The FBI attributed the $6.3 billion Binance crypto heist to North Korean state hackers, sparking denials from Pyongyang amid ongoing asset recovery efforts.

Related Posts:

• Cloudflare DDoS Report Shows 18.2 Million Network Attacks in Q3 2026
• Chinese Hackers Deploy Chrome Zero-Day Exploit Chain
• NCSC Warns of Physical Disruptions from Cyberattacks on OT Systems

The post North Korea Binance Heist: Pyongyang Denies $6.3B Hack appeared first on Daily CyberSecurity.

The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds.

The FBI has named North Korea as the party behind the theft of more than $6 billion in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a public alert. The FBI specifically blames the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38.

Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to TraderTraitor, and Chainalysis also said it’s highly confident in that finding.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” reads the FBI’s statement.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys.

The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named.

The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers.

The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert.

If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work.

The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft.

“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local FBI field office or FBI’s Internet Crime Complaint Center at ic3.gov.”

TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” TRM said. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”

Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t.

Below is the link to my interview regarding the Binance case for Italian state television.

https://www.youtube.com/watch?v=DtvhBA9TdPo

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Binance)

The Binance hack involving more than $6 billion in virtual assets has been attributed to North Korea by the US Federal Bureau of Investigation (FBI), while the cryptocurrency exchange has begun preparing to restore withdrawals in phases and reported that approximately 95% of the affected amount has been covered. The incident, which Binance says occurred around October 29, 2026, has prompted security reviews, efforts to trace stolen assets, and cooperation between law enforcement and industry partners. The FBI refers to the North Korean activity associated with the theft as “TraderTraitor.” In its advisory, the agency said the stolen assets were being converted primarily into Ethereum (ETH), with further laundering through decentralized finance (DeFi) platforms and instant swap services expected. Binance said on November 1 that the first phase of withdrawal services was scheduled to resume between 06:00 and 09:00 UTC. The exchange said the restoration would depend on security assessments and operational readiness checks, with additional assets and networks becoming available as they pass the required checks.

Binance Hack: FBI Attributes $6 Billion Theft to North Korea

According to the FBI, North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026. The agency is working with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to address the activity. The agencies have observed stolen crypto assets being converted primarily into Ethereum. The FBI expects the operators to use DeFi platforms and instant swap services to move the funds through additional laundering stages. The FBI, USSS, and IRS-CI have urged cryptocurrency industry participants to block transactions involving addresses used by the TraderTraitor actors, including transactions derived from those addresses. The request covers THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers. The FBI has also asked anyone with relevant information to contact a local FBI field office or submit information through the Internet Crime Complaint Center.

Binance Withdrawals to Resume in Phases

In its November 1 recovery update, Binance said it was preparing to restore withdrawals progressively after temporarily suspending the service as a precautionary measure. The exchange said the suspension allowed its teams to contain the impact of the incident, assess affected services, review withdrawal infrastructure, and monitor for residual risks. The company also said it was working with law enforcement and industry partners to trace and recover stolen funds. The first phase prioritizes assets and networks based on user demand over the preceding week. Binance said additional networks and assets would be added as they become ready, rather than reopening every withdrawal service simultaneously. Users may encounter temporary delays or longer processing times during the initial rollout because of traffic volumes. Binance advised users to check the withdrawal page for their selected asset and network, or consult its network status page, to confirm availability. The exchange said deposit services remained open and were not affected by the incident. It also stated that it would absorb the financial impact of the stolen funds rather than pass the losses on to users.

Binance Reports 95% Recovery of Affected Assets

Binance's recovery updates show a steady increase in the amount of affected assets it says has been covered. In its October 31 update, the company reported that coverage had reached approximately 90%, up from around 80% in the previous update. By November 1, Binance said it had covered approximately 95% of the impacted amount. The remaining 5% consists of tokens outside the ten assets it identified as fully backed, which include BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. According to Binance, these remaining tokens have lower market liquidity and take longer to acquire at the required scale. The company said it was continuing to purchase the outstanding assets through market transactions and over-the-counter (OTC) channels. The exchange also said its replenishment efforts involved its corporate treasury, a partial deployment of the Secure Asset Fund for Users (SAFU), and a portion of its Futures insurance fund. Binance committed to replenishing SAFU to bring the fund back to approximately $1 billion.

FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds.

A Hive ransomware affiliate who also used Nefilim ransomware got 70 months in prison. A co-conspirator remains at large with an $11M reward.

Related Posts:

• Gheist Campaign Abuses Stolen GitHub Tokens Across 850 Accounts to Steal Secrets
• Exposed Cairn AI Panels Reveal Autonomous Hacking Against Over 1,100 Targets
• GMO Desktop Cloud Breach Exposes 26,000 FX Servers

The post Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison appeared first on Daily CyberSecurity.

A new StopRansomware advisory warns SafePay ransomware has hit 600+ victims via VPN logins and edge flaws. See its tactics and key defenses.

Related Posts:

• Exposed Attacker Server Reveals AI Agent Toolkit and a Second PaperCut RCE Path
• LiteLLM 1.107.0 Compromised to Steal Cloud, AI Tool and Developer Credentials
• 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks

The post SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning appeared first on Daily CyberSecurity.

Federal investigators suspect a US ransomware negotiator helped ShinyHunters operate an extortion site used to pressure nearly 100 organisations.

A ransomware negotiator attended a cybersecurity conference, only to be arrested by the FBI in connection with its investigation into the ShinyHunters gang. Meanwhile, hackers get the keys to ASOS's app and the chance to message every single customer. What did they say? And how did the company respond? We have thoughts. All this and more is discussed in episode 488 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Paul Ducklin.

A scam crackdown on West Africa scam centers by Meta, tech firms and police removed 3.7M accounts, led to 28 arrests and freed 117 victims.

Related Posts:

• DOJ Charges Engineer After OpenAI Recording Device Arrest
• DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies
• Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

The post Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests appeared first on Daily CyberSecurity.

DOJ officials announced an OpenAI recording device arrest after an engineer allegedly hid bugs in executive rooms. Read the case details.

Related Posts:

• Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests
• DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies
• Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

The post DOJ Charges Engineer After OpenAI Recording Device Arrest appeared first on Daily CyberSecurity.

The DOJ and FBI raided DPRK IT worker laptop farms in Texas, seizing 187 devices and charging 14 suspects in a $3M fraud scheme hitting 70+ US firms.

Related Posts:

• Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests
• DOJ Charges Engineer After OpenAI Recording Device Arrest
• Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

The post DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies appeared first on Daily CyberSecurity.

The U.S. Justice Department and FBI have seized two hacking tools, Microscan and FishHub, that court documents say were operated and used by Flax Typhoon actors working for a China-based company. According to the government, the tools were used to scan, and in some cases hack, U.S. and foreign critical infrastructure systems and other networks. The court-authorized seizures were announced alongside court documents unsealed in the Western District of Pennsylvania. Prosecutors allege the actors worked for Integrity Technology Group (Integrity Tech), a company based in the People's Republic of China (PRC) that holds contracts with the PRC government. The action is the latest step by U.S. authorities against China state-sponsored hackers.

How Flax Typhoon Actors Used Microscan for Vulnerability Scanning

According to court documents, Integrity Tech built and used a botnet of internet-of-things devices infected with a variant of Mirai malware. The botnet supported the company's vulnerability scanning through Microscan, a tool Integrity Tech developed to perform reconnaissance on victim networks and identify weaknesses its clients would later exploit. Targets of Microscan scanning included a U.S. power company based in South Carolina, a multinational non-governmental organization, airports in Japan and Poland, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities. Integrity Tech accessed Microscan through c0cc[.]cc, one of the seized domains.

FishHub and the Flax Typhoon Spear Phishing Operation

The second tool, FishHub, allegedly helped compromise computer networks through spear phishing. After gaining initial access, FishHub downloaded additional malware to the victim network. That malware either gave Integrity Tech's clients unauthorized remote access or searched for specific files and sent them to servers controlled by Integrity Tech. Confirmed FishHub victims included about 20 Taiwanese universities. Five seized domains helped deliver the malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com, and linkedinns[.]net.

What Officials Said About Flax Typhoon

Assistant Attorney General for National Security John A. Eisenberg said the United States "will not allow China or its proxies to operate against United States interests with impunity in cyberspace." He added that the National Security Division would continue working to disrupt the Flax Typhoon threats and dismantle the infrastructure sustaining them. Assistant Director Brett Leatherman of the FBI's Cyber Division said, "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure." U.S. Attorney Troy Rivetti for the Western District of Pennsylvania described the seizures as the second disruption of Integrity Tech's operations in as many years. Special Agent in Charge Mark Remily of the FBI San Diego Field Office said the action reflects the FBI's commitment to disrupting PRC state-sponsored cyber actors who threaten critical infrastructure and national security.

Second Disruption of Flax Typhoon Infrastructure

This is the Justice Department's second public technical disruption of Integrity Tech's hacking infrastructure. In September 2024, the department announced the court-authorized disruption of Integrity Tech's Mirai botnet, which included more than 200,000 consumer devices in the United States and worldwide. Alongside the latest seizures, the FBI and other U.S. and foreign partner agencies published a cybersecurity advisory listing indicators of compromise tied to Integrity Tech intrusion activity. The advisory is intended to help network defenders identify and respond to the group's malicious activity. The FBI San Diego and Baltimore Field Offices are investigating the case in coordination with the FBI's Cyber Division. Assistant U.S. Attorney Brendan McKenna for the Western District of Pennsylvania and Trial Attorney Jacques Singer-Emery of the National Security Division's National Security Cyber Section are prosecuting the case. Assistant U.S. Attorney Thomas Sullivan for the District of Maryland and the National Police Agency of Japan provided substantial assistance.

FBI arrests Cypfer co-founder Edward Dubrovsky, now associated with CyberSteward, in the ShinyHunters investigation into the FBI jobs…

FortiBleed attacks continue to target Fortinet FortiGate devices, with SOCRadar reporting more than 86,644 compromised devices across 194…

The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.

According to the advisory, the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, allowing threat actors to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet firewalls using previously obtained credentials, and some affected organizations have been locked out of their own systems.

How the FortiBleed Attack Chain Works

The operation's internal workflow came to light after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign run as an initial access broker operation.

Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts. They then gathered credentials through credential stuffing and password spraying, drawing on prior Fortinet leak dumps and infostealer logs.

Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.

[caption id="attachment_114628" align="aligncenter" width="800"] Source: FBI[/caption]

Cracked credentials were then validated, with scripts filtering out honeypots, mapping organizations and ranking high-value targets by revenue and network structure. Attackers created new administrative accounts on firewalls to maintain persistence, then moved into victim networks to enumerate Active Directory and identify privileged accounts. The final stage involved selling access, including working VPN configurations and target lists, to downstream threat actors.

FortiBleed Lockouts and Ransomware Links

The advisory warns that victims may lose access to their Fortinet devices if attackers delete original accounts or change their passwords. In certain cases, threat actors removed existing accounts to block organizations from their devices while attempting lateral movement. Recovery may require steps beyond standard patching and password resets.

Reporting also indicates that initial access brokers using the FortiBleed attack chain have supplied access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware.

FortiBleed Indicators of Compromise

The agencies released indicators of compromise (IOCs) to help defenders review their environments. IP address 45.154.12.132 was observed as a command and control server, while 154.202.59.169 and 103.27.186.156 served as proxy nodes and 45.155.250.158 functioned as a beacon relay. The address 85.11.187.8 was linked to the Hashtopolis tool. The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.

Account names found on victim systems include adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin and roadmin. The agencies note that IP addresses may be reassigned over time and advise organizations to vet IOCs before acting on them.

Recommended Mitigations Against FortiBleed

The FBI and USSS recommend that organizations:

• Restrict external management through trusted hosts, a local-in policy, or by removing internet administration entirely.
• Terminate all active admin and VPN sessions and reset all Fortinet VPN and administrative passwords.
• Enforce phishing-resistant MFA on all remote access and administrative accounts.
• Review firewall and VPN configurations for unrecognized accounts and unauthorized changes.
• Check firewall, VPN, authentication and domain controller logs for unusual access.
• Use PBKDF2 to store administrator credentials and remove weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.
• Review all REST API keys, remove unknown ones and refresh legitimate keys.

Organizations that detect a compromise are urged to isolate affected hosts, scope the intrusion and report incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office or a local USSS field office.

US and French authorities seized two domains and arrested a suspected administrator in a CSAM and non-consensual intimate image abuse case.

The FBI removed a contractor over a ShinyHunters-linked breach. Reuters sources identified Accenture and an unpatched Oracle PeopleSoft system.

Accenture lost an FBI contract after a missed security patch exposed sensitive employee data, raising serious concerns over operational security.

The FBI pulled an Accenture contractor off its account on Monday, and the reason is almost mundane compared to the damage it caused. One update didn’t get installed on time.

“The ‌Federal Bureau of Investigation removed an Accenture contractor on Monday over their role in a damaging data breach that exposed sensitive personal details of thousands of bureau employees, two sources familiar with the matter told Reuters.” Reuters reports. “The development comes as the FBI is still trying to ascertain the ramifications of the breach, ​which some former bureau officials have described as a major blow to the organization’s operational security.”

Two sources told Reuters the bureau cut ties with the contractor over their role in a breach that exposed sensitive personal data on thousands of FBI employees. Former bureau officials are calling it a serious hit to the organization’s operational security, not just an embarrassing headline. That’s a strong statement coming from people who used to run the place.

“To date, our review has determined that the incident occurred as the result of a security failure ​of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the ​platform,” FBI cyber chief Brett Leatherman said in the statement to Reuters. “As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”

FBI cyber chief Brett Leatherman laid out exactly what went wrong in a statement to Reuters. The incident traces back to a platform managed by a third party, where a contractor “failed to implement a security patch explicitly issued to secure the platform.” Not an unknown flaw, not a zero day, a fix that already existed and just didn’t get installed.

Reuters’ sources identified the platform as Oracle PeopleSoft, the human resources software running the FBI’s job site, and named Accenture as the third party managing it. Oracle hasn’t responded to requests for comment. Accenture, for its part, said only that it’s proud to support the FBI’s mission and plans to keep doing so, dodging every question about the contractor or the missed patch.

In June, Google warned about a ShinyHunters-linked campaign targeting PeopleSoft users. On the same day, Oracle issued a security alert about the vulnerability and released a fix. Both companies told PeopleSoft customers to install all critical patches and security updates as soon as possible.

ShinyHunters later said they used this same PeopleSoft vulnerability to access the FBI’s job site. Patching large enterprise systems can be difficult, but this wasn’t an unknown or obscure flaw. It had already been publicly identified, attackers were exploiting it, and a fix was available.

In September, the popular cybercrime group ShinyHunters claimed that it breached the U.S. Federal Bureau of Investigation (FBI) and stole sensitive information belonging to FBI employees and job applicants. The group says the operation was not financially motivated and was instead carried out in response to an FBI warning published earlier this year.

The claim surfaced on September 22 and quickly drew attention after ShinyHunters said it obtained data on a large number of current and former FBI personnel. The group reportedly offered a sample of around 5,000 records as evidence and claimed that the stolen information could include names, addresses, phone numbers, Social Security numbers, assignments and, in some cases, family details.

Reuters was able to partially match some of the sample information with other records, including data associated with FBI Director Kash Patel.

“Reuters was able to partially verify the authenticity of the information by running the details, including the Social Security numbers, ​against credit bureau records and previously breached data preserved by the dark-web intelligence firm District 4 Labs.” reads the report published by Reuters. “In at least 10 instances — including in the case ‌of FBI ⁠Director Kash Patel — Reuters found details that appeared to match. A person familiar with the matter said that the job descriptions in the data also matched in at least some cases.”

The FBI acknowledged that it is aware of claims involving unauthorized activity affecting FBIjobs.gov and said it is investigating. The agency has not confirmed that its internal systems were compromised or that ShinyHunters obtained the data it claims to possess.

ShinyHunters provided a possible technical explanation for the alleged intrusion. The group claims the exploitation of an Oracle PeopleSoft zero-day, reportedly using it to gain remote code execution through infrastructure connected to the FBI’s recruitment services.

The attackers also reportedly claimed access to several FBI-related services, including human resources systems and a system they referred to as Medlink. They allegedly said that between 2 TB and 3 TB of data had been taken and that the FBI jobs infrastructure had been compromised.

There is also a clear motive behind the operation claimed by ShinyHunters. The group says it targeted the FBI after a May 2026 public advisory describing its tactics and warning victims against paying. ShinyHunters disputes the FBI’s characterization of its activities and is reportedly demanding that the Bureau retract or correct the warning.

This makes the alleged attack unusual. Instead of immediately demanding a conventional ransom, the group appears to be using the stolen data as leverage in a dispute with U.S. law enforcement.

The timing is also significant. ShinyHunters has recently claimed responsibility for several major breaches and has been involved in a public dispute with the Clop cybercrime operation. The group recently claimed to have compromised Clop’s data leak site, highlighting the increasingly aggressive behavior surrounding the group.

The stolen data is much more sensitive than the usual names and email addresses seen in data breaches. It includes details about named employees’ counterintelligence roles, home addresses of human intelligence operatives, and medical and psychiatric records of FBI staff.

For an agency where some employees depend on keeping their identities, jobs and home addresses private, this goes beyond a normal data breach. It creates a serious operational security risk.

Last week a key ShinyHunters suspect got picked up in Jordan and reportedly started cooperating with investigators, which might help the bureau understand just how bad the damage really is. Removing one contractor doesn’t undo an exposure like this, it just closes the door after the fact.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Accenture)

The FBI confirmed multiple arrests in its ShinyHunters investigation after suspected member Saif al-Din Khader was reportedly detained in Jordan.

A ShinyHunters hacker arrest in Jordan may aid the FBI, as an alleged member reportedly shares devices and chats. Here is what we know.

Related Posts:

• Warlock Ransomware Group Hits Water and Telecom Operators Through SharePoint Flaws
• China-Aligned TA419 Credential Phishing Hits AI Experts
• Phishing Abuses RMM Tools for Persistent Network Access

The post ShinyHunters Hacker Arrest in Jordan Aids FBI Probe appeared first on Daily CyberSecurity.