volkov

Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST updates its DNS security guidance for the first time in over a decade DNS infrastructure underpins nearly every network connection an organization makes, yet security configurations for it have gone largely unrevised at the federal guidance level for more than twelve years. NIST published SP 800-81r3, the Secure Domain Name System Deployment Guide, superseding a version that dates to 2013. The document covers three main areas: using DNS as an active security control, securing the DNS protocol itself, and protecting the servers and infrastructure that run DNS services. Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructure Security Agency warned on Friday. Your AI agents are moving sensitive data. Do you know where? In this Help Net Security interview, Gidi Cohen, CEO at Bonfy.AI, addresses what he sees as the most pressing gap in AI agent security: data-layer risk. While the industry focuses on prompt injection and model behavior, Cohen argues the deeper threat is autonomous AI agents operating across systems with no visibility into what data they access, combine, or expose. Quantum threats are already active and the defense response remains fragmented Enterprises are moving toward post-quantum security at uneven speeds, and the gap between organizations that have built crypto-agility into their infrastructure and those that have adopted the label without the underlying capability is widening. Dr. Tan Teik Guan, CEO of Singapore-based cybersecurity company pQCee, draws a sharp line between the two. Crypto-agility, in his view, requires more than support for multiple algorithms or protocol-level negotiation. Measuring security performance in real-time, not once a quarter Most organizations have invested heavily in security products over the past decade. The assumption embedded in that spending is that more tools equal better protection. Tim Nan, CEO of digiDations, says that assumption is the most persistent misconception he encounters when working with security leaders across industries. NVIDIA puts GPU orchestration in community hands GPU-accelerated AI workloads now run on Kubernetes in the large majority of enterprise environments. Managing those workloads at scale has required specialized tooling that, until now, remained under vendor control. NVIDIA moved to change that at KubeCon Europe in Amsterdam this week, donating its Dynamic Resource Allocation (DRA) Driver for GPUs to the Cloud Native Computing Foundation (CNCF). TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware TeamPCP continues is supply chain compromise rampage, with telnyx on PyPI being the latest maliciously modified package. The AI safety conversation is focused on the wrong layer Organizations have spent years accumulating fragmented identity systems: too many roles, too many credentials, too many disconnected tools. For a workforce of humans, that fragmentation was manageable. Humans log in, log out, and make decisions slowly enough that gaps in control rarely turned into immediate incidents. AI agents operate differently. Training an AI agent to attack LLM applications like a real adversary Most enterprise software development teams now ship AI-powered applications faster than traditional penetration testing can keep up with. A security team with 500 applications may test each one once a year, or less. In the time between tests, the underlying models, integrations, and behaviors can change, with no corresponding security review. Novee launched a product it calls AI Red Teaming for LLM Applications, an AI pentesting agent built specifically to probe LLM-powered software. Your facilities run on fragile supply chains and nobody wants to admit it In this Help Net Security interview, Christa Dodoo, Global Chair at IFMA, discusses how facility managers are managing supply chain risk in critical building systems. She explains how sourcing, localized redundancy, and flexible infrastructure design are being integrated into resilience planning. A nearly undetectable LLM attack needs only a handful of poisoned samples Prompt engineering has become a standard part of how large language models are deployed in production, and it introduces an attack surface most organizations have not yet addressed. Researchers have developed and tested a prompt-based backdoor attack method, called ProAttack, that achieves attack success rates approaching 100% on multiple text classification benchmarks without altering sample labels or injecting external trigger words. AI SOC vendors are selling a future that production deployments haven’t reached yet Vendors selling AI-powered security operations platforms have built their pitches around a consistent set of promises: autonomous threat investigation, dramatic reductions in analyst workload, and an accelerating path toward humanless operations. Practitioners buying and deploying those platforms describe something different. Top product launches at RSAC 2026 RSAC 2026 showcased a wave of innovation, with vendors unveiling technologies poised to redefine cybersecurity. From AI-powered defense to breakthroughs in identity protection, this year’s conference delivered a glimpse into the future. Here are the most interesting products that caught our attention, and could shape what’s next. Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whether the vulnerability has been exploited as a zero-day, but has urged customers to apply the updates or provided mitigations as soon as possible. GitHub-hosted malware campaign uses split payload to evade detection A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub, Netskope researchers have warned. These “lures” are highly polished and appear legitimate, occasionally mimicking real projects, thus making them difficult to distinguish from safe software. Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE-2026-3055) Citrix has fixed two vulnerabilities in NetScaler ADC and NetScaler Gateway, with the more serious flaw (CVE-2026-3055) potentially allowing attackers to extract active session tokens from the memory of affected devices. LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks A slew of supply chain attacks against popular open source tools and packages appears to have been orchestrated by TeamPCP, a cybercriminal group that rose to prominence in late 2025. The latest victim of the group is BerryAI’s popular LiteLLM library, a unified interface that makes it easier for apps to switch between various LLMs: on March 24, TeamPCP uploaded two compromised versions (1.82.7 and 1.82.8) on PyPI that included a credential stealer and a malware dropper. Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect implants used by the China-based group dubbed Red Menshen, Rapid7 researchers have released a scanning script. CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33017, a recently disclosed code injection vulnerability in Langflow, an open-source framework for building AI agents and workflows, and CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner. Product showcase: Cross-platform and third-party endpoint patching with Action1 Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. You don’t have to choose between BAS or automated pentesting, you shouldn’t There’s a debate making the rounds in security circles that sounds reasonable on the surface but falls apart under operational scrutiny: Which is better, breach and attack simulation (BAS) or automated penetration testing (APT)? Security vendors have stoked this debate for obvious reasons, with some even explicitly arguing that automated pentesting should replace BAS entirely. But for practitioners responsible for defending an organization, this framing is the problem. It represents a coverage regression disguised as simplification. Why your phishing simulations aren’t building a security culture Security culture isn’t built by phishing simulations. In this Help Net Security video, Dan Potter, VP of Cyber Resilience at Immersive, argues that annual training videos and quarterly phishing tests happen in calm, controlled settings that tell us nothing about how people perform when a real incident hits. Russian hackers go after high-value targets through Signal Russian intelligence-linked hackers are targeting commercial messaging platforms, with Signal a primary focus, the FBI and CISA warn. The campaign is aimed at individuals of intelligence interest, including government personnel, journalists, and others with access to sensitive communications. The devices winning the race to get hacked in 2026 Enterprise networks keep adding connected devices, expanding the attack surface as threat actors target a wider range of systems, many of which are difficult to inventory, secure, and patch consistently. Forescout’s 2026 Riskiest Devices research maps that shift in IT, IoT, OT, and IoMT environments, with 11 new riskiest asset types entering the list this year. GitHub just made it much harder to ship a vulnerable pull request GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public preview planned for early Q2. The update is intended to improve code scanning, secret detection, and dependency analysis within repositories hosted on the platform. 32% of top-exploited vulnerabilities are over a decade old Exploitation timelines continued to compress in enterprise environments, with newly disclosed flaws reaching active use almost immediately and older weaknesses remaining active years after disclosure. Findings from Cisco Talos’ 2025 Year in Review show how attackers combined rapid weaponization with long-term exposure spanning infrastructure, identity systems, and user workflows. Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months A Russian citizen, Aleksei Volkov, was sentenced to 81 months in prison for helping ransomware groups carry out attacks causing over $9 million in actual losses and over $24 million in intended losses, after being arrested in Italy and extradited to the United States where he pleaded guilty. Uncle Sam closes the door on all new foreign-made routers The US Federal Communications Commission (FCC) has imposed a ban on all new routers manufactured overseas being imported into and sold within the United States. The move follows a determination by a White House-led interagency group that consumer-grade routers produced outside the United States pose what officials described as an “unacceptable risk” to national security and public safety. Anthropic trims action approval loop, lets Claude Code make the call Auto mode is a new permissions feature in the Claude Code system that allows the AI to make approval decisions on a user’s behalf while safeguards review actions before execution. The feature is available on Team plans and requires administrator approval before use, with support for Enterprise and API users expected soon. Gemini picks up criminal activity buried in dark web noise To help teams make faster and more accurate decisions on emerging threats, Google has introduced a dark web intelligence capability in Google Threat Intelligence. Powered by Gemini, the feature analyzes millions of dark web events each day and surfaces threats relevant to an organization’s operations. Botnet operator behind $14 million in ransomware extortion payments gets 24 months behind bars A Russian national has been sentenced to 24 months in prison after admitting he managed a botnet used to launch ransomware attacks against dozens of U.S. companies. The judge also imposed a $100,000 fine and ordered him to forfeit $1.6 million linked to the scheme. Google races to secure encryption before quantum threats arrive Google is preparing for the quantum era, a turning point in digital security, with a 2029 timeline for post-quantum cryptography (PQC) migration. Security professionals warn that current encryption could be broken by large-scale quantum computers in the coming years. This risk is already relevant due to store-now-decrypt-later attacks. Mission to smuggle $170 million worth of AI tech to China collapsed for three men Three individuals, Stanley Yi Zheng, Matthew Kelly, and Tommy Shad English, have been charged with conspiracy to commit smuggling and export control violations after allegedly attempting to procure millions of dollars’ worth of restricted computer chips from a California-based hardware company. Second RedLine infostealer operator ends up in US custody Hambardzum Minasyan, an Armenian man extradited to the United States, is accused of conspiring with others to develop and operate the RedLine infostealer malware used to steal sensitive data, including login credentials, from victims’ computers. Ajax data breach exposed season tickets, supporter bans open to tampering AFC Ajax, the Dutch football club from Amsterdam, disclosed that an unknown hacker gained access to parts of its IT systems and obtained the email addresses of a few hundred people. The hack exploited vulnerabilities in Ajax’s app and website, including exposed APIs and shared access keys. Plumber: Open-source scanner of GitLab CI/CD pipelines for compliance gaps GitLab CI/CD pipelines often accumulate configuration decisions that drift from security baselines over time. Container images get pinned to mutable tags, branches lose protection settings, and required templates go missing. An open-source tool called Plumber automates the detection of those conditions by scanning pipeline configuration and repository settings directly. Attackers are handing off access in 22 seconds, Mandiant finds Exploits remain the leading entry point for attackers for the sixth consecutive year, according to Mandiant’s M-Trends 2026 report, which draws on more than 500,000 hours of incident response work conducted in 2025. The data shows attackers speeding up their internal hand-offs, shifting away from email phishing, and targeting backup and virtualization infrastructure with greater precision. Microsoft details AI prompt abuse techniques targeting AI assistants Prompt abuse occurs when crafted inputs manipulate an AI system into producing unintended behavior, such as attempting to access sensitive information or overriding built-in safety instructions. Prompt injection is also recognized as one of the top risks in the 2025 OWASP guidance for LLM applications. Kali Linux 2026.1 ships BackTrack mode, eight new tools, and a kernel upgrade to 6.18 Penetration testers running Kali Linux have a new release to work with. Version 2026.1 delivers the annual theme refresh, a new BackTrack-inspired mode in kali-undercover, eight tools added to the network repositories, a kernel bump to 6.18, and several Kali NetHunter changes. Your security stack looks fine from the dashboard and that’s the problem One in five enterprise endpoints is operating outside a protected and enforceable state on any given day, according to device telemetry collected across tens of millions of corporate PCs. That figure, drawn from Absolute Security’s 2026 Resilience Risk Index, has barely moved in a year, even as organizations continue to add security tools and increase spending. Google’s TurboQuant cuts AI memory use without losing accuracy Large language models carry a persistent scaling problem. As context windows grow, the memory required to store key-value (KV) caches expands proportionally, consuming GPU memory and slowing inference. A team at Google Research has developed three compression algorithms: TurboQuant, PolarQuant, and Quantized Johnson-Lindenstrauss (QJL). All three are designed to compress those caches aggressively without degrading model output quality. Microsoft hands Entra ID users new option for MFA Organizations rely on MFA to enforce identity checks before granting access to systems and services. Microsoft has made external MFA generally available in Microsoft Entra ID, expanding support for third-party identity providers. External MFA supports organizations that use third-party MFA solutions to meet regulatory or business requirements, handle scenarios such as mergers and acquisitions, or maintain a consistent MFA approach within Microsoft Entra ID. Unbreakable Enterprise Kernel 8.2 ships with confidential computing support, XFS live repair Many enterprise Linux deployments rely on hardware-level memory isolation to protect sensitive workloads from co-tenants and compromised hypervisors. Oracle’s Unbreakable Enterprise Kernel 8.2 (UEK 8.2) extends that capability on Oracle Linux with support for Intel Trust Domain Extensions, along with a set of file system and memory management changes intended to reduce downtime and improve diagnostic visibility. Who owns AI agent access? At most companies, nobody knows AI agents are operating across production enterprise environments at scale, and the identity infrastructure managing their access has not kept up with their deployment. A January 2026 survey of 228 IT and security professionals, conducted by the Cloud Security Alliance, finds that the majority of organizations have AI agents active in core systems, with fragmented ownership of how those agents authenticate and what they can access. Reddit declares war on bad bot activity Reddit is introducing changes to support interactions between people. The company is taking a bottom-up approach to help users understand when they are engaging with another person unless an account is labeled otherwise. Reddit plans to verify that users are human without requiring disclosure of real-world identity. GitHub jumps on the bandwagon and will use your data to train AI GitHub updated how it uses data to improve AI-powered coding assistance. Starting April 24, interaction data from Copilot Free, Pro, and Pro+ users may be used to train and improve GitHub’s models unless users opt out. Copilot Business and Copilot Enterprise users are not included in this change. Tails 7.6 ships automatic Tor bridge retrieval and a new password manager Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Make OpenAI’s models misbehave and earn a reward OpenAI’s public Safety Bug Bounty program focuses on AI abuse and safety risks across its products. The goal is to support safe and secure systems and reduce the risk of misuse that could lead to harm. This program complements the Security Bug Bounty. It accepts reports of abuse and safety risks that do not meet the criteria for a security vulnerability. AI frenzy feeds credential chaos, secrets leak through code, tools, and infrastructure Code keeps moving through pipelines, and credentials continue to surface alongside it. GitGuardian’s State of Secrets Sprawl 2026 puts the count at 28.65 million new hardcoded secrets in public GitHub commits in 2025, extending a multi-year rise in exposed access keys, tokens, and passwords. Cybersecurity jobs available right now: March 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices. The activity has been attributed with high confidence to the Russian state-sponsored threat group known as TA446, which is also tracked by the broader cybersecurity community under the monikers Callisto, COLDRIVER, and Star Blizzard (formerly SEABORGIUM). It's assessed to be affiliated with Russia's Federal Security Service (FSB). The hacking group is known for spear-phishing campaigns aimed at harvesting credentials from targets of interest. However, attacks mounted by the threat actor over the past year have targeted victims' WhatsApp accounts, as well as leveraged various custom malware families to steal sensitive data. The latest activity, highlighted by Proofpoint and Malfors, involves using fake "discussion invitation" emails spoofing the Atlantic Council to facilitate the delivery of GHOSTBLADE, a dataminer malware, via the DarkSword exploit kit. The emails were sent from compromised senders on March 26, 2026. One of the email recipients was Leonid Volkov, a prominent Russian opposition politician and the political director of the Anti-Corruption Foundation. An automated analysis triggered by Proofpoint's security tools is said to have redirected to a benign decoy PDF document, likely because of server-side filtering put in place to only lead iPhone browsers to the exploit kit. "We have not previously observed TA446 target users' iCloud accounts or Apple devices, but the adoption of the leaked DarkSword iOS exploit kit has now enabled the actor to target iOS devices," Proofpoint said. The enterprise security firm also noted that the volume of emails from the threat actor has been "significantly higher" in the last two weeks, adding that these attacks lead to the deployment of a known backdoor referred to as MAYBEROBOT via password-protected ZIP files. The group's use of DarkSword has also been corroborated by the fact that a DarkSword loader uploaded to VirusTotal has been found to reference "escofiringbijou[.]com," a second-stage domain attributed to the threat actor. A urlscan.io result has revealed that the TA446-controlled domain has served the DarkSword exploit kit, including the initial redirector, exploit loader, remote code execution, and Pointer Authentication Code (PAC) bypass components. However, there is no evidence that sandbox escapes were delivered. It's suspected that the TA446 is repurposing the DarkSword exploit kit for credential harvesting and intelligence collection, with Proofpoint noting that the targeting observed in the email campaign was "much wider than usual" and that it included government, think tank, higher education, financial, and legal entities. This, in turn, has raised the possibility that the threat actor is leveraging the new capability afforded by DarkSword as part of an opportunistic campaign against a broader target set. Greg Lesnewisch, staff threat researcher at Proofpoint, told The Hacker News that the attack likely leveraged a leaked version of DarkSword, which was taken directly from one of UNC6353's watering holes and uploaded to GitHub, and that "TA446 is using the same version of the exploit kit UNC6353 was using." It's currently not known if any of these attacks were successful. However, Proofpoint said all messages targeting its customers were blocked. The development comes as Apple has begun sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urging them to install the update to block the threat. The unusual step signals that the company is treating it as a broad enough threat requiring users' immediate attention. Apple's warning also coincides with the leak of a new version of DarkSword on GitHub, raising concerns that they could democratize access to nation-state exploits, fundamentally shifting the mobile threat landscape. Justin Albrecht, principal researcher at Lookout, said the leaked, plug-and-play version allows even unskilled threat actors to deploy the advanced iOS espionage kit, turning it into commodity malware. "DarkSword refutes the common belief that iPhones are immune to cyber threats, and that advanced mobile attacks are only used in targeted efforts against governments and high-ranking officials," Albrecht added.

Una Corte federale dell’Indiana ha condannato uno dei principali protagonisti del cybercrime internazionale. “81 mesi di carcere per il cyber criminale russo Aleksei Volkov, ritenuto uno dei più importanti elementi del gruppo di ransomware Yanluowang“. Questo il verdetto di una Corte federale dell’Indiana. Volkov (già arrestato a Roma e poi estradato negli Usa) si era dichiarato “colpevole nel novembre 2025 di sei capi d’accusa relativi alla sua attività“. Secondo il tribunale Volkov, noto anche come “chubaka.kor”, era “un initial access broker“. Ossia si era specializzato nell’ottenere accessi non autorizzati alle reti e ai sistemi informatici, dopo averne studiato le vulnerabilità. Sia delle aziende, che di altre organizzazioni. Una volta ottenuti, li vendeva ad altri soggetti cyber criminali, come i gruppi di ransomware. Sul mercato dell’economia cyber illecita la figura del broker di accesso iniziale è sempre più importante e richiesta. Consente infatti ai criminali di trarre profitto dagli attacchi senza distribuire direttamente malware o eseguire richieste di estorsione. Il volume economico Per capire il valore di queste operazioni, la Corte ha ricostruito tutte le operazioni di “facilitazione“, ricavando che Volkov ha facilitato decine di attacchi informatici. In tutto, questi hanno causato più di 9 milioni di dollari di perdite confermate alle vittime e oltre 24 milioni di dollari di perdite previste. L’accusa ha identificato sette specifiche aziende statunitensi oggetto di attacco durante il periodo di 16 mesi, tra cui una società di ingegneria e una banca. Due soggetti hanno pagato complessivamente 1,5 milioni di dollari in riscatti. Un sistema molto complesso In realtà, l’hacker criminale russo non riceveva subito e sempre il denaro. I sui complici infatti utilizzavano gli accessi per infettare le reti e i sistemi informatici colpiti con malware. Quest’ultimo cifrava i dati delle vittime e impediva loro di accedervi, danneggiando le loro operazioni aziendali. Dopodiché richiedevano un “riscatto in criptovaluta“, in cambio del ripristino dell’accesso ai dati. Il riscatto avrebbe permesso di non rendere pubblico l’attacco informatico né di pubblicare i dati rubati delle vittime su un sito di “leak”. Soltanto se si procedeva a pagare il riscatto, Volkov ne riceveva una parte. Senza denaro, avveniva la pubblicazione dei dati esfiltrati. In ogni caso, come parte della sua condanna, Volkov dovrà risarcire integralmente le vittime, versando almeno 9,1 milioni di dollari alle società identificate. Inoltre, dovrà consegnare le piattaforme utilizzate nelle sue attività criminali.

Russian botnet operator linked to major ransomware attacks sentenced in US A Russian national has been sentenced to two years in U.S. prison for helping operate a botnet used by ransomware gangs to attack American companies, authorities said Tuesday. Ilya Angelov, 40, of Tolyatti, Russia, pleaded guilty to managing a botnet that other cybercriminals used to break into corporate systems and deploy ransomware. A U.S. district court sentenced Angelov to 24 months in prison and imposed a $100,000 fine. According to court records, he was one of the leaders of a Russia-based cybercrime group known as Mario Kart, also tracked as TA-551, Shathak, Gold Cabin and Monster Libra. Members of the group distributed malware, launched large-scale spam campaigns and sold access to compromised machines to other cybercriminal operations. Mario Kart spread its malware primarily through phishing emails sent on a massive scale, sometimes reaching as many as 700,000 messages per day. Victims who opened malicious attachments unknowingly infected their computers, adding them to the botnet. At its peak, the campaign was capable of compromising roughly 3,000 machines per day. Angelov and a co-manager monetized the botnet by selling access to individual compromised computers, known as bots. This access was sold to other criminal groups that typically carried out ransomware extortion schemes. One customer distributed the BitPaymer ransomware, which locked victims out of their computer systems and demanded payment, typically in cryptocurrency, to restore access. The FBI identified 72 U.S. computer networks infected with BitPaymer between August 2018 and December 2019, generating more than $14 million in ransom payments, according to court documents. After disruptions to the BitPaymer operation, another criminal group linked to the IcedID malware paid Angelov’s group about $1 million for access to the botnet in late 2019 or early 2020, authorities said. The relationship later evolved into a partnership that lasted until around August 2021. Angelov used the online aliases “milan” and “okart” while helping manage the group, which developed malware, operated spam distribution infrastructure and recruited members to expand the operation, prosecutors said. In a separate case earlier this week, U.S. prosecutors announced a prison sentence for another Russian hacker linked to ransomware operations. Aleksei Volkov, who helped the Yanluowang ransomware gang breach U.S. companies, received an 81-month prison sentence for his role in attacks that caused millions of dollars in damage. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Russian cybercriminal Ilya Angelov, known online as ‘Milan’ and ‘Okart’, has been sentenced to two years in federal prison for his role in the administration of a botnet used to facilitate ransomware attacks, the DOJ announced on Tuesday. According to the DOJ, Angelov was part of a threat group tracked by the FBI as Mario Kart, and by the cybersecurity community as TA-551, Shathak, Gold Cabin, Monster Libra, G0127, and ATK236. The charges against Angelov stem from activities he engaged in between 2017 and 2021, during which his cybercrime group built a botnet by distributing malware via spam email attachments. They monetized the compromised machines by selling access for deploying ransomware. TA-551 was known to distribute malware such as Emotet, IcedID, Qbot, and Ursnif. The DOJ has mentioned ransomware attacks facilitated by the botnet against more than 70 US corporations, with the cybercriminals earning $14 million in ransom payments. Court documents show Angelov has been in custody since 2023 and has pleaded guilty to his role in the cybercrime operation. In addition to the 24-month prison sentence, he received a $100,000 fine and a $1.6 million money judgment, allowing the government to seize assets tied to his criminal proceeds. Angelov’s sentencing comes shortly after the DOJ announced that another Russian national, Aleksei Volkov, has been sentenced to 81 months in prison for his role in ransomware attacks. Related: Russian Ransomware Operator Pleads Guilty in US Related: Russian APT Exploits Zimbra Vulnerability Against Ukraine

The U.S. Department of Justice (DoJ) said a Russian national has been sentenced to two years in prison for managing a botnet that was used to launch ransomware attacks against U.S. companies. Ilya Angelov, 40, of Tolyatti, Russia, was also fined $100,000. Angelov, who went by the online aliases "milan" and "okart," is said to have co-managed a Russia-based cybercriminal group known as TA551 (aka ATK236, G0127, Gold Cabin, Hive0106, Mario Kart, Monster Libra, Shathak, and UNC2420) between 2017 and 2021. "Angelov's group built a network of compromised computers (a 'botnet') through distribution of malware-infected files attached to spam emails," the DoJ said. "Angelov and his co-manager then monetized this botnet by selling access to individual compromised computers ('bots')." According to the sentencing memorandum, the threat group developed programs to distribute spam email and refined malware to bypass security tools. Angelov and his co-manager recruited members and oversaw the various activities. Chief among its tools was a backdoor through which malicious software could be uploaded to the victim's computers. The main goal of the attacks was to resell the access to other criminal groups, who leveraged it for ransomware extortion schemes. Between August 2018 and December 2019, TA551 provided the BitPaymer ransomware group with access to its botnet, allowing the e-crime gang to infect 72 U.S. corporations. This resulted in more than $14.17 million in extortion payments. The operators of the IcedID malware also paid Angelov's group over a million dollars to acquire access to the botnet in late 2019 or early 2020 and distribute ransomware, although the extent of the damage is currently not known. It's suspected that this partnership blossomed after the disruption of the BitPaymer group. The collaboration lasted until about August 2021, per the U.S. Federal Bureau of Investigation (FBI). Based on a report published by Google-owned Mandiant in February 2021, phishing emails containing password-protected archives tricked recipients into opening macro-enabled Microsoft Word documents, leading to the deployment of a macro downloader dubbed MOUSEISLAND. The malware acted as a conduit for a secondary payload, codenamed PHOTOLOADER, which ultimately installed IcedID. Both MOUSEISLAND and PHOTOLOADER have been attributed to TA551. In November 2021, Cybereason revealed that the operators of the TrickBot trojan were teaming up with TA551 to distribute Conti Ransomware. That same month, France's Computer Emergency Response Team (CERT-FR) also disclosed that the Lockean ransomware gang was using distribution services offered by TA551 following the law enforcement takedown of the Emotet botnet at the start of 2021. "Foreigner cybercriminals like this defendant target American citizens and corporations," U.S. Attorney Jerome F. Gorgon Jr. said in a statement. "Their methods grow in sophistication. But their motive remains the same – to rip-off and harm us." The development comes a day after the DoJ announced that another Russian national, a 26-year-old Aleksei Olegovich Volkov (aka "chubaka.kor" and "nets"), was sentenced to nearly 7 years in prison after pleading guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks targeting eight companies in the U.S. between July 2021 and November 2022.

The US Justice Department announced this week that Russian national Aleksei Volkov has been sentenced to 81 months in prison for his role in ransomware attacks. Volkov, 26, has been accused of taking part in Yanluowang ransomware attacks that caused more than $9 million in losses — the cybercriminals attempted to extort $24 million in ransom from targeted organizations, the DOJ said. The man served as an initial access broker for the operation, gaining access to the targeted organizations’ systems and then handing over that access to other members of the operation, who specialized in malware deployment and data theft. Following his indictment, Volkov was arrested by Italian police in Rome and later extradited to the US to stand trial. The hacker pleaded guilty in November 2025, admitting that he and his co-conspirators hacked into company networks, stole data, deployed ransomware, and demanded a ransom payment. In addition to the prison sentence, the Russian national has agreed to pay more than $9 million in restitution to victims. The Yanluowang ransomware group was active in 2021 and 2022. It made headlines in late 2021 for targeting financial corporations and other types of organizations in the United States. One of the cybercrime gang’s most notable attacks was against Cisco. Information shared by the networking giant in mid-2022 attributed the attack to an initial access broker with ties to the Russia-linked threat actor UNC2447 and to Lapsus$. Related: Russian Ransomware Operator Pleads Guilty in US Related: Dutch Port Hacker Sentenced to Prison Related: 3 Men Charged With Conspiring to Smuggle US Artificial Intelligence to China

A Russian national has been sentenced to two years in prison after admitting that the phishing botnet he managed was used to launch BitPaymer ransomware attacks against 72 U.S. companies. According to court documents, 40-year-old Ilya Angelov (who used the "milan" and "okart" online handles) decided to travel to the United States to plead guilty and face charges after the Russian invasion of Ukraine in February 2022 and after Vyacheslav Igorevich Penchukov, a member of the IcedID cybercrime gang and a criminal associate, was arrested in Switzerland. Angelov was one of two leaders of a Russian cybercriminal operation tracked by the FBI gang as Mario Kart, and by threat analysts at various cybersecurity companies as TA551, Shathak, GOLD CABIN, Monster Libra, ATK236, and G0127. Angelov and the other co-manager recruited members and oversaw the operation's malicious activities. The gang members filled a wide range of roles, including software coders responsible for developing malware, developing programs that distributed spam email, and customizing malware to evade security software. "Through a massive spam email campaign—which could send 700,000 emails a day—the group distributed malware around the globe," prosecutors said. "If an unwitting recipient clicked on an attachment to one of the group's emails, concealed malware would infect their computer and add it to the Mario Kart botnet. At the height of the group's operation, approximately 3,000 computers per day could be infected." The cybercrime gang used a massive botnet to distribute malware in large-scale phishing campaigns between 2017 and 2021, then sold access to infected devices to other cybercriminals, including affiliates involved in Ransomware-as-a-Service (RaaS) operations. "This access was sold to other criminal groups, who typically engaged in ransomware extortion schemes: locking victims out of their computer networks and demanding extortion payments — commonly in cryptocurrency — to restore access," the Justice Department said on Tuesday. "The FBI has identified over 70 U.S. corporations that were infected with ransomware by one organization linked to Angelov's group, resulting in over $14 million in extortion payments." While these attacks took place between August 2018 and December 2019 and were all linked to the BitPaymer ransomware operation, the IcedID cybercrime gang also paid Angelov and his accomplices another million dollars between late 2019 and August 2021 for access to their bots, but the resulting damage is not yet known. In the past, TA551 has been linked to various malware operators and some ransomware affiliates. TA551 operators also partnered with the notorious TrickBot gang (Wizard Spider) in phishing campaigns that deployed Conti ransomware on targets' compromised systems. France's Computer Emergency Response Team (CERT) also flagged TA551 as a collaborator in the Lockean ransomware operation, helping its affiliates drop ProLock, Egregor, and DoppelPaymer ransomware payloads on devices infected with the Qbot/QakBot banking trojan. 26-year-old Russian national Aleksey Olegovich Volkov was also sentenced to nearly 7 years in prison this week after pleading guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months A Russian citizen, Aleksei Volkov, was sentenced to 81 months in prison for helping ransomware groups carry out attacks causing over $9 million in actual losses and over $24 million in intended losses, after being arrested in Italy and extradited to the United States where he pleaded guilty. According to prosecutors, Volkov was an initial access broker who found vulnerabilities in computer networks, gained unauthorized access, and sold that access to other cybercriminals. Volkov’s co-conspirators used the access he provided to deploy malware that encrypted victims’ data and disrupted their operations. They then demanded cryptocurrency payments, sometimes in the tens of millions of dollars, in exchange for restoring access and not releasing stolen data on leak sites. Some victims paid, while others refused and had their data published. Volkov took a share of the payments. In November 2025, Volkov pleaded guilty to charges including access device fraud, identity theft, conspiracy to commit computer fraud, and money laundering. He agreed to pay restitution to victims and forfeit equipment used in the crimes. The ruling signals law enforcement focus on individuals who enable ransomware attacks, even without direct involvement.

A Russian national was sentenced to nearly 7 years in prison after pleading guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks. As 26-year-old Aleksey Olegovich Volkov (also known online as "chubaka.kor" and "nets") admitted in his November guilty plea, he targeted at least eight companies across the United States between July 2021 and November 2022. Volkov said that he breached corporate networks and sold that access to the Yanluowang ransomware-as-a-service (RaaS) operation, whose affiliates encrypted victims' data and sent ransom demands ranging from $300,000 to $15 million. He was extradited to the U.S. after being arrested in Italy in January 2024. U.S. prosecutors charged him after the Yanluowang gang stole non-sensitive files from a Cisco employee's Box folder, but failed to encrypt systems and collect a ransom. "As part of his plea, Volkov admitted that he and his co-conspirators hacked into numerous victims' computer networks, stole their data, deployed ransomware, demanded payment in cryptocurrency to exchange for restoring access to the data, and divided the ransom payments among themselves," the Justice Department said on Monday. As revealed in court documents, the FBI recovered chat logs, stolen data, victims' network credentials, and evidence that Yanluowang email accounts were used for ransom negotiations after seizing a server linked to the ransomware gang. They also traced Volkov's identity through Apple iCloud data, cryptocurrency exchange records, and social media accounts (including a Twitter account) linked to his Russian passport and phone number. The recovered chat logs showed Volkov negotiating deals with an accomplice for a percentage of the ransom payments in exchange for providing credentials to some of Yanluowang's victims' networks. The FBI said that Volkov's percentage of the collected ransoms reached $1.5 million. According to an affidavit signed by FBI Special Agent Jeffrey Hunter, while reviewing documents obtained from Volkov's Apple account, the investigators also discovered a screenshot of a chat with a user named LockBit, suggesting an additional potential link to the notorious LockBit ransomware gang. Volkov was sentenced to 81 months in prison after initially facing a maximum sentence of 53 years, and is required to pay over $9 million in restitution to the victims of the Yanluowang ransomware attacks. "Volkov agreed to pay full restitution to victims including at least $9,167,198.19 to known victims to compensate them for their actual losses as well as to forfeit equipment he used for his crimes," the Justice Department added. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Russian hacker who helped Yanluowang ransomware gang gets nearly 7-year prison sentence A Russian hacker who helped the notorious Yanluowang ransomware gang break into U.S. companies and demand millions of dollars in ransom payments has been sentenced to nearly seven years in prison. Aleksei Volkov, 26, of St. Petersburg, received an 81-month prison sentence after pleading guilty to charges related to a series of ransomware attacks against organizations across the U.S. Prosecutors said Volkov operated as an “initial access broker,” a type of cybercriminal who breaks into corporate computer networks and sells that access to other hackers, including ransomware groups. In 2021 and 2022, Volkov worked with members of the Yanluowang ransomware gang, helping them infiltrate networks and deploy malicious software that locked victims out of their systems, according to court documents. The attacks targeted a range of organizations, including banks, telecommunications providers and engineering firms in several states, including Pennsylvania, California, Michigan, Illinois, Georgia and Ohio. Authorities said the campaign caused more than $9 million in actual losses and involved ransom demands totaling more than $24 million. Volkov was arrested in Rome and later extradited to face charges filed in federal courts in Indiana and Pennsylvania. He pleaded guilty to charges in both states in November. According to investigators, Volkov identified vulnerabilities in corporate networks and provided that access to co-conspirators who carried out the ransomware attacks. In return, he received a share of the ransom payments. Victims were typically told to pay ransoms in cryptocurrency — sometimes reaching tens of millions of dollars — in exchange for restoring access to their systems and preventing the release of stolen data on leak sites. As part of his sentence, Volkov agreed to pay at least $9 million in restitution to victims and forfeit equipment used in the hacking operation. The FBI also found evidence that Volkov had communicated with members of the LockBit ransomware group, another prolific cybercrime operation. Cybersecurity researchers first identified the Yanluowang ransomware gang in 2021. Despite the group’s Chinese-sounding name, investigators later determined that its members were likely posing as Chinese hackers, a tactic used to obscure their identities. The group ultimately disbanded in late 2022 after its leak site was hacked and thousands of internal chat messages were published online. At least one member of the group was believed to be affiliated with the Russian Ministry of Defense. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration ai and ml Anthropic says text watermarking scheme relies on inconsequential words'Shall I compare thee to a summer's afternoon' is the sort of thing this will make, and others look likely to adopt it Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

A prolific initial access broker (IAB) who played a key role in dozens of ransomware attacks costing victims over $9m, has been sentenced to 81 months behind bars in the US. Russian national, Aleksei Volkov, 26, of St. Petersburg, was sentenced in an Indiana court yesterday. He pleaded guilty last November to unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft. He had also pleaded guilty in a Pennsylvania court to conspiracy to commit computer fraud and conspiracy to commit money laundering, before the cases were consolidated in Indiana. Volkov and his co-conspirators admitted to hacking victims’ networks, stealing their data, deploying ransomware and then dividing between themselves the ransom they subsequently extorted. The Department of Justice (DoJ) claimed that they tried to extort victim organizations to the tune of $24m. Volkov was accused of working as an IAB for several “major cybercrime groups,” including the Yanluowang ransomware operation. IABs continue to comprise an important part of the cybercrime supply chain, selling unauthorized access to networks to mainly ransomware-as-a-service (RaaS) outfits. This helps to lower the barriers to entry for these groups, while also speeding up attacks. Yanluowang Ransomware Unmasked Yanluowang was first spotted in 2021 using aggressive "triple extortion" tactics whereby data would be stolen and encrypted and then victims threatened with DDoS as well as “calls to employees and business partners” if they didn’t pay up. Despite the name, which references a Chinese deity linked to the underworld, the group was subsequently found to be Russian. It was unmasked by researchers in 2022 after a whistleblower shared thousands of internal messages on Twitter. Among its members were leader and payroll manager “Saint,” lead developer Killanas (aka "coder0") and pen-testers “Felix” and “Shoker.” The group counted Cisco and Walmart among its victims. In a rare move, Volkov eschewed the relative safety of Russia and was arrested in Rome in 2024 after being indicted in the US the previous year. He was then extradited to the US in 2025. He has agreed to pay restitution of at least $9.2m to compensate known victims for their losses.

A 26-year-old Russian citizen has been sentenced in the U.S. to 6.75 years (81 months) in prison for his role in assisting major cybercrime groups, including the Yanluowang ransomware crew, in conducting numerous attacks against U.S. companies and other organizations. According to the U.S. Department of Justice (DoJ), Aleksei Olegovich Volkov facilitated dozens of ransomware attacks across the U.S., causing more than $9 million in actual losses and over $24 million in intended losses. Volkov was arrested on January 18, 2024, in Italy and extradited to the U.S. to face charges. He pleaded guilty to the crimes in November 2025. Volkov is said to have served as an initial access broker responsible for obtaining unauthorized access to computer networks and systems belonging to various organizations and selling that access to other criminal groups, including ransomware actors. This was accomplished by exploiting vulnerabilities or finding ways to access the networks without authorization. "Volkov's co-conspirators then used the access Volkov provided to infect the affected computer networks and systems with malware," the DoJ said. "This malware encrypted the victims' data and prevented the victims from accessing it, damaging their business operations." "The conspirators then demanded that the victims pay them a ransom in cryptocurrency — sometimes in the tens of millions of dollars — in exchange for restoring the victims' access to the data and promising not to publicly disclose the hack or release victims’ stolen data on a 'leak' website." Every time a victim paid a ransom, Volkov received a share of the illicit proceeds. He was charged with unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft, in addition to two counts of computer fraud and conspiracy to commit money laundering. As part of the guilty plea, the defendant has agreed to pay full restitution to victims, including at least $9,167,198 to known victims to compensate them for their actual losses, along with forfeiting the tools used to pull off the crimes. U.S. Charges Third Ransomware Negotiator Linked to BlackCat Attacks The disclosure comes as U.S. prosecutors have charged a third individual with acting as a negotiator for the BlackCat (aka ALPHV) ransomware gang, helping the threat actors extort higher payouts from at least 10 victims. The 41-year-old man, Angelo Martino (previously identified only as "Co-Conspirator 1"), worked as a ransomware negotiator for DigitalMint. Authorities have confiscated nearly $9.2 million in five types of cryptocurrency (Bitcoin, Monero, Ripple, Solana, and Stellar) from 21 wallets controlled by Martino, in addition to seizing luxury vehicles and properties. He faces up to 20 years in prison. Two other incident responders, Ryan Clifford Goldberg and Kevin Tyler Martin, pleaded guilty to their roles as BlackCat affiliates in December 2025. In a statement shared with The Record, DigitalMint said the actions were in violation of the company's policy and ethical standards, and that it had terminated both Martino and Martin after their behavior came to light. "DigitalMint condemns these individuals' criminal behavior, which is a clear violation of our values, our ethical standards, and the law," it said. "Our firm and industry both exist to support organizations suffering from the impacts of a cyberattack, and this runs completely counter to what we stand for."

Police forces have made 94 arrests in a large-scale law enforcement operation against phishing and ransomware. The effort, codenamed Operation Synergia III, ran from July, 18 2025 to January 31, 2026. It was coordinated by Interpol and involved law enforcement units from 72 countries as well as private sector partners, including Group-IB, Trend Micro and S2W. In a March 13 announcement, Interpol said the operation led to the seizure of 212 electronic devices and servers, the takedown of 45,000 malicious IP addresses and the arrest of 94 people, with another 110 individuals still under investigation. While several investigations remain ongoing across participating countries, early reports from key cases highlight the diverse and sophisticated criminal tactics uncovered during the operation. Cybercrime Rings Dismantled from Togo to Macau Operation Synergia III targeted a wide range of cybercriminal activities, including fraudulent websites, phishing campaigns, malware distribution, ransomware attacks, romance scams and credit card fraud schemes. The malicious domains and servers seized were often used by criminals to impersonate financial institutions, government platforms and legitimate services in order to steal personal information and financial data from victims. In Macau, China, law enforcement identified over 33,000 phishing and fraudulent websites, many of them linked to fake casinos and spoofed versions of official bank, government and payment service platforms. Meanwhile, authorities in Togo dismantled a fraud ring operating from a residential area, arresting 10 suspects involved in a range of cybercrimes. Some members of the fraud ring specialized in technical attacks, such as hacking social media accounts, while others ran social engineering schemes, including romance scams and sextortion. In Bangladesh, police arrested 40 suspects and seized 134 electronic devices tied to a variety of cybercrime schemes, from loan and job scams to identity theft and credit card fraud. Public-Private Partnership Against Cybercrime Interpol said its role was to transform data into actionable intelligence, facilitate cross-border collaboration and provide tactical operational assistance to member countries. The private partners helped law enforcement agencies track illegal cyber activities and identify malicious servers. In a separate statement, also published on March 13, Group-IB confirmed it shared information on phishing domains, hosting infrastructure and servers which distributed malware such as infostealers. The information shared helped investigators identify and disrupt cybercriminal infrastructure across multiple jurisdictions. Dmitry Volkov, CEO of Group-IB, said, “[Operation Synergia III] demonstrates how close cooperation between law enforcement agencies and private-sector partners can significantly disrupt [cybercriminal] networks.” “By sharing intelligence on malicious infrastructure and attacker tactics, Group-IB remains committed to supporting global efforts to dismantle cybercrime operations and protect organizations and individuals worldwide,” he added. Operation Synergia III is named after two similar cybercrime takedowns coordinated by Interpol in 2023 and 2024.

Russian hacker to plead guilty to aiding Yanluowang ransomware group A Russian national is set to plead guilty to several charges at the end of the month for his role as a participant in multiple Yanluowang ransomware attacks. Last week, federal prosecutors unsealed court documents for Aleksey Olegovich Volkov, a 25-year-old who was arrested in Rome two years ago. Court documents show evidence proving Volkov served as an initial access broker for the ransomware gang — breaking into the network of victims and then offering his access for a percentage of the ransom. The court documents were first spotted by reporter Seamus Hughes. The indictment lists at least eight victims, two of which paid hackers a total of about $1.5 million to unlock their systems. Volkov received a cut of more than $256,000. Prosecutors said he also earned thousands from offering other hackers access to the companies he had infiltrated. After his 2023 arrest in Rome, Volkov was extradited to the U.S. and on October 29, 2025 he agreed to a plea deal that will be signed at a federal court in Indiana on November 25 and his sentencing will take place at a later date. He is facing decades in prison on charges of hacking into computers, stealing information and attempting to extort companies. As part of the plea deal, Volkov agreed to pay more than $9 million in restitution to at least six of the victims. “The defendant admits being the [initial access broker] for the Yanluowang ransomware attacks against Victims 3 through 6, as well as other potential victims during the conspiracy, and knew that he was providing access to victim networks to his conspirators for the purpose of attacking them with ransomware,” the plea deal stated. “The defendant admits that he was paid a portion of the ransomware proceeds. The defendant admits that the conspirators divided the ransom payments amongst themselves, using numerous cryptocurrency transactions to conceal their identities and obfuscate the source of the funds.” chubaka.kor From July 2021 to November 2022, Volkov worked with members of the Yanluowang ransomware gang on several attacks targeting U.S.-based organizations. He helped the group with their initial access and also launched distributed denial-of-service (DDoS) attacks as well as other threatening tactics to force victims to pay ransoms. Some companies said executives received threatening calls from Yanluowang members demanding they pay ransoms. Victims included banks, telecommunications companies and engineering firms in Pennsylvania, California, Michigan, Illinois, Georgia and Ohio. The FBI was able to obtain a server that showed messages between a member of the ransomware gang and an account going by the name “chubaka.kor.” Many of the messages showed “chubaka.kor” offering the ransomware gang access to victim networks for a price. The FBI traced the ransom payments back to cryptocurrency addresses belonging to an account owned by “Alekseq Olegovi3 Volkov.” The cryptocurrency exchange confirmed that the account was verified with a Russian passport in the name of Aleksey Volkov with a birthdate of March 20, 2000. Using the email account tied to that cryptocurrency wallet, the FBI found a Twitter account which eventually led them to an Apple ID belonging to the email address alekseyvolkov4574@icloud[.]com. The FBI noted that they found evidence Volkov had also been communicating with members of the LockBit ransomware gang. Cybersecurity firm Symantec first discovered the Yanluowang group in October 2021, and it quickly got a reputation for the skill in which it targeted Western companies, such as Cisco and Walmart. The group disbanded at the end of 2022 when its leak site was hacked and the contents of one of the group’s discussion channels – some 2,700 messages sent between January and September 2022 – were uploaded to a website. Using the leaked chats, researchers and law enforcement confirmed a long-running suspicion — that despite the name, Yanluowang members were just masquerading as Chinese hackers. At least one member of the group was believed to be a member at the Russian Federation Ministry of Defense. Kaspersky researchers found a vulnerability in the Yanluowang encryption algorithm and released a free decrypter in 2022. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

A transnational operation involving 14 African countries has taken down a large-scale digital scamming network, leading to 260 arrests and the seizure of 1235 electronic devices. The Interpol-led effort, named Operation Contender 3.0, marks the third wave of arrests against fraudsters and romance scammers in Africa following operations in 2021 and 2024. This third crackdown was conducted between July 28 and August 11, 2025. It focused on romance scams, where perpetrators build online relationships to extract money from victims, and sextortion, in which victims are blackmailed with explicit images or videos. Raids in Ghana, Senegal, Côte d’Ivoire and Angola During the operation, police forces across the 14 participating African countries identified IP addresses, digital infrastructures, domains and social media profiles linked to members of the scam syndicates, with the collaboration of two private sector organizations, Group-IB and Trend Micro. These leads helped the law enforcement locate the scammers, with raids taking place in Ghana, Senegal, Côte d’Ivoire and Angola. In Ghana, suspects of romance scams had used fake profiles, forged identities and stolen images to deceive victims. They extracted payments using a range of schemes, including fake courier and customs shipment fees. In Senegal, Operation Contender 3.0 uncovered a network that impersonated celebrities and used emotional manipulation on social media and dating platforms to defraud 120 victims of approximately $34,000. Police in Côte d’Ivoire dismantled a cybercrime ring that created fake profiles online to manipulate vulnerable individuals into sharing intimate images. Once in possession of compromising material, the criminals blackmailed victims and demanded payments to prevent public exposure. In Angola, offenders used fraudulent documents to create fake identities, facilitate financial transactions and conceal their real identities while engaging victims. Investigators identified 1463 victims linked to the scams in these four countries and estimated their losses at nearly $2.8m. They also seized a range equipment which supported their criminal activities, including USB drives, SIM cards and forged documents, and took down 81 cybercrime infrastructures across Africa. Cyril Gout, acting executive director of police services at Interpol, said in a public statement published on September 26 that cybercrime units across Africa are reporting a sharp rise in digital-enabled crimes such as sextortion and romance scams. “The growth of online platforms has opened new opportunities for criminal networks to exploit victims, causing both financial loss and psychological harm,” he added. Dmitry Volkov, CEO of Group-IB, commented: “Cybercriminals behind romance scams and sextortion deliberately exploit some of the deepest human vulnerabilities, such as trust and emotional attachment. They manipulate victims by taking advantage of their feelings and personal relationships, turning genuine emotions into tools of deception and coercion.” “Through our ongoing partnership with Interpol, Group-IB remains committed to dismantling these networks and protecting individuals from both financial devastation and profound psychological harm,” he continued. Part of the African Joint Operation against Cybercrime Project Operation Contender 3.0 was funded by the UK’s Foreign, Commonwealth and Development Office (FCDO) under the African Joint Operation against Cybercrime project. Countries involved included Angola, Benin, Burkina Faso, Cote d’Ivoire, Gambia, Ghana, Guinea, Kenya, Nigeria, Rwanda, Senegal, South Africa, Uganda and Zambia. The effort is a follow-up of Operation Contender 2.0, that led to eight arrests, in Côte d’Ivoire and Nigeria for a romance scam that defrauded a victim in Finland and a large-scale phishing scheme that caused over $1.4 m in losses to Swiss citizens.

A large-scale law enforcement operation coordinated by Interpol has taken down a 1000-person cybercriminal network and recovered $97.4m in stolen money from over 88,000 victims. The effort, codenamed Operation Serengeti 2.0 following a previous crackdown on African cybercrime in November 2024, ran from June to August 2025. It involved law enforcement agencies from the UK and 18 African countries, as well as private companies (Fortinet, Group-IB, Kaspersky, Team Cymru, Trend Micro, TRM Labs and Uppsala Security) and nonprofit organizations (Cybercrime Atlas and the Shadowserver Foundation). The operation achieved considerable results, including: The arrest of 1209 cybercriminals The dismantling of 11,432 malicious infrastructure assets (all in Angola) The recovery of $97,418,228 In total, law enforcement agencies have estimated that this cybercriminal network has targeted 87,858 victims and caused a monetary loss of $484,965,199. Their activities included ransomware, online scams and business email compromise (BEC). Valdecy Urquiza, secretary general of Interpol, highlighted that Interpol-led operations continue to grow in scale and achieve larger successes. "Each Interpol-coordinated operation builds on the last, deepening cooperation, increasing information sharing and developing investigative skills across member countries. With more contributions and shared expertise, the results keep growing in scale and impact. This global network is stronger than ever, delivering real outcomes and safeguarding victims,” he said. Raids in Angola, Zambia and Côte d’Ivoire Operation Serengeti 2.0 included raids across several African countries. In Angola, law enforcement agencies dismantled 25 illegal cryptocurrency mining centers operated by 60 Chinese nationals who were unlawfully validating blockchain transactions. Authorities also confiscated 45 illicit power stations and mining equipment worth over $37m, which will now support power distribution in underserved areas. In Zambia, authorities uncovered a massive $300m online investment fraud scheme that defrauded 65,000 victims through fake cryptocurrency ads and fraudulent apps. At least 15 suspects were arrested and investigators seized domains, mobile numbers and bank accounts linked to the scam. Separately, Zambian officials, working with immigration authorities, raided a scam center in Lusaka and confiscated 372 forged passports from seven countries, disrupting a suspected human trafficking operation. In Côte d’Ivoire, law enforcement took down a cross-border inheritance scam originating in Germany, where victims were tricked into paying fees to claim non-existent inheritances. The fraud caused losses of $1.6m before authorities arrested the primary suspect and seized assets, including electronics, jewelry, cash and vehicles. The collaborating private partners and nonprofit organizations provided law enforcement with intelligence, guidance and training to help investigators identify offenders effectively. This intelligence comprised critical information on specific threats, suspicious IP addresses, domains and malicious command-and-control (C2) infrastructure and was shared among participating agencies ahead of the operation. Group-IB, an Interpol Gateway Partner, told Infosecurity that it provided investigators with information that led to the arrest of 1,006 suspects and the dismantling of more than 134,000 malicious infrastructures and networks used by cybercriminals for investment-related scams, multiple scam schemes including those impersonating government officials, phishing, romance baiting (pig butchering) and online casinos. Dmitry Volkov, CEO of Group-IB, commented: “By dismantling criminal infrastructures and bringing offenders to justice, we are not only protecting victims across Africa but also strengthening the resilience of the entire digital ecosystem. […] With the right threat intelligence, advanced tools, and knowledge sharing, Group-IB helps — and will continue to help — safeguard communities and businesses worldwide.” Partnership with Cybercrime Prevention Network InterCOP Operation Serengeti 2.0 was held under the umbrella of the African Joint Operation against Cybercrime, funded by the UK’s Foreign, Commonwealth and Development Office (FCDO). Participating African countries included Angola, Benin, Cameroon, Chad, Côte D’Ivoire, Democratic Republic of Congo, Gabon, Ghana, Kenya, Mauritius, Nigeria, Rwanda, Senegal, South Africa, Seychelles, Tanzania, Zambia and Zimbabwe. Beyond arrests, the operation prioritized prevention through a partnership with the International Cyber Offender Prevention Network (InterCOP), a 36-nation alliance led by the Netherlands. By identifying and neutralizing cyber threats before they strike, InterCOP aims to shift the fight against digital crime from reaction to proactive disruption.