42
Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack
Cameron Curry sentenced to two years for stealing Brightly Software employee data and extorting the Siemens-owned firm for $7,540.92.
Cameron Nicholas Curry, a 27-year-old data analyst contractor at Siemens-owned Brightly Software, stole corporate and sensitive payroll data between August and December 2023 and sent more than 60 threatening emails to employees after his contract ended. He demanded roughly $2.5 million but received $7,540.92 in late January 2024, and was convicted of six counts of extortion in March. He was sentenced to two years in prison plus one year of supervised release, less than the 12-year maximum, after investigators traced him via operational security mistakes including a Coinbase account linked to family debit cards.
28
30
42
60
55
30
Man gets 15 years for extorting women with AI-generated porn videos
An Ohio man was sentenced to 15 years in prison for sextortion and cyberstalking numerous victims using AI-generated sexually explicit videos.
An Ohio man received a 15-year prison sentence for multiple cybercrimes. The offenses included sextortion and cyberstalking of numerous victims, with AI-generated sexually explicit content used against the victims. The case illustrates criminal justice outcomes for offenders using AI-generated imagery in extortion schemes.
42
Risky Bulletin: The EU publishes its upcoming cybersecurity standards
ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.
The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.
78
42
55
30
42
42
60
30
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members, a data extortion group tied to prolonged software supply chain attacks.
The Australian Federal Police arrested two unnamed suspects from Western Australia, aged 21 and 23, believed to be members of TeamPCP. The group is described as a cybercrime and data extortion syndicate blamed for the longest-running spree of software supply chain attacks, allegedly creating malicious open-source software that hit thousands of global businesses. KrebsOnSecurity had identified the 21-year-old suspect in June and had been in contact with him.
65
Risky Bulletin: White House lets private companies carry out offensive cyber ops
A White House memo directs DHS to create a program letting vetted private companies conduct US-government-directed offensive cyber operations against cybercrime.
A presidential memo tasks the DHS National Coordination Center with building a program, under DOJ and DHS oversight, through which private-sector companies can conduct offensive cyber operations against large-scale cybercrime organizations. Requirements include secure facilities, vetted personnel, a $1 million escrow for damages, and written approvals co-signed by DHS and DOJ executive directors. The program must launch within 60 days, around October 11, expanding a March executive order targeting scam compounds, ransomware, and other large-scale cybercrime.
65
55
30
42
60
30
42
30
30
Swiss court sentences 52-year-old Ukrainian ransomware dev to nearly 13 years in the cooler
Zurich court sentences Ukrainian ransomware developer to 12 years, 9 months for LockerGoga, MegaCortex and Nefilim attacks including Stadler Rail.
Zurich District Court sentenced a 52-year-old Ukrainian to 12 years and 9 months for developing LockerGoga, MegaCortex, and Nefilim ransomware, plus a 10-year ban from Switzerland; the verdict can be appealed. The operations hit over 1,800 victims across 71 countries with losses of several hundred million Swiss francs, including Stadler Rail (2020, $6 million Nefilim demand), Meier Tobler, and Crealogix. Alleged mastermind Volodymyr Tymoshchuk, indicted in the US and tied to at least 250 companies including Norsk Hydro, remains at large with an $11 million FBI bounty.
55
Conti Ransomware Hacker Sentenced After Group Attacked Over 1,000 Victims Worldwide
Ukrainian national Oleksii Lytvynenko sentenced to four years in US prison for his role in Conti ransomware attacks on 1,000+ victims.
Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty to conspiracy to commit wire fraud for working as a developer and intruder in the Conti ransomware operation, coding a malware loader and handling data stolen from 12 victims. Conti compromised over 1,000 victims across 47 US states and 31 foreign countries between 2020 and 2022, generating more than $150 million in ransoms. He was arrested in County Cork, Ireland in July 2023 and extradited to the US. The sentencing is part of a wider US investigation into the Conti and TrickBot ecosystem.
62
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.
74
60
42
30
30
42
42
42
60
30
42
42