Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cybersecurity. Show all posts
Threat Intelligence
Advanced Persistent Threats Critical Infrastructure Security cyber espionage Cyber Security Cybersecurity EU Sanctions State Sponsored Attacks Threat Intelligence

Europe Targets Chinese and Iranian Entities in Response to Cyber Threats


 

Council of the European Union, in response to the escalation of state-linked cyber intrusions, has tightened its defensive posture by imposing targeted sanctions on a cluster of entities and individuals allegedly engaged in sophisticated digital attacks against European interests in a measured yet unmistakably firm manner. 

According to the Council, on behalf of the bloc's member states, this decision represents a broader strategic shift within the European Union, where cyber threats are increasingly treated as instruments of geopolitical pressure capable of compromising critical infrastructure, public trust, and economic stability rather than isolated technical disruptions. 

It was announced earlier this week that sanctions would extend beyond corporate entities and include senior leadership figures, indicating a desire to hold not only organizations, but also their decision-makers accountable for orchestrating or enabling malicious cyber activity. 

China's Integrity Technology Group and Anxun Information Technology Co., a company formerly known as iSoon, were among those names, along with Iranian entity Emennet Pasargad, who are believed to have participated directly in attacks against essential services and government networks. 

The inclusion of executives such as Wu Haibo and Chen Cheng further underscores the EU's evolving approach to cyber operations, one in which the traditional veil of denial is pierced. 

The European Union attempts to reset deterrence in cyberspace by formally assigning responsibility and imposing economic and legal constraints, where attribution is a challenging task, accountability is often elusive, and the consequences of inaction continue to increase with each successive breach by establishing a new standard of deterrence. 

European authorities have also focused attention on Anxun Information Technology Co., commonly referred to as I-Soon. The company appears to be closely connected to Chinese domestic security apparatuses, particularly the Ministry of Public Security. Despite its formal positioning as a commercial company, Huawei has long been associated with cyber operations aligned with Beijing's strategic intelligence objectives, blurring the line between state-directed activity and outsourced service. 

As a result of this dual-purpose posture, Western governments have paid sustained attention to the situation; following sanctions imposed by the United Kingdom in March 2025, the Department of Justice unveiled charges against multiple I-Soon personnel for participating in coordinated intrusion campaigns. 

In confirming these concerns, the European Union has made the claim that I-Soon operated as an offensive cyber services provider, systematically attacking critical infrastructure sectors and governmental systems both within member states and abroad. 

As alleged by investigators, its activities extend beyond unauthorized access to include sensitive data exfiltration and monetization, introducing persistent risks to the diplomatic and security frameworks supporting the Common Foreign and Security Policy as a result of institutionalizing the hacker-for-hire model.

It is also important to note that the Council has designated key corporate figures, including Wu Haibo and Chen Cheng, who are senior managers and legal representatives within the company's structure. This reinforces the EU's intention to attribute accountability at both the individual and organization level. There have also been actions taken against Emennet Pasargad, an Iranian threat actor known by various aliases, such as Cotton Sandstorm, Marnanbridge, and Haywire Kitten and widely considered to be linked with the Cyber-Electronic Command of the Islamic Revolutionary Guard Corps. 

A wide range of disruptive and influence-driven cyber activities have been associated with the group, ranging from interference operations in connection with the 2020 presidential election to intrusion attempts related to the Summer Olympics in 2024. 

In accordance with European assessments, cyberattacks against Sweden's digital infrastructure, including the compromise of the national SMS distribution service, were also attributed to the group, indicating a pattern of operations intended not only to infiltrate systems but also to undermine public trust and operational resilience.

Furthermore, additional technical assessments further demonstrate the extent and persistence of Emennet Pasargad's activities. As indicated by Microsoft's analysis previously, the group-tracked as "Neptunium"-is suspected of compromising the personal information of over 200,000 Charlie Hebdo subscribers. 

According to many observers, the intrusion was a retaliatory act in response to the publication's controversial content targeting Ali Khamenei, illustrating the trend of politically motivated cyber operations being increasingly integrated with information exposure and intimidation methods.

The Council of the European Union identifies the group as conducting hybrid operations, including the unauthorized control of digital advertising billboards during the 2024 Summer Olympics for propaganda purposes, as well as a compromise of a Swedish SMS distribution service.

Interestingly, the latter incident is consistent with an earlier documented campaign that utilized mass messaging to incite retaliatory sentiments within the Swedish community, a tactic that has later been referenced by the Federal Bureau of Investigation in its threat advisories. 

Additionally, the Council's documentation illustrates earlier interference activities targeting the 2020 United States presidential elections, during which stolen voter data was used to deliver coercive communications using false political identities, demonstrating a deliberate campaign to undermine the trust of voters. 

Indictments have been issued in the United States against individuals such as Seyyed Mohammad Hosein Musa Kazemi and Sajjad Kashian as a result of enforcement actions. Financial sanctions have been imposed by the Treasury Department in an attempt to disrupt the group's operations funding. In spite of these measures, the actor has remained active, and subsequent attribution has linked it to ransomware campaigns believed to be affiliated with the Islamic Revolutionary Guard Corps.

There are parallel findings regarding Integrity Technology Group that reinforce the transnational nature of these threats. Investigators discovered that the company's infrastructure and tooling were used by the Flax Typhoon threat group as a means of gaining access to tens of thousands of devices throughout the European continent, as well as facilitating espionage-focused activities targeting Taiwanese entities. 

In addition, coordinated sanctions between the United Kingdom and the United States indicate a growing alignment of international responses targeted at reducing the ability of state-linked cyber activities to sustain their operations.

In combination, these coordinated efforts indicate a maturing enforcement posture in which cyber operations are not viewed merely as technical incidents but rather as matters of strategic significance that require sustained, multilateral responses. 

As part of the ongoing process of improving the European Union's cyber sanctions framework, the EU will emphasize attribution, intelligence sharing, and alignment with international partners in order to ensure that punitive measures are effectively translated into tangible operational disruptions.

It becomes increasingly important for organizations operating both within and outside of Europe to strengthen their resilience against advanced persistent threats, in particular those that utilize supply chain access, managed service providers, and covert infrastructure. 

It has been noted that the convergence of espionage, cybercrime, and influence operations calls for a more integrated defense model that includes technical controls, threat intelligence, and regulatory compliance. 

Having said that, the effectiveness of sanctions will ultimately depend on the consistency with which they are enforced, on the timely attribution of the perpetrators and on the ability of both public and private sectors to anticipate and mitigate the evolving threat environment.
Read more »
Hackers
Cloning cyber attack Cyber Attacks Cybersecurity Hackers

Cyberattacks Shift Tactics as Hackers Exploit User Behavior and AI, Experts Warn

 

Cybersecurity threats are evolving rapidly, forcing businesses to rethink how they approach digital security. Experts say modern cyberattacks are no longer focused solely on breaking technical defenses but are increasingly designed to exploit everyday user behavior. 
 
According to industry observers, files downloaded by employees have become a common entry point for cybercriminals. Items such as invoices, installers, documents, and productivity tools are often downloaded without careful verification, creating opportunities for attackers. 

“The Downloads folder has quietly become one of the hottest pieces of real estate for cybercriminals,” said Sanket Atal, senior vice president of engineering and country head at OpenText India. 

“Attackers are not trying to break cryptography anymore. They’re hijacking habits.” Research cited by the company indicates that more than one third of consumer malware infections are first detected in the Downloads directory. 

Security specialists say this reflects a broader shift in how cyberattacks are designed, with attackers relying more on social engineering and multi-stage malware. Atal said malicious files frequently appear harmless when first opened. “These files often look completely harmless at first,” he said. 

“They only later pull in ransomware components or credential-stealing payloads. It is a multi-stage approach that is very difficult to catch with signature-based tools.” Experts say the rise in such attacks is also linked to the growing industrialization of cybercrime. 

Modern ransomware groups and information-stealing operations increasingly operate like structured businesses that continuously test and refine their methods. “Ransomware-as-a-service groups and info-stealer operators are constantly refining their lures,” Atal said. 

“They are comfortable using SEO-poisoned websites, fake update prompts, and even ‘productivity tools’ to get users to download something that looks normal.” India’s rapidly expanding digital ecosystem has made it an attractive target for attackers. 

The combination of millions of new internet users, the widespread use of personal devices for work, and the overlap between personal and professional computing environments increases exposure to risk. 

“When a poisoned file lands in a Downloads folder on a personal device, it can easily become an entry point into enterprise systems,” Atal said. “Especially when that same device is used for banking, office work, and email.” Artificial intelligence is further changing the threat landscape. 

Generative AI tools can now produce convincing phishing messages that mimic corporate communication styles and reference real projects. “AI has removed the traditional visual cues people relied on to spot scams,” Atal said. 

“Generative models now write in perfect business language, reuse an organisation’s tone, and reference real projects scraped from public sources.” Security analysts say deepfake technology is also being used to manipulate business processes. 

Synthetic video calls and cloned voices have been used to approve financial transactions in some cases. Another emerging pattern is the rise of malware-free intrusions, where attackers rely on stolen credentials or legitimate remote access tools instead of traditional malicious software. 

“We’re also seeing a rise in malware-free intrusions,” Atal said. “Attackers use stolen credentials and legitimate remote access tools. Nothing matches a known signature, yet the breach is very real.” Experts say these developments are forcing organizations to shift their security strategies. 

Instead of focusing solely on scanning files and attachments, security teams are increasingly monitoring behavior patterns across users, devices, and systems. “The first shift is moving from content to behaviour,” Atal said. 

“Instead of just scanning attachments, organisations need to focus on whether a user or service account is behaving consistently with historical and peer norms.” Security specialists also emphasize the importance of integrating identity verification with threat detection systems. 

When phishing messages become difficult to distinguish from legitimate communication, identity context becomes a key factor in identifying suspicious activity. In addition, companies are beginning to rely on artificial intelligence for defensive purposes. 

Automated systems can help security teams manage the growing volume of alerts by identifying patterns and highlighting potential threats more quickly. “Security teams are overwhelmed by alerts,” Atal said. 

“AI-based triage is essential to reduce noise, correlate weak signals, and generate plain-language narratives so analysts can act faster.” Despite increased awareness of cybersecurity threats, several misconceptions persist. 

Many organizations assume that the most serious cyberattacks originate from sophisticated state-backed actors. “One big myth is that serious attacks only come from exotic nation-state actors,” Atal said. “The truth is, most breaches begin with everyday issues such as phishing, malicious downloads, weak passwords, or cloud misconfigurations.” 

Another misconception is that smaller organizations are less likely to be targeted. However, experts say attackers often focus on industries with weaker security controls, including healthcare providers, hospitality companies, and smaller financial institutions. 

Cybersecurity specialists also warn that many attacks no longer rely on traditional malware. Techniques such as identity-based attacks, business email compromise, and misuse of legitimate administrative tools often bypass standard antivirus defenses. “Identity-based attacks, business email compromise, and abuse of legitimate tools often never trigger traditional antivirus,” Atal said. 

“The starting point can be any user, device, or partner that has access to data.” Industry leaders say the challenge is compounded by the fact that many cybersecurity systems were designed for a different technological environment. 

Vinayak Godse, chief executive of the Data Security Council of India, said existing security frameworks were built before the widespread adoption of digital services and artificial intelligence. 

“In the digitalisation space, we are creating tremendous experiences, productivity gains, and new possibilities,” Godse said. “But the security frameworks we have in place were designed for an older paradigm.” He added that attackers today are capable of identifying and exploiting even a single vulnerability in complex digital systems. 

“The current attack ecosystem can identify and exploit even one vulnerability out of millions, or even billions,” Godse said. Experts say the erosion of traditional network boundaries has further complicated security efforts. Remote work, cloud computing, software-as-a-service platforms, and third-party integrations mean that sensitive systems can now be accessed from a wide range of devices and locations. 

“A user on a personal phone, accessing a SaaS application from home Wi-Fi, is still inside your risk perimeter,” Atal said. As a result, organizations are increasingly focusing on continuous verification and context-aware monitoring rather than relying solely on perimeter defenses. 

According to Atal, the effectiveness of AI-driven security tools ultimately depends on the quality of underlying data. If data sources are fragmented or poorly labeled, even advanced analytics systems may struggle to detect threats. 
 
“Every advanced AI-driven security use case boils down to whether you can see your data and whether you can trust it,” he said. Security experts say that integrating identity signals, access patterns, and data sensitivity into unified monitoring systems can help organizations identify suspicious activity more effectively. 

“When data, identity, and threat signals are unified, security teams can see a connected narrative,” Atal said. “A login, a download, and a data access event stop being isolated alerts and start telling a story.” 

 
Despite advances in technology, experts say human behavior remains a critical factor in cybersecurity. 

“In today’s cyber landscape, the front line is no longer the firewall,” Atal said. “It is the file you choose to open and the behaviour that follows.”
Read more »
San Francisco
cyber attack Cyber Attacks Cybersecurity San Francisco

San Francisco Children’s Council Breach Exposes SSNs of 12,000+ People

 

The Children’s Council of San Francisco has notified more than 12,000 individuals that their personal information was compromised in a cyberattack discovered last year. 

According to breach notification letters, the incident occurred on August 3, 2025, when the organization experienced what it described as a network disruption. An investigation later found that an unauthorized actor had accessed and obtained certain data. 

“On August 3, 2025, ChCo experienced a network disruption,” the Council said in its notice to affected individuals. 

“The investigation determined that an unknown actor accessed and acquired certain data without authorization.” 

The compromised information includes names and Social Security numbers belonging to 12,655 people. 

The notice did not specify whether the affected data included information related to children served by the organization. About two weeks after the breach occurred, a ransomware group known as SafePay claimed responsibility for the attack on its data leak website. 

The group reportedly demanded payment within 24 hours in exchange for deleting the stolen data. The Children’s Council has not confirmed the claim made by SafePay, and it remains unclear how attackers gained access to the organization’s systems. 

The nonprofit has not disclosed whether a ransom demand was paid. The organization said it is offering individuals affected by the breach free identity protection services. 

Victims can enroll in 12 months of credit monitoring and receive identity theft insurance coverage of up to one million dollars through TransUnion. The offer is available for 90 days from the date of the notification letter. 

SafePay is a ransomware operation that began publicly listing its victims on a leak site in November 2024. The group uses ransomware based on the LockBit strain and typically employs a double extortion strategy, demanding payment both to restore encrypted systems and to prevent the release of stolen data. 

In 2025, SafePay claimed responsibility for 374 ransomware attacks. Of those, 46 organizations confirmed the incidents and reported data breaches affecting about 17 million people. One of the largest involved Conduent Business Services, which notified approximately 16.7 million individuals that their data had been exposed. 

 
The group continues to be active in 2026 and has already taken credit for more than a dozen additional attacks, although only one of those has been confirmed so far. Ransomware incidents targeting organizations in the United States remain widespread. 

Researchers tracked 653 confirmed ransomware attacks against U.S. organizations in 2025, exposing roughly 43.3 million personal records. 

Several nonprofit and social service organizations have been among the victims. Recent incidents have affected groups such as Bucks County Opportunity Council in Pennsylvania, Catholic Charities of the Diocese of Albany in New York, North American Family Institute in Massachusetts, Elmcrest Children’s Center in New York and Family and Community Services in Ohio.

The Children’s Council of San Francisco is a nonprofit that works with government agencies to support childcare and early education services. The organization helps families locate and pay for childcare while distributing public funding to childcare providers that serve infants and children up to age 13. 

According to its website, the nonprofit administers an annual budget of nearly 250 million dollars and partners with the California Department of Social Services as well as local government agencies in San Francisco.
Read more »
zero day attacks
Akira Cybersecurity Data Breach Madison Square Garden Ransomware SSNs zero day attacks

Madison Square Garden Notifies Victims of SSN Data Breach

 



The Madison Square Garden Family of Companies has disclosed that it recently alerted an undisclosed number of individuals about a cybersecurity incident that occurred in August 2025. The company confirmed that the exposed information includes names and Social Security numbers.

According to MSG’s notification letter, attackers exploited a previously unknown vulnerability in Oracle’s E-Business Suite, an enterprise software platform widely used for finance, human resources, and back-office operations. The affected system was hosted and managed by an unnamed third-party vendor, indicating the intrusion occurred through an externally maintained environment rather than MSG’s core internal network.

Oracle informed customers that an undisclosed condition in the application had been abused by an unauthorized party to obtain access to stored data. MSG stated that its investigation, completed in late November 2025, determined that unauthorized access had taken place in August 2025. The gap between compromise and confirmation reflects a common pattern in zero-day attacks, where flaws are exploited before vendors are aware of their existence or able to issue patches.

In November 2025, the ransomware group known as Clop, also stylized as Cl0p, publicly claimed responsibility for the breach. During the same period, the group carried out a broader campaign targeting hundreds of organizations by leveraging the same Oracle vulnerability. MSG has not acknowledged Clop’s claim, and independent verification of the group’s involvement has not been established. The company has not disclosed how many people were notified, whether a ransom demand was made, or whether any payment occurred. A request for further comment remains pending.

MSG is offering eligible individuals one year of complimentary credit monitoring through TransUnion. Affected recipients have 90 days from receiving the notice letter to enroll.

Clop first appeared in 2019 and has become known for exploiting zero-day flaws in enterprise software. Beyond Oracle’s E-Business Suite, the group has targeted Cleo file transfer software and, more recently, vulnerabilities in Gladinet CentreStack file servers. Unlike traditional ransomware operators that focus primarily on encrypting systems, Clop frequently prioritizes data theft. The group exfiltrates information and then threatens to publish or sell it if payment is not made.

In 2025, Clop claimed responsibility for 456 ransomware incidents. Of those, 31 targeted organizations publicly confirmed resulting data breaches, collectively exposing approximately 3.75 million personal records. Institutions reportedly affected by the Oracle zero-day campaign include Harvard University, GlobalLogic, SATO Corporation, and Dartmouth College.

So far in 2026, Clop has claimed another 123 victims, including the French labor union CFDT. Its most recent operations reportedly leverage a newer vulnerability in Gladinet CentreStack servers.

Ransomware activity across the United States remains extensive. In 2025, researchers recorded 646 confirmed ransomware attacks against U.S. organizations, along with 3,193 additional unverified claims made by ransomware groups. Confirmed incidents resulted in nearly 42 million exposed records. One of the largest cases linked to Clop involved exploitation of the Oracle vulnerability at the University of Phoenix, which later notified 3.5 million individuals. In 2026 to date, 17 confirmed attacks and 624 unconfirmed claims are under review.

Other incidents disclosed this week include a December 2024 breach affecting the City of Carthage, Texas, reportedly claimed by Rhysida; a March 2025 breach at Hennessy Advisors impacting 12,643 individuals and attributed to LockBit; an August 2025 breach at KCI Telecommunications linked to Akira; and a December 2025 incident at The Lewis Bear Company affecting 555 individuals and also claimed by Akira.

Ransomware attacks can both disable systems through encryption and involve large-scale data theft. In Clop’s case, data exfiltration appears to be the primary tactic. Organizations that refuse to meet ransom demands may face public disclosure of stolen data, extended operational disruption, and increased fraud risks for affected individuals.

The Madison Square Garden Family of Companies includes Madison Square Garden Sports Corp., Madison Square Garden Entertainment Corp., and Sphere Entertainment Co.. The group owns and operates major venues such as Madison Square Garden, Radio City Music Hall, and the Las Vegas Sphere.



Read more »
Cybersecurity
Blockchain Botnet Cyber risks Cyber Security Cybersecurity

Botnet Moves to Blockchain, Evades Traditional Takedowns

 

A newly identified botnet loader is challenging long standing methods used to dismantle cybercrime infrastructure. Security researchers have uncovered a tool known as Aeternum C2 that stores its command instructions on the Polygon blockchain rather than on traditional servers or domains. 

For years, investigators have disrupted major botnets by seizing command and control servers or suspending malicious domains. Operations targeting networks such as Emotet, TrickBot, and QakBot relied heavily on this approach. 

Aeternum C2 appears designed to bypass that model entirely by embedding instructions inside smart contracts on Polygon, a public blockchain replicated across thousands of nodes worldwide. 

According to researchers at Qrator Labs, the loader is written in native C++ and distributed in both 32 bit and 64 bit builds. Instead of connecting to a centralized server, infected systems retrieve commands by reading transactions recorded on the blockchain through public remote procedure call endpoints. 

The seller claims that bots receive updates within two to three minutes of publication, offering relatively fast synchronization without peer to peer infrastructure. The malware is marketed on underground forums either as a lifetime licensed build or as full source code with ongoing updates. Operating costs are minimal. 

Researchers observed that a small amount of MATIC, the Polygon network token, is sufficient to process a significant number of command transactions. With no need to rent servers or register domains, operators face fewer operational hurdles. 

Investigators also found that Aeternum includes anti virtual machine checks intended to avoid execution in sandboxed analysis environments. A bundled scanning feature reportedly measures detection rates across multiple antivirus engines, helping operators test payloads before deployment. 

Because commands are stored on chain, they cannot be altered or removed without access to the controlling wallet. Even if infected devices are cleaned, the underlying smart contracts remain active, allowing operators to resume activity without rebuilding infrastructure. 

Researchers warn that this model could complicate takedown efforts and enable persistent campaigns involving distributed denial of service attacks, credential theft, and other abuse. 

As infrastructure seizures become less effective, defenders may need to focus more heavily on endpoint monitoring, behavioral detection, and careful oversight of outbound connections to blockchain related services.
Read more »
Passwords
Crypto Cyber Security Cybersecurity GitHub Linux Passwords

Fake Go Crypto Package Caught Stealing Passwords and Spreading Linux Backdoor

 



Cybersecurity investigators have revealed a rogue Go module engineered to capture passwords, establish long-term SSH access, and deploy a Linux backdoor known as Rekoobe.

The package, published as github[.]com/xinfeisoft/crypto, imitates the legitimate Go cryptography repository widely imported by developers. Instead of delivering standard encryption utilities, the altered version embeds hidden instructions that intercept sensitive input entered in terminal password prompts. The stolen credentials are transmitted to a remote server, which then responds by delivering a shell script that the compromised system executes.

Researchers at Socket explained that the attack relies on namespace confusion. The authentic cryptography project identifies its canonical source as go.googlesource.com/crypto, while GitHub merely hosts a mirror copy. By exploiting this distinction, the threat actor made the counterfeit repository appear routine in dependency graphs, increasing the likelihood that developers would mistake it for the genuine library.

The malicious modification is embedded inside the ssh/terminal/terminal.go file. Each time an application calls the ReadPassword() function, which is designed to securely capture hidden input from a user, the manipulated code silently records the data. What should have been a secure input mechanism becomes a covert data collection point.

Once credentials are exfiltrated, the downloaded script functions as a Linux stager. It appends the attacker’s SSH public key to the /home/ubuntu/.ssh/authorized_keys file, enabling passwordless remote logins. It also changes default iptables policies to ACCEPT, reducing firewall restrictions and increasing exposure. The script proceeds to fetch further payloads from an external server, disguising them with a misleading .mp5 file extension to avoid suspicion.

Two additional components are retrieved. The first acts as a helper utility that checks internet connectivity and attempts to communicate with the IP address 154.84.63[.]184 over TCP port 443, commonly used for encrypted web traffic. Researchers believe this tool likely serves as reconnaissance or as a loader preparing the system for subsequent stages.

The second payload has been identified as Rekoobe, a Linux trojan active in the wild since at least 2015. Rekoobe allows remote operators to receive commands from a control server, download additional malware, extract files, and open reverse shell sessions that grant interactive system control. Security reporting as recently as August 2023 has linked the malware’s use to advanced threat groups, including APT31.

While the malicious module remained listed on the Go package index at the time of analysis, the Go security team has since taken measures to block it as harmful.

Researchers caution that this operation reflects a repeatable, low-effort strategy with glaring impact. By targeting high-value functions such as ReadPassword() and hosting staged payloads through commonly trusted platforms, attackers can rotate infrastructure without republishing code. Defenders are advised to anticipate similar supply chain campaigns aimed at credential-handling libraries, including SSH utilities, command-line authentication tools, and database connectors, with increased use of layered hosting services to conceal corrupted infrastructure.


Read more »
Data Theft
Business Cyber Breaches Cyber Security Cybersecurity Data Theft

Cybersecurity Breaches Emerge as top Business Risk for Indian Companies

 


Cybersecurity breaches and attacks have become the leading threat to business performance for Indian companies, with 51% of senior executives identifying them as their primary risk, according to a new survey released by FICCI and EY. 

The FICCI-EY Risk Survey 2026 ranked changing customer expectations and geopolitical developments as the next most significant risks, flagged by 49% and 48% of respondents respectively. 

The findings point to a business environment where technology, regulation and external shocks are increasingly interconnected. 

The survey, conducted through a web-based questionnaire, gathered responses from 137 senior decision-makers, including CXOs, across multiple sectors. 

Technology firms accounted for the largest share of respondents, followed by professional services companies. According to the report, technology-related risks are now closely tied to operational continuity and resilience. 

About 61% of respondents said rapid technological change and digital disruption are affecting their competitive position, while an equal proportion cited cyber-attacks and data breaches as major financial and reputational threats. 

More than half of those surveyed, 57%, flagged risks related to data theft and insider fraud, and 47% said they face difficulties in countering increasingly sophisticated cyber threats. 

Artificial intelligence emerged as a dual risk area. While 60% of executives said inadequate adoption of emerging technologies, including AI, could weaken operational effectiveness, 54% said risks linked to AI ethics and governance are not being managed effectively. 

“In a business environment shaped by volatility, the ability to anticipate, absorb and adapt to risk is emerging as a defining capability for sustained growth,” said Rajeev Sharma, chair of the FICCI Committee on Corporate Security and Disaster Risk Reduction. 

He added that organisations are increasingly embedding risk considerations into strategic decision-making rather than treating them as isolated events. 

The survey also highlighted workforce-related concerns. Nearly two-thirds of respondents said talent shortages and skill gaps could hurt organisational performance, while 59% pointed to weak succession planning as a risk to long-term stability. 

Regulatory change remains another pressure point. About 67% of executives said regulatory developments need to be addressed proactively, while 40% acknowledged that existing compliance frameworks struggle to keep pace with evolving rules. 

Climate and environmental, social and governance risks are also translating into financial exposure. Around 45% of respondents cited climate-related financial impacts as a critical operational risk, and 44% said non-compliance with ESG disclosure requirements could significantly affect business outcomes. 

Supply chain disruptions continue to weigh on corporate planning, with 54% of leaders identifying them as a risk to operational and business continuity. 

“Organisations are navigating a phase where multiple risks are converging rather than occurring in isolation,” said Sudhakar Rajendran, risk consulting leader at EY India, pointing to the combined impact of inflation, cyber threats, AI governance, climate exposure and regulatory change on corporate resilience.
Read more »
Technology
Asia Cloud Services Cybersecurity Data protection data sovereignty Europe Geopolitical Cyber Risk Government organisations Technology

Geopolitical Conflict Is Increasing the Risk of Cyber Disruption




Cybersecurity is increasingly shaped by global politics. Armed conflicts, economic sanctions, trade restrictions, and competition over advanced technologies are pushing countries to use digital operations as tools of state power. Cyber activity allows governments to disrupt rivals quietly, without deploying traditional military force, making it an attractive option during periods of heightened tension.

This development has raised serious concerns about infrastructure safety. A large share of technology leaders fear that advanced cyber capabilities developed by governments could escalate into wider cyber conflict. If that happens, systems that support everyday life, such as electricity, water supply, and transport networks, are expected to face the greatest exposure.

Recent events have shown how damaging infrastructure failures can be. A widespread power outage across parts of the Iberian Peninsula was not caused by a cyber incident, but it demonstrated how quickly modern societies are affected when essential services fail. Similar disruptions caused deliberately through cyber means could have even more severe consequences.

There have also been rare public references to cyber tools being used during political or military operations. In one instance, U.S. leadership suggested that cyber capabilities were involved in disrupting electricity in Caracas during an operation targeting Venezuela’s leadership. Such actions raise concerns because disabling utilities affects civilians as much as strategic targets.

Across Europe, multiple incidents have reinforced these fears. Security agencies have reported attempts to interfere with energy infrastructure, including dams and national power grids. In one case, unauthorized control of a water facility allowed water to flow unchecked for several hours before detection. In another, a country narrowly avoided a major blackout after suspicious activity targeted its electricity network. Analysts often view these incidents against the backdrop of Europe’s political and military support for Ukraine, which has been followed by increased tension with Moscow and a rise in hybrid tactics, including cyber activity and disinformation.

Experts remain uncertain about the readiness of smart infrastructure to withstand complex cyber operations. Past attacks on power grids, particularly in Eastern Europe, are frequently cited as warnings. Those incidents showed how coordinated intrusions could interrupt electricity for millions of people within a short period.

Beyond physical systems, the information space has also become a battleground. Disinformation campaigns are evolving rapidly, with artificial intelligence enabling the fast creation of convincing false images and videos. During politically sensitive moments, misleading content can spread online within hours, shaping public perception before facts are confirmed.

Such tactics are used by states, political groups, and other actors to influence opinion, create confusion, and deepen social divisions. From Eastern Europe to East Asia, information manipulation has become a routine feature of modern conflict.

In Iran, ongoing protests have been accompanied by tighter control over internet access. Authorities have restricted connectivity and filtered traffic, limiting access to independent information. While official channels remain active, these measures create conditions where manipulated narratives can circulate more easily. Reports of satellite internet shutdowns were later contradicted by evidence that some services remained available.

Different countries engage in cyber activity in distinct ways. Russia is frequently associated with ransomware ecosystems, though direct state involvement is difficult to prove. Iran has used cyber operations alongside political pressure, targeting institutions and infrastructure. North Korea combines cyber espionage with financially motivated attacks, including cryptocurrency theft. China is most often linked to long-term intelligence gathering and access to sensitive data rather than immediate disruption.

As these threats manifest into serious matters of concern, cybersecurity is increasingly viewed as an issue of national control. Governments and organizations are reassessing reliance on foreign technology and cloud services due to legal, data protection, and supply chain concerns. This shift is already influencing infrastructure decisions and is expected to play a central role in security planning as global instability continues into 2026.

Read more »
StealC
Cybersecurity information stealer MaaS malware StealC

Researchers Exploit Flaw in StealC Malware Panel to Monitor Cybercriminals




Security researchers have identified a weakness in the web-based dashboard used by operators of the StealC information-stealing malware, allowing them to turn the malware infrastructure against its own users. The flaw made it possible to observe attacker activity and gather technical details about the systems being used by cybercriminals.

StealC first surfaced in early 2023 and was heavily promoted across underground cybercrime forums. It gained traction quickly because of its ability to bypass detection tools and extract a wide range of sensitive data from infected devices, including credentials and browser-stored information.

As adoption increased, the malware’s developer continued to expand its capabilities. By April 2024, a major update labeled version 2.0 introduced automated alerting through messaging services and a redesigned malware builder. This allowed customers to generate customized versions of StealC based on predefined templates and specific data theft requirements.

Around the same time, the source code for StealC’s administration panel was leaked online. This leak enabled researchers to study how the control system functioned and identify potential security gaps within the malware’s own ecosystem.

During this analysis, researchers discovered a cross-site scripting vulnerability within the panel. By exploiting this weakness, they were able to view live operator sessions, collect browser-level fingerprints, and extract session cookies. This access allowed them to remotely take control of active sessions from their own systems.

Using this method, the researchers gathered information such as approximate location indicators, device configurations, and hardware details of StealC users. In some cases, they were able to directly access the panel as if they were the attacker themselves.

To prevent rapid remediation by cybercriminals, the researchers chose not to publish technical specifics about the vulnerability.

The investigation also provided insight into how StealC was being actively deployed. One customer, tracked under an alias, had taken control of previously legitimate video-sharing accounts and used them to distribute malicious links. These campaigns remained active throughout 2025.

Data visible within the control panel showed that more than 5,000 victim systems were compromised during this period. The operation resulted in the theft of roughly 390,000 passwords and tens of millions of browser cookies, although most of the cookies did not contain sensitive information.

Panel screenshots further indicated that many infections occurred when users searched online for pirated versions of widely used creative software. This reinforces the continued risk associated with downloading cracked applications from untrusted sources.

The researchers were also able to identify technical details about the attacker’s setup. Evidence suggested the use of an Apple device powered by an M3 processor, with both English and Russian language configurations enabled, and activity aligned with an Eastern European time zone.

The attacker’s real network location was exposed when they accessed the panel without a privacy tool. This mistake revealed an IP address associated with a Ukrainian internet service provider.

Researchers noted that while malware-as-a-service platforms allow criminals to scale attacks efficiently, they also increase the likelihood of operational mistakes that can expose threat actors.

The decision to disclose the existence of the vulnerability was driven by a recent increase in StealC usage. By publicizing the risk, the researchers aim to disrupt ongoing operations and force attackers to reconsider relying on the malware, potentially weakening activity across the broader cybercrime market.

Read more »
Dark Web
Cloud Defense Cyber Security Cybersecurity CyberThreat Dark Web

NtKiller Tool Boasts AV/EDR Evasion on Dark Web

 

A threat actor dubbed AlphaGhoul has now begun to push NtKiller-a perilous tool-on the dark web forums, claiming it silently kills antivirus software and bypasses endpoint detection and response systems. As a malware loader, this tool targets popular security products such as Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro. This puts organizations relying on traditional security in great danger. Its announcement consolidates the escalating commercialization of evasion tools in the underground. 

NtKiller has a modular pricing system; the base price is $500, while the inclusion of rootkit capabilities or UAC bypass would be an additional $300 each, demonstrating the refinement of cybercriminal sales. KrakenLabs researchers witnessed early-boot persistence, embedding the tool within a system at an early stage of boot time, which is long before most security monitors have become active. This mechanism complicates the work of security teams for detection and removal. 

Beyond basic process killing, NtKiller boasts HVCI disabling, VBS manipulation, and memory integrity bypasses among other advanced evasion tactics. Anti-debugging and anti-analysis protections thwart forensic examination and create a gap between hype and proven performance. The silent UAC bypass escalates privileges with no user prompts, its menace amplified when combined with rootkits for persistent, surreptitious access. 

While the claims target enterprise EDR in aggressive modes, independent verification is lacking, and caution should be exercised when reviewing true efficacy. Such tools pose a more significant challenge to organizations because they take advantage of timing and stealth over signature-based defenses. That makes behavioral detection necessary in the security stacks to help with mitigating these threats.

Cybersecurity professionals recommend vigilance, layered defense, and active monitoring as a way of mitigating tools such as NtKiller in these increasing dark web threats. As cybercriminals continue to improve evasion techniques, it requires moving the advantage beyond simple reliance on traditional antivirus. This incident has highlighted the need for timely threat intelligence within enterprise security strategies.
Read more »
Scam
Bangladesh Cybersecurity FBI Identity Fraud Privacy Scam

U.S. Authorities Shut Down Online Network Selling Fake Identity Templates

 



United States federal authorities have taken down an online operation accused of supplying tools used in identity fraud across multiple countries. The case centers on a Bangladeshi national who allegedly managed several websites that sold digital templates designed to imitate official government identification documents.

According to U.S. prosecutors, the accused individual, Zahid Hasan, is a 29-year-old resident of Dhaka. He is alleged to have operated an online business that distributed downloadable files resembling authentic documents such as U.S. passports, social security cards, and state driver’s licenses. These files were not physical IDs but editable digital templates that buyers could modify by inserting personal details and photographs.

Court records indicate that the operation ran for several years, beginning in 2021 and continuing until early 2025. During this period, the websites reportedly attracted customers from around the world. Investigators estimate that more than 1,400 individuals purchased these templates, generating nearly $2.9 million in revenue. Despite the scale of the operation, individual items were sold at relatively low prices, with some templates costing less than $15.

Law enforcement officials state that such templates are commonly used to bypass identity verification systems. Once edited, the counterfeit documents can be presented to banks, cryptocurrency platforms, and online services that rely on document uploads to confirm a user’s identity. This type of fraud poses serious risks, as it enables financial crimes, account takeovers, and misuse of digital platforms.

The investigation intensified after U.S. authorities traced a transaction in which Bitcoin was exchanged for fraudulent templates by a buyer located in Montana. Following this development, federal agents moved to seize multiple domains allegedly connected to the operation. These websites are now under government control and no longer accessible for illegal activity.

The case involved extensive coordination between agencies. The FBI’s Billings Division and Salt Lake City Cyber Task Force led the investigation, with support from the FBI’s International Operations Division. Authorities in Bangladesh, including the Dhaka Metropolitan Police’s Counterterrorism and Transnational Crime Unit, also assisted in tracking the alleged activities.

A federal grand jury has returned a nine-count indictment against Hasan. The charges include multiple counts related to the distribution of false identification documents, passport fraud, and social security fraud. If convicted, the penalties could include lengthy prison sentences, substantial fines, and supervised release following incarceration.

The case is being prosecuted by Assistant U.S. Attorney Benjamin Hargrove. As with all criminal proceedings, the charges represent allegations, and the accused is presumed innocent unless proven guilty in court.

Cybersecurity experts note that the availability of such tools highlights the growing sophistication of digital fraud networks. The case is an alarming call for the importance of international cooperation and continuous monitoring to protect identity systems and prevent large-scale misuse of personal data.



Read more »
UK Critical Infrastructure
Clop Ransomware Cybersecurity Dark Web Leak Data Breach Healthcare Cyber Attack Oracle Security Risks Ransomware attack Software Vulnerability UK Critical Infrastructure

Russian Hackers Obtain Sensitive NHS Documents from UK Royal Properties

 


In a recent cyberattack, a ransomware group affiliated with Russia infiltrated the NHS computer system and retrieved hundreds of thousands of highly sensitive medical records, including those associated with members of the royal family, triggering alarms in several parts of the United Kingdom.

A breach, which was first revealed by The Mail on Sunday, revealed that over 169,000 confidential medical documents, some of which contained high-profile patient information, were published on dark-web forums following a software vulnerability within NHS clinical infrastructure that was exploited. 

A number of sources indicated that the attackers took advantage of a software bug in healthcare software and were able to use ransomware and steal classified patient information from networks connected to several royal residences, including Buckingham Palace, Windsor Castle, Sandringham, and Clarence House, which serves as the official home of the King. 

It's important to note that the incident has raised concerns regarding national digital security, patient confidentiality and the ability of critical healthcare systems to withstand state-aligned cybercriminal activities as well as one of the most significant exposures of protected medical data in recent years. 

There has been increasing scrutiny of the NHS following the breach, as 169,000 confidential healthcare records have been discovered on dark web platforms after attackers exploited a software fault in the systems used within the national health network to conduct the intrusion. 

Additionally, reports indicated that the same group had accessed medical files stored in digital environments connected with several royal properties, including Buckingham Palace, Windsor Castle, Sandringham Estate, and Clarence House. This has led to increased concerns regarding how Royal Household records are safeguarded.

There has been no confirmation from the Royal Family as to who had sought treatment or what type of treatment they received, but it is understood that the leaked materials contain information relating to King Charles' ongoing cancer treatment, emphasizing the sensitivity of this issue. 

Cyber security experts had previously cautioned about the vulnerable software that had been compromised in October of last year, to the effect that Russian-aligned cyber operations were not just plausible, but also "highly likely," a risk that has now been confirmed by independent researchers. 

Following subsequent investigations by Google's security division and the GB News, it was determined that a hacking group referred to as Clop had earlier contacted senior executives across numerous organizations requesting money in exchange for withholding stolen data, and that they had asked for payment. It was ultimately not possible to prevent publication of the documents, which later became available online. 

Currently, it is widely recognized that the breach was part of a larger scheme of exploitation which impacted the BBC, as well as several Premier League football clubs, in addition to the breach. As a result, Barts NHS Health Trust has commenced legal action to prevent any further dissemination of this material, and authorities continue to investigate the full extent of the breach and its consequences. In addition to reviving concerns about the security of enterprise software embedded within critical UK institutions, the breach has also renewed earlier concerns about enterprise software security. 

The NHS, as well as the HM Treasury, both rely on Oracle platforms for their core functions in the areas of financial administration, human-resource workflows, payroll, and personnel management. It was reported by security analysts in October that several exploitable weaknesses in the software environment presented an attractive entry point for Russian-linked threat groups as well as a high probability of targeted exploitation occurring without immediate remediation if the flaws were not fixed. 

There was more evidence later to support the warnings that Google had issued on a ransomware collective known as Clop, which had distributed direct email communication to executives across a wide variety of organizations, claiming that sensitive information from their networks had been extracted by the ransomware collective. Google's threat-intelligence division reported that those reports had been strengthened by independent security research. 

It has been noted that in previous mass intrusions, the group was attempting to extort money in exchange for nondisclosure, a tactic similar to high-pressure extortion campaigns that were observed before. The subsequent leak has intensified debate over third-party software risk, supply-chain security, and the greater challenge of protecting a nation's infrastructure that is heavily reliant on widely used commercial platforms even though authorities did not confirm the alerts at that time. There are reports that health records have been compromised to the point of compromise. 

The disclosure of these health records arises during a particularly sensitive time for the monarchy. This follows King Charles's recent public health update indicating gradual progress in his ongoing cancer treatment. It was during a conversation with Channel 4's Stand Up To Cancer campaign, a joint campaign with Cancer Research UK, that the monarch, who had been diagnosed with an unknown form of cancer in February of last year and had first announced his condition publicly in January of this year, gave the monarch hope that, in the near future, his treatment schedule may be relaxed. 

As the King announced at Buckingham Palace this month, he expects his medical interventions to be reduced from beginning next year onwards, which is considered a cautiously optimistic development in his medical treatment. It was during the campaign that the King referred to the structure, regularity, and regularity of his treatment routine, revealing a very intimate insight into an aspect of the Royal Household which, until now, has remained virtually secret. 

It was intended that the update would raise awareness of cancer research and encourage national participation, but because of its timing, the update has inadvertently coincided with renewed concerns about the security of royal medical records. As a result, there has been an increased public debate about privacy, digital security, and the vulnerability of high-sensitivity health records connected to national figures, intensifying. 

It has been reported that public engagement in cancer awareness initiatives has surged in recent weeks following the King's televised appeal, and Cancer Research UK has reported that the number of people visiting its new Cancer Screening Checker has increased drastically. This service was introduced by the charity on 5 December to provide a straightforward way for consumers to compare cancer screening options available through the National Health Service and the Public Health Agency in Northern Ireland, along with personalised advice on eligibility for specific screening categories, and to provide them with the information that they need. 

In total, more than 100,000 people have used the tool to date, many of whom have done so as a result of King Charles sharing a video message on Friday in which he spoke candidly about his own cancer treatment journey on Channel 4’s Stand Up To Cancer programme. According to Michelle Mitchell, Chief Executive of Cancer Research UK, the King’s openness sparked unprecedented public interest, and this led to an unprecedented increase in public interest.

A major part of her argument was that most visits to the checker were made after the monarch discussed his diagnosis and routine care, when national attention was focused on early detection and screening. As a result of the rapid uptake of the service, it is evident that the public is becoming increasingly willing to seek verified health information, as well as the effect high-profile advocacy has on increasing participation in preventive healthcare services.

With the incident, it has become increasingly important for national institutions to balance digital innovation with defensive readiness, particularly when core public services are delivered through commercial infrastructure that is shared among them. In addition to immediate containment, cybersecurity advisors emphasize that maintaining sustained vigilance, releasing vulnerabilities and accelerating software patch cycles are imperative for critical sectors like healthcare, finance, and public administration as well. 

According to security experts, organizations should move towards layered security frameworks that combine encrypted records segmentation, zero-trust access policies, and continual simulations of ransomware attacks to mitigate both the likelihood and impact of future intrusions. The breach emphasizes that cyber literacy at the leadership level is urgently needed in order to assist executives in recognizing extortion tactics before their negotiations reach crisis point. This will help executive managers identify extortion tactics as soon as possible during negotiations. 

After this incident, there is a renewed awareness among the people about the fragility of personal data once it reaches the outside world. This emphasizes the importance of engaging with only reliable health platforms and exercising caution when dealing with unsolicited communications. 

A study is still in progress, but analysts note that the outcome of this breach might influence the way in which a stronger regulatory push is made to ensure software supply chain accountability and real-time threat intelligence sharing across UK institutions. Those lessons that can be drawn from this compromise will ultimately strengthen both policy and practice in an era of persistent, borderless cyber threats, reshaping the country's ability to protect its most sensitive digital assets.
Read more »
Security Risks
Agentic Browsers AI Threat Business Security Cyber Security Cybersecurity Security Risks

Gartner Warns: Block AI Browsers to Avert Data Leaks and Security Risks

 

Analyst company Gartner has issued a recommendation to block AI-powered browsers to help organizations protect business data and cybersecurity. The company says most of these agentic browsers—browsers using autonomous AI models for interacting with web content and automating tasks by default—are designed to provide good user experiences at the cost of compromising security. 

These, the company warns, may leak sensitive information, such as credentials, bank details, or emails, to malicious websites or unauthorized parties. While browsers like OpenAI's ChatGPT Atlas can summarize content, gather data, and automatically navigate users between different websites, the cloud-based back ends commonly used by such browsers handle and store user data, leaving it exposed unless their security settings are carefully managed and appropriate measures implemented. 

What Gartner analysts mean here is that agentic browsers can be deceived into collecting and sending sensitive data to unauthorized parties, especially when workers have confidential data open in browser tabs while using an AI assistant. Furthermore, even if the backend of a browser conforms to the cybersecurity policies of a firm, improper use or configuration may turn the situation very risky. 

The analysts highlight that in all cases, the responsibility lies squarely with each organization to determine the compliance and risks involved with backend services for any AI browser. Besides, Gartner cautions that workers will be tempted to automate mundane or mandated activities, such as cybersecurity training, with the browsers, which could circumvent basic security protocols. 

Safety tips 

To mitigate these risks, Gartner suggests organizations train users on the hazards of exposing sensitive data to AI browser back ends and ensure users do not use these tools while viewing highly confidential information. 

"With the rise of AI, there is a growing tension between productivity and security, as most AI browsers today err toward convenience over safety. I would not recommend complete bans but encourage organizations to perform risk assessments on specific AI services powering the browsers," security expert Javvad Malik of KnowBe4 commented. 

Tailored playbooks for the adoption, oversight, and management of risk for AI agents should be developed to enable organizations to harness the productivity benefits of AI browsers while sustaining appropriate cybersecurity postures.
Read more »
Technology
AI/ML vulnerabilities Artificial Intelligence Cybersecurity SQL Technology

How Security Teams Can Turn AI Into a Practical Advantage

 



Artificial intelligence is now built into many cybersecurity tools, yet its presence is often hidden. Systems that sort alerts, scan emails, highlight unusual activity, or prioritise vulnerabilities rely on machine learning beneath the surface. These features make work faster, but they rarely explain how their decisions are formed. This creates a challenge for security teams that must rely on the output while still bearing responsibility for the outcome.

Automated systems can recognise patterns, group events, and summarise information, but they cannot understand an organisation’s mission, risk appetite, or ethical guidelines. A model may present a result that is statistically correct yet disconnected from real operational context. This gap between automated reasoning and practical decision-making is why human oversight remains essential.

To manage this, many teams are starting to build or refine small AI-assisted workflows of their own. These lightweight tools do not replace commercial products. Instead, they give analysts a clearer view of how data is processed, what is considered risky, and why certain results appear. Custom workflows also allow professionals to decide what information the system should learn from and how its recommendations should be interpreted. This restores a degree of control in environments where AI often operates silently.

AI can also help remove friction in routine tasks. Analysts often lose time translating a simple question into complex SQL statements, regular expressions, or detailed log queries. AI-based utilities can convert plain language instructions into the correct technical commands, extract relevant logs, and organise the results. When repetitive translation work is reduced, investigators can focus on evaluating evidence and drawing meaningful conclusions.

However, using AI responsibly requires a basic level of technical fluency. Many AI-driven tools rely on Python for integration, automation, and data handling. What once felt intimidating is now more accessible because models can draft most of the code when given a clear instruction. Professionals still need enough understanding to read, adjust, and verify what the model generates. They also need awareness of how AI interprets instructions and where its logic might fail, especially when dealing with vague or incomplete information.

A practical starting point involves a few structured steps. Teams can begin by reviewing their existing tools to see where AI is already active and what decisions it is influencing. Treating AI outputs as suggestions rather than final answers helps reinforce accountability. Choosing one recurring task each week and experimenting with partial automation builds confidence and reduces workload over time. Developing a basic understanding of machine learning concepts makes it easier to anticipate errors and keep automated behaviours aligned with organisational priorities. Finally, engaging with professional communities exposes teams to shared tools, workflows, and insights that accelerate safe adoption.

As AI becomes more common, the goal is not to replace human expertise but to support it. Automated tools can process large datasets and reduce repetitive work, but they cannot interpret context, weigh consequences, or understand the nuance behind security decisions. Cybersecurity remains a field where judgment, experience, and critical thinking matter. When organisations use AI with intention and oversight, it becomes a powerful companion that strengthens investigative speed without compromising professional responsibility.



Read more »
Scam Networks
Crypto Scam Cyber Fraud Cybercrime Prevention Cybersecurity DOJ Action Financial crime Investment fraud Online Safety Scam Networks

DOJ Disrupts Major Myanmar-Based Scam Targeting TickMill Users

 


Taking action to demonstrate the United States' commitment to combating transnational cyber-fraud networks, the Department of Justice has announced a decisive seizure of tickmilleas.com, a domain allegedly used by a sophisticated cryptocurrency investment scam originating in Burma, as a decisive step to underscore its intensifying campaign against cyber-fraud networks. 

Investigators have determined that the site, linked to the notorious Tai Chang scam compound, a hub favored by Burmese groups previously designated by the U.S Treasury for connections to Chinese organized crime and large-scale Southeast Asian scam operations, was intentionally crafted to lure foreign investors with fabricated promises of high returns, based on fabricated information provided to the investigators. A further manipulation took place to induce the victim to download fraudulent mobile applications that were part of the scheme's broader ecosystem. 

Law enforcement authorities have already taken coordinated actions that led to the removal of malicious apps from major app stores and the eradication of more than 2,000 scam-related accounts across Meta platforms as a result of coordinated actions. A renewed global alert has also been issued by Interpol, warning that such criminal activities are rapidly on the rise due to the rapidly developing use of technology and, in some cases, trafficking of forced labor in order to sustain these criminal enterprises. 

Using a counterfeit platform, the scammers deceived their victims into transferring their savings, and they usually presented fabricated dashboards that showed handsome, albeit fictional, gains from their investments, using the counterfeit platform. 

A number of victims reported seeing supposed deposits that were entered by the criminals themselves, according to the FBI. This was done in order to create the appearance that the money would be in a good position and to encourage further contributions. Even though the domains were registered only in early November 2025, investigators have already identified multiple individuals who have been induced to contribute cryptocurrency to the scam in recent weeks. 

Additionally, users were directed to download mobile applications which were alleged to be related to the platform through the website, prompting the FBI to alert both Google and Apple; some of the fraudulent apps have since been removed from the market. As the domain has been seized, visitors are met with an official law enforcement notice, eschewing what once looked like an impressive facade for an international fraud operation.

As the FBI San Diego Field Office continues its investigations, as well as the newly formed Scam Center Strike Force, it has been revealed that the seized domain was not an isolated fraud, but rather an extension of a scam infrastructure in Southeast Asia which is well-entrenched in the digital world. Tickmilleas.com, a website that sells pig meat and related products, was identified by authorities as having been built inside the Tai Chang compound in Burma, a fortified enclave located on the Thai-Myanmar border known for violent enforcement tactics, coerced labor, and large-scale "pig butchering" schemes. 

Associated with the Democratic Karen Benevolent Army, this compound has become a central engine within a multibillion dollar fraud economy, which targets Americans through sophisticated cryptocurrency investment traps that are disguised as professional trading platforms operated by affiliates of the Democratic Karen Benevolent Army, as well as broader Chinese transnational crime syndicates.

In order to be convincing to the victims, the website which was taken down by U.S. officials was designed as a convincing imitation of the legitimate TickMill trading service. It was decorated with fake trading dashboards, staged deposits, and fraudulent mobile applications aimed at luring victims deeper into the con. The investigators noted that there was a high degree of trafficking among the individuals working for the scam, as they were forced to engage in scripted interactions that were meant to reassure victims and extract increasing amounts of money from them. 

Despite the domain having been active for just a short time, federal agents were able to quickly map its infrastructure, identify the investors who had been deceived, and cut off the digital channels used for siphoning funds within minutes of its activeness. There had been three successful domain seizures linked to Tai Chang within the past few weeks, with the rapid intervention marking the third in the region—a sign that the U.S. efforts are becoming more aggressive, and the criminal networks operating around the region are experiencing a greater degree of disruption.

These operations are part of a broader criminal ecosystem known as pig butchering, which is a long-con scam in which perpetrators build trust with victims before stealing from them their savings. Officials from the U.S. estimate that these types of fraud schemes are draining approximately $9 to $10 billion from Americans every year, underscoring both their scale and sophistication in the way they are developed and executed. 

However, the human cost of such fraud schemes goes far beyond financial loss. Human rights groups, investigators, and experts have all repeatedly gathered evidence that a substantial number of these scam centers' staff members are trafficking victims who have been coerced, threatened, and violently forced into participating. As a result of the expansion of scam compounds across parts of Southeast Asia, it is reportedly estimated that they account for a substantial share of the country's economic output as well. 

According to the FBI's Internet Crime Complaint Center, there were more than 41,000 reports of cryptocurrency investment fraud in 2024, involving losses of over $5.8 billion, but investigators believe that the actual numbers don't even come close to the true damages, as many victims are too embarrassed or scared to come forward. 

A growing number of cross-border fraud networks are being uncovered by U.S. authorities. Officials are warning the public to be vigilant against platforms that promise effortless returns or encourage the download of unfamiliar apps - tactics that have been repeatedly used in these types of schemes. Experts note that if early skepticism, independent verification, and prompt reporting are utilized, they can significantly reduce the reach of such criminal organizations. 

Despite the fact that tickmilleas.com has been dismantled, investigators stress the importance of sustained international cooperation and ensuring that consumers remain informed in order to disrupt the larger ecosystem that provides the basis for these schemes to flourish.
Read more »
Subscribe to: Comments (Atom)