Hive and Nefilim affiliate sentenced to 70 months in prison
Artem Stryzhak pleaded guilty in December 2025; the FBI still offers up to $11 million for co-conspirator Volodymyr Tymoshchuk.
54
- Mentions · 7d9
- Mentions · 30d52
- All mentions93
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
93 articles · newest firstAt least 68 killed in Spanish high-speed train crash
Spain's transport minister calls a post-failure go-ahead inexplicable; police are reported interviewing Atocha control-centre staff.
4
Nefilim and Hive affiliate sentenced to 70 months in US
Ukrainian Artem Stryzhak was arrested in Spain in June 2024, extradited in April 2025, and allegedly hit about seven Hive victims.
58
Ukrainian Hive and Nefilim affiliate sentenced to 70 months
Artem Stryzhak deployed Nefilim in 2021 and Hive against seven organizations, including healthcare and law firms.
58
Nefilim and Hive affiliate Artem Stryzhak sentenced to nearly six years
The State Department is offering up to $11 million for co-conspirator Volodymyr Tymoshchuk; Hive hit about 1,500 victims worldwide.
62
Ukrainian Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak, 36, pleaded guilty in December 2025 after extradition from Spain; co-conspirator Tymoshchuk remains sought.
62
Nefilim and Hive ransomware affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty after attacks on hospitals and large firms; an alleged accomplice remains at large.
58
Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty in December 2025; the FBI says the groups caused more than $100 million in losses.
58
Nefilim and Hive affiliate Artem Stryzhak sentenced to 70 months
He pleaded guilty after extradition from Spain for attacks from 2018 through 2021; prosecutors still seek co-conspirator Volodymyr Tymoshchuk.
46
RootedCON opens 2027 call for papers for Madrid conference
The 17th edition is set for March 4–6, 2027, with organizers citing 9,000 to 10,000 attendees.
18
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
76
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
Midnight Mimosa malware ships in Android phone firmware
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
70
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Midnight Mimosa hides ad-fraud malware in cheap Android firmware
Bitdefender saw thousands of infected phones in more than 150 countries over about two years.
74
Barcelona Supercomputing Center opens AI Factory access via NVIDIA
BSC says it has delivered more than 800 services since April 2025 and named three AI Champions.
22
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
Encryption Is Getting Squeezed From All Sides
Canada's C-22 bill could force encryption backdoors and metadata retention, prompting Signal and Psiphon to threaten exit.
62
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.
84
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
NVIDIA Expands Advanced Technology Access for Europe’s Scientific Community Through Open Learning Resources, Collaborations and Compute
NVIDIA pledged open models, training, and compute to Europe's AI-in-science initiative.
56
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.
82
Fridge hack costing millions and sparking fires stemmed from poor security
Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.
72
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
Extortion group n0n listed 38 global ports, terminals, and shipping firms on its leak site.
76
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
76
Low-cost Android phones are arriving with malware that owners can’t uninstall
Bitdefender found preinstalled Midnight Mimosa malware on budget Android phones that owners cannot uninstall.
74
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.
74
Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
76
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
US authorities seized China-linked Integrity Tech tools Microscan and FishHub used to hack critical infrastructure.
84
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Bitdefender found Midnight Mimosa firmware malware preinstalled on budget Android phones in over 150 countries.
72
Thousands of wind and solar park systems sit exposed on the internet across Europe
Modat and NCSC-NL found 8,547 internet-reachable wind and solar control systems across Europe.
77
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
Low-cost Android phones ship with residential proxy malware
Midnight Mimosa malware preinstalled on cheap Android phones enables ad fraud and residential proxy abuse.
74
International coalition seizes tools used by cyber firm behind Flax Typhoon
A US-led coalition seized Flax Typhoon tools Microscan and FishHub operated by China's Integrity Tech.
80
China-linked malicious actors called out by UK and international partners for targeting sensitive data globally
UK and partners attribute global data theft to China-linked Integrity Technology Group and Flax Typhoon-related activity.
76
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
Related CVEs
by mentions- CVE-2015-330699%10.0Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
Appears with
- Googlevendor · 15
- FBIorganization · 14
- Androidproduct · 13
- Microsoftvendor · 10
- Europolorganization · 9
- Google Playproduct · 8
- Midnight Mimosamalware · 8
- Bitdefenderorganization · 8
- CISAorganization · 8
- KillSecthreat actor · 8
- Hivemalware · 7
- Google Threat Intelligence Grouporganization · 7
- MediaTekvendor · 7
- Nefilimmalware · 7
- Group-IBorganization · 6
- OpenAIvendor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.