30
30
Revolut Data Leak May Trace Back to Compromised Italian Government Accounts
Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.
Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.
55
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30
45
30
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.
Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.
55
30
30
30
30
30
30
30
30
45
30
30
30
30
SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques
45
30
30
30
30
30