A threat actor used AI tools with disabled safety controls to plan and execute multiple cybercrime activities, including credential theft, VoIP fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and database exfiltration. The actor targeted several Indian organizations, including universities, successfully exfiltrating thousands of personal records. AI-generated scripts and reconnaissance reports facilitated attacks such as WordPress brute force and MongoDB database theft. The actor also developed AI-powered VoIP fraud infrastructure and maintained automated pipelines for other criminal activities. Multiple unrelated actors are adopting similar AI-enabled toolchains, indicating a growing trend in AI-assisted cybercrime.
A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. [...]
The China-based hacking group known as Warlock, linked to Longlegs and Storm-2603, has been exploiting SharePoint vulnerabilities since July 2025 to target critical infrastructure, government, education, and telecom entities globally. Their attacks leverage multiple SharePoint flaws including ToolShell zero-days and recent CVEs such as CVE-2026-32201 and others. The group employs advanced techniques including webshell deployment, ASP.NET machine key exfiltration, DLL sideloading, and disabling security software to execute ransomware at scale. They also abuse Visual Studio Code's tunnel feature for covert network access and stage ransomware payloads in SYSVOL shares for domain-wide impact. These activities demonstrate that unpatched or unmitigated SharePoint vulnerabilities remain a significant attack vector for ransomware campaigns.
Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. [...]
An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. [...]
The FBI has publicly warned members of the ShinyHunters extortion group to surrender following the arrest of an alleged leader by Dutch police. ShinyHunters is linked to over 140 breaches worldwide, extorting victims by stealing sensitive data from corporate SSO accounts, third-party vendors, and cloud SaaS platforms. The group recently claimed responsibility for a significant breach of FBI systems, allegedly exploiting an Oracle PeopleSoft zero-day and stealing terabytes of data, including sensitive FBI personnel information. The FBI is actively investigating and pursuing remaining members, emphasizing that anonymity will not protect them. The arrested suspect remains in pre-trial detention, and further arrests are possible.
The North Korean hacking group WaterPlum has compromised at least 30,000 devices worldwide between December 2025 and July 2026, stealing over $10.7 million in cryptocurrency. WaterPlum uses malicious npm packages and fake job interviews to infect victims with malware that steals credentials, cryptocurrency keys, and sensitive data. The group is linked to North Korea's 313 General Bureau, supporting the regime's weapons programs. WaterPlum also impersonates victims to obtain jobs and expand attacks to espionage. Law enforcement agencies from Japan, the US, Australia, and Germany jointly issued this advisory.
The ShinyHunters extortion group breached the Clop ransomware gang's data leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the Tor site, uploaded a taunting message, and claim to have stolen server data including source code, Grav CMS plugins, system logs, and the private keys for Clop's Tor onion service. The stolen private keys could allow ShinyHunters to impersonate Clop's onion site. ShinyHunters intends to extort Clop using the stolen data. This attack appears to be part of an ongoing feud between the two cybercrime groups dating back to 2025.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]
Five alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges. [...]
A Ukrainian national has been sentenced to four years in prison for involvement in Conti ransomware attacks conducted between 2021 and 2022. The sentencing reflects law enforcement efforts to disrupt ransomware operations and hold individuals accountable for cybercrime activities.
Australian authorities arrested two men allegedly involved with the TeamPCP hacking group, which conducted widespread supply-chain attacks targeting open-source software and developer platforms. The group injected malicious code into software repositories, compromising over a thousand organizations globally and stealing credentials and data. The attacks impacted high-profile targets including Trivy, LiteLLM, SAP, OpenAI, and the European Commission. The suspects face multiple charges related to computer offenses and criminal proceeds. The investigation is ongoing, with further arrests possible.
Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks. The post Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia appeared first on SecurityWeek .
The cybercrime gang has listed major companies such as Shell, Philips, Fiserv, Zebra, Mindray, and Largan Precision. The post Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign appeared first on SecurityWeek .
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. [...]
Contracts may require a $1 million bond, which will be forfeited if a company fails to comply with operational requirements. The post White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs appeared first on SecurityWeek .
Initially calling itself BlackFile, the group has expanded operations to the Redact, Pink, Helix, and Falcon brands. The post Vishing Extortion Group UNC6671 Rebrands After Making Millions appeared first on SecurityWeek .
A recent wave of cyberattacks targeting hedge funds, private-equity firms, and other financial organizations has been linked to UNC6671, an extortion group reportedly associated with the BlackFile threat actors. [...]
