Syrian Electronic Army hacker sentenced to 42 months in US
Ahmad Umar Agha, known as Th3Pr0, was sentenced Thursday after more than a decade as a fugitive; accomplice Firas Dardar remains at large.
48
- Mentions · 7d34
- Mentions · 30d170
- All mentions388
- First seenAug 11, 2026
- Last mentioned8h ago
Timeline
388 articles · newest firstSyrian Electronic Army hacker sentenced to 42 months
Ahmad Umar Agha, known as Th3Pr0, was jailed Thursday; co-defendant Firas Dardar remains a fugitive.
48
FBI seizes virtualine.net, domain of bulletproof host Virtualine
TRM Labs ties the host to ransomware and StealC payments and says the seizure may leave infrastructure online.
58
Syrian Electronic Army hacker sentenced to 42 months in U.S. prison
Ahmad Umar Agha, known as Th3Pr0, was sentenced for phishing-based hacks of about 47 Western targets, including a fake AP tweet.
62
UNM Health addresses cyberattack after ransomware group claims responsibility
UNM says operations are normal while the FBI investigates whether patient data was stolen; the group is unnamed.
62
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Essay argues cheap AI agents will make cyberattacks routine
It cites an authorized NSA Mythos test, a claimed Cairn campaign, and slower patching times.
28
42% of US county election sites still lack .gov domains
Of 2,081 county election sites, 869 are off .gov; about 51% of contact domains lack enforced DMARC.
38
FBI seizes Virtualine.net over alleged criminal hosting
The government says Virtualine still hosts a replacement site that has already drawn a child-abuse complaint.
58
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
US and partners seize Virtualine bulletproof hosting domain
Dutch police seized dozens of servers in Limburg and recovered data on more than 3,000 customers; follow-up is underway.
72
Hive and Nefilim affiliate sentenced to 70 months in prison
Artem Stryzhak pleaded guilty in December 2025; the FBI still offers up to $11 million for co-conspirator Volodymyr Tymoshchuk.
54
US sanctions Russians and North Koreans over IT-worker laundering
Treasury says two Russians each moved about $3.5 million in crypto tied to North Korean IT workers in Russia.
64
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Nefilim and Hive affiliate sentenced to 70 months in US
Ukrainian Artem Stryzhak was arrested in Spain in June 2024, extradited in April 2025, and allegedly hit about seven Hive victims.
58
US charges six in Madagascar NFT dating-scam scheme
Prosecutors say fake dating profiles steered about 800 victims into fraudulent NFT sites and at least about $516,695 in crypto losses.
52
Ukrainian Hive and Nefilim affiliate sentenced to 70 months
Artem Stryzhak deployed Nefilim in 2021 and Hive against seven organizations, including healthcare and law firms.
58
FBI seizes Virtualine bulletproof hosting domain
Prosecutors say the host ignored abuse notices, offered to move infrastructure after law-enforcement requests, and took unhosted Bitcoin payments.
62
Nefilim and Hive affiliate Artem Stryzhak sentenced to nearly six years
The State Department is offering up to $11 million for co-conspirator Volodymyr Tymoshchuk; Hive hit about 1,500 victims worldwide.
62
Ukrainian Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak, 36, pleaded guilty in December 2025 after extradition from Spain; co-conspirator Tymoshchuk remains sought.
62
FBI seizes Virtualine bulletproof hosting domain
A court authorized seizure of virtualine.net; prosecutors allege it kept serving a forum after child-abuse complaints and have not charged operators.
58
FBI seizes Virtualine bulletproof hosting domain in Operation Omegaline
German, Dutch and UK agencies assisted; the operator said it could rebrand and resume within about a day.
62
Nefilim and Hive ransomware affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty after attacks on hospitals and large firms; an alleged accomplice remains at large.
58
Nefilim and Hive affiliate sentenced to 70 months
Artem Stryzhak pleaded guilty in December 2025; the FBI says the groups caused more than $100 million in losses.
58
US indicts Malaysian national over Madagascar NFT scam compounds
Prosecutors say Chui Kok Wa and five others stole more than $516,695 from 74 cryptocurrency wallets.
58
FBI says SafePay breached 600-plus organizations since 2024
US, German and UK agencies say the gang guesses passwords, phishes and exploits known flaws.
78
Police stop drivers after AI flags license-plate travel as suspicious
An ACLU account says an officer showed a driver a nationwide plate heat map and claimed an FBI role after a pretext stop.
52
MonsterCloud CEO indicted over alleged ransomware recovery scam
Zohar Pinhasi allegedly billed clients more than $19 million while secretly paying over $8 million in ransoms and pleaded not guilty.
55
Election scams seek voter data, donations, fines, and fake merch
Malwarebytes outlines five lures, including a fake Minnesota absentee text and a Brazilian WhatsApp app push, backed by FBI and court warnings.
32
Tenable urges whole-of-state defense for SLED critical infrastructure
The post cites NASCIO survey findings and an FBI-EPA warning that water utilities in at least seven states reported cyberattacks.
32
UNM Health System diverts patients after unspecified cybersecurity issue
New Mexico's only Level 1 trauma center later resumed operations in phases; on-screen data-theft claims remain unconfirmed.
71
Senators say administration is withholding a secret FISA 702 ruling
The surveillance court objected to search filters seven months ago, yet collection continues under its March approval.
60
FBI raids Texas laptop farms tied to North Korean IT schemes
Operation Lonestar Roundup seized 187 devices, charged 14 people, and affected more than 70 US companies, the FBI says.
62
FBI and CISA warn SafePay hit at least 600 organizations
The independent group uses stolen or brute-forced credentials and VPN access, then steals data and appends .SafePay.
76
PHP2Shell exploit attempt hit Amazon honeypot before disclosure
CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.
91
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Since August 2024 the private group has used stolen or brute-forced credentials, VPN access, phishing, and edge-device flaws, then double-extorted victims.
82
SafePay Ransomware Affects 600+ Organizations
SafePay ransomware has compromised at least 600 organizations since August 2024 by exploiting exposed VPNs, remote access and backup servers.
90
CISA says SafePay ransomware hit 600+ organizations and wiped backups
The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.
86
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2024-4076618%9.8Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls)
- CVE-2024-4071190%9.8Unauthenticated Deserialization RCE in Veeam Backup & Replication
- CVE-2023-2026927%9.1Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense
- CVE-2020-325972%7.5Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
Appears with
- ShinyHuntersthreat actor · 85
- CISAorganization · 79
- FBIvictim · 50
- NSAorganization · 33
- U.S. Department of Justiceorganization · 33
- Microsoftvendor · 32
- Oraclevendor · 31
- US Department of Justiceorganization · 24
- Googlevendor · 22
- Oracle PeopleSoftproduct · 18
- Fortinetvendor · 17
- Oracleorganization · 16
- OpenAIvendor · 15
- Anthropicvendor · 15
- Googleorganization · 14
- OpenAIorganization · 13
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.