The DOJ recently announced it seized $2.8M from an alleged ransomware operator living in California back in early 2024. The Russian national was arrested and charged a year ago, but released on bail the same day. He's still out, despite multiple run-ins with police. cyberscoop.com/ianis-antrop...

Likewise, and your story on this is fantastic.

21-year-old former Army soldier pleaded guilty Tuesday to charges stemming from a series of attacks and extortion attempts last year on telecommunications companies, including AT&T. tip @techmeme.com cyberscoop.com/cameron-wage...

Scattered Spider weaves web of social-engineered destruction. The cybercrime ring has infiltrated more than 100 businesses since 2022, including more than a dozen since it regrouped earlier this year. via @mattkapko.com cyberscoop.com/scattered-sp...

NEW: The head of the FBI's cyber div told @timstarks.bsky.social that Salt Typhoon is “largely contained” and “dormant” in the networks, “locked into the location they’re in” and “not actively infiltrating information" in an exclusive intv with @cyberscoop.bsky.social cyberscoop.com/top-fbi-cybe...

Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report cyberscoop.com/hacker-helpe...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

Cybercrime crackdown disrupts malware, infostealers, marketplaces across the globe. A burst of global law enforcement actions during the past few weeks marked by a flurry of successful takedowns gives cybercrime experts a jolt of hope. via @mattkapko.com cyberscoop.com/cybercrime-c...

The Com’s chaotic, sprawling network, composed of mostly teenagers and young adults, are committing their crimes primarily for notoriety amongst their peers on the internet, @nixonnixoff.bsky.social said during a presentation @sleuthcon.bsky.social. cyberscoop.com/the-com-subc...

CrowdStrike and Microsoft announced an agreement Monday to formally connect the different names each company uses for the same threat groups in their attribution analysis. via @mattkapko.com cyberscoop.com/crowdstrike-...

Treasury sanctions crypto scam facilitator that allegedly stole $200M from US victims. The Philippines-based company Funnull operated a large cybercrime platform encompassing more than 332,000 domains, the FBI said. via @mattkapko.com youtu.be/ytmg-jbyl6o?... | cyberscoop.com/funnull-cryp...

This is good news! Just as ransomware has a whole ecosystem built up around it, so do these scam call centers, but at a much larger scale. Taking down one of the bigger ecosystem players will, hopefully, have a disruptive effect. via @mattkapko.com & @cyberscoop.bsky.social

Multiple attackers are raiding Ivanti customers’ systems again by exploiting a pair of closely intertwined vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to achieve unauthenticated remote code execution. via @mattkapko.com cyberscoop.com/ivanti-epmm-...

Laundry Bear, a group recently identified by Dutch intelligence and security services, stole work-related contact details on the Netherlands’ national police force in September 2024, Microsoft researchers said. via @mattkapko.com www.youtube.com/watch?v=b53l... | cyberscoop.com/laundry-bear...

A newly discovered Russian state-sponsored threat group has targeted a large swath of industries, especially in #NATO member states and #Ukraine, part of a global #espionage campaign in support of Moscow’s interests, Microsoft Threat Intelligence said in a Tuesday blog post. via @mattkapko.com

The successful break-up of DanaBot marks the second high-profile law enforcement disruption of a widespread malware operation in as many days. via @mattkapko.com cyberscoop.com/danabot-malw...

Lumma Stealer, a widely used infostealer malware linked to cybercrime sprees and multiple high-profile attacks, was dismantled through a coordinated global operation meant to seize its core infrastructure. via @mattkapko.com cyberscoop.com/lumma-steale...

An extensive investigation by #Sophos X-Ops, pulled from thousands of posts on two Russian-language and three English-language cybercrime forums, uncovered the dark underbelly of illegal schemes #cybercriminals use to reinvest their money. via @mattkapko.com youtu.be/DVCEMR0hc_4?...

Great story from @mattkapko.com and @sophossecurity.bsky.social on what cybercriminals do with their money: it's not all lambos and bottle service, its often laundered through legit businesses (with forums featuring guides on how to bury cash in the ground) cyberscoop.com/what-cybercr...

Vulnerabilities are proliferating in SonicWall devices and software this year. The company is among many network security device vendors targeted by cybercriminals. Yet, unlike almost all of its competitors, SonicWall hasn't signed CISA's secure-by-design pledge. cyberscoop.com/sonicwall-ex...

#CrowdStrike is cutting 5% of its #workforce, about 500 positions, telling its staff that it’s shifting resources and realigning its operating model for growth in new market segments, according to a Wednesday filing with the SEC. via @mattkapko.com cyberscoop.com/crowdstrike-...

Five months after education software vendor PowerSchool paid an unnamed threat actor a #ransom in exchange for the deletion of sensitive stolen data, some of the company’s customers are now receiving #extortion demands. via @mattkapko.com cyberscoop.com/powerschool-...

Amazon, CrowdStrike, Google and Palo Alto Networks claim no change to threat intel sharing under Trump. Top security leaders at some of the largest tech and cybersecurity vendors said public-private collaborative work continues, despite budget cuts and personnel changes. via @mattkapko.com

Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime. via @mattkapko.com cyberscoop.com/north-korea-...

🎙️ Ready for #RSA 2025? CyberScoop’s @mattkapko.com joined the latest episode of Pressing Matters to preview the conference—and yes, #AI talk is inevitable. 🔗 Listen here: www.buzzsprout.com/2028393/epis...

Cyber threat wonks and incident response firms don't have to release all of their research during the chaos of RSA. Yet, without fail, they do this year after year. Good luck cutting through the noise.

I usually ask the questions, but not this time. It was an honor to join Big Valley Marketing's Pressing Matters podcast. We covered a lot of ground, maybe too much. This is my story and I'm grateful for the thought and care Dave Reddy put into our conversation. www.buzzsprout.com/2028393/epis...

Attackers have exploited 16 vulnerabilities in Ivanti products since 2024. That’s more than any other vendor in the network edge device space. cyberscoop.com/ivanti-explo...

On the latest episode of the Safe Mode podcast, @gregotto.bsky.social speaks with @mattkapko.com about the latest investigations into the growing threat of North Korean remote workers infiltrating global enterprises. www.youtube.com/watch?v=PaNX...

Fascinating story about North Korean tech workers: they never log off, and they generate hundreds of millions in salaries for the regime. By @mattkapko.com of @cyberscoop.bsky.social #infosec cyberscoop.com/north-korea-...

A Canadian citizen is one step closer to standing trial in the U.S. for his alleged involvement in a series of attacks targeting as many as 165 Snowflake customers, one of the most widespread and damaging attack sprees on record. via @mattkapko.com cyberscoop.com/connor-mouck...

On the latest episode of #SafeMode, @gregotto.bsky.social talks with @mattkapko.com about who is sending those massively annoying #scam text messages about unpaid toll violations. youtu.be/OSjEn_MgXuQ?...

Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue. via @mattkapko.com cyberscoop.com/microsoft-wi...

It’s not just you. Seemingly everyone is getting those text messages that serve as a notification of an unpaid toll road violation. cyberscoop.com/toll-road-te...

The only thing the internet can seemingly agree on is that X was in fact hit with a DDoS attack on Monday. That's really where the agreements end. @mattkapko.com talked to researchers cyberscoop.com/x-ddos-attac...

On the latest episode of #SafeMode, @gregotto.bsky.social speaks with @mattkapko.com about the Justice Department’s indictment of 12 Chinese nationals accused of running an extensive hacker-for-hire operation on behalf of China’s #intelligence and #security services. youtube.com/shorts/4oBUd...

Threat actors became increasingly efficient last year, rapidly achieving lateral movement and swiftly stealing data at a faster clip than ever before, according to multiple threat intelligence firms. cyberscoop.com/cybercrimina...

A 21-year-old U.S. Army soldier linked to last year's Snowflake attack spree allegedly tried to sell stolen data to a foreign intelligence service after searching for information about how to defect to Russia. Hat tip to @nixonnixoff.bsky.social @austinlarsen.me cyberscoop.com/army-soldier...

Check out this deep dive on the ORIGINAL version of "CISA."

#Crypto analysts stunned by Lazarus Group’s capabilities in $1.46B Bybit #theft. The amount stolen last week surpasses what the group was able to steal in all of 2024. via @mattkapko.com cyberscoop.com/bybit-lazaru...

Palo Alto Networks’ threat intelligence firm said nearly 9 in 10 #cyberattacks it responded to last year involved disrupted business operations. via @mattkapko.com cyberscoop.com/cyberattacks...

Black Basta’s internal chat logs, which were leaked earlier this month, are providing defenders with actionable intelligence on the #ransomware group’s operations, cybercrime experts told CyberScoop. via @mattkapko.com cyberscoop.com/black-basta-...

The CyberScoop editorial team is closely monitoring the federal government's activities and developments in cybersecurity. If you're interested in discussing what's happening across these areas, we have several reporters actively covering these topics who you can reach out to via Signal:

#SaltTyphoon gained initial access to Cisco devices as part of the Chinese nation-state threat group’s sweeping attacks on U.S. telecom networks, the company confirmed Thursday in a #threat intelligence report. via @mattkapko.com cyberscoop.com/cisco-talos-...

Russia-aligned threat groups dupe Ukrainian targets via #Signal. Google researchers say multiple #Russian state threat groups have conducted remote #phishing operations to target and compromise Signal accounts. via @mattkapko.com cyberscoop.com/russia-threa...

Edge devices harboring zero-day and n-day vulnerabilities were linked to the most consequential attack campaigns last year, Darktrace said in an annual threat report released Wednesday. via @mattkapko.com cyberscoop.com/edge-device-...

Suspected Russian nation-state threat groups have duped multiple victims into granting potentially persistent access to networks via authentication requests and valid tokens. via @mattkapko.com cyberscoop.com/russia-threa...

Salt Typhoon remains active, hits more telecom networks via Cisco routers cyberscoop.com/salt-typhoon...

#Russian state #threat group shifts focus to US, UK targets. A subgroup of Seashell Blizzard exploited public #vulnerabilities in internet-facing systems, Microsoft researchers said. via @mattkapko.com cyberscoop.com/russian-stat...