Authorities in the Republic of North Macedonia filed charges against the alleged administrator of OLVX, a cybercrime marketplace that sold stolen personal data, credentials and malicious tools for attacks since 2023.

The 20-year-old citizen of North Macedonia, who officials identified as “E.A.” in a news release, is accused of commiting computer fraud, misuse of personal data, and production and distribution of child sexual abuse material. 

The arrest comes six months after authorities dismantled the cybercrime platform, arrested the alleged administrator and searched their home in April, according to European authorities. Officials at that time said the cybercrime platform’s sales exceeded $500,000 and a seized server contained a database with more than 2,600 customer accounts.

The FBI provided intelligence to North Macedonian authorities and aided in the joint investigation into OLVX. “The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use,” the FBI Cyber Division said in a LinkedIn post Wednesday. 

“This disruption marks the first-ever cyber operation coordinated between the FBI and North Macedonia, and reflects the FBI’s commitment to working with partners around the world to protect the American people in cyberspace,” the agency added.

Officials said evidence gathered during the investigation revealed that the suspect allegedly offered more than 1,500 sets of stolen credentials for sale. The suspect, who was charged in the village of Golema Rečica near Tetovo, also allegedly administered domains and sites associated with the OLVX platform, which they used to sell stolen data, malicious tools and services between 2023 and 2025.

More recently, including earlier this year, authorities accused the alleged cybercriminal of running an online group on Telegram where illegal services and software were sold to facilitate various forms of cybercrime, including fraudulent refund schemes.

The post Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia appeared first on CyberScoop.

Authorities arrested an alleged leader of ShinyHunters, the notorious cybercrime group responsible for a string of high profile extortion attacks since 2025, including last week’s attack on the FBI.

The Dutch National Police said they arrested a 24-year-old man in Amsterdam accused of participating in the cybercrime group. Officials haven’t named the accused man, but independent cybersecurity journalist Brian Krebs identified him as Pepjin van der Stap, a previously convicted cybercriminal who moonlighted as a cybersecurity professional. 

The arrest, which occurred about a week before ShinyHunters claims it broke into FBI systems and stole reams of data containing sensitive information on almost every FBI agent, marks a major development for global law enforcement’s push to track down and arrest the group’s members. 

“Since last year, this cybercriminal and his co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement on YouTube Tuesday. “They often target third-party vendors in cloud-based platforms, stealing sensitive data and extort victims with threats to publish it.”

The Dutch National Police said they retrieved a large amount of evidence on van der Stap’s laptop, including details about two murders he allegedly ordered abroad. As the investigation continues, a court in Rotterdam ordered him to remain detained awaiting trial for at least 90 days. 

ShinyHunters is among the most prolific cybercrime groups currently in operation. It previously targeted major cloud platforms, healthcare organizations, universities, technology companies, retailers and education service providers. Previous victims of ShinyHunters this year include Instructure, Salesforce, Snowflake and McKesson.

“FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest,” FBI Director Kash Patel wrote in a post on X Tuesday. 

Leatherman, who described van der Stap as an alleged leader of the group, pulled further on that thread, speaking directly to other members of ShinyHunters in his recorded statement. 

“You’ve heard about the arrest of your colleague. We’re confident you’ve seen or heard things in recent days that the public has not. Other groups believed anonymity or their friends would protect them, and they were wrong,” he said. 

“Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you,” Leatherman added. “You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”

The post Alleged ShinyHunters leader arrested in the Netherlands appeared first on CyberScoop.

A 19-year-old alleged member of the Scattered Spider extortion crew was extradited to the United States last week and remains in federal custody awaiting several cybercrime charges, the Justice Department said Wednesday. 

Peter Stokes, a dual citizen of the United States and Estonia, was allegedly involved in Scattered Spider since it formed in 2022 and boasted on social media about the luxurious globetrotting life he enjoyed while he was still a child. 

The cybercrime ring of young, native English-speaking people has infiltrated more than 100 businesses since 2022, and extorted more than $100 million from its victims around the world, officials said. 

“Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement. “Through strong domestic and international partnerships, the FBI will continue to identify, disrupt, and hold cybercriminals accountable, no matter where they are located.”

Stokes, also known as “Bouquet” and “Jordan,” is accused of participating in multiple data theft and extortion attempts, but the FBI only provided specific details about some more recent attacks on a luxury jewelry retailer in May 2025 and a U.S.-based insurance company in June 2025.

Cybercrime researchers have been tracking Stokes’ online activity since 2022.  Microsoft determined his true identity and implicated Stokes as a member of Scattered Spider in a criminal referral in October 2024, according to court records.

He was still a child at that time, and authorities typically don’t arrest known cybercriminals until they reach adulthood. Stokes lived in Estonia and the United Arab Emirates while he allegedly committed some of his crimes. 

Police arrested Stokes in Finland as he attempted to board an April 10 flight to Japan, possessing two hard drives containing allegedly incriminating evidence. He made an initial court appearance in Chicago Tuesday and was ordered to remain in jail.

Stokes exhibited an opulent life before his capture, according to his social media activity and State Department travel records. This included trips and multiple stays in luxury hotels in Paris, Italy, Spain, Germany, New York, Florida, New Mexico, Thailand and Dubai between 2024 and 2025, according to a criminal complaint filed against him in the U.S. District Court for the Northern District of Illinois.

He also posted images of watches, substantial cash and an apparently diamond-encrusted chain depicting the words “Hack the Planet.”

Officials also noted that Stokes’ family appeared to be well off, as his father was a previous executive in two major European companies. 

Stokes was charged with conspiracy, cyber intrusion and fraud offenses.

“The malicious attacks from Scattered Spider caused widespread disruption to businesses and organizations throughout the United States,” Andrew Boutros, U.S. attorney for the Northern District of Illinois, said in a statement. “These charges underscore our unwavering commitment to keeping pace with technologically savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions who do harm to American businesses and victims.”

The post Alleged longstanding member of Scattered Spider extradited to US appeared first on CyberScoop.