifications from Apple that contributes to the trend. 

“Conventional guidance on spyware risk focused on people with a public profile, a sensitive job or a role that put them on a government’s radar,” the company said. “Some Apple Threat Notification cases iVerify saw this year don’t fit that pattern.”

“In Ottawa, Apple Threat Notifications reached the children of a city bus driver and a stay-at-home mom,” it continued. “In Australia, one went to a limousine driver. None of them had a public profile, a sensitive job or an obvious connection to anyone worth spying on. These cases matter because they show the threat reaching people who had no reason to expect it.  For an enterprise, the employees most likely to be hit look much more like the limousine driver than like the CEO.”

Part of that is that when spyware attacks are less targeted, they might be more likely to hit those who aren’t as diligently focused on routine cyber hygiene, as opposed to CEOs who are probably regularly upgrading their defenses, iVerify told CyberScoop.

Rocky Cole, co-founder of the company, said the change reflects a shift in who’s using spyware.

“The vast majority of our detections were mass attacks by criminal groups looking to do purely criminal things,” Cole said. “For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than a system administrator or even an average employee.”

iVerify’s report looked at other trends as well. Among the findings:

• iVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.
• The rate of spyware infections held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans.
• “Three in four of this year’s detections were criminal adversaries stealing credentials and cryptocurrency, not state-sponsored actors,” the report said.

The post Spyware attacks trend toward hitting just about anyone appeared first on CyberScoop.

Three men concocted an elaborate, yearslong scheme that defrauded companies of at least $129 million by using AI to impersonate executives and lawyers, tricking targeted victims into transferring large payments to criminal-controlled accounts, the Justice Department said Thursday.

Jacob Soall, Sharon Hazan and Guy Sheetrit allegedly used AI to impersonate the voices and images of chief executive officers at companies and lawyers at major international law firms. The trio are accused of targeting thousands of victims between July 2024 and February 2026, according to court records.

Victims include a U.K.-based financial tech company that lost almost $11.6 million, a Florida-based pet food company that lost $5.2 million, a Missouri-based hospital system that lost $4.8 million, a Massachusetts-based mutual fund company that lost $4.6 million, a California-based hospital system that lost nearly $3 million, a New York-based investment company duped out of $2.8 million, and a Rhode Island-based bank that transferred nearly $2.7 million.

The trio’s scheme typically started by targeting accounting staff, pretending to be the CEO, and requesting help on a financial transaction, officials said. Using AI to create deepfakes pretending to be CEOs, the crew allegedly directed employees to contact attorneys who they would also impersonate to trick the employee into thinking the financial transaction was legitimate.

Prosecutors said the men and their co-conspirators identified and targeted employees who had sufficient authority to authorize large wire transfers. 

The scheme typically began with an email from an e-signature company, wherein the impersonated CEO claimed they were working on a “confidential financial transaction” that required the victim employee to sign a non-disclosure agreement before contacting the purported attorney at a victim law firm, according to an unsealed indictment.

Soall, Hazan, Sheetrit and their co-conspirators allegedly impersonated attorneys at some of the 50 largest law firms globally. 

“Super intelligence technology offers tremendous potential, but the public should recognize that there are some who seek to use this emerging technology to pursue criminal goals,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

Prosecutors said the wire transfers were sent to bank accounts controlled by co-conspirators around the world, including the United States, Spain, Portugal, Greece, the United Arab Emirates, Singapore, Austria, Slovakia and China. The crew allegedly converted the funds to cryptocurrency and distributed the illicit proceeds amongst themselves and their co-conspirators.

Soall, a 41-year-old from Marbella, Spain, was arrested in Spain on June 17. He allegedly primarily impersonated attorneys from the United Kingdom, reading from a handwritten script designed to dupe targeted victims.

Hazan, a 54-year-old from Israel, was arrested in Spain on Aug. 5. He allegedly boasted that he had been laundering money since 1994, including more than $400 million in the past three years, and was previously convicted in the Southern District of New York of conspiracy to commit bank fraud in 2008.

Sheetrit, a 42-year-old from Israel and the United Arab Emirates, was arrested in the United Kingdom on Sept. 7 and allegedly laundered funds from the scheme.

The trio are charged with conspiracy to commit wire fraud, wire fraud, two counts of aggravated identity theft, money laundering conspiracy and two counts of money laundering. The seven counts carry a maximum sentence of 104 years in prison.

“The alleged scheme orchestrated by Soall, Hazan, and Sheetrit demonstrates how the use of advanced technology can be exploited to commit large scale fraud,” James C. Barnacle Jr., assistant director in charge of the FBI New York field office, said in a statement.

“As criminals continue to weaponize emerging technologies, the FBI remains committed to rapidly adapting our capabilities to identify, investigate, and disrupt those who seek to harm New Yorkers and businesses operating in our communities.”

After initial publication of this story, Sheetrit’s attorneys, Sharon Nahari and Shay Shorer, emailed a statement to CyberScoop saying their client “has no connection to this matter and has had no involvement in it whatsoever.”

“Mr. Sheetrit is a businessman with extensive expertise and professional experience in cybersecurity and technology,” wrote Nahari and Shorer. “In the course of his work, he provides professional advisory services to a range of clients. Working in cybersecurity, possessing specialist expertise or providing advisory services cannot, in themselves, establish complicity in or involvement in the alleged conduct.”

“Our client maintains his complete innocence and, like everyone else, is entitled to the presumption of innocence,” the statement continued. “We are confident that, once the facts have been established and the evidence fully examined, it will become clear that there is no basis for holding him criminally responsible.”

UPDATE: Nov. 6, 2026; 8:25 p.m.: This story has been updated to include a statement from attorneys representing Guy Sheetrit.

The post Authorities accuse trio of using AI deepfakes to defraud $129M from businesses appeared first on CyberScoop.

Two Canadian men broke into the networks of multiple U.S. universities, stole credentials and implanted malware on compromised computers to commandeer processing power for a cryptocurrency mining operation, the Justice Department said.

Ryan James Roach and Mathiew James Stubbings allegedly compromised the networks of at least four universities in New York, Tennessee, North Carolina and Massachusetts between mid 2016 and late 2019, according to an unsealed indictment. 

Roach, a 35-year-old from Saskatchewan, Canada, was extradited to the United States on Oct. 28 and arraigned Tuesday in the U.S. District Court for the Western District of New York. Prosecutors said they are still seeking the extradition of Stubbings, a 41-year-old from Ontario, Canada.

A grand jury previously indicted the Canadian nationals in April 2022. The men are charged with multiple cybercrimes and face up to 10 years in prison and up to a $250,000 fine, if convicted.

Prosecutors accuse the men of researching and identifying potential victims with supercomputers containing vulnerabilities they could exploit. The men breached networks and deployed malware on compromised machines to take over systems, officials said. 

Roach and Stubbings allegedly rented virtual private servers based in Europe and the United States under false identities to conceal traffic, deploy rootkits, steal credentials and data, and transmit cryptocurrency mining software to compromised computers.

“The defendants caused at least one supercomputer to mine cryptocurrency on their behalf, which caused much of the supercomputer’s processing speed and power to become unavailable to its legitimate owner,” prosecutors wrote in the indictment.

Officials didn’t say how much cryptocurrency the pair allegedly mined for financial gain as part of the conspiracy.

If convicted, Roach and Stubbings are also ordered to forfeit an assortment of networking and data storage devices, and any property or proceeds obtained through the alleged crime spree.

The post Officials extradite Canadian man to US for alleged cryptomining spree appeared first on CyberScoop.

Authorities arrested seven people allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, Europol said Tuesday. Officials said the operation caused estimated losses of at least $4.5 million. 

The takedown effort involved searches across 17 countries Tuesday and netted the seizure of more than 100 servers, according to Europol.

Officials targeted the scheme run by a company that allegedly provided cybercrime groups a series of trading websites and an assortment of call centers tasked with tricking victims into transferring their savings. 

The company, operated from Cyprus and Israel, was linked to call centers in Albania, Kosovo and North Macedonia, officials said. 

“The scheme promised substantial, quick returns from trading in cryptocurrencies, foreign currencies or stocks,” Europol wrote in a news release. “Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more.”

The investment scam’s operators used affiliate marketing to target potential victims with advertisements that led them to fraudulent investment platforms. Cybercrime groups running the call centers purchased data collected through those ads to contact potential victims, officials said.

Operators duped victims by displaying fictitious profits and pressured victims to transfer large sums of money. “When victims asked to withdraw their money, the operators used delaying tactics to block payments. Eventually, contact ceased, leaving victims unable to recover their funds,” Europol wrote. 

Authorities were tipped off to the investment scam in 2022 when a German couple reported they couldn’t withdraw funds invested in an online trading platform. Authorities arrested two people allegedly involved in the scheme that year and seized evidence that eventually led to further arrests and seizures in 2025.

The joint investigation and takedown effort was supported by officials in Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia and Poland. The seven people arrested Tuesday, who were not identified, are facing extradition to Germany to face charges, Europol said.

The post Europol dismantles investment scheme that impacted potential victims in 50 countries appeared first on CyberScoop.

Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday. 

Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold. Those backdoors established XCPE, an expansive botnet that cybercriminals used to conduct ad fraud, steal data and route malicious traffic through residential proxy networks, according to a Google Threat Intelligence Group report.

Google took legal action to shut down the domains and servers Videostrong used to control the botnet. The company also took down command-and-control domains that more than a dozen malware families ran as modules through the XCPE backdoor, claiming it disrupted access to at least 10 million additional compromised devices from various manufacturers.

Videostrong sold Android devices with pre-installed malware for years, slipping by Google’s security tests by loading the malicious code after the device’s first boot. “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder, head of disruption operations at GTIG, told CyberScoop.

Snyder declined to say when or how Google first became aware of the approved vendor running a botnet on Android-powered devices. 

“We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google researchers wrote in the report. “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”

Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activities in the future. Yet, Snyder said the company isn’t sharing specifics on these changes because it doesn’t want to provide threat actors insights that might help them circumvent these additional protections.

Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs. 

“Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors,” researchers wrote in the report. “This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices.”

The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers. Nearly 44,000 infected devices were based in the United States between June and October.

Google also partnered with Japan’s National Police Agency, Lumen Technologies, Human Security, Plume and Synthient to study and disrupt the botnet. 

The company said the dismantling of XCPE “seriously impacted over a dozen malicious actors,” yet it warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.

The post Google shuts down global botnet running on certified Android devices appeared first on CyberScoop.

A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison.

Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department. The operation was organized and led by members of Assad’s circle, including the commander of Syria’s General Intelligence Directorate.

Agha hacked approximately 47 media entities, businesses, nongovernmental organizations and U.S. and allied government bodies, prosecutors said. The motives included punishing news organizations for reporting on Syrian government atrocities during the Arab Spring and the civil war that followed, spreading fear and confusion among the regime’s opponents, collecting intelligence and trying to persuade members of the U.S. military to refuse their orders.

“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.

The most damaging intrusion came April 23, 2013. Prosecutors said Agha accessed the Twitter account belonging to the Associated Press to post a false claim that President Barack Obama had been injured in two explosions at the White House. The post triggered a flash crash, briefly erasing $136 billion in value from the stock market. 

In another intrusion, Agha, who used the hacker handle, “Th3 Pr0,” compromised the company hosting the U.S. Marine Corps’ recruitment website and redirected about 3,500 visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. On two occasions, he stole usernames and passwords for White House staff email accounts in attempts to take control of the White House’s social media accounts. In one instance he succeeded, prosecutors said.

The costs to victims were significant. One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and suffered $480,000 in total losses.

“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.

Agha and coconspirator Firas Dardar were first charged by criminal complaint June 12, 2014, and indicted May 17, 2018. Dardar remains a fugitive. He was also charged in 2015 in a separate conspiracy alongside Peter Romar, a Syrian national then living in Germany, that involved computer intrusion, extortion, money laundering and violations of the Syrian Sanctions Regulations. Romar was extradited from Germany and pleaded guilty in 2016.

Assad’s regime collapsed in December 2024, and the former president fled the country.

The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.

Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 

Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 

The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.

Virtualine received almost one-fifth of all illicit-attributed inflow among bulletproof hosting providers tracked by TRM this year to date.

A Russian drug marketplace accounted for nearly 44% of the direct payments Virtualine received from customers and attributed counterparties so far this year, according to TRM. A sextortion scheme accounted for nearly 17% of direct payments to Virtualine, followed by a cryptocurrency mixer at almost 13%, ransomware at nearly 5%, cybercrime services at 3% and malware at 2%.

“Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM Labs, said in a prepared statement. 

“Bulletproof hosting is the connective tissue. Seizing a domain matters, but the blockchain record doesn’t disappear with it. It shows who is paying, who is getting paid, and where they go next,” he added. 

Virtualine attracted many criminals as customers. Ransomware groups, including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin all paid the site’s operators, according to TRM. The bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM. 

The FBI and prosecutors got a court order to seize Virtualine’s primary domain, which was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.

Officials said Virtualine continued hosting services for a customer that distributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.

TRM underscores that Virtualine was disrupted, but not completely shut down. “A domain seizure disrupts how customers find and access a service,” researchers wrote. “It does not, by itself, establish that the operator has stopped working, or that customers have lost access to all underlying infrastructure.”

The post Officials seize domain of top bulletproof hosting provider Virtualine appeared first on CyberScoop.

Prosecutors announced charges against six alleged scammers based out of Africa who targeted Americans with fake non-fungible token (NFT) investment scams by posing as women on dating websites, netting hundreds of victims.

According to an affidavit for the arrest of of the six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — the criminal group with connections to China and Malaysia opened a scam compound in Madagascar early last year.

“In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments,” the Justice Department said in a news release Tuesday. “Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge.”

The FBI identified approximately 74 cryptocurrency wallets associated with approximately 800 victims in the scheme, for an estimated loss of at least approximately $516,695, according to the affidavit and news release.

The U.S. District of Columbia’s Scam Center Task Force, the FBI’s field office in Honolulu and the U.S. Attorney’s Office for the District of Alaska made a trip to Madagascar in August to review electronic devices seized from scam compounds. Interviews with scam compound workers there revealed that Cambodian police activity and armed conflict between Thailand and Cambodia led to operations at a Cambodian scam compound being moved to Madagascar.

Phones for the alleged scheme leader, Wa, contained employment contracts and scripts for what scammers should say to victims, which said they would be committing “an emotional scam.” The devices that officials reviewed and the interviews also established further connections between the scammers and Southeast Asia and China.

After the initial interviews, though, Madagascar repatriated some suspects to China before the investigation was complete, according to the Justice Department.

“Today, [D.C.] U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar,” the release stated.

In the same release, DOJ said that the Scam Center Strike Force had crossed the $1 billion threshold in cryptocurrency recovered in its first year. 

The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles appeared first on CyberScoop.

A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.

Artem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms. He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Stryzhak pleaded guilty to multiple cybercrimes in late 2025. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.

Attacks involving Nefilim ransomware caused millions of dollars in losses from extortion payments and damage to victim networks, officials said. Stryzhak and his co-conspirators allegedly customized executable ransomware files for each victim, creating unique decryption keys and unique ransom notes.

The ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data. The crew researched companies after it broke into their networks to determine their net worth, size and contact information.

Stryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri and an international eyewear company. 

Stryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said. 

Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”

The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.

A 44-year-old Chinese national was extradited to the United States and arraigned in federal court for his alleged involvement in a sweeping investment scam network that tricked at least 174 U.S. residents out of nearly $37 million, the Justice Department said Friday. 

Zheng Zhao was extradited from the Netherlands to the United States to face a conspiracy to commit money laundering charge that could keep him in prison for 20 years. 

Prosecutors accuse Zhao and his co-conspirators of operating a global cryptocurrency investment scheme out of multiple countries, including scam centers in Cambodia. 

The cybercrime ring allegedly reached out to U.S.-based victims proactively via social media, phone calls, text messages and online dating sites to establish a deceitful relationship and build trust. Eventually, Zhao and his co-conspirators promoted cryptocurrency investments to the victims and directed them to send funds through fake sites that resembled legitimate trading platforms.

Victims were told their investments were growing in value, yet they were already transferred from U.S. bank accounts controlled by the co-conspirators to an account at Deltec Bank in the Bahamas, officials said. The crew allegedly converted the victim funds to Tether before transferring the assets to a digital wallet controlled in Cambodia.

The stolen funds were ultimately distributed to leaders of scam networks throughout the region, officials said.

Eight of Zhao’s co-conspirators previously pleaded guilty participating in the investment scam conspiracy, including Shengsheng He and Jingliang Su, who were sentenced to 51 months and 46 months in prison, respectively. 

Joseph Wong, a co-conspirator living in California, managed a network of money launderers in Los Angeles who registered shell companies, opened U.S. bank accounts and transferred stolen victim funds to international bank accounts.

“This case should serve as a warning to scammers in every corner of the world: there is nowhere to hide,” Todd Bratz, special agent in charge of the U.S. Secret Service Criminal Investigation Division, said in a statement. “Secret Service investigators and our law enforcement partners remain unwavering in their commitment to identify those who operate scam centers, disrupt their financial infrastructure and bring them to justice.”

The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.

A 45-year-old U.S. citizen pleaded guilty to running a widespread identity theft and fraud scheme that defrauded thousands of U.S. servicemembers and veterans while living in the Philippines, the Justice Department said Tuesday.

Robert Wayne Boling Jr. exploited stolen personally identifiable information (PII) to compromise victims’ bank accounts and steal their money and veterans’ benefits during a five-year period ending in July 2019, according to court records. He pleaded guilty to conspiracy to commit wire fraud and money laundering and faces up to 40 years in prison upon sentencing. 

“Those who courageously served our nation deserve our gratitude and protection — not to become targets for criminals seeking to profit from their sacrifice,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “This defendant betrayed our country by exploiting personal information belonging to thousands of military-affiliated individuals, including elderly and disabled veterans, in a calculated scheme to steal from those who have given so much.”

Boling was arrested in May in Los Angeles after he was deported by the Philippines to the United States to face charges related to the scheme, officials said.

He was originally indicted in July 2019 along with four co-conspirators, and a warrant issued for his arrest in October 2022. Two of Bolling’s co-conspirators — Frederick Brown and Trorice Crawford — previously pleaded guilty and were sentenced to 151 months and 46 months in prison in 2021 and 2020, respectively. Other alleged co-conspirators Jongmin Seok and Allan Albert Kerr remain at large.

Prosecutors describe Boling as the “principal orchestrator of the scheme.” He received PII of thousands of military-affiliated individuals from Brown, who worked as a contractor medical records administrator for the U.S. Army in South Korea from 2010 to 2015, officials said. 

Boling used the sensitive data to compromise various accounts belonging to U.S. servicemembers and veterans. 

Officials said the crew also worked with dozens of money mules in the United States who provided bank accounts to deposit stolen funds into and sent a portion of the funds to the Philippines. 

Prosecutors said they’ve worked for years to bring Boling to the United States to face charges. He was raised in South Korea as a U.S. military dependent and lived in Angeles City, Philippines, according to the indictment.

“This defendant and his fellow fraudsters served themselves by stealing from those who selflessly serve our country,” Justin R. Simmons, U.S. attorney for the Western District of Texas, said in a statement. “We will always work tirelessly to fully prosecute those who prey on others in this manner, especially when the victims of those crimes are servicemembers.”

The post Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers appeared first on CyberScoop.

A 40-year-old Nigerian national was sentenced to eight years in prison for running a years-long hacking, tax fraud and investment scheme, the Justice Department said Monday.

Chukwuemeka Victor Amachukwu enriched himself from 2019 to 2023 by hacking into U.S.-based tax preparation businesses, filing false tax returns with federal and state authorities using identities stolen from victim organizations and enticing victims to send him money for investments that did not exist, according to court records.

Amachukwu pleaded guilty to conspiracy to commit computer intrusions and wire fraud in April. He was arrested in France in July 2023 and extradited to the United States in August 2025.

“Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

“Amachukwu took part in sophisticated schemes to hack into U.S. businesses, steal and use stolen identity information of victims, and commit fraud,” McDonald added. “These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant.”

The financial penalties imposed on Amachukwu for his crimes accentuate the damage he inflicted at scale. A federal judge ordered him to pay nearly $3.65 million in restitution to his many victims and forfeit almost $10.85 million.

Prosecutors said Amachukwu and his alleged co-conspirators obtained more than $7 million in fraudulent investment schemes, about $2.5 million in fraudulent tax returns and $819,000 in fraudulent payouts from the Small Business Administration’s Economic Injury Disaster Loan program. 

Amachukwu, his alleged co-conspirator Kingsley Uchelue Utulu and other alleged Nigeria-based co-conspirators also stole the tax and personal data of at least 800 business customers after hacking into tax businesses based in New York, Texas and elsewhere, according to court records.

In one of those attacks, in May 2021, members of the conspiracy sent a spearfishing email to an employee of a New York-based tax preparation business, which infected the firm’s computer systems with malware.

The FBI, Justice Department’s Office of International Affairs and the U.S. Marshals Service assisted the investigation, which led to Amachukwu’s arrest and extradition from France.

The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop.

Authorities in the Republic of North Macedonia filed charges against the alleged administrator of OLVX, a cybercrime marketplace that sold stolen personal data, credentials and malicious tools for attacks since 2023.

The 20-year-old citizen of North Macedonia, who officials identified as “E.A.” in a news release, is accused of commiting computer fraud, misuse of personal data, and production and distribution of child sexual abuse material. 

The arrest comes six months after authorities dismantled the cybercrime platform, arrested the alleged administrator and searched their home in April, according to European authorities. Officials at that time said the cybercrime platform’s sales exceeded $500,000 and a seized server contained a database with more than 2,600 customer accounts.

The FBI provided intelligence to North Macedonian authorities and aided in the joint investigation into OLVX. “The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use,” the FBI Cyber Division said in a LinkedIn post Wednesday. 

“This disruption marks the first-ever cyber operation coordinated between the FBI and North Macedonia, and reflects the FBI’s commitment to working with partners around the world to protect the American people in cyberspace,” the agency added.

Officials said evidence gathered during the investigation revealed that the suspect allegedly offered more than 1,500 sets of stolen credentials for sale. The suspect, who was charged in the village of Golema Rečica near Tetovo, also allegedly administered domains and sites associated with the OLVX platform, which they used to sell stolen data, malicious tools and services between 2023 and 2025.

More recently, including earlier this year, authorities accused the alleged cybercriminal of running an online group on Telegram where illegal services and software were sold to facilitate various forms of cybercrime, including fraudulent refund schemes.

The post Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia appeared first on CyberScoop.

Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday.

Since the start of the year, a vast collection of customized phishing kits developed and sold by Chinese-speaking threat actors — a cluster Microsoft tracks as Storm-2990 — have delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. More than three-quarters of those malicious messages targeted Microsoft customers, the company said.

Cybercriminals purchased the phishing kits, tools and infrastructure from an interconnected network Microsoft and Japanese authorities started investigating in early 2025. The kits were used to target individuals and organizations in healthcare, financial services, logistics and IT predominantly in the United States and Japan.

Microsoft said it and Health-ISAC, working with a federal court order, seized and redirected domains that powered the underlying infrastructure of these cybercrime tools and services known as YAM Store, CoGUI and Iron Man. 

The company said it also disabled more than 20,000 accounts connected to YAM Store and continues to disrupt the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

“Most people have opened their messages to find a suspicious alert urgently telling them that a package cannot be delivered, a toll remains unpaid, a bank account needs attention, or a tax bill is overdue. The details may change, but the goal is the same: to get someone to click, share personal information, or pay,” Steven Masada, general counsel and general manager of Microsoft’s Digital Crimes Unit, wrote in a blog post.

“These messages are relentless,” he added. “Delete and block one, and another takes its place. Ignore them, and more will follow. Fall for one, and the floodgates open. What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The phishing kids included templates impersonating legitimate brands that cybercriminals used to facilitate high-volume campaigns. Researchers said similar infrastructure and overlapping activity suggested the tools shared development origins, code reuse or close collaboration among developers.

Microsoft said cybercriminals used the phishing kits to steal credentials, financial data and abuse the device code authentication process to obtain authentication tokens and access compromised accounts. Researchers said cybercriminals primarily used the tools for financial fraud, typically using stolen payment data to make fraudulent purchases of high-end goods or transactions on legitimate financial platforms. 

Resecurity, which aided the investigation, gained access to Iron Man’s infrastructure and found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries. Cloudflare, Oracle, Proofpoint and TRM Labs also provided research and investigative support.

“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world,” Masada wrote. 

“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” he added. “The scam message is often the only part victims see. The businesses behind it are what make it possible.”

The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.

Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. 

The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as “laptop farms,” where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad.

An indictment unsealed in the Northern District of Ohio charges two U.S. citizens, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas. It alleges the two Americans, along with 10 others located in China, held remote jobs at more than 70 companies from 2019 through 2025 using stolen or fabricated identities, and collected about $3 million in pay. 

An Ohio resident, Trey Michael Nolte, is also named as a co-conspirator in the indictment, but is not charged. Two unnamed defendants were also charged.

“This investigation is about far more than fraud,” Ryan Raybould, a U.S. attorney in the Northern District of Texas, said in a release. “It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability. Operation Lonestar Roundup sends a clear message: we will not allow enemies of the United States to exploit our businesses or compromise our national security.”

This particular scheme proliferated over the past decade as remote work became more common. There have been multiple indictments since 2024 that have looked to charge willing conspirators in the U.S., while also disrupting the ability for North Korean nationals to successfully earn a paycheck. 

Despite those actions, the scheme has persisted. Last month, U.S. and allied governments warned that a North Korean hacking group operating under the country’s Munitions Industry Department’s 313 General Bureau is infiltrating tens of thousands of job seekers’ networks by posing as prospective employers like AI firms to steal sensitive data and millions in cryptocurrency. The intent is to circumvent economic sanctions that prevent the country from bankrolling its military ambitions through legitimate financial channels.

Detailed in an indictment released Tuesday, this particular scheme was allegedly facilitated by Nolte, who kept roughly two dozen company laptops online for overseas workers, installed remote-access software on them, and moved more than $320,000 through accounts opened under false names. The DOJ said Bostelle aided the scheme by providing his name and a fraudulent driver’s license to help a remote worker obtain a job, Carrillo hosted laptops at his home under various names, receiving about $190,000 from five employers.

Prosecutors also allege that the men filed false employment records with the Department of Homeland Security, the IRS and the Social Security Administration in the names of more than 25 identity theft victims.

The FBI also released an updated advisory that detailed how the scheme has changed over the past few years. Under pressure from better detection, North Korean workers now pay U.S. citizens to appear in interviews, take drug tests, access accounts, and keep company laptops running at home. They target people under financial strain, whom they see as easier to recruit. 

Some go further and hire freelancers in Pakistan, India and Nigeria to do the work itself, hiding who is behind the job. 

The advisory also recounted sharper tactics: threats against former managers after firings, demands for payment backed by stolen data, and paid helpers sent to intimidate companies in person. 

The group has also changed how they use certain tools. CrowdStrike, which provided assistance to law enforcement, reported that since May, the group has spoofed device identifiers, making a video capture card appear as a webcam, and reused the same disguised device across several jobs. Because these habits resemble normal remote work, no single warning sign catches them, the FBI said, so it called for layered checks throughout employment and warned that blunt filters would screen out qualified applicants.

Adam Meyers, CrowdStrike’s head of counter adversary operations, told CyberScoop while the tradecraft may change, the North Koreans’ goal of evading sanctions remains the same.

“As companies get better at identifying fraudulent workers and law enforcement disrupts their infrastructure, FAMOUS CHOLLIMA is finding new ways to conceal its operations and make the scheme more resilient,” Meyers said. “That’s why disruption is so important. Working with the FBI, we’re not just identifying the threat but dismantling the infrastructure that enables it, forcing the adversary to rebuild and reinvest. Every laptop seized, every facilitator exposed, and every operation disrupted raises the cost of doing business for North Korea.”

Despite the law enforcement effort, CrowdStrike said in its own announcement that this particular action is unlikely to have a lasting effect.

“While disrupting a laptop farm will likely only yield a limited impact on Famous Chollina centered mostly on the geolocation of the takedown, these operations send a clear signal to the adversary that law enforcement and CrowdStrike have visibility into their infrastructure and are actively tracking their movements,” the blog post reads. 

The State Department is offering rewards of up to $5 million for further information that disrupts this scheme. 

You can read the full indictment below. 

UPDATE, 10/14/2026, 11:25 a.m.: This story has been updated with comment from CrowdStrike’s Adam Meyers.

The post DOJ charges 14 over a sprawling North Korean remote work scheme appeared first on CyberScoop.

Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday.

Edward Dubrovsky, 54, is a former employee of CYPFER, a firm that helps organizations negotiate with ransomware operators. He is charged with conspiring to threaten the confidentiality of information in order to extort money, a violation of federal computer fraud law, and with conspiring to commit Hobbs Act extortion, which involves using threats to obstruct or affect interstate commerce to obtain money. Other details of the case remain sealed. 

While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees. FBI Director Kash Patel said in a social media post that the bureau had arrested “another suspected co-conspirator” of the group, but did not name the suspect. The New York Times reported Friday that a Canadian man was arrested in Pennsylvania in connection with the attack.

When asked for further comment, the FBI pointed CyberScoop to Patel’s social media post. 

Dubrovsky’s LinkedIn page touts him as the chief operating officer and ex-founder of CYPFER. However, a firm representing CYPFER told CyberScoop that his role was Managing Director from May 2022 through Dec. 2025.

Dubrovsky “had no affiliation, operational role or relationship with CYPFER since that time, and contrary to certain reporting, was never a founder or co-founder of the company,” the firm wrote in an email to CyberScoop.

Dubrovsky’s LinkedIn page also makes reference to an affiliation with CyberSteward, which is described as a Toronto-based firm that helps breach victims negotiate ransom payments. Last month, Dubrovsky released a book covering how to deal with ransomware negotiations. 

Dubrovsky did not return CyberScoop request for comment. 

The FBI breach has drawn widespread attention. The attack marks a sobering escalation by ShinyHunters, a notorious group that previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson. 

Brett Leatherman, the FBI’s assistant director for cyber, said a review found the breach resulted from a third-party platform, where a contractor had not installed a security patch issued for the system. Reuters reported that the contractor worked for Accenture.

Since the breach was disclosed, several suspects have been taken into custody. In September, Dutch authorities arrested a 24-year-old suspected of affiliation with ShinyHunters. Additionally, a teenager, which Reuters identified as Saif Al-din Khader, had been detained and was cooperating with investigators. 

Dubrovsky’s case docket states that the case has been moved to the Eastern District of Texas, where Dubrovsky will be detained until a detention hearing is scheduled. 

UPDATE: 10/13/2026, 11:25 a.m.: This story has been updated with comment from CYPFER.

The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop.

A 21-year-old from North Carolina who joined and helped establish 764 as an underage teenager and quickly emerged as the leader of the child sextortion group until his arrest last year pleaded guilty in federal court Thursday, the Justice Department said. 

Prasan Nepal pleaded guilty to conspiracy to commit sexual exploitation of a child as part of a plea agreement with prosecutors and faces at least 15 years and up to 30 years in prison upon sentencing.

Nepal, also known as “Trippy,” ran the nihilistic violent extremist network for almost four years and played a crucial role facilitating the grooming, manipulation and extortion of minors.

Nepal and his alleged co-conspirator Leonidas Varagiannis, who was arrested in Greece last year, controlled membership in 764 and access to a subgroup of highly-involved members known as “764 Inferno,” according to court records.

The Justice Department describes 764 as a “network of nihilistic violent extremists who engage in criminal conduct in the United States and abroad, seeking to destroy civilized society through the corruption and exploitation of vulnerable populations, which often include minors.”

Members of 764 are affiliated with “The Com,” a global collective of loosely associated groups that commit financially motivated, sexual and violent crimes, according to threat researchers.

Nepal instructed 764 members on how to exploit vulnerable children and commented on content posted in the group’s channels. He admitted to requiring prospective members to produce and share child sexual abuse material, self-mutilation, self-immolation, animal cruelty, and acts of violence against other people and property.

He regularly monitored activity in the group and required members to continue producing and posting acts of self-harm. Nepal also ordered victims to commit these acts and engaged in psychological torment and extreme violence against children, sometimes extorting victims to produce sexually harmful material.

In an indictment, prosecutors accused Nepal and Varagiannis of exploiting at least eight minor victims, some as young as 13 years old, across multiple jurisdictions. 

“This case exposes a world where cruelty is currency, violence is entertainment and children are treated as targets in a game of domination and control,” Jeanine Pirro, U.S. attorney for the District of Columbia, said in a statement.

“What Nepal and his co‑conspirators built was not just a criminal operation, it was a deliberate campaign to corrupt the vulnerable and dismantle the guardrails of civilized society,” Pirro added. “Today’s plea is a victory for every child they sought to harm, and a warning to anyone who believes they can hide behind an encrypted screen: we will find you, and we will stop you.”

Officials said members of 764 also extort victims to commit suicide and murder, and publish compilations of photographs and videos of targeted victims to gain notoriety within the network and spread fear.

“I doubt these types of offenders can be reasoned with, and I don’t think sending a message is the point,” Allison Nixon, chief research officer at Unit 221B, told CyberScoop. “The biggest value is getting them off the table. Reoffending rates for online gangs is extremely high, so making each prison stint count is important.”

Prosecutors listed the monikers of 22 additional alleged co-conspirators in the indictment against Nepal and Variagiannis. The Justice Department said Varagiannis, also known as “War,” remains detained in Greece and is expected to face a trial in the next six months on charges related to CSAM and participation in a criminal organization.

Nepal’s guilty plea follows a period of heightened law enforcement activity targeting members of 764 and affiliated groups.

Kyle William Spitze, an original member of 764 and leader of one of its offshoots, was sentenced to 77 years in prison, the longest imprisonment ever imposed on a nihilistic violent extremist in late August.

Alexis Aldair Chavez, who began associating with 764 as a child in 2022 before leading an offshoot 8884, was sentenced to 40 years in prison in July.

Other alleged 764 members arrested since 2025 include: Baron Cain Martin, Tony Christopher Long, Erik Lee Madison, Zachary Sweeney and Aaron Corey.

“It is great seeing every generation of copycats get arrested even faster than the previous generation, and seeing the long sentences,” Nixon said. 

“We need realistic expectations about permanently ending the problem, because people with violent tendencies have existed for all of human history,” she added. “The measure of success is whether society can enforce the law to ensure people with these tendencies cannot persist and escalate.”

A case in Maine last month, involving the first child federally charged and adjudicated for crimes stemming from their involvement in 764, underscores the sprawling reach of the group and legal challenges confronting law enforcement. 

“With the 764 cases, I think law enforcement sets a strong example,” Nixon said. 

“Success can be directly measured in terms of child lives. Success means minimizing turnaround time and maximizing sentences,” she added. “I hope the entire Com is treated like this one day.”

The post Leader of 764 pleads guilty, faces up to 30 years in prison appeared first on CyberScoop.

Authorities accuse the owner of a so-called ransomware remediation company of swindling clients victimized by ransomware attacks into paying the company inflated fees under false pretenses.

Zohar Pinhasi, owner and operator of MonsterCloud, claimed he could decrypt and recover victims’ data with specialized, proprietary tools and avoid paying cybercriminals. Yet, no such tool existed, the Justice Department said Wednesday. 

Pinhasi allegedly used MonsterCloud clients’ fees to pay off cybercriminals and recover encrypted data without telling clients ransom payments were made on their behalf. The dual U.S.-Israeli national is accused of charging hundreds of clients more than $19 million and paying more than $8 million in ransom payments during a five-year period ending in 2023.

“It baffles me that companies fall for this,” Jon DiMaggio, principal researcher at Arkem Cyber, told CyberScoop. “I mean, they just got hacked and they go straight to a shady source.”

Pinhasi’s alleged criminal acts illustrate how the ransomware economy attracts money-seeking professionals of all types.

Ransomware response and remediation occurs in the shadows, providing cover for cybercriminals who fuel the scourge of extortion and, sometimes, those hired by victims to help put one of their worst days behind them. 

A trio of former ransomware negotiators were sentenced to prison earlier this year for deceiving their employers’ clients and conspiring with ransomware affiliates to extort those organizations — effectively playing both sides and victimizing clients’ twice over. 

Prosecutors charged Pinhasi with two counts of wire fraud and one count of wire fraud conspiracy. He pleaded not guilty Wednesday in a federal court in Brooklyn, N.Y., and was released on a $2 million bond.

The Florida resident, where MonsterCloud is also based, faces up to 60 years in prison. A federal judge granted a one-month delay on trial proceedings, noting that attorneys are engaged in plea negotiations. Pinhasi’s lawyer did not immediately respond to a request for comment.

“By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Pinhasi and one of his co-conspirators, an employee at MonsterCloud, allegedly drew clients into their scheme with an initial exploratory fee between $2,500 and $10,000. Pinhasi or an employee at MonsterCloud then obtained the ransom note sent to their client and a sample of encrypted files on the client’s system, according to the indictment.

After this “analysis phase,” Pinhasi allegedly provided encrypted samples to the prospective client as proof MonsterCloud could decrypt the files.

“However, in many instances, Pinhasi had actually shared the sample files with the cybercriminal and obtained decryption samples without informing or revealing to the client that MonsterCloud had not employed any proprietary technology,” prosecutors wrote in the indictment.

This preliminary phase reinforced Pinhasi’s false claims and “induced clients to contract for full ransomware recovery — a more expensive service, costing up to two or more times the ransom,” prosecutors added. 

In August 2023, Pinhasi charged a client approximately $150,000 and allegedly made a ransom payment of about $8,200 to recover the organization’s data. He allegedly used the monikers “Zack Silver” and “Zack Green” in some of his communications with cybercriminals. 

Officials said MonsterCloud’s contracts noted that the company would contact a cybercriminal after exhausting all other options, but dealing with cybercriminals was often Pinhasi’s first step in accessing encrypted files and the typical way he obtained proof of recovered data and decryption keys. 

MonsterCloud landed deals with hundreds of companies based in the United States and Canada. The company still has an active site with a contact form for prospective clients, packaged with testimonials from law enforcement agencies and a former FBI official.

Pinhasi and MonsterCloud reportedly operated this scheme for years. An exposé in ProPublica in 2019 detailed how the company professed to use its own data recovery methods but instead paid ransoms without informing victims, including law enforcement agencies.

“Pinhasi claimed to fix ransomware while never remediating the underlying threat. Instead, he turned the victim’s crisis into his own profit center,” James C. Barnacle Jr., assistant director of the FBI, said in a statement. “This deception is unacceptable, and the FBI is committed to ensuring accountability for those who choose to victimize the very people who trusted them for help.”

You can read the full indictment below.

The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop.

Malware that takes technical cues from a poem to assemble a growing botnet by targeting open-source AI services has compromised more than 3,400 servers since April, Lumen Technologies’ Black Lotus Labs said in a report Wednesday. 

The poem, which a threat actor wrote and posted on a GitHub repository, seems innocuous but it’s driving a stealthy piece of malware researchers call PoeLLM. Four specific words extracted from the poem, which have been changed at least a dozen times, are converted into a command-and-control server address through a hard-coded dictionary embedded in the malware — a framework that bolsters PoeLLM’s resiliency.

“The most interesting piece of the poem approach is that the IP address used for C2 communications is invisible outside of the victim’s netflow. In other malware samples, there might be a hard-coded fallback C2 address, or URL which points to an IP address written elsewhere on the internet,” Ryan English, information security engineer at Black Lotus Labs, told CyberScoop.

“To anyone who comes across it, this is simply a poem on GitHub. It has no links, no files to download, no encrypted text that could easily be flagged as malicious, even by advanced models,” he added. “There would be no reason for any security researcher to identify this poem as malicious — or know about the IP address hidden within it — unless they had access to the malware referencing it.”

Researchers first encountered PoeLLM infrastructure in June during an investigation into a maximum-severity defect affecting Ivanti’s secure mobile gateway product, Sentry. That discovery uncovered a sweeping exploit-scanning and cryptocurrency-mining botnet linked to multiple compromised services and tools, including LiteLLM, Ollama, Gotenberg and Gitea.

While “PoeLLM has been extremely successful in compromising multiple AI-related services at scale,” the threat actor’s achievements beyond exploit scanning and cryptomining remain under investigation, English said. 

The malware contains functionality that can allow for remote code execution, potentially allowing a threat actor to abuse AI models on victim servers, along with public-facing services for downstream compromise, he added.

“Through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more,” English said.

The botnet has continued to grow by converting compromised servers into attackers and shifting through C2 infrastructure, leaving fewer traces across the internet.

“If one exploit server gets reported by the security community, the attacker can easily pivot and start proxying attacks through hundreds of other compromised victims,” English said. 

The poem serves as a dynamic lookup table for this infrastructure rotation. When the malware retrieves the updated poem from GitHub, it extracts four specific words based on their positions relative to fixed text anchors within the verse. Each extracted word is then matched against a hard-coded dictionary in the malware, where individual words map to sets of IP addresses. The four numbers combine to form the current C2 server address. This means the threat actor can change the entire poem, and thus the C2 location, without updating the malware itself.

“Many of the C2s used in this campaign were never detected on crowd-sourced security tools, indicating that this layer of obfuscation was very helpful in improving the resilience of a C2,” English said.

For instance, the first stanza of the poem, as it was observed last month, reads: “In the silent hum of driver, the machines begin to speak, each pulse of diode threading light through copper veins. We taught the dark to carry meaning, byte by byte — a language built from lightning, cold and clean.”

The malware extracts four specific words from the poem and matches each to a number in a hard-coded dictionary — for example, “driver” equals 92, “diode” equals 119, “decryption” equals 165, and “string” equals 74, combining to form the C2 address. When the threat actor changes the poem’s keywords, the malware automatically calculates a new C2 address without needing to update itself. This keeps the infrastructure invisible to network monitoring tools unless the malware code is directly analyzed.

Black Lotus Labs said the threat actor behind PoeLLM is likely Italian or speaks Italian. Researchers observed multiple comments in the malware code written in Italian and said the threat actor has relied on Italy-based servers for testing and C2 infrastructure. 

Researchers said they don’t know how many people are involved in the PoeLLM’s operation, and they haven’t observed any connections to other groups or campaigns.

The post PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem appeared first on CyberScoop.

Authorities arrested the alleged leader and two additional members of KillSec, a data extortion group primarily run by teenagers that successfully compromised about 500 organizations since 2024, Europol and the Justice Department said Thursday.

Investigators said the alleged leader of the group is 16 years old, but declined to name them. One of the group’s accused members, Fouad Eltibrizi, was arrested Wednesday in the United Kingdom and awaits extradition to the United States, the Justice Department said. 

The Dutch national, who is accused of acting as a negotiator for the group, was indicted last month in Puerto Rico and faces up to 10 years in prison for unauthorized computer access conspiracy. Europol said a suspected developer involved in the group committed multiple crimes before they turned 18 in August.

The arrests were part of “Operation KillSwitch,” a globally coordinated operation aided by 10 countries and private cybersecurity companies. Officials seized KillSec’s data-leak site and at least 110 terabytes of data, including information on the group’s criminal proceeds.

Law enforcement’s accumulated actions targeting KillSec’s infrastructure and people involved “imposed serious cost and degraded the adversary’s core capabilities,” the FBI’s Cyber Division said in a statement on X.

“We have undermined the group’s ability to rebuild, limited their operational reach and reduced the likelihood of future attacks,” the FBI added.

Europol said investigators gained control of domains and five central servers, including infrastructure the group used to manage its activities and store stolen data.

The cybercrime group, which was also known as Kill Security Ransomware Group, exploited various defects to intrude victims’ computers or cloud-based network infrastructure and steal sensitive data for extortion demands. Officials said the group obtained substantial ransom payments in some cases. 

Officials from the United States and Europe searched eight residences in Spain, Greece, the United Kingdom and Romania, and investigators are looking through evidence seized during those raids to identify other potential members of the group. 

Some of the group’s victims were identified by initials and the location and date of the attack in the indictment filed against Eltibrizi. This list includes I.D.O. in Puerto Rico in March 2025, U.S.B.L. in Washington state in March 2025 and A.A. in Louisiana in September 2025.

Three of those victims align with organizations that were listed on KillSec’s data-leak site for Instituto de Ojos, US BioTek Laboratories and Accelerated Academy. 

Prosecutors accuse Eltibrizi, who allegedly participated in the conspiracy from at least March through November 2025, of placing calls as a KillSec representative in at least one of those extortion demands. 

“The defendant and his co-conspirators carried out targeted intrusions against multiple companies and organizations, stealing highly sensitive information and attempting to extort their victims for substantial sums of money,” Héctor Ramírez‑Carbó, acting U.S. attorney for the District of Puerto Rico, said in a statement.

“Ransomware remains a serious and evolving threat to all sectors of our economy, from critical infrastructure to small businesses,” he added.

The post Authorities seize KillSec extortion group infrastructure, arrest 3 alleged members appeared first on CyberScoop.