All news with #cybercriminal tag

📰 A Ukrainian-Russian dual citizen, Oleg Korniev, pleaded guilty to leading a large money laundering ring that processed millions for cybercriminals. The organization, Your Mule Cashout (YMCO), recruited over 15,000 money mules, primarily in the U.S., to move stolen funds through bank accounts and wire services. Korniev admitted laundering at least $7 million and faces substantial prison time and restitution obligations.

🔒 The co-creator and operator of Empire Market, a major dark web marketplace, was sentenced to 40 years in prison for facilitating roughly $430 million in illicit transactions between 2018 and 2020. Operating as a TOR hidden service and modeled after AlphaBay, the site handled over 4 million transactions and primarily trafficked controlled substances. Authorities seized substantial cryptocurrency and assets tied to the operation, and the operator admitted to using encryption and tumblers to evade law enforcement.

🔒 The U.S. Department of Justice says the alleged developer of Ploutus malware, accused of orchestrating ATM jackpotting that stole millions, has appeared in U.S. court following his arrest. Known as "Prometheus" or "The Engineer," 50-year-old Anibal Alexander Canelon Aguirre faces multiple federal charges tied to attacks from February 2024 to December 2025. Authorities allege the stolen funds were laundered and transferred to accounts controlled by the Tren de Aragua criminal gang, which has been designated by U.S. agencies.

🔍 Dutch police arrested a 24-year-old Amsterdam man on September 15 on suspicion of involvement with the ShinyHunters cybercrime group, and investigators say his laptop contained details of two alleged murder plots abroad. Authorities are treating the homicide allegations separately from cybercrime probes and have extended his detention for three months while digital forensic work continues. The suspect, identified by reporting as Pepijn van der Stap, previously served prison time for data theft and later worked as a penetration tester.

🔒 Rydox administrator Ardit Kutleshi pleaded guilty to operating a major illicit marketplace that sold stolen identities, login credentials, credit card data, and cybercrime tools. Arrested in a 2024 international operation that seized the site's domain and servers, Kutleshi was extradited to the U.S. in 2025 and charged with identity theft, money laundering, and related offenses. He faces sentencing in February 2027 and substantial prison time.

🔍 The White House memorandum creates a vetted program permitting private firms to conduct covert access and disruptive cyber operations under DOJ and DHS oversight, but it leaves significant legal, insurance, and commercial exposure with participating companies and their customers. The document relies on an untested reading of the CFAA for criminal protection, offers no civil safe harbor or indemnification, and may increase attribution risk internationally. Non-participating organizations can still inherit risk through shared infrastructure, vendor silence, insurance exclusions, and supply-chain telemetry.

📰 Five alleged leaders of the Black Axe cybercrime syndicate were extradited from South Africa to the United States to face wire fraud, money laundering, and aggravated identity theft charges. Prosecutors allege the defendants ran romance and advance-fee scams targeting U.S. victims from Cape Town between 2011 and 2021, using aliases, social media, dating sites, and VoIP services to defraud and coerce victims. Arrested in 2021 at U.S. request, they face significant prison terms if convicted.

🔍 A 22-year-old Singaporean, Malone Lam, pleaded guilty to leading a group that stole over US $245 million in cryptocurrency from U.S. victims between October 2023 and May 2025. Lam, who used aliases like Anne Hathaway and King Greavy, recruited accomplices via gaming platforms and allegedly orchestrated scams including fake tech support calls. The gang spent lavishly on nightclubs, luxury cars, mansions, private jets, and security, drawing law enforcement attention. Lam faces up to 20 years in prison while co-conspirators receive sentences and ongoing prosecutions continue.

🛡️ An eight-month INTERPOL operation has led to 58 arrests and the identification of 263 suspects linked to West African organized crime groups, including Black Axe. The effort, involving 22 countries across six continents, targeted cyber-enabled fraud, romance and investment scams, and money laundering. Investigations uncovered a major crime-as-a-service network and disrupted call-center and syndicate operations responsible for large-scale thefts and laundering.

📰 International law enforcement actions led to the identification of 263 suspects and 58 arrests connected to West African-organized cybercrime networks during Operation Jackal IV, conducted from November 2025 to June 2026. The operation targeted the Black Axe syndicate and related groups involved in romance, cryptocurrency, investment scams and business email compromise, with arrests and seizures across Argentina, South Africa, Romania and Italy. Authorities disrupted money-laundering services, blocked accounts and confiscated millions while highlighting the use of Crime-as-a-Service and coercion tactics against victims.

📝 This week's Threat Source newsletter by Mick Baccio examines a recent presidential memorandum directing DOJ and DHS to create a program that allows private companies to conduct government-authorized cyber surveillance and effects operations against transnational criminal organizations. The piece highlights operational questions about attribution, intelligence handling, and geopolitical risk, and notes Talos reporting on AI-driven Chinese cybercrime group UAT-10147 and critical active exploits.

🛡️ Research from Cisco Talos and CrowdStrike shows cybercriminals increasingly use AI to write code, manage infrastructure, and accelerate exploitation. Recovered prompts and tooling reveal attackers bypass model guardrails, switch to uncensored models, and embed malicious prompts in shared files to hijack LLM assistants. Supply-chain attacks against AI components and rapid exploitation after PoC releases further magnify risk, while authentication systems and cloud environments see rising compromise.

🔒 A federal judge sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, a ransomware-as-a-service operation active from 2021 to 2023. The group attacked at least 18 companies across the U.S. and abroad, using stolen credentials from initial access brokers, a hidden affiliate panel, and cryptocurrency mixers to process ransoms. The sentence follows an indictment unsealed in 2024 and a separate unresolved prosecution in New Jersey.

🛡️ The interview outlines a partnership between Crime Stoppers International and Fortinet to create the Cybercrime Bounty program, a secure and anonymous channel for private-sector contributors to report suspected cybercriminals. It emphasizes anonymity, Fortinet’s threat-intelligence validation, and the program’s focus on identifying human actors and networks rather than software vulnerabilities. The initiative aims to turn tips into actionable intelligence for law enforcement and strengthen public–private cooperation to disrupt cybercrime at scale.

🔍 Spanish police dismantled an industrial-scale cybercrime and money-laundering operation that stole €140 million via investment fraud and business email compromise. Four suspects were arrested across Spain, Portugal, and Panama after raids on multiple premises and an international operation with Interpol and Europol. Authorities seized digital devices, froze €3 million in proceeds, and identified hundreds of mule accounts used to launder funds.

💼 A Bulgarian national, Rossen G. Iossifov, has been charged with removing $290,000 in government-seized cryptocurrency while serving a 121-month prison sentence for his role in laundering millions from U.S. fraud victims. He appeared in federal court in the Eastern District of Kentucky on counts of removal of property to prevent seizure and conspiracy to commit money laundering. Prosecutors allege he conspired in January 2024 to move funds through exchanges and mixers to evade seizure, and he faces up to 25 years if convicted.

🛡️ A global anti-fraud operation, Operation First Light 2026, ran from January 15 to April 30, 2026, coordinated by Interpol with support from regional partners and funding from China’s Ministry of Public Security. The crackdown targeted social engineering scams such as romance fraud and BEC, leading to over 5,800 arrests, identification of 15,606 suspects and interception of $293m in illicit assets. Actions included raids, freezing 31,014 bank accounts, seizing devices and using Interpol’s I-GRIP stop-payment mechanism.

🔎 A 19-year-old dual US-Estonian citizen, Peter Stokes, was extradited from Finland to the United States to face charges alleging membership in the Scattered Spider hacking collective. He is accused of participating in multiple intrusions and extortion schemes, including a March 2023 breach and a May 2025 attack on a multibillion-dollar retailer that led to over $2 million in losses. Stokes faces charges of fraud, conspiracy, and computer intrusion and has appeared in federal court in Chicago.

📰 The US Justice Department announced the arrest and extradition of 19-year-old dual US-Estonian citizen Peter Stokes from Finland in April, with charges unsealed on June 30. He faces conspiracy, computer intrusion and fraud counts tied to alleged membership in the Scattered Spider hacking group. Authorities say the group conducted over 100 intrusions, netting $100m+ in ransoms and causing millions in damages. Stokes is accused of targeting a luxury jeweller and attempting an $8m extortion that resulted in $2m+ losses for the firm.

🛡️ The 2026 FIFA World Cup presents an unprecedented cyberattack surface across three host countries, with illegal streaming and black-market gambling exposing viewers to significant risks. UpGuard researchers found publicly exposed log systems containing plain-text credentials, IP addresses, and betting details tied to pirate streams and offshore bookmakers. Law enforcement and international operations are disrupting many servers, but resilient criminal networks continue to adapt and monetize audiences via unregulated gambling.