Search: “Cyprus”

10 stories in the last 30d

US DoJ charged extradited Russian Searzhudin Aktulaev for a 2016-2017 Excel macro campaign infecting ~80,000 freelance platform users with TVRAT and DarkVNC.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025 and extradited to the US on August 28, facing charges including wire fraud conspiracy and aggravated identity theft. The indictment alleges ~255 fake freelance-platform accounts were used to send Excel macro attachments to about 80,000 users in 2016-2017, deploying TVRAT (TeamSpy/TVSPY) and DarkVNC RATs for remote access and data theft. Thousands of infected machines called back to a US-hosted C2 domain, with stolen credentials and PII stored in the shared email account used in the scheme.

The Hacker NewsSep 2, 09:10 UTC · 14d agoPolicy & legal

Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.

Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.

The Hacker NewsSep 14, 07:24 UTC · 2d agoMalware in the wild

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business NewsSep 4, 03:02 UTC · 12d agoPolicy & legal

Russian man indicted for spreading malware to 80,000 freelancers

US prosecutors indicted a Russian national for infecting roughly 80,000 freelancers with TVRAT and DarkVNC malware via fake freelance-platform accounts.

Searzhudin Tamirlanovich Aktulaev, 40, was indicted in California for conspiracy, transmission of malicious code, and aggravated identity theft; he was arrested in Cyprus in May 2025 and extradited in August 2026. From June 2016 to November 2017, about 255 fake accounts on a Northern California freelance platform messaged roughly 80,000 users with malicious Excel attachments that ran macros to download malware. The campaign deployed TVRAT (also known as TeamSpy), which exploited a TeamViewer flaw, and DarkVNC via VNC Viewer, exfiltrating stolen data to US-hosted command-and-control servers. About half the victims were in the US, and stolen credentials were used for fraud.

Help Net SecuritySep 3, 00:00 UTC · 13d agoPolicy & legal in the wild

Russian national facing 20 years for malware campaign that infected 80,000 freelancers

US prosecutors indicted Russian national Searzhudin Aktulaev for a 2016 TVRAT malware campaign that infected 80,000 freelance platform users, carrying up to 20 years.

Searzhudin Tamirlanovich Aktulaev was arrested in Cyprus in May 2025, extradited to the US, and appeared in a San Francisco federal court on charges including conspiracy, aggravated identity theft, and damaging protected computers. Between June 2016 and November 2017 he spread a TVRAT (TVSPY/TeamSpy) variant via malicious Microsoft Excel attachments sent from 255 fake accounts on a freelance employment platform's messaging system, infecting about 80,000 users. TVRAT exploited a TeamViewer vulnerability and DarkVNC exploited a bug in VNC Viewer to take over devices; he used the access to steal data and commit fraud, maintained C2 domains, and stored stolen e-commerce credentials for hundreds of victims. About half the victims were in the US, mostly California; the charges carry a maximum 20-year sentence and his next hearing is October 5.

The RecordSep 2, 18:47 UTC · 13d agoPolicy & legal

Russian Man Extradited Over Malware Campaign Targeting Freelancers

A Russian national was extradited to the US for allegedly spreading TVRAT and DarkVNC malware to 80,000 freelance platform users via Excel attachments.

Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, extradited on August 28, 2026, and indicted on conspiracy, computer damage, unauthorized access and aggravated identity theft charges. Prosecutors say he and co-conspirators used about 255 fake accounts on a freelance employment platform's messaging system to send macro-laden Excel attachments between June 2016 and November 2017, deploying TVRAT (TVSPY/TeamSpy) and DarkVNC remote access trojans. Thousands of victims were identified on a US-hosted C2 domain, with roughly half of the 80,000 affected users in the US; C2 infrastructure was paid for with virtual currency. If convicted he faces up to 20 years for wire fraud conspiracy plus additional terms and fines.

Infosecurity MagazineSep 2, 15:00 UTC · 14d agoPolicy & legal in the wild1

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.

Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.

Security AffairsAug 27, 20:31 UTC · 19d agoThreat actor in the wild

Slovakia Warns of Cyber Risks in Road Speed Cameras

Slovakia's NBÚ warns that speed camera systems from SODASUS, Simicon and NEROline pose cyber risks including undocumented remote access.

Slovakia's National Security Authority (NBÚ) warned of a significant cyber threat tied to several road speed camera products: NERO R-ONE units sold by Cyprus-based SODASUS, and Cordon-series cameras made by Russia's Simicon and sold by Croatia's NEROline. A security analysis requested by the Interior Ministry found weak protections, mismatches between documented and actual communication settings and software versions, unclear hardware/software provenance, and pre-configured remote-access mechanisms outside operator control. NBÚ warned that compromised cameras could expose vehicle and licence-plate data, tamper with records, or serve as a foothold into public-sector networks lacking segmentation. The Interior Ministry reportedly removed the units from its pilot deployment and asked the supplier to replace them with equipment meeting Slovak and EU security requirements.

Security AffairsAug 24, 08:54 UTC · 23d agoAdvisory

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business NewsAug 20, 05:29 UTC · 27d agoPolicy & legal1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business NewsAug 19, 04:52 UTC · 28d agoThreat actor in the wild1