All news with #ransomware gang tag

🔒 UK law enforcement has arrested two teenagers allegedly tied to the Scattered Spider hacking group over an August 2024 cyberattack on Transport for London (TfL). Nineteen-year-old Thalha Jubair and 18-year-old Owen Flowers were detained; authorities say Jubair faces U.S. charges for dozens of intrusions, extortion and money laundering while Flowers faces additional charges linked to U.S. healthcare targets. Prosecutors allege the group extorted at least $115 million in ransoms and that law enforcement previously seized roughly $36 million in cryptocurrency tied to Jubair.

🔎 Researchers at Lumen Technology’s Black Lotus Labs say the SystemBC proxy botnet actively targets commercial VPS instances worldwide to build a high-capacity proxy network. The operation averages about 1,500 bots daily, relies on more than 80 C2 servers, and primarily exploits unpatched systems that often contain dozens of vulnerabilities. Customers and operators exhibit poor operational security, and the service is used by ransomware groups and third-party proxy resellers.

🔒 Researchers have identified CountLoader, a multi‑language malware loader used by Russian ransomware affiliates and initial access brokers to deploy post‑exploit tools such as Cobalt Strike, AdaptixC2 and the commercial PureHVNC RAT. Appearing in .NET, PowerShell and JavaScript flavors, the loader has been observed in PDF phishing campaigns targeting Ukraine and employs LOLBins and multiple download/execution methods to evade detection. The JavaScript variant is most feature‑complete, offering diverse downloaders, execution paths and persistence via a Google‑update‑named scheduled task.

🚓 Law enforcement dismantled a darknet drug shipping operation across the German–Dutch border following an extensive IT-led investigation. Three men, aged 33, 39 and 40, are suspected of selling ecstasy and cocaine on darknet marketplaces and using border-area mailboxes to forward shipments into Germany. Searches of three residences and a boxing studio yielded multi-million-euro quantities of drugs, a firearm, five-figure cash, and numerous electronic devices that will now undergo forensic analysis.

🕵️ Scattered Spider and roughly 15 affiliated ransomware and cybercrime groups posted a joint manifesto on BreachForums claiming to 'go dark' after recent arrests. Experts point to inconsistencies — an unlikely coalition, rapid timing, and no observed money‑movement — and call the announcement a likely smokescreen. They warn organizations not to lower their guard and to assume tactics and infrastructure remain active, taking immediate hardening steps.

🔎 Volodymyr Tymoshchuk, a 28-year-old Ukrainian, has been placed on Europe’s most wanted list over alleged involvement in widespread LockerGoga, MegaCortex and Nefilim ransomware campaigns targeting hundreds of firms between 2018 and 2020. Europol and international partners tied him to high-profile incidents including the 2019 Norsk Hydro attack, which caused major operational disruption. The US has unsealed charges and an $11m reward is being offered for information leading to his arrest or conviction.

🔒 Lovesac reported a cybersecurity incident in which unauthorized actors accessed internal systems between February 12, 2025 and March 3, 2025, with the company detecting the activity on February 28, 2025. The notice to impacted individuals states that full names and additional personal information were stolen, although specific data elements and the total number of affected people were not disclosed. Lovesac says it remediated the intrusion within three days and currently has no indication the information has been misused, but it is advising vigilance for phishing and other fraud. The RansomHub ransomware group claimed responsibility and added Lovesac to its extortion portal; affected individuals are being offered 24 months of Experian credit monitoring.

🔐 Jaguar Land Rover (JLR) is investigating claims by an English‑speaking cybercrime syndicate calling itself “Scattered Lapsus$ Hunters,” which says it accessed JLR systems and is attempting to extort the company. The group shared unverified screenshots on Telegram that allegedly show internal logs and troubleshooting notes. JLR confirmed a cyber incident on September 2 that disrupted sales and production after the company proactively shut down systems; analysts warn that alleged collaboration with ShinyHunters and Lapsus$ could amplify the threat.

🔒 The AWO Karlsruhe-Land reported a cyberattack on 27 August that briefly caused a full outage of its central IT; affected systems were isolated and external IT specialists were engaged. An extortion letter demanding €200,000 allegedly came from the Lynx ransomware group, linked by local reporting to the Russian milieu. Central services were largely restored within a day, investigations with data protection authorities and the Landeskriminalamt continue, and the organisation says the compromised server held employees' employment contracts, prompting stepped-up security measures and staff briefings.

🔍 Europol has confirmed that a circulated Telegram post claiming a reward of up to $50,000 for information on senior Qilin ransomware operators is false. The message originated on a newly created channel (@europolcti) rather than on Europol's official accounts and was amplified by security outlets after being copied. The bogus announcement named alleged aliases "Haise" and "XORacle", and the channel poster later boasted about fooling researchers and journalists. Europol stressed that Qilin remains a significant threat, previously linked to an attack on a UK NHS provider with severe consequences.

🔒 MedusaLocker, a ransomware-as-a-service (RaaS) group active since 2019, has posted a dark web job advert openly recruiting penetration testers and insiders who already have direct access to corporate networks. The advert explicitly instructs applicants not to apply unless they possess network access, signalling a preference for initial access brokers and company insiders. CISA previously linked MedusaLocker to exploitation of RDP vulnerabilities, and the group’s tactic highlights the blurred line between legitimate pentesting and criminal activity. Organisations should prioritise layered defenses, authorised penetration testing, and strict controls over remote access and privileged accounts.

💰 The US Department of Justice announced it seized US $1,091,453 in cryptocurrency linked to the Russian-operated BlackSuit ransomware group following an international takedown of servers, domains and the gang's dark web extortion site. The recovered funds derive from a 49.3120227 Bitcoin ransom payment on or about April 4, 2023; that payment was originally worth US $1,445,454.86. Law enforcement partners in the United States, United Kingdom, Canada, Germany, Ireland and France collaborated on the operation that seized four servers and nine domains on July 24, and the frozen funds were identified after repeated deposits and withdrawals that ended with an exchange freeze in January 2024.

🔍 Europol and Ukrainian authorities announced the arrest of a 38-year-old suspect tied to the Russian-language XSS crime forum after a July 22, 2025 operation led by French investigators. Authorities say the detainee served as a trusted third party, arbitrating disputes and assuring transaction security for members linked to multiple ransomware groups. Reporting traces forum activity and multiple domain registrations tied to the handle 'Toha', but investigation suggests the arrested man is likely Anton Medvedovskiy rather than alternate identities circulated online. The takedown yielded Jabber server logs and forum backups, prompting a wary, contested relaunch.