2009
Your daily source of cybersecurity news brought to you by Group-IB, one of the global industry leaders.
Group-IB is proud to have supported INTERPOL’s Operation Synergia III, a global cybercrime operation targeting malicious infrastructure used in phishing, malware, ransomware, and online fraud campaigns.
Conducted between July 2025 and January 2026, the international operation brought together law enforcement from 72 countries and territories, resulting in:
🔹 94 arrests (with 110 additional individuals under investigation)
🔹 45,000+ malicious IP addresses and servers taken down
🔹 212 electronic devices and servers linked to cybercriminal activity are seized.
As part of the operation, Group-IB provided adversary-centric threat intelligence on phishing infrastructure and malicious servers, sharing insights into phishing domains, hosting infrastructure, and malware distribution networks used by cybercriminal groups.
🔗 Read the full press release.
#ThreatIntelligence #Cybersecurity #INTERPOL #Ransomware #Phishing
🚨 Indonesia’s tax season exposed a coordinated fraud campaign powered by industrialized malware infrastructure.
Our latest technical deep dive reveals how the GoldFactory threat cluster leveraged shared infrastructure to deploy multiple malware families across an entire national digital ecosystem.
Key highlights:
🔹 A highly synchronized campaign targeted ~67 million tax residents during the 2026 tax season.
🔹 Infrastructure extended beyond tax services, abusing 16+ trusted brands with an estimated USD 1.5–2M systemic impact.
🔹 A multi-stage attack chain combined phishing, vishing, and malicious APK sideloading for full device takeover.
🔹 228 new Gigabud.RAT and MMRat samples were identified, highlighting rapid malware evolution.
🔹 Attribution confirms GoldFactory’s shift toward unified, cross-border fraud infrastructure.
🔹 Proactive infrastructure mapping reduced fraud success to just 0.027% among protected, compromised devices
Read the full technical breakdown.
#CyberSecurity #MalwareAnalysis
🤝Group-IB has signed a strategic partnership with the National Polytechnic University of Armenia to advance cybersecurity education, research, and workforce development.
By embedding predictive threat intelligence, real-world investigative methodologies, and industry-grade tools into academic programs, the collaboration connects students to the same ecosystem that supports global cybercrime investigations bridging education with practical defense capabilities.
The initiative reinforces a shared commitment to developing future cybercrime fighters, strengthening Armenia’s cyber resilience, and building a new generation of professionals ready to anticipate and disrupt evolving threats. Read the full announcement here.
#IncidentResponse #Cybersecurity #ThreatIntelligence #Infosec
🚨Many fraud programs cannot clearly answer two questions: where are we today, and where are we going?
Teams add tools, rules, and processes over time, but visibility and direction often lag behind. The result is fragmented controls, uneven governance, and reactive decisions.
Group-IB’s Unified Counter Fraud Framework provides a structured, seven-step lifecycle that helps organizations assess their current fraud maturity, define a target state, and plan measurable improvement.
Inside the white paper:
🔹 A practical implementation methodology
🔹 A maturity assessment tool for benchmarking
🔹 Guidance for financial institutions, fintechs, and regulators
🔹 Detailed mapping to ISO 37003:2025
Download the white paper.
#CyberSecurity #FraudPrevention #FinancialCrime #Fintech #Compliance
✨We are proud to continue our participation in the Hong Kong Cyber Security Action Task Force, following its extension by the Hong Kong Police Force for another 2 years. This ongoing collaboration reflects the trust placed in Group-IB’s predictive, adversary-focused threat and fraud intelligence, helping authorities and organizations anticipate and disrupt cyber threats before impact.
During the Inauguration Ceremony, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, received the CSATF certificate from Commissioner of Police CHOW Yat-ming in recognition of Group-IB’s contribution to the Cyber Security Action Task Force and its support of law-enforcement efforts in Hong Kong.
At the same event, Vesta Matveeva, Head of Strategic Cybercrime Investigations at Group-IB, was awarded Silver at the Cyber Security Professional Awards 2025 (CSPA), a recognition of investigative excellence and real-world impact.
🔗 Read the full press release.
#LawEnforcement #ThreatIntelligence #CyberCrime #CSPA2025
🚨Group-IB’s first Weaponized AI report reveals how cybercriminals are operationalizing artificial intelligence to drive a fifth wave of cybercrime.
Skills that once required human expertise, such as persuasion, impersonation, and malware development, are now being turned into on-demand services, available at scale and speed. From the abuse of publicly available LLMs to the rise of proprietary Dark LLMs traded on the dark web, AI crimeware is rapidly being commercialized across the underground economy.
Key insights from the report:
✅ Mentions of AI on dark web forums surged 371% between 2019 and 2025, signalling rapid adoption by threat actors.
✅ AI-powered phishing tools are selling for as little as $30 per month.
✅ A growing deepfake-as-a-service market, with synthetic identity kits from US$5 and activity up 52% YoY in 2025.
✅ Criminal-grade LLMs sold for $30–$200 per month, with customer bases exceeding 1,000 users.
👉 Download the full report.
#AI #DarkWeb #Deepfake
🚨 Group-IB has uncovered a sophisticated new threat rewriting the ransomware playbook. DeadLock leverages Polygon smart contracts to rotate proxy addresses, a stealthy, under-reported technique that bypasses traditional defenses by abusing decentralized infrastructure.
Key Highlights:
🔹 Decentralized Proxy Management: Uses Polygon smart contracts to dynamically retrieve and rotate proxy server addresses, complicating takedowns.
🔹 Service Disruption: Employs a custom PowerShell script to stop all non-whitelisted Windows services, sparing only native processes & its own RMM tool, AnyDesk.
🔹 Evolving Extortion: Ransom notes have matured from simple encryption alerts to explicit threats of selling stolen data, even offering "security reports" and promises not to re-target victims.
🔹Infrastructure Tracking: We traced proxy servers and smart contract transactions, revealing dedicated infrastructure & recent reactivation of operations.
Read the full technical analysis.
#ThreatIntelligence #DeadLockRansomware
🚨 Tap-to-pay fraud has evolved into a remote, industrialized threat. Chinese cybercrime groups are now selling NFC relay malware on Telegram, enabling real-time payment fraud from anywhere in the world.
Our latest research breaks down the full ecosystem from malware vendors and illicit POS terminals to mule networks and provides technical analysis of key families like TX-NFC and NFU.
Learn how this threat works and how to defend against it. 🔗 Read the full report.
#CyberSecurity #MalwareAnalysis #NFCFraud #AndroidSecurity #FraudPrevention #ThreatIntelligence #FightAgainstCybercrime
🚨Android-based financial fraud in Uzbekistan has entered a new stage of operational maturity, with threat actors shifting from simple SMS stealers to sophisticated, multi-stage infection chains built around stealthy droppers, advanced obfuscation, and automated infrastructure.
Key Highlights:
🔹Over $2M stolen by a single tracked group since January 2025
🔹Two primary dropper families, MidnightDat and RoundRift, were identified using native decryption and encrypted asset storage.
🔹Wonderland, a new SMS stealer with bidirectional WebSocket C₂, enables real-time command execution, SMS sending, and USSD control.
🔹Telegram remains the central distribution channel, fueled by stolen sessions sold on dark web markets.
🔹Thousands of unique samples generated through automated build pipelines to evade signature-based detection
🔗 Read the full analysis here.
#ThreatIntelligence #AndroidMalware
As digital lending accelerates in Uzbekistan, cybercriminals are exploiting verification gaps, low financial awareness, and social engineering to weaponize online credit services at scale turning personal identity into a profitable attack surface.
Key Highlights:
🔹 Online credit fraud cases surged 42% in 2024 compared to 2023
🔹 34% of incidents involved fraudsters posing as bank or government officials
🔹 Microcredits are approved using stolen passport, FaceID, and OTP data
🔹 Scammers deploy Telegram bots and SMS-stealers to bypass authentication
🔹 New regulations now allow victims to be exempt from repaying fraudulent loans
Our latest analysis breaks down the evolving fraud ecosystem, the social engineering tactics behind it, and the controls financial institutions must implement to stay ahead.
Read the full report here.
#FraudIntelligence #ThreatIntel #DigitalFraud #SocialEngineering #CyberSecurity
🚨 New launch: Fraud moves fast. Now defense does too.
Announcing the Cyber Fraud Intelligence Platform: real-time, privacy-preserving fraud intelligence sharing for banks, payment providers, e-commerce, gaming, and telecoms.
🔹Share risk signals on suspicious activity, not just confirmed fraud.
🔹Stop APP fraud & mule networks before funds are lost.
🔹GDPR-compliant, Bureau Veritas verified.
🔹Personal data never leaves your organization.
Collective problem. Collective defense.
📄 Read the press release here.
🔗 Learn more.
#CFIP #Cybersecurity #GDPR #AppFraud
🚨 New Threat Report Released: UNC2891 — ATM Threats Never Die
A financially motivated threat actor infiltrated banking networks using a Raspberry Pi connected to an ATM switch, deployed custom malware like CAKETAP and SLAPSTICK, and maintained undetected access for years.
From DNS tunneling to money mule recruitment via Telegram see how modern attackers operate.
🔗 Get the full breakdown of UNC2891’s TTPs, malware analysis, and incident response insights.
#CyberSecurity #ThreatIntelligence #ATMThreats #FinancialSecurity
🚨 New technical deep-dive: “Ghosts in / proc” 🚨
Attackers are no longer just hiding files, they are rewriting what the OS shows. Our new research demonstrates how adversaries manipulate Linux’s / proc filesystem to spoof process names and corrupt forensic timelines, effectively making malicious activity look benign.
Key Highlights:
🔹Malicious processes spoofing / proc/<pid>/cmdline so tools like ps and top report harmless names
🔹Timeline corruption via modified / proc/<pid>/stat start times processes can appear to start in the future
🔹When / proc is trusted in isolation, triage, timeline stitching, and attribution can all fail
🔹Full lab walkthrough, indicators, and practical mitigations included
🔗 Read the full analysis here.
#ThreatIntel #LinuxSecurity #DFIR #CyberSecurity #IncidentResponse
Group-IB Threat Intelligence has uncovered a global phishing campaign orchestrated by MuddyWater (TA450). The phishing campaign targeted international organizations and more than 100 governments worldwide to gather foreign intelligence using the Phoenix V4 malware.
Key highlights:
🔹 Over 100 governments and international organizations targeted globally
🔹 Use of FakeUpdate injector and Phoenix v4 malware with new persistence methods
🔹 Integration of legitimate RMM tools (Action1, PDQ) and a custom Chromium credential stealer
🔹 C2 infrastructure hosted behind Cloudflare and active for just five days, indicating strong OPSEC discipline
This campaign highlights how MuddyWater continues to evolve its tradecraft, blending social engineering, custom malware, and legitimate tools to gather foreign intelligence.
Read the full technical analysis here.
#ThreatIntelligence #APT #Phishing #MuddyWater #CyberSecurity #MalwareAnalysis
We are proud to unveil our first Cyber Fusion Center in the Asia-Pacific region, located within the Digital Crime Resistance Center, Singapore.
The Cyber Fusion Center integrates core capabilities, including Threat Intelligence, Digital Forensics & Incident Response, Managed XDR, Attack Surface Management, Digital Risk Protection, and Fraud Protection, into one unified, intelligence-driven ecosystem.
Unlike conventional SOCs, the Cyber Fusion Center delivers proactive, AI-powered threat hunting and fraud prevention, giving organizations real-time visibility and rapid response across their digital environments. Read the full announcement.
#CyberFusionCenter #ThreatIntelligence #ManagedXDR #FraudPrevention #FightAgainstCybercrime
🚨MuddyWater is back, and Operation Olalampo reveals how the actor continues to refine its intrusion tradecraft. This campaign combines macro-delivered payload chains, stealthy in-memory loaders, and a Rust-based Telegram C2 backdoor to maintain persistence and evade detection. Our analysis exposes sandbox-evasion techniques, fragmented encrypted communications, infrastructure reuse, and operator telemetry that provides rare insight into post-exploitation behavior.
Key highlights include the discovery of new malware variants, selective loader execution paths, AI-assisted development indicators, and backend infrastructure revealing how victims are tracked and managed with defensive recommendations including RMM tool restrictions, Telegram API monitoring, and memory integrity controls.
Dive into the full technical breakdown to understand the tooling, tactics, and defensive implications behind MuddyWater's latest operation.
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #MuddyWater #Infosec
🔐 How to share suspicious fraud data without breaking privacy laws
Until now, banks couldn't share intelligence on suspicious accounts without risking GDPR violations.
Group-IB's Cyber Fraud Intelligence Platform solves this with Bureau Veritas-validated Distributed Tokenization.
Watch our 18-minute panel discussion with experts explaining:
✅ Why SHA-256 hashing fails privacy standards
✅ How distributed tokenization enables compliant collaboration
✅ How to stop APP scams as early as during the warm-up phase before any losses
👉 Watch now!
🎉 Our High-Tech Crime Trends (HTCT) 2026 Report is here!
Supply chain attacks have become the dominant force reshaping the global cyber threat landscape.
Group-IB's HTCT Report 2026 reveals a decisive shift in cybercrime away from isolated intrusions toward ecosystem-wide compromise. Attackers are now exploiting trusted vendors, open-source software, SaaS platforms, and managed service providers to gain inherited access to hundreds of downstream organizations.
Key findings:
🔹 Open-source ecosystems under siege npm and PyPI targeted with stolen credentials & automated malware worms
🔹 Malicious browser extensions weaponized to harvest credentials and hijack sessions
🔹 AI-powered phishing campaigns bypassing MFA through OAuth workflows
🔹 Data breaches triggering multi-tenant, cascading downstream impact
🔹 Industrialized ransomware supply chains coordinating upstream access
📥 Download the High-Tech Crime Trends Report 2026.
🔗 Read the full press release.
#CyberSecurity #SupplyChainAttack #HTCT2026
🚨ShadowSyndicate isn’t a single campaign or threat actor, it’s a malicious activity cluster formed by numerous servers sharing the same SSH fingerprints. That infrastructure is used for hosting of various attack frameworks and is involved in multiple, mostly ransomware, cyber operations.
Our latest research breaks down how reuse of SSH fingerprints performed with OPSEC inaccuracies reveals links between seemingly unrelated activities. Discovered server clusters have the same use as known ones: various C2 frameworks running on servers, connections to multiple cyber campaigns attributed to different threat actors. All of that points to ShadowSyndicate’s likely role as either an Initial Access Broker or a Bulletproof Hosting provider.
For threat intelligence teams, these patterns matter. Infrastructure reuse creates opportunities for earlier detection, stronger correlation, and more effective disruption across the cybercrime supply chain. Read the full technical analysis here.
#CyberSecurity #ShadowSyndicate
🎉 Group-IB announces the launch of Cloud Security Posture Management (CSPM) as part of our Unified Risk Platform. Designed to help organizations reduce risks associated with cloud transformation, it ensures business continuity by identifying misconfigurations, eliminating compliance gaps, and enhancing cloud security from initial development through to deployment.
What makes Group-IB CSPM different:
🔹 See the configurations that matter most: By enriching posture findings with real-world exposure data from Group-IB Attack Surface Management and industry-leading Group-IB Threat Intelligence, your team sees cloud risks as attackers would.
🔹 Combined with built-in CI/CD misconfiguration checks and a unified Group-IB ecosystem, it goes beyond traditional CSPM to give you deep visibility that closes active cloud risks.
Read the full press release to learn how Group-IB is redefining cloud security posture management.
#CloudSecurity #CSPM #CyberSecurity
🚨Peruvian Peaks: The Illusion of Digital Loans
Phishing scams based on fake digital loan offers are growing at an alarming rate in Peru and across Latin America. In this new technical blog, we present an in‑depth investigation into a fraudulent campaign that combines social media advertising, bank impersonation, and advanced credential‑harvesting techniques.
Since 2024, Group‑IB has identified approximately 370 fraudulent domains and dozens of malicious social‑media advertisements, all designed to mimic legitimate loan application processes in order to capture sensitive financial data, including card numbers, PINs, and online banking credentials, for sale on underground markets or use in further attacks.
👉 Discover how this scheme operates, why it is so effective, and what risks it poses to the regional financial ecosystem. Read the full technical analysis here.
#DigitalLoans #PhishingScams #CyberSecurity #FraudPrevention #LATAM #OnlineScams
Most organizations are stuck in survival mode. Real resilience is achieved when we move beyond reaction to planning ahead with real-world threat intelligence.
Gartner report highlights:
🔹 90% of attacks will exploit known vulnerabilities by 2028
🔹 Most can be prevented with strategic Threat Intelligence
🔹 Threat intelligence reduces MTTD & MTTR and strengthens overall readiness.
Download the report.
#ThreatIntelligence #CyberSecurity #IncidentResponse #CyberAwareness #GartnerReport
💸 “Easy money. Simple tasks. Work from your phone.”
Our latest analysis exposes a coordinated wave of fake online job ads sweeping across the Middle-East and Africa region. These aren't isolated scams, they are a large-scale, organized operation exploiting the demand for remote work to steal personal data and funds.
Key insights from our investigation:
🔹 Over 1,500 fraudulent job ads identified in 2025, impersonating trusted e-commerce platforms, banks, and even government ministries.
🔹 Ads are highly localized, using Arabic dialects and regional currencies to appear authentic.
🔹 Victims are funneled from social media into private Telegram and WhatsApp groups, where sensitive information and upfront “deposits” are collected.
🔹The scam infrastructure includes fake registration portals, cloned branding, and repeat behavioral patterns among attackers.
Read More.
#CyberSecurity #OnlineScams #MENA #Phishing #DigitalRisk #FraudPrevention #ThreatIntelligence
Group-IB’s Red Team has identified two previously unknown zero-day vulnerabilities in widely used enterprise platforms: Cisco UCCX and IBM Sterling.
Following responsible disclosure, both vendors validated the findings and released security updates to protect their customers.
This discovery highlights the strength of Group-IB’s approach to rigorous, dependable, and attributable analysis. By leveraging deep empirical threat intelligence to replicate highly advanced attacks, our teams reveal critical risks that many other security assessments overlook.
Full technical details are available in our press release.
#CyberSecurity #ZeroDay #VulnerabilityAssessment #ThreatIntelligence #EnterpriseSecurity #SecurityUpdates #FightAgainstCybercrime
Group-IB’s latest threat report exposes the full scale of GoldFactory’s mobile fraud operation, one of the most technically advanced campaigns currently targeting APAC.
Key insights:
🔹A surge of 300+ modified banking apps, patched with injected modules to bypass security and retain full legitimate functionality
🔹Over 11,000 device infections traced through Group-IB Fraud Protection telemetry
🔹A unified ecosystem of loaders (Gigabud, Remo, MMRat) delivering secondary payloads such as SkyHook
🔹New Gigaflower variant features experimental OCR and QR code scanning to auto-extract ID card data.
🔹Infrastructure overlaps linking open directories and shared S3 buckets hosting malicious binaries
This report reveals how GoldFactory has industrialized mobile fraud by weaponizing legitimate apps and what defenders need to know now. Read the full analysis.
#MobileBanking #CyberSecurity #APACThreats #BankingMalware #GoldFactory
🚨Bloody Wolf Expands Across Central Asia 🚨
Since June 2025, Group-IB analysts have been tracking a rapidly evolving campaign by Bloody Wolf, an APT group weaponizing trusted government identities to deliver lightweight but highly effective JAR-based loaders.
By impersonating Ministries of Justice and abusing legitimate remote-access software like NetSupport Manager, the group has quietly scaled its operations from Kyrgyzstan to Uzbekistan supported by geo-fenced infrastructure, tailored lures, and a custom JAR generator designed for stealth and persistence.
Key highlights:
🔹 Their spear-phishing techniques and localized PDF lures
🔹 How custom JAR loaders deploy NetSupport RAT
🔹 Infrastructure masquerading as government portals
🔹 Multi-layered persistence and evasion methods
🔹 IOCs, MITRE mapping, & defensive recommendations
Bloody Wolf shows how low-cost tools & precise social engineering can evolve into regionally impactful cyber operations. Read the full analysis.
#CyberSecurity #BloodyWolf
🚨Uncovering a Multi-Stage Phishing Kit Targeting Italy’s Infrastructure
Phishing has evolved, becoming industrialized, automated, and powered by underground ecosystems that mirror legitimate SaaS businesses.
Our latest investigation exposes a professional phishing framework impersonating Aruba S.p.A., Italy’s major IT and web services provider.
The key findings:
🔹 Multi-stage kit automating every phase of the attack from CAPTCHA evasion to OTP interception
🔹 Pre-filled login URLs designed to increase credibility and lower suspicion
🔹 Fake payment pages harvesting full credit card and 3D Secure/OTP data
🔹 Telegram bots used for real-time exfiltration and backup data logging
🔹 Evidence of Phishing-as-a-Service (PhaaS) scaling fraud through automation and community support
Phishing may be one of the oldest cyber threats, but today, it operates like a fully industrialized ecosystem.
🧩 Read the full technical analysis here.
#ThreatIntelligence #CyberSecurity #Phishing #CyberCrime
Investment scams are no longer isolated schemes, they have evolved into industrialized, multi-actor fraud networks operating at a global scale.
Key highlights:
🔹 A shared centralized backend powers hundreds of fake trading platforms, linked through recurring API endpoints, reused SSL certificates, and identical admin panels.
🔹 Chatbots act as automated operators screening victims, simulating support, and distributing payment instructions that expose valuable artifacts for attribution.
🔹 Fraud groups exploit weak KYB/KYC processes using forged documents and biometric bypass services traded on Telegram to open mule accounts.
🔹 Auxiliary infrastructure such as chat simulators and exposed admin panels fabricates investor activity and leaves technical footprints that analysts can pivot on.
Our report maps the Victim Manipulation Flow, details the infrastructure links, and exposes the mechanics behind the illusion.
Read the full technical report.
#InvestmentScams #Cybersecurity
Group-IB has uncovered a coordinated scam operation exploiting verified Google Ads, deepfake videos, and fake news outlets to impersonate Singapore’s government officials and noted public figures in a fraudulent investment campaign known as the “Immediate Era” scam.
Our latest Threat Intelligence Report details how this operation leveraged:
🔹28 verified Google advertiser accounts targeting Singapore users
🔹Over 50 intermediary redirect domains to evade detection
🔹Fabricated media sites mimicking CNA and Yahoo! News
🔹AI-generated deepfakes used to build false credibility
This case highlights a new era of organized, cross-border financial fraud, where legitimacy is simulated through verified platforms and regulatory loopholes. Read the full technical breakdown here.
#CyberSecurity #DeepfakeAwareness #ScamAlert #FightAgainstCybercrime
89% of IT departments allow bring-your-own-device policies. At the same time 46% of compromised systems are unmanaged devices mixing personal and corporate accounts.
But how do you detect threats from unmanaged devices if you only monitor the perimeter?
This is the problem with many NDR deployments. They cover north-south traffic, but miss the internal connections where credential theft and lateral movement unfold.
Group-IB’s new blog post explains what real internal visibility looks like and why it matters.
#CyberSecurity #NDR #EndpointProtection #DataSecurity #ThreatDetection #FightAgainstCybercrime