n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Country
Netherlands
- Mentions · 7d18
- Mentions · 30d98
- All mentions161
- First seenAug 11, 2026
- Last mentioned10h ago
Timeline
161 articles · newest firstWiz says AI agents are running hands-on intrusions
Named cases include ARTEX at Korean banks and ConnectWise, Hermes at Thailand's finance ministry, and AI-assisted API attacks in Japan.
68
Wiz says AI agents are doing hands-on intrusion work
Named cases include ARTEX and Hermes, plus three Wiz investigations that begin with an exposed Flowise service.
68
FBI seizes Virtualine.net over alleged criminal hosting
The government says Virtualine still hosts a replacement site that has already drawn a child-abuse complaint.
58
US and partners seize Virtualine bulletproof hosting domain
Dutch police seized dozens of servers in Limburg and recovered data on more than 3,000 customers; follow-up is underway.
72
noyb sues Scale AI over Outlier worker tracking and biometrics
Complaints in four EU countries allege keystroke logging and mandatory face video; Scale calls the claims inaccurate.
52
FBI seizes Virtualine bulletproof hosting domain
Prosecutors say the host ignored abuse notices, offered to move infrastructure after law-enforcement requests, and took unhosted Bitcoin payments.
62
FBI seizes Virtualine bulletproof hosting domain
A court authorized seizure of virtualine.net; prosecutors allege it kept serving a forum after child-abuse complaints and have not charged operators.
58
FBI seizes Virtualine bulletproof hosting domain in Operation Omegaline
German, Dutch and UK agencies assisted; the operator said it could rebrand and resume within about a day.
62
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
58
Nefilim and Hive ransomware affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty after attacks on hospitals and large firms; an alleged accomplice remains at large.
58
FBI seizes Virtualine domain over alleged criminal hosting
Prosecutors say the host kept a forum online after child-exploitation notices and took unhosted bitcoin.
70
Nefilim and Hive affiliate Artem Stryzhak sentenced to 70 months
He pleaded guilty after extradition from Spain for attacks from 2018 through 2021; prosecutors still seek co-conspirator Volodymyr Tymoshchuk.
46
Chinese national extradited over alleged $37 million investment scam
Prosecutors say a Cambodia-linked ring used fake trading sites and moved victim money into Tether.
58
Dutch police extradite Chinese national over Cambodian scam laundering
Zheng Zhao faces up to 20 years after prosecutors say at least $36.9 million from 174 US victims moved through a Bahamas bank into USDT.
48
Dutch police arrest two over AI bank calls and NFC card fraud
Police say a fake banking app copied NFC card data so accomplices could withdraw cash from 170 victims.
58
Chinese man extradited to US over $36.9 million crypto scam
Zhen Zhao was arraigned in California after extradition from the Netherlands and faces up to 20 years if convicted.
52
Dutch police arrest two over NFC-relay bank fraud above $400,000
Police say 170 victims lost more than €380,000 after AI voice calls led them to scan debit cards.
46
Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
58
Commentary: Caribbean outages show shared-platform cyber risk
A Curaçao ransomware incident and a shared court outage hit services used by six jurisdictions, the author argues.
24
Post claims Dutch government hacked Jared Kushner's phone
The item is only a Hacker News link title, with 34 points and 8 comments and no further details.
28
Book says Dutch spies viewed Kushner’s iPhone after GRU breach
Matthew Cole writes that MIVD saw a Dubai account that had received hundreds of millions from Azerbaijan.
44
ThreatsDay: Bluesky phishing, Laravel bypass, NVIDIA AIStore flaw
Bluesky suspended over 4,500 phished accounts; Laravel 12.68.0 and 13.29.0 fix CVE-2026-114509, and Roundcube shipped 20 fixes.
58
PHP2Shell takes 32 UK government services offline
AWS says the two critical PHP bugs were exploited four days before disclosure; no public-sector compromise is confirmed.
88
Critical PHP flaws prompt site shutdowns as exploit attempts surge
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
90
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
92
PHP emergency patches fix two critical unauthenticated RCE flaws
Both CVSS 9.2 bugs affect web-facing PHP, including PHP-FPM and mod_php; fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Critical PHP flaws let unauthenticated attackers run code on web servers
CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.
90
Sites go offline as two critical PHP bugs draw early attacks
Fixes are out only for PHP 8.2 and newer; Cloudflare and watchTowr report emerging attacks dubbed PHP2Shell.
90
Dutch NCSC takes its website offline over PHP flaws
A PHP security patch is planned for 16:00 Dutch time, and NCSC expects an advisory within an hour.
58
European Commission opens DSA fraud probe into Booking.com
Officials cite Booking.com’s June 2024 report of a 500–900 percent rise in travel scams and more than 1,000 Dutch fraud notices.
50
Eight eMudhra intermediate CA keys compromised; browsers block them
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
86
FBI suspects consulting executive helped run ShinyHunters extortion site
Edward Dubrovsky was arrested October 8; sources say shinywire.com listed nearly 100 organizations through October 16.
74
Ahold Delhaize restoring services after a cyberattack
Many European sites are back and Albert Heijn home delivery is expected by Friday; no data theft is confirmed.
74
Ahold Delhaize cyberattack disrupts services in the US and Europe
Stores stayed open; investigators have not found stolen customer, associate or partner data.
74
FBI probes alleged ShinyHunters ties to ransom negotiators
Canadian executive Edward Dubrovsky was arrested and charged with extortion; an unnamed U.S. firm’s executive is also suspected, with no charges yet.
74
Ahold Delhaize takes US and European systems offline after cyberattack
Stores stayed open, and the company says investigators have found no evidence of stolen sensitive data.
74
Ahold Delhaize confirms malicious actions behind grocery outages
US online shopping at Food Lion and Stop & Shop is still down; Dutch brand sites are back, with Albert Heijn deliveries expected Friday.
74
FBI suspects a ransom negotiator ran ShinyHunters extortion site
Sources say an unnamed US consulting executive helped run shinywire.com; that person has not been charged.
74
Related CVEs
by mentions- CVE-2026-10249011%9.4Local privilege escalation to root in all Zammad versions
- CVE-2026-10248922%9.4Session hijack to RCE in Zammad
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-8510254%9.8Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
Appears with
- FBIorganization · 40
- ShinyHuntersthreat actor · 37
- FBIvictim · 29
- Microsoftvendor · 24
- Oraclevendor · 19
- CISAorganization · 18
- Citrixvendor · 13
- NetScaler Gatewayproduct · 12
- NetScaler ADCproduct · 12
- NCSC-NLorganization · 11
- Dutch Institute for Vulnerability Disclosurevictim · 11
- Dutch Institute for Vulnerability Disclosureorganization · 11
- Zammadproduct · 11
- Zammadvendor · 10
- NCSCorganization · 10
- Googlevendor · 10
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.