ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “italy”

35 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 10Threat actor 8Data breach 6Policy & legal 4Ransomware 2Phishing & fraud 1AI safety & security 1AI industry 1Exploit / PoC 1AI research 1
SeverityAllcritical 3high 3medium 13low 0info 16

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security News · 9d agoRansomware in the wild

Troy Hunt

Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.

Troy Hunt's blog roundup centers on a cautionary tale about data breach claims: ShinyHunters claims it compromised Carhartt and stole over 50GB of compressed data containing millions of customer records, employee information and loyalty data, but Hunt stresses criminal claims require verification. The feed also covers Sri Lanka CERT becoming the 48th government onboarded to Have I Been Pwned's free government monitoring service, following Nepal as the 47th. Other commentary addresses ransomware economics, Brinks Home's lawyer-heavy extortion FAQ, and the Origin Energy breach in Australia.

Troy Hunt · 10d agoData breach1

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security · 20d agoIndustry

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net Security · 22d agoIndustry

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security · 22d agoIndustry2

58 Arrested In International Cybercrime Crackdown

Interpol's Operation Jackal IV arrested 58 people across 22 countries, disrupting Black Axe-linked money laundering and fraud networks and uncovering $166 million.

Law enforcement in 22 countries coordinated on Operation Jackal IV from November 2025 to June 2026, arresting 58 people and identifying hundreds of suspects, Interpol announced. Actions in Argentina uncovered a 196-person crime-as-a-service network providing domains and money laundering support to Black Axe, with 17 arrests there; South African raids in Johannesburg linked to romance and investment scams targeting the elderly led to 39 arrests and about $2.7 million seized. Romanian investigators found $166 million in stolen and laundered funds in electronic wallets controlled by a cryptocurrency investment scam call center, making 11 arrests and seizing about $379,000 plus properties and luxury watches. Interpol also flagged rising sextortion of minors as young as 14 via social media and gaming platforms.

The Record · 22d agoPolicy & legal

Cybersecurity jobs available right now: December 16, 2025

Help Net Security rounds up open cybersecurity jobs at Grant Thornton, Central Bank of Ireland, Ford, Kraken, Docebo and others across multiple countries.

This is a job listing roundup covering cybersecurity openings at organizations including Grant Thornton, the Central Bank of Ireland, Ford Motor Company, Global Medical Response, banglalink, Mindrift, Kraken, PFH Technology Group, Kiwibank, Mazrui International, Docebo and Alpitronic. Roles span SOC operations, GRC, endpoint security, FedRAMP compliance, threat intelligence and privacy leadership across the USA, Ireland, India, Bangladesh, France, UAE, Canada and other locations. All listings were marked as no longer accepting applications at publication time.

Help Net Security · 27d agoIndustry

Cyber-Attacks Cost Organizations $52,000 on Average

Hiscox's 2026 survey of 6,800 security leaders found 29% of organizations hit by successful attacks averaging $52,000 in costs and 32.8 hours of downtime.

The Hiscox Cyber Readiness Report 2026, based on a survey of 6,800 security decision-makers across the UK, Europe, and US, found 29% of organizations suffered at least one successful cyber-attack in the past 12 months, averaging four incidents per victim. UK firms were most attacked at 38% while US firms were least at 20%; average incident cost was $52,000 globally, peaking at $134,138 in Italy, with 32.8 hours of average downtime. Impacts included growth delays (32%), financial penalties (28%), and burnout or toxic culture (69%). Businesses invest about $51,000 annually in resilience, and 32% now tie executive compensation to cybersecurity outcomes.

Infosecurity Magazine · 22h agoIndustry

Amazon launches Alexa+ in India with Hindi support

Amazon launched its generative AI Alexa+ assistant in India with Hindi support in Early Access, free for Prime customers after testing.

Amazon announced that Alexa+, its generative AI-powered conversational assistant, is now available in India in Early Access with Hindi and English support, including mid-sentence language switching and long-form context retention. The assistant handles multi-step tasks such as ordering groceries via Amazon Now and controlling smart home devices, with integrations including Swiggy, District, MakeMyTrip, EazyDiner, Amazon Music, and JioSaavn. It will be free for Prime members after the testing period and cost about $20.85 per month for non-Prime customers. Amazon is targeting India's 600 million-plus Hindi speakers, and says smart device adoption grew 20% year over year.

TechCrunch · AI · 23h agoAI industry

America's Driver's License Breach Is a National Security Disaster

Dark web service Nexus sells 153 million US/Canadian driver's licenses linked to a breach of identity verifier IDScan.

Krebs on Security revealed a dark web service, Nexus, selling access to 153 million driver's licenses and 3 million travel documents from US and Canadian citizens, roughly 63 percent of all US licenses. Circumstantial evidence links the data to identity verification firm IDScan, which confirmed it is investigating a breach, and the FBI is probing the incident. Licenses belonging to senior US officials, including Pete Hegseth, an FBI assistant director, and Krebs's own contacts were verified as genuine. The exfiltration appears ongoing, with the database growing by nearly 400,000 licenses in a single day, and the data carries significant national security value for foreign intelligence services.

Hacker News · security · 1d agoData breachHN 26↑ · 4 comments3· 1 read

Exein Secures $270M at $1.7B Valuation for Physical AI Security

IoT security firm Exein raised $270 million at a $1.7 billion valuation to expand runtime protection and physical AI security agents.

Italy-based IoT security startup Exein announced a $270 million oversubscribed round led by Headline, bringing total funding above $600 million and valuing the company at $1.7 billion. Exein builds embedded and kernel-level runtime protection for IoT devices and is developing a proprietary foundation model for physical AI security powering autonomous defense agents. The funding will accelerate expansion, particularly into the US market.

SecurityWeek · 1d agoIndustry

Sexually Explicit Deepfake Sites Target 100-Plus Politicians in Europe

Deepfake pornography sites have targeted nearly 150 European politicians, overwhelmingly women MPs, per new research on 160 abusive domains.

Researcher Benjamin Shultz analyzed roughly 160 deepfake abuse domains and found at least 138 women MPs from 22 EU countries appeared or were mentioned, versus nine male MPs — making women MPs 33 times more likely to be targeted. Sites host database-like profiles with names, photos, personal details, and links to 'nudifier' creation tools. The findings, published by German think tank Agora Digitale Transformation, show politicians from Germany, the Netherlands, Italy, and France most affected, with senior politicians targeted more often. The UK and EU are planning bans on nudify services, while the US Take It Down Act has taken major deepfake sites offline.

WIRED · Security · 2d agoAI safety & security1

Trezor: 347,000 users targeted in phishing attacks after Brevo breach

Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.

Threat actors who breached Trezor's third-party email provider Brevo on September 9, 2026 sent fake 'critical security alert' emails from [email protected] to 347,000 opted-in newsletter subscribers, claiming an STM32 microcontroller vulnerability exposed wallet seeds. The emails linked to a malicious app that asked users to enter their wallet backup; 2,500 users clicked before Trezor disabled the phishing domain within 20 minutes. Trezor also disclosed that a prior breach via logistics provider ShipMonk, exploited through a critical Metabase SQL injection zero-day, affected 81,000 customers and drew extortion emails from the ShinyHunters gang.

BleepingComputerupdated · 5d agofirst · 6d agoPhishing & fraud in the wild 4 sources1

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security Affairs · 6d agoExploit / PoC in the wildCVE-2026-154091

Trezor warns users of email provider breach, phishing attacks

Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.

Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from [email protected], claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.

BleepingComputer · 7d agoData breach in the wild

Srsly Risky Biz: America's Drivers Licence Breach is a National Security Disaster

Dark web service Nexus sold 153 million US and Canadian driver's licenses, linked to identity verification firm IDScan under FBI investigation.

Krebs On Security reported that a dark web service called Nexus sold access to 153 million US and Canadian driver's licenses, claiming over a year of continuous exfiltration from a major identity verification company, with roughly 400,000 new licences added in a single day. Krebs verified the data as genuine and linked the incident via circumstantial evidence to identity verification firm IDScan, whose licences of senior US officials including Secretary of War Pete Hegseth appeared in the database; the FBI is investigating and IDScan has confirmed a breach inquiry. The article argues the data has national security implications, citing how Chinese APT espionage (Anthem, Equifax, Marriott, OPM) and Bellingcat investigations exploited leaked databases. Class action suits are being prepared, and the piece calls for stricter oversight of identity verification firms.

Risky Business News · 7d agoData breach in the wild

Cybersecurity jobs available right now: September 1, 2026

Help Net Security's September 1, 2026 roundup lists cybersecurity job openings at Google, Barclays, HUMAN and others across the US, Europe and Asia.

The weekly jobs roundup lists openings including a Google Security Engineer (Professional Services) role in the USA, a Cryptography Operations Engineer at Barclays in the UK, a Backend Engineer at HUMAN in Israel, and an AI Security Engineer at CPX in the UAE. Other listed roles span SOC analysis, SIEM engineering, cloud security, and network security across the USA, Ireland, India, Italy and Australia.

Help Net Security · 7d agoIndustry 2 sources

Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate

Proofpoint's 2026 survey of 1,600 CISOs finds improving cyber resilience, rising human risk, and expanding AI responsibilities without added resources.

Proofpoint released its 2026 Voice of the CISO report, a Censuswide-conducted survey of 1,600 CISOs across 16 countries fielded in May 2026. Expected material cyberattacks fell from 76% to 61% year over year and material data loss declined from 66% to 53%, but 79% of CISOs now identify human risk as their biggest vulnerability and GenAI security concerns jumped 18 points to 78%. The report also finds 79% of CISOs expect to manage AI-related risks without proportional resources, and 85% say boards are evaluating cyber risk through a commercial lens.

Proofpoint Threat Insight · 8d agoIndustry

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise · 8d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Trezor customers hit with phishing calls and letters after shipping-partner breach

A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.

SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.

Help Net Security · 8d agoData breach

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputer · 9d agoData breach in the wild

Why AI food looks like that

Experts explain why AI-generated food images look unappetizing, citing diffusion model limitations, weak structural reasoning, and stylized training data.

The Verge examines why AI-generated food imagery from restaurants and brands often appears grotesque, citing researchers from Oxford, Naples, Zurich, and London. Diffusion models recover coarse structure before fine texture, so structural errors like extra fingers or donut shrimp get baked in early. Researchers note the models are weak at thin, continuous, terminating structures such as noodles, and reproduce the glossy conventions of professional food photography without understanding the objects. Odd internet imagery and memes in training data further skew outputs toward strange textures and clustered holes.

The Verge · AI · 12d agoAI research

G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules

G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.

Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.

Infosecurity Magazine · 13d agoPolicy & legal

The G7 tells industry to hurry up and prep for post-quantum encryption

A G7 working group report urges governments and industry to accelerate post-quantum cryptography migration, framing quantum risk as a near-term economic threat.

A cybersecurity working group formed at the June 2026 G7 Summit in France called on organizations to stop postponing migration of critical systems to post-quantum cryptography, warning that harvest-now-decrypt-later attacks against currently encrypted data exist today. The report was signed by CISA, the UK NCSC, France's ANSSI, Germany's BSI, Canada's CSE, Japan's NCO, and Italy's ACN. It also cautions that some NIST-selected PQC algorithms have already been broken on classical computers, reinforcing support for crypto-agility. The push aligns with a recent US executive order moving federal PQC migration timelines from 2035 to 2030, while Google and others target 2029.

CyberScoop · 13d agoPolicy & legal

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News · 16d agoThreat actor in the wild

Rhysida Ransomware Group Targets Berlin Government Ahead of Vote

Rhysida ransomware hit Berlin's state government weeks before the September 20 election, claiming 5.79 TB stolen; officials refused the ransom.

Berlin's government confirmed an August cyberattack on its administrative network, with data exfiltrated between August 7 and August 12 and departments isolated on August 17. The Rhysida group claimed responsibility on August 28, alleging theft of 5.79 TB and 1.44 million files including personal data on 12,076 individuals, payroll files, plaintext credentials, and vulnerability analyses of Berlin's water supply. Officials said election systems were not affected and refused to pay; Rhysida has claimed roughly 280 victims since 2023, entering via VPNs without MFA, Zerologon, or phishing.

Security Affairs · 18d agoRansomware in the wild

Cybersecurity jobs available right now: March 31, 2026

Help Net Security's job roundup lists cybersecurity vacancies worldwide, from malware research director to SOC, IAM, and GRC roles, mostly already closed.

The roundup aggregates cybersecurity openings across Israel, Ireland, India, the UK, Australia, France, Germany, Canada, the US and the UAE. Roles include Android malware research director, cloud security engineer, IAM analyst, SOC lead, GRC specialist, and vulnerability management positions at employers such as Iceland Foods, Pernod Ricard, A10 Networks, and TOMRA. Most listings were marked as no longer accepting applications at publication.

Help Net Security · 20d agoIndustry

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.

Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.

Security Affairs · 20d agoThreat actor in the wild

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown

INTERPOL's Operation Jackal IV arrested 58 and identified 263 suspects in West African cyber-fraud networks, seizing millions across 22 countries.

Operation Jackal IV, run by INTERPOL with 22 countries between November 2025 and June 2026, targeted West African organized crime groups such as Black Ace behind romance, investment, and business email compromise fraud. It produced 58 arrests and 263 identified suspects, including 17 arrests tied to a crime-as-a-service network providing domains and money laundering support to 196 identified individuals. Raids in Johannesburg netted 39 arrests, $2.67 million seized, and 257 blocked bank accounts, while a Romanian call-center investment scheme had stolen an estimated 143 million euros (~$166 million) and led to 11 arrests. The operation is the fourth iteration, following waves in 2022, 2023, and 2024 with 75, 103, and 300 arrests respectively.

The Hacker News · 21d agoPolicy & legal

Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams

INTERPOL's Operation Jackal IV made 58 arrests across 22 countries, disrupting Black Axe-linked networks laundering scam, BEC and sextortion proceeds.

INTERPOL's Operation Jackal IV (November 2025–June 2026) involved 22 countries and led to 58 arrests and 263 suspects identified tied to West African organized crime networks such as Black Axe. Key actions included 39 arrests in South Africa with $2.67 million seized and 257 bank accounts frozen, 17 arrests in Argentina against a crime-as-a-service laundering network, and a Romanian call-center investment scam with estimated global losses around €143 million. The operation also flagged rising sextortion of minors as young as 14 by these networks.

Security Affairs · 22d agoThreat actor

Interpol targets Black Axe’s illicit financial web in latest international sting

Interpol's Operation Jackal IV made 58 arrests across four continents, disrupting Black Axe money-laundering, BEC, and sextortion networks and seizing millions.

Interpol-coordinated Operation Jackal IV produced 58 arrests and identified 263 suspects across Africa, Europe and South America, targeting Black Axe and other West African organized crime financial networks. Romanian authorities dismantled a call-center investment scam valued at roughly 143 million euros, while South African police made 39 arrests, seized $2.67 million and blocked 257 bank accounts tied to romance and investment scams targeting retirees. Argentine investigators identified 196 people in a Crime-as-a-Service network supplying website domains and laundering support, and Interpol noted the groups' growing focus on sextortion of victims as young as 14.

CyberScoop · 22d agoThreat actor

INTERPOL crackdown on West African crime rings uncovers troubling new trend

INTERPOL's Operation Jackal IV arrested 58 suspects across 22 countries targeting Black Axe-linked West African fraud networks, flagging a rising trend of sextortion against minors.

Operation Jackal IV (November 2025 to June 2026) coordinated arrests across 22 countries against West African organized crime groups such as Black Axe, which INTERPOL links to a large share of global cyber-enabled fraud. Johannesburg raids on a romance and investment scam syndicate targeting retirees yielded $2.67 million seized, 257 bank accounts frozen and 39 arrests, while Argentina exposed a 196-member Crime-as-a-Service network with 17 arrests. Romanian police dismantled a call-center investment scam with roughly €143 million stolen and laundered, and INTERPOL warned these groups increasingly sextort minors as young as 14 and procure Crime-as-a-Service via the dark web.

Help Net Security · 23d agoThreat actor

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM

Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.

Check Point researchers showed Microsoft's signed Defender Boot-Time Removal driver (BTR.sys) can be repurposed as a universal kernel operation engine to bypass endpoint security without BYOVD. The DoJ charged 17 members of Iran's Mabna Institute, which on behalf of the IRGC stole over 31 TB of academic data from 144 US universities and compromised roughly 8,000 of 100,000 targeted professor accounts; the State Department offered a $10 million reward for five defendants. Separately, Acronis tracked a Grandoreiro campaign abusing DLL sideloading in the Duplicate Files Finder app across Latin America and Spain, while ErrTraffic ClickFix campaigns deliver Cruciferra (BYOVD) and Remus Stealer. OpenAI also previewed Private Safety Processing, a privacy-centric approach to monitoring model misuse without retaining customer content.

The Hacker News · 27d agoThreat actor1

Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000

GuidePoint reports a ransomware affiliate posing as 'Ransom Busters' charges victims $20,000-$60,000 to delete stolen data, and details UNC6671's $8M AitM extortion wave.

GuidePoint's GRIT team reports that 'Ransom Busters', likely a ransomware affiliate active across multiple RaaS operations including DragonForce, Settra and Anubis, proactively emails victims claiming it deleted their stolen data and backups for a $20,000-$60,000 fee, citing claimed access to RaaS administrative panels for over three years. Two analyzed intrusions shared tooling: SoftPerfect Network Scanner for reconnaissance, s5cmd-based exfiltration to AWS cloud storage, an RMM tool installed via PowerShell, a backdoor account with password 'Numlock!123' and the same attacker hostname DESKTOP-BBETH6K. Separately, GRIT detailed UNC6671's (Cordial Spider) adversary-in-the-middle vishing operation running since April under five extortion brands, with more than $8 million across 15 Bitcoin wallets, an average of $600,000 per payment, and 78 phishing sub-domains across 76 organizations, 40% in financial services.

The Hacker News · 29d agoThreat actor in the wild1

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.

The Hacker News ThreatsDay Bulletin bundles roughly 20 short updates across cloud services, AI tools, malware, breaches, and scams. Highlights include the City-Forum campaign pulling data from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals since March 2025, and a ShipMonk breach exposing Trezor customer order data for orders in seven countries between May 10 and August 8, 2026. Other items cover a patched Cursor CLI flaw that let cloned repositories run commands before the workspace-trust prompt, Okta's analysis of the Work Panel vishing console used by actors like UNC6671, and GhostJacking AI agent hijacking via a patched Claude Desktop sandbox escape. Meta also launched an on-device WhatsApp Scam Alert machine learning model that keeps message content on the device.

The Hacker News · 29d agoIndustry1