What Happened

Four notable UK prosecutions illustrate the growing intersection of cybercrime, online exploitation subcultures, and digital terrorism involving teenage offenders:

Scattered Spider Operators Sentenced for Transport for London (TfL) Hack:

• In July 2026, Thalha Jubair (20) and Owen Flowers (18) were sentenced at Woolwich Crown Court to five years and six months each in prison. Convicted under Section 3ZA of the Computer Misuse Act (CMA), reserved for attacks causing serious damage to critical national infrastructure, the pair, operating as part of the "Scattered Spider" collective, breached Transport for London (TfL) in late August 2024.
• Initiated when Flowers was 17, the attack bypassed two-factor authentication (2FA) by social engineering a TfL help-desk worker over the phone. The intrusion knocked 148 internal IT systems offline, forced in-person password resets for 27,000 staff, exposed up to 10 million customer records, and incurred £29 million to £39 million in operational and recovery costs. 

"The Com" Online Exploitation Network: 

• In August 2026, Justin Swaddle (20) of Leeds was sentenced at Leeds Crown Court to two years' imprisonment, alongside a 10-year Sexual Harm Prevention Order, following a National Crime Agency (NCA) investigation.
• Swaddle, who began offending at age 17 under aliases such as "Epstein" and "Moscow" across Telegram, Discord, and Snapchat, operated within "The Com," a decentralised online network of youth engaged in cyber-extortion, harassment, and swatting.
• Swaddle used doxxing threats and intimate images to blackmail 117 female victims worldwide (aged 13–17) into self-harm and sexual abuse for peer recognition and status within the community.  

Cybersecurity Provisioning for Proscribed Terrorist Groups:

• In July 2026, Yusuf Shah (18) of Ilford was convicted at Kingston Crown Court of multiple offences under the Terrorism Act 2000 following an investigation by Counter Terrorism Policing (CTP) London.
• Radicalised online from age 13, Shah offered technical capabilities to proscribed groups via Telegram, authored a bespoke manual titled "A Guide on Cybersecurity" for Tehrik-e-Taliban Pakistan (TTP), and facilitated an untraceable $1,376.51 cryptocurrency donation to Al-Qaeda using privacy techniques he developed.

Another IoT cyberattack, this one in France:

Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.

[…]

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.

In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster.

Last week, the FBI arrested (alternate link) someone associated with that crime.

What Happened

Four key UK enforcement actions have showcased the diversifying spectrum of cryptocurrency crime in the UK in 2026. This ranges from violent home invasions to sophisticated police impersonation and seed phrase social engineering. UK law enforcement also cracked down on P2P exchanges to help prevent cryptocurrency laundering and cashing out.

Cryptocurrency Theft via Physical Violence (February 2026)

• Three individuals from Sheffield executed a targeted home invasion in London. Posing as Amazon delivery drivers, the teenagers ambushed the victim with physical violence, forced him to transfer $4.5 million (£3.1 million) in cryptocurrency to their accounts, and stole his vehicle.
• The offenders recorded their escape and boasted about the crime on Snapchat. The Metropolitan Police tracked the vehicle down and detained all three suspects within hours of the crime taking place.
• The trio was sentenced at Sheffield Crown Court to a combined total of 16 years in youth detention, with the victim's assets recovered within 72 hours.

OCG Arrested for Seed Phrase Vishing (May 2026)

• Ten suspects were arrested and charged following a coordinated multi-force operation led by the Eastern Region Special Operations Unit (ERSOU) alongside the Met, City of London Police, Kent Police, and YHROCU.
• The organised crime group (OCG) targeted victims via fraudulent phone calls, posing as police officers or cryptocurrency platform representatives. Victims were tricked into disclosing critical wallet credentials, including private wallet seed phrases, allowing the attackers to drain the contents of their wallets.
• One victim alone lost over £300,000. Simultaneous search warrants across Kent, Essex, London, and Yorkshire resulted in ten individuals being charged with conspiracy to defraud.

Impersonation Gang Jailed Over £4 Million Police Impersonation Fraud (July 2026) 

• At Southwark Crown Court, three men in their twenties, were jailed for up to six years for defrauding eight victims out of over £4 million in cryptocurrency.
• The gang impersonated police officers over the phone, informing victims their assets were compromised and convincing them to move funds to "secure police accounts" or share account access. To reinforce the ruse, the group also constructed fake police websites.
• The Met Police Cryptocurrency Team dismantled the OCG, seizing 40 mobile devices, luxury vehicles, and recovering £1 million in direct victim funds.

FCA and Partners Crackdown on Illegal P2P Crypto Trading (September 2026):

• In a joint operation, the UK Financial Conduct Authority (FCA), HM Revenue & Customs (HMRC), and the Metropolitan Police targeted three London premises operating as unregistered peer-to-peer (P2P) cryptocurrency exchanges, serving cease-and-desist letters to halt their unauthorised commercial activities under the Money Laundering Regulations 2017.
• Because carrying out P2P crypto trading "by way of business" legally requires FCA authorisation, and zero P2P crypto businesses are currently registered in the UK, these firms operated outside mandatory Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) frameworks, establishing a critical, unregulated liquidity channel for criminals to move and launder illicit funds.

Analyst Comment

The operational shift in UK-based cryptocurrency targeting indicates a dangerous blend of high-tech social engineering and low-tech physical coercion.

The first case involving the home invasion highlights to risks of showing off rich lifestyles on social media. Unfortunately, we live in an age whereby criminals can research their targets and gather the information necessary to attack their homes. High net-work individuals are prime targets and can be relatively trivial to locate due to posting their lives on social media.

Both the cryptocurrency vishing cases highlight the effectiveness of police impersonation. Threat actors exploit the high trust and compliance associated with law enforcement branding to bypass technical two-factor authentication (2FA) mechanisms, inducing panic in victims to voluntarily surrender seed phrases or authorise wallet transfers.

In the UK, unlawful gains are rapidly off ramped into physical luxury items (designer clothing, jewellery, high-end vehicles) or moved to foreign jurisdictions. However, as demonstrated by the Snapchat post in the Sheffield home invasion case, cybercriminal operational security (OPSEC) remains a primary vulnerability for law enforcement to exploit.

Unregistered P2P cryptocurrency exchanges continue to operate as a liquidity channel where illicit virtual funds can be converted into physical cash or clean bank transfers. By targeting the physical infrastructure where shadow financial activity meets the mainstream economy, law enforcement can starve wider cybercrime ecosystems of accessible liquidity.

Defensive Takeaways

Security teams, high-net-worth individuals, and institutional custodians must update defence models to protect against hybrid physical/digital vectors:

• Operational Security (OPSEC) & Privacy: Minimise public disclosure of crypto holdings, wallet addresses, and physical locations. Threat actors frequently leverage social media OSINT to target victims for home invasions or vishing campaigns.
• Absolute Protection of Seed Phrases: Never disclose seed phrases, recovery keys, or private keys to anyone. Legitimate financial institutions, exchanges, and law enforcement agencies will never request seed phrases or ask users to transfer funds to a "safe account".
• Out-of-Band Verification: If contacted by someone claiming to be a police officer or exchange representative regarding asset security, hang up immediately. Independently verify the call by calling the official institution number.
• Multi-Signature (Multi-Sig) & Time-Locked Storage: Implement multi-sig wallets requiring authorisations across geographically separated keys, alongside time-locked vaults. This mitigates the immediate risk of forced transfers during physical home invasions.

Relevant Sources

1. https://www.independent.co.uk/tv/news/amazon-delivery-thief-londoncrytpcurrency-met-police-video-b2914193.html
2. https://x.com/metpoliceuk/status/2019078494227997095
3. https://www.rocu.police.uk/news/2026/may/ten-arrests-arrested-linked-to-alleged-crypto-currency-scam/
4. https://news.met.police.uk/news/men-who-stole-more-than-4-pounds-million-of-crypto-are-jailed-511271
5. https://www.fca.org.uk/news/press-releases/fca-and-partners-continues-crackdown-illegal-crypto-trading

What Happened

• On 25 August 2026, Manchester Airports Group (MAG), the operator of Manchester Airport, London Stansted Airport, and East Midlands Airport, reported they recently suffered data breach.
• Personal information belonging to approximately 8.7 million customers was reportedly accessed. The majority of affected records involve email addresses collected via in-airport Wi-Fi sign ups, alongside customer data from car parking, airport lounge, and Fast Track security bookings.
• According to BBC reports, the cybercriminals behind the attack issued a ransom demand to MAG. MAG said it had to temporarily suspended access to its online "Manage My Booking" service but importantly said that passenger safety, aviation security, and flight operations remained uncompromised and operated normally.
• On 30 August, the MAG breach was then claimed by an known data extortion group called FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data. 
• The FulcrumSec group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.

• In mid-2026, an emerging cybercriminal group known as ExfilSquad launched a high-profile extortion campaign targeting prominent UK organisations across the public sector, education, and law enforcement, as well as other firms worldwide.
• Unlike traditional ransomware groups, ExfilSquad does not deploy encryptors or destructive malware. Instead, they operate as a pure data extortion group, stealing data and threatening to publish it on their onion-based Data Leak Site (DLS) if a ransom is not paid.
• Several prominent UK entities have confirmed breaches linked to the group:
• UK Department for Education (DfE): Approximately 600,000 records stolen from its Help Portal containing parent and staff contact details (names, emails, phone numbers, job titles), plus around 7,000 records from the Turing Portal.
• Police National Legal Database (PNLD): Stole 1.9 GB of data (around 135,000 records) containing contact information for over 100,000 serving police officers, staff, and criminal justice professionals, alongside around 21,000 "Ask the Police" public inquiry records.
• Newcastle University: Approximately 440,000 records compromised containing applicant and student contact information, personally identifiable information (PII), and admissions database records caused by a technical configuration flaw connecting to an admissions system.
• Analysis of the details left on the data leak site revealed that ExfilSquad's primary attack vector involves exploiting misconfigurations in cloud portals, customer relationship management (CRM) platforms, internal case management systems, as well as Microsoft Power Pages data tables left publicly accessible without proper authentication.
• To force compliance and prove their claims are real, ExfilSquad uploaded multi-gigabyte torrent files for each victim to their TOR leak site. Resecurity noted that ExfilSquad assigns a distinct Torrent Tracker and initial Web Seed per victim.

Analyst Comment

While ExfilSquad is a new group, they appear to be already experienced at running these types of attacks, suggesting they have a history of cybercrime. Plus, ExfilSquad’s recent campaign highlights the growing trend of transitioning from file-encrypting ransomware to extortion driven entirely by cloud and SaaS misconfigurations. Organisations that have invested in defending against endpoint-based threats are often leaving critical business application interfaces exposed.

SaaS platforms continue to be primary targets of English-speaking cybercrime communities. In recent years,  customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have all been extorted. Microsoft Power Pages portals, CRM databases, and customer support helpdesks frequently hold vast repositories of sensitive contact data and interaction histories. When internet-facing API endpoints or data table permissions are left unauthenticated or unpatched, cybercriminals can systematically scrape massive volumes of data without ever needing to drop a payload or escalate privileges internally.

ExfilSquad’s reliance on torrent distribution further amplifies reputational and operational damage. While gangs like LockBit, Clop, and Akira have previously utilised torrents, ExfilSquad’s operational twist of assigning unique Torrent Trackers and dedicated Web Seeds to individual victims ensures that leaked files distribute rapidly across P2P networks, making it extremely difficult to perform a takedown.

While ExfilSquad’s breaches have largely compromised contact directories and administrative support records, the real-world risks remain significant. Exposing work emails, names, and organisational structures for over 100,000 police officers and civil servants poses distinct social engineering, spear-phishing, and physical security concerns that impacted institutions will have to manage long after the breach occurs.

Defensive Takeaways

• Audit Microsoft Power Pages and Public SaaS Tables: Regularly review public data table permissions, web API settings, and unauthenticated browser views across Microsoft Power Pages, CRMs, and customer support portals to ensure backend data tables are not exposed to the public internet.
• Harden CRM and Case Management Integrations: Treat external-facing admissions portals, helpdesks, and case management systems as high-risk platforms. Implement strict access controls, conduct routine configuration audits, and enforce proper API token security.
• Deploy External Attack Surface Management (EASM): Utilise continuous external attack surface scanning to detect newly exposed web endpoints, misconfigured database connectors, and publicly exposed storage buckets before malicious actors locate them.
• Incorporate Pure Extortion into Incident Response Plans: Security teams must adapt incident response playbooks for data-theft-only scenarios. Organisations may seek to establish protocols for monitoring peer-to-peer (P2P) networks and managing public disclosures when stolen data is distributed via torrents.

Relevant Sources

1. https://www.computing.co.uk/news/2026/security/newcastle-university-data-breach-exfilsquad
2. https://www.thetimes.com/uk/crime/article/who-are-exfilsquad-hackers-cyberattacks-dtzhvvzgj
3. https://www.ncl.ac.uk/press/articles/latest/2026/07/statementonpotentialunauthoriseddataaccess/
4. https://www.bbc.co.uk/news/articles/cq6dmgrp21po
5. https://www.pnld.co.uk/article/?id=7ebf3c0e-598e-f111-8077-7ced8d3aa78f

Relevant CTI Sources

1. https://www.ransomware.live/group/ExfilSquad
2. https://www.resecurity.com/blog/article/exfilsquad-targets-new-victims-shares-data-via-torrents
3. https://socradar.io/blog/dark-web-profile-exfilsquad/
4. https://www.sans.org/blog/hunting-saas-threats-insights-for589-course-cybercriminal-campaigns

OpenAI disrupted a social engineering group from Cambodia that used ChatGPT. Its scope is impressive:

The network simultaneously conducted multiple types of scams, often blending elements from different schemes. For instance, operators used dating personas to build trust before introducing fraudulent investment opportunities involving cryptocurrencies and spot gold trading. Other users engaged in lengthy romantic conversations with targets using fictitious identities, posed as representatives of online gambling platforms offering fake bonuses and winnings, or impersonated law enforcement agencies to tell targets they needed to pay fines for committing serious criminal offenses.

Although the narratives varied, users across the network consistently displayed the same underlying pattern of deceptive behavior. For example, they created and operated fake dating profiles, fictitious investment experts, and fraudulent law enforcement personas. They also generated images of forged documents, including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

• On 7 August 2026, the UK Information Commissioner's Office (ICO) disclosed that between July 2021 and June 2023, the ACRO Criminal Records Office suffered three separate compromises involving its customer portal website (acro.police.uk).
• ACRO is a national police unit providing public services such as issuing Police Certificates, International Child Protection Certificates, and processing Subject Access Requests.
• In March 2023, ACRO was notified about an SQL injection attack that reportedly exposed 15 sets of credentials, the majority of which belonged to its employees.
• A subsequent forensic investigation uncovered long-term threat actor activity within the website's environment, spanning from 9 July 2021 to 22 June 2023.
• The website was built on the Kentico CMS and was running version 12.0.0 between September 2019 and March 2023. This version had multiple known vulnerabilities at the time of the incident, but suffered from ambiguity around who was accountable for patching led to missed hotfixes and updates.
• Between 15 and 16 February 2023, an unknown threat actor staged personal data for exfiltration, which included Police Certificate Applications, Subject Access Request (SAR) forms, and International Child Protection Certificate forms.
• Due to insufficient log retention, ACRO could not definitively determine if the data was successfully exfiltrated. A maximum of 10,920 data subjects had their data staged, but ACRO ultimately notified 84,048 data subjects on a precautionary basis in April 2023.
• Notably, on 23 February 2023, the ICO learned that ACRO's Trend Micro antivirus software detected and quarantined four attempts to install the well-known credential harvesting tool Mimikatz. However, because ACRO operated without a documented patching policy and lacked a structured process for analyzing security alerts, these warnings were never reviewed or acted upon.

Interesting paper:

Abstract: With entrepreneurial fraud cases on the rise, we investigate how entrepreneurs carry out criminal deception, employing deceptive means to defraud audiences. Analyzing court data from Silicon Valley ventures and their founders prosecuted for fraud between 2000 and 2023, our findings reveal that entrepreneurs carry out criminal deception through a process of façading: Entrepreneurs construct, perform, and protect illusory appearances (façades) that externally project high-growth performance to audiences while masking ventures’ actual underperformance. We identify three forms of façading—­surface, reinforced, and deep façading­—that are contingent on the severity of the gap that entrepreneurs face between audiences’ performance expectations and ventures’ performance reality. Our theoretical framework captures how entrepreneurs facing minor, wide, and extreme expectation-reality gaps engage in evermore sophisticated efforts to detach the venture’s externally projected appearance from its actual operational reality. Practically, we propose several approaches to deter and detect criminal deception, including the extension of U.S. Securities and Exchange Commission surveillance and whistleblower program, investor due diligence reform, and dedicated entrepreneurship education interventions that clearly demarcate when entrepreneurs transgress into criminal deception. We make contributions to literatures on cultural entrepreneurship, organizational wrongdoing, and the social effects of entrepreneurship.

What Happened

• New data published by the City of London Police in June 2026 reveals that courier fraud losses exceeded £21 million in 2025, with individuals aged over 70 being heavily targeted. The highest concentration of these offenses was recorded in London and the Home Counties.
• Cybercriminals and fraud syndicates are actively evolving their operational tactics, increasingly pivoting to messaging platforms like WhatsApp to contact their victims and remotely paying for third-party courier services to facilitate physical collections.
• UK law enforcement also highlighted a dangerous shift in 2025 toward high-value physical goods. Victims are being systematically manipulated into visiting multiple jewellers over an extended period to purchase gold and expensive jewellery, which they then hand directly to fraud couriers.

Recent operational crackdowns by UK Regional Organised Crime Units (ROCUs) showcase the nationwide scale of these networks:

• North West ROCU Operations (July 2026): Police executed coordinated search warrants in Huddersfield and Manchester, arresting two men (aged 21 and 25) on suspicion of Conspiracy to Defraud and Money Laundering. In this specific series, the suspects impersonated bank fraud departments, convinced a victim her card was compromised, sent a courier to collect it, and immediately exploit the physical card to make numerous fraudulent transactions.
• North East ROCU (NEROCU) Sentencing (June 2026): A complex, cross-country courier fraud operation spanning March to May 2022 concluded with a prison sentence for a primary operative. The network targeted 14 separate victims, convincing them to hand over physical bank cards and PIN numbers under the guise of an internal "investigation" by their bank's fraud department. The group scammed a total of £56,000, which was then rapidly laundered through the high street purchase of smartphones, designer clothing, and luxury jewellery.

Analyst Comment

Courier fraud is effectively a hybrid cyber-physical social engineering campaign. While the final phase relies on a physical courier arriving at a victim’s doorstep, the initial approach relies heavily on psychological manipulation and email, message, or phone call-based deception.

This type of fraud is notable as it follows a structured cybercriminal playbook that bypasses detection systems and takes advantage of the vulnerable in society. The victim is instructed to bypass normal banking security controls by withdrawing cash, disclosing sensitive credentials (like PINs), or purchasing high-value physical commodities like gold or luxury jewellery. This makes it difficult to proactively detect and prevent.

The other concerning factor is the couriers themselves. According to reports, they can be an unwitting third-party courier service that is paid to go to the victim's home to collect the assets. Online services enable cybercriminals to organise these pickups remotely, lowering their risk of being caught.

The £21 million sizeable loss metric from 2025 shows how profitable this low-tech, high manipulation vector remains. The recent shift to targeting gold and luxury jewellery is a deliberate evasion tactic against traditional anti-money laundering (AML) and banking fraud detection algorithms. While banks have grown adept at flagging unusual rapid bank transfers, they cannot easily stop an account holder from physically withdrawing funds or using a card over several days at different brick-and-mortar luxury retailers. This tactic serves as a highly liquid physical laundering pipeline for these syndicates that remains a challenge to prevent.

Defensive Takeaways

• Implement Bank Transfer and Purchase Outlier Alerts: Financial institutions can focus on further behavioural monitoring for elderly demographics, looking specifically for sudden, consecutive high-value transactions at physical luxury retail or jewellery establishments and flag patterns on unusual activity for review.
• Public Awareness on Cross-Media Scams: Security awareness campaigns must make it clear that legitimate institutions, specifically the Police and Banking Fraud teams, will never send a courier to a residential address to collect cash, PIN numbers, bank cards, or purchased items.
• Vetting of Courier Logistics: Commercial courier services are increasingly being abused as infrastructure by these threat groups. Logistics firms must implement logging and analysis systems to detect unusual residential pickups booked via suspicious accounts and forged identities.

Relevant Sources

1. https://www.cityoflondon.police.uk/news/city-of-london/news/2026/june/over-70s-targeted-as-courier-fraud-exceeds-21-million-in-2025-with-london-and-home-counties-hit-hardest/
2. https://www.rocu.police.uk/news/2026/july/two-suspected-fraudsters-arrested-after-cross-border-strikes/
3. https://www.rocu.police.uk/news/2026/june/a-courier-fraud-conman-has-been-jailed/

What Happened

• Throughout H1 2026, the Qilin ransomware-as-a-service (RaaS) Tor data leak site (DLS) listed the most UK-based victims out of all ransomware gangs, with up to 37 British organisations hit in total. Qilin's victim count is followed by DragonForce with 21 victims listed, and TheGentlemen with 18 listed.
• The fallout from the Qilin attack on the UK National Health Service (NHS) supplier, Synnovis, in 2024 persists as well. On 1 June 2026, the Bedfordshire Hospitals NHS Foundation Trust disclosed that over 32,000 patient data records related to Synnovis tests were exfiltrated and took over a year to analyse what information was related to which patient. The breached data includes patient name and number, date of birth, postcode, and test results.
• In H1 2026, Qilin averaged between seven and nine published UK victims per month. For the entries listing an estimated attack date, there was a roughly six-week extortion lifecycle on average, from initial intrusion to the date the victim is publicly named.
• This UK footprint highlights their aggressive pursuit of Small-to-Medium Enterprises (SMEs) as most organisations had a revenue between £10m and £250m.
• Interestingly, one of the Qilin victims, Salford City College, also appeared on both the Qilin and DragonForce Tor data leak site (DLS) only a few days apart from 6 March to 10 March 2026, respectively.

Analyst Comment 

Many of the organisations targeted by Qilin operators are just large enough to have the funds to pay mid-tier ransoms but often never got around to making an investment into a 24/7 dedicated threat detection service, such as an outsourced Security Operations Centre (SOC). Such services are usually enough protection to prevent an attack. If a ransomware affiliate faces tough resistance from a target, they often move on to a weaker and easier one.

One key face to also note about Tor data leak sites operated by ransomware groups is that they include victims who failed to pay the ransom. The total number of victims by each group is often going to be higher.

The reason for the cross-posting of Salford City College is unknown for now. However, it could indicate that an affiliate may be using both Qilin and DragonForce RaaS platforms. An alternative theory could be that the college was hit by two affiliates of each RaaS. Interestingly, cross-posting on multiple leak sites is not as uncommon as it seems. Some victims listed on the Qilin leak site have historically appeared on the leak sites of ALPHV/BlackCat and Conti as well.

The Ransomware Vulnerability Matrix Group Profile for Qilin reveals a diverse set of exploits leveraged by its operators. Like many other ransomware gangs, Qilin operators have exploited corporate VPN gateways such as Fortinet, Check Point, and WatchGuard for initial access. Interestingly, the exploitation of SmarterTools SmarterMail and SolarWinds Web Help Desk is less common but are also exploited by the Warlock ransomware gang. Another common theme from Qilin's Ransomware Tool Matrix Group Profile is their regular abuse of Bring Your Own Vulnerable Driver (BYOVD) tactics to bypass Endpoint Detection and Response (EDR) and Antivirus software.

Defensive Takeaways 

• Harden Common Attack Paths: Treat any web-facing helpdesk or mail server as a high-risk device. If it does not absolutely require open internet access, place it behind a zero-trust network access gateway or a strict VPN. Enforce strict phishing-resistant Multi-Factor Authentication (MFA) on all remote access points. Ensure processes are in place for rapid patching and integrity checks for all corporate VPN gateways.
• Overcoming SME Resource Caps: Organisations must bridge the gap with an outsourced MDR service. Ransomware execution routinely happens at 2:00 AM on Fridays and weekends. Outdated antivirus agents alone are not enough to stop a motivated human adversary.
• Utilise Free Support Services: Capitalise on sovereign and community-vetted threat intelligence feeds to block attacker infrastructure early. UK defenders should actively enroll in the National Cyber Security Centre’s MyNCSC portal and integrate community resources like the Spamhaus DROP list and Abuse.ch tracking into their perimeter firewalls to automatically block known ransomware command-and-control (C2) nodes. ShadowServer and Team Cymru also offer useful free community resources.

Relevant Sources 

1. https://www.bbc.co.uk/news/articles/c1d2wwyd6qqo
2. https://www.bedfordshirehospitals.nhs.uk/news/notification-synnovis-cyber-incident/
3. https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-linked-to-attack-on-london-hospitals/

Relevant CTI Sources

1. https://www.ransomware.live/map/GB
2. https://www.ransomware.live/group/qilin
3. https://www.ransomware.live/id/c2FsZm9yZGNjLmFjLnVrQGRyYWdvbmZvcmNl
4. https://www.ransomware.live/id/U2FsZm9yZCBDaXR5IENvbGxlZ2VAcWlsaW4
5. https://github.com/BushidoUK/Ransomware-Tool-Matrix/blob/main/GroupProfiles/Qilin.md
6. https://github.com/BushidoUK/Ransomware-Vulnerability-Matrix/blob/main/GroupProfiles/Qilin.md
7. https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html 
8. https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

A key leader of the Kinahan cartel who is wanted by authorities around the world and has been living in hiding in Dubai for a decade has just had his Emirates residence permit renewed.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

A Bellingcat and The Sunday Times review of public immigration records from the United Arab Emirates (UAE) has revealed that Christopher Kinahan Jr, the son of cartel founder Christy Kinahan, was issued with a new visa less than two weeks ago. 

This is despite his status as a sanctioned individual who is the subject of a $5 million reward from the US government for information leading to his arrest. 

Our analysis has also exposed the residence statuses of the crime gang’s other sanctioned leaders who remain at large in Dubai. The records include previously unknown companies where the cartel members are purportedly employed.

It comes after Christopher Jr’s older brother Daniel Kinahan lost his final appeal in Dubai last week to prevent being extradited back to Ireland. He is the second key figure of the crime group to be apprehended in the Emirates following his high-profile arrest in April.

The Kinahan Organised Crime Group is a $1.5 billion transnational network involved in drug trafficking, money laundering and arms smuggling. Investigators have connected it to Iran’s intelligence services and the Lebanon-based militant group Hezbollah.

The cartel’s senior leadership – Christy Kinahan, 69, and his sons Daniel, 49, and Christopher Jr, 45, their cousin Ian Dixon, 36, along with associates Sean McGovern, 40, Bernard Clancy, 48, and Johnny Morrissey, 66 – was sanctioned by the US government in 2022.

The UAE reportedly banned the Kinahans from doing business in the wake of the sanctions and the Emiratis also claim to have frozen €200 million in Kinahan assets. However, our findings suggest the cartel is still doing business in the Emirates and its leadership has repeatedly engaged with immigration authorities in the years following the sanctions.

The visa records were accessed through publicly available UAE government websites. We entered data contained in the US government’s sanctions notice, including the gang members’ ID or passport number, birth date and nationality, to view their immigration files.

Action in Dubai

Six of the seven key cartel figures who were sanctioned by the US in 2022 lived in Dubai. Cartel lieutenant Sean McGovern was extradited to Ireland in 2025 and jailed in June.

Daniel Kinahan awaits extradition from Dubai.

Online Immigration Records

Our open source review of immigration records shows two members have active residence permits. The other two have expired permits.

Chris Kinahan Jr

Active Permit

Christopher Kinahan Jr’s residence permit was renewed on July 20 for a two-year period. His previous visa had expired in December 2024. The new residence card lists his employment as “sales officer” at a company named Island Star Tourism.

Bernard Clancy

Active Permit

Bernard Clancy’s most recent two-year residence permit was renewed in January. Like Christopher Jr, Clancy’s stated profession is “sales officer”, but for a company named Al Matn Goods Wholesalers LLC.

Christy Kinahan

Expired Permit

Ian Dixon

Expired Permit

Records for Christy Kinahan and Ian Dixon show the residence permits associated with their available passport numbers have expired.

Christy Kinahan

Expired Permit

On his most recent visa, which expired on April 1, Christy Kinahan’s listed employer is OSA Management Consultancies DWC LLC. This firm is based at the same Dubai address as CV Aviation Consulting Services DWC LLC, another company reportedly linked to the cartel.

Ian Dixon

Expired Permit

Dixon’s employer listed on his most recent visa was Hoopoe Sports LLC, one of the firms sanctioned by the US for being “owned or controlled” by Dixon.

Christy Kinahan

The UAE imposes a fine for each day a person stays in the country after their visa expires. A Dubai government portal shows Christy Kinahan owes the equivalent of more than USD $1,000 for an 81 day overstay.

Ian Dixon

Dixon, whose residency expired in 2024, owes more than USD $11,000 for an 852-day overstay.

Sanctioned

Christy Kinahan

Dubai

Expired Permit

• 81 days overstay
• Fine: ~$1,000

Chris Kinahan Jr

Dubai

Active Permit

• Renewed: Jul 2026
• Island Star Tourism

Bernard Clancy

Dubai

Active Permit

• Renewed: Jan 2026
• Al Matn Goods Wholesalers LLC

Ian Dixon

Dubai

Expired Permit

• 852 days overstay
• Fine: ~$11,000

Daniel Kinahan

Dubai

Sean McGovern

Dubai > IRE

Johnny Morrissey

Spain

Chris Kinahan Jr

Dubai

Active Permit

Bernard Clancy

Dubai

Active Permit

Christy Kinahan

Dubai

Expired Permit

Ian Dixon

Dubai

Expired Permit

Christy Kinahan

Dubai

Expired Permit

Ian Dixon

Dubai

Expired Permit

*Bellingcat searched the Dubai government’s identity and foreign affairs portal by inputting data about the cartel’s leadership that was contained in the US government’s sanctions notice. Searching the gang members’ ID or passport number, birth date and nationality returned a “Unified Number”, a unique identifier assigned to every UAE visa holder. This number, when entered with the other identity information on a UAE federal government portal, returned the visa holder’s current status, history and file number.

Roy McComb, a former deputy director of the UK’s National Crime Agency, told The Sunday Times it was preposterous to suggest that the UAE did not know the visa status of the cartel members in Dubai.

“How is Christy Kinahan in the UAE unlawfully and the authorities there are unwilling to take appropriate action? The Kinahans are not an unknown entity, they are at the very apex of organised crime,” he said. “For the UAE not to know their residency status beggars belief.”

David Haigh, a British solicitor who was imprisoned on fraud charges in Dubai and now assists victims of abuse in the region, said it was clear the cartel must be paying off officials. “If someone is living openly there for a long period of time with that level of heat, that to me shows there’s been corruption involved,” he said. “If they were using false passports to enter Dubai, that’s a serious federal offence.”

The passport details publicly listed in the US sanctions provide an unprecedented glimpse into the timeline of the cartel leadership’s visa history, giving an overview of their initial entry and exit to the Emirates.

The records show that four of the six key gang members had entered the UAE long before the 2016 attempt on Daniel Kinahan’s life in Dublin and the ensuing deadly feud that led to the cartel’s full relocation to the UAE.

Related articles by Bellingcat

Europe

Poster Boy: Sanctioned Kinahan Cartel Lieutenant Found Playing Padel in Dubai

A passport number for Christopher Kinahan Jr is linked to short-term UAE visas issued as early as September 2013. A passport number listed for Daniel Kinahan, searched in combination with an alternative sanctions-listed date of birth that is not his real one, returned seven short-term UAE visas between 2013 and 2015. It is not known what name this passport was under, but Daniel Kinahan has reportedly held illegitimate passports in the past.

A short-term visa for details associated with Ian Dixon first appeared in 2015. Authorities allege that Dixon acted as a trusted lieutenant to Daniel Kinahan by helping move bulk cash across Europe, arranging payments and keeping tabs on money owed by a narco-trafficker. In June, we revealed that Dixon was the poster boy for a padel club in Dubai, where he has been captured playing the racquet sport on webcams. 

The earliest visas found for details associated with Sean McGovern and Bernard Clancy were from March and April 2016 respectively, the months after the 2016 attack in Dublin.

All key members of the group, with the exception of crime boss Christy Kinahan, gained residency in the UAE using Irish passports. The cartel founder’s British passport number is linked to his immigration file; both to his latest residence permit and four previous temporary visas. Records show the first visa associated with this passport was issued in February 2007 – the earliest known instance of Christy Kinahan entering the UAE. Another was issued in November 2009, and then two more in 2017. 

However, details for an Irish passport under one of Christy Kinahan’s aliases (“Christopher O’Brien”) return 31 separate records on the UAE’s visa inquiry portal between 2014 and 2017. Bellingcat confirmed this passport number was associated with the name Christopher O’Brien after discovering both in corporate documents for a now-defunct Hong Kong firm that was incorporated in February 2014. This suggests Kinahan may have been using a false passport to travel to and from the UAE in addition to traveling under his authentic document. A man was jailed in 2023 after admitting he supplied “fraudulently obtained genuine passports” to criminals, including Kinahan.

One short-term UAE visa issued for “Christopher O’Brien” ended on August 19, 2015. Posts on LinkedIn three days later showed Christy Kinahan – wearing black-framed glasses and named in the posts as “Christopher O’Brien” – surrounded by Iranian and Turkish businessmen in a high-rise company office in Ankara. These images, discovered by Bellingcat in posts under the name of the managing director of a now-defunct Turkish investment company, have since been deleted.

According to the Dubai government, employment-based residence visas are valid for two years and must be obtained by a company on its employee’s behalf. The employer is required to apply for a work permit through the UAE’s Ministry of Human Resources and Emiratization. The employee must pass a fitness test before their employer can apply for the residence permit.

The company names on Clancy and Kinahan Jr’s residence permits, Al Matn Goods Wholesalers and Island Star Tourism respectively, match existing firms in Dubai. However, Bellingcat was unable to confirm whether these entities are the same as the ones listed on the residence permits. It is also not known why Clancy’s residence permit only includes his first and middle names (“Bernard Patrick”) while the other cartel members’ visas used their full names. 

The firm named on Christy Kinahan’s permit, OSA Management Consultancies, is listed as an aviation consultancy on a Dubai government registry. In addition to sharing an address with cartel-linked firm CV Aviation Consulting Services, UAE company data accessed on Horizons, a platform created by Washington DC-based nonprofit C4ADS that aggregates public records, shows that both firms also have the same business licence number and date of incorporation, suggesting OSA may be a newer name for the same entity.

The managing director of Island Star Tourism told Bellingcat on the phone that Christopher Kinahan Jr was working as “commission-based staff, not in-office staff”. He confirmed he recognised Christopher Kinahan Jr’s name but said he had never met him. Asked how the company name appeared on his visa, he said “I don’t know”. He said if the UAE had any problem with Christopher Kinahan Jr, it would “not give permission”.

Al Matn Goods Wholesalers and OSA Management Consultancies did not respond to questions from Bellingcat.

The UAE foreign ministry has been approached for comment.

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article. Scroll-driven interactive by Connor Plunkett and Miguel Ramalho. 

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Welcome to Dubai: Kinahan Cartel’s Visas Revealed appeared first on bellingcat.

What Happened

HMRC Issues Warning to TikTok Users

• On 4 June 2026, HM Revenue and Customs (HMRC) uncovered a suspected £153 million tax fraud scam involving TikTok.
• The scheme allegedly involved individuals posting advertisements on the TikTok, enticing users to hand over sensitive tax information, including business VAT registration details or personal self-assessment credentials for a financial reward.
• Using the stolen tax details, the fraudsters could file bogus repayment requests with HMRC.
• The warning comes after two Romanian men, aged 22 and 25, were apprehended by HMRC officers in east London on 23 April 2026 in connection with the alleged fraud.

Lloyds Bank found Two Thirds of Fraud Cases Started on Meta 

• On 6 June 2026, Liz Ziegler, the Lloyds fraud prevention director disclosed that 68% of fraud reports from their customers started on a Meta platform, including Facebook, Instagram, and WhatsApp.
• The average claim value submitted to Lloyds Bank is now above £500, an increase of about £100 from last year. Plus, victims were sending up to £66 million a year to fraudsters after falling victim to a scam advert via Meta, up from £27 million in 2023.
• The most common scams involve fake tickets for concerts, festivals and sporting events. Meta’s Facebook Marketplace is also plagued by fake adverts for cars, bikes, campervans and mobility vehicles.
• Other categories of fraud on Meta platforms, collected by Lloyds between March 2025 and 2026, include: wedding photobooths, tattoo deposits, vapes, wigs, Moncler jackets, football shirts, Dyson products and Amazon Alexas. Fraudulent transactions for deposits for flats, mobile phones, household furniture and gym equipment have also been observed.

UK Finance Recorded £221.5m Lost to Investment Scams

• In June 2026, UK Finance's Annual Fraud Report recorded the highest loss total ever recorded and the highest total number of cases ever reported at 14,893, which was 26% higher than 2025.
• Up to £221.5m was lost to scams in which victims were persuaded to transfer funds to a fake investment or fictitious fund. This figure also marked a 40% rise more than 2025.
• The primary observed tactics involved in investment scams include traditional cold calling to pressurise victims into acting quickly to claim an opportunity before it expires, as well as adverts on social media offering unrealistic rates of returns on investments, and hand-delivered letters.
• The types of investments fraudsters used as bait in 2026 involved gold, property, carbon credits, cryptocurrencies, land banks, and wine.

Fraudsters arrested in Nigeria following NCA intelligence sharing

• In February 2026, the National Crime Agency (NCA) announced that seven men were arrested in Nigeria after intelligence identified an online investment scam compound targeting UK victims. These arrests were the result of co-operation between the National Crime Agency, Meta and the Nigerian Police.
• Using hundreds of fake Facebook accounts accounts to impersonate cryptocurrency traders, the Nigeria-based scammers targeted people who used legitimate investment platforms.
• The scam compound was also allegedly recruiting and training young people in targeting victims for future investment frauds and phishing attacks. A total of 26 phones, 42 sim cards and a laptop were seized on 13 January.

Analyst Comment 

H1 2026 reinforces the transition from email-centric fraud campaigns to social-media-powered fraud operations, with platforms increasingly serving as the primary source of victims for organised cybercriminal groups. Fraudsters are also adapting scams to the culture and user behaviour of individual platforms, such as generate short promotional videos on TikTok or listing fake items for sale on Facebook Marketplace. Rather than deploying identical scams everywhere, criminals tailor campaigns to the platform's intended purpose. Recommendation algorithms and advertising ecosystems provide fraudsters with scalable victim acquisition channels that were previously unavailable through traditional phishing campaigns.

Advances in artificial intelligence (AI) and large language models (LLMs) has also meant it is much easier for cybercriminals to carry out scams on a much larger scale than they were previously able to. Autonomous systems can enable them to send out messages at scale and contact users by telephone at scale. Plus the scam attempts are also more convincing as they can mimic voices and appearance of celebrities or even a target’s friends and family.

The scale of fraudulent activities across social media is so large, it requires vast resources and expertise to monitor, detect, and prevent. At the same time, the response from HMRC, banks, social media companies, the NCA, and international law enforcement suggests increasing recognition that combating social media fraud requires coordinated action.

The volume of fake accounts on social media used for scams does also validate the calls for increased verification and security checks on such platforms. The UK Government's proposal to introduce a national digital ID system, however, was met with fierce opposition. Up to 2.9 million people signed a UK parliament petition to show their disagreement with such a system.

Defensive Takeaways 

• Reduce Public Exposure: Fraudsters increasingly use information shared on social media to personalise scams and identify potential victims. Consider making profiles private or limiting visibility to trusted contacts and if you no longer actively use a social media platform, consider deleting the account entirely.
• Be on Guard for Scams: Sponsored advertisements should not automatically be considered legitimate. Refuse any financial rewards in exchange for your login credentials. Be cautious of investment opportunities promoted solely through social media. Assume Facebook Marketplace listings can be fraudulent.
• Report Suspicious Activity: Reporting scams helps remove fraudulent content and supports law enforcement investigations. Useful UK reporting channels include Report Fraud and the UK NCSC's Suspicious Email Reporting Service report@phishing.gov.uk.
• Seek Support after a Scam: Victims should not assume financial losses are unrecoverable. It can be possible to get funds returned if they contact their bank immediately, preserve screenshots and transactions records, and report the incident to Report Fraud. Further, if a victim is dissatisfied with how their bank handled their case, they can complain to the Financial Ombudsman Service.

Relevant Sources 

1. https://www.independent.co.uk/news/uk/crime/tiktok-hmrc-tax-fraud-scam-b2989914.html
2. https://www.thetimes.com/article/840020a8-1210-47c9-9262-e3139116b652?shareToken=771d08288cd2ac9d0ba13194f43d75a0
3. https://www.theguardian.com/money/2026/jun/15/investment-fraud-uk-more-than-220m-lost-last-year-scams-ai
4. https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf
5. https://www.nationalcrimeagency.gov.uk/news/fraudsters-arrested-in-nigeria-following-nca-intelligence-sharing 

What Happened

Nemesis Dark Web Drug Dealers Arrested

• On 14 May 2026, two Cambridgeshire drug dealers were sentenced after being arrested in July 2024 by the Eastern Region Special Operations Unit (ERSOU).
• ERSOU officers recovered Royal Mail parcel labels, order lists, Gorgonites-branded packaging, and a USB memory stick containing login credentials for multiple dark web marketplace accounts.
• The dealers reportedly used the dark web to supply heroin, cocaine, and amphetamine to hundreds of users across the UK.
• The drug deals were initially arranged via a Telegram channel under the handle Gorgonites, which was linked to at least 570 individual sales on Nemesis Market since September 2023.

AEGIS Dark Web Drug Market Seizure

• On 17 March 2026, the London Metropolitan Police’s Cyber Crime Unit announced the seizure of AEGIS Marketplace.
• In June 2025, the Met Cyber Crime Unit became aware of AEGIS Marketplace, which was a site where individual sellers could market drugs for sale to users who could make purchases using cryptocurrency.
• By March 2026, the website had 30 active sellers and was estimated to have generated 10,000 drug sales in ten months, leading to an estimated annual turnover of almost £2 million.
• Officers from the Met managed to infiltrate the site, retrieving server data that led to the identification of administrators, sellers and customers.

Online Killers Marketplace (OKM) Admins Arrested

• On 19 January 2026, two suspects were arrested in Romania as part of an ERSOU investigation into a bogus ‘harm-for-hire’ website which offered services including murder.
• The arrests were connected to a dark web scam website called Online Killers Marketplace (OKM), which purported to facilitate criminal activities including the hiring of hitmen and extortion.
• ERSOU noted that even though none of the services OKM offered were genuine, successful prosecutions have previously been pursued by police forces of individuals attempting to use it to cause harm to others.
• The investigation led to the seizure of US crypto currency worth at least $600,000, as well as cash which included almost €50,000 Euros, and around £48,000 worth of Romanian Leu.

Analyst Comment

The anonymity and connectivity of encrypted messaging apps, the Tor network, cryptocurrency, and online marketplaces makes it nearly impossible to prevent such crime. However, law enforcement can achieve strategic containment by targeting specific infrastructure for seizure and individuals for arrest. These activities support the overall strategy for national law enforcement agencies is to deter criminals from being active in their country.

Telegram is increasingly used as a front-end service for all sorts of cybercrime activities. As seen in the Nemesis investigation, the dealers operated a Telegram channel under the handle Gorgonites to coordinate and funnel buyers toward more secure transactions. It is an easy-to-use mobile application that makes access to such illicit services simple for buyers. It is more accessible than having to download the Tor browser and use a desktop or laptop browser. Many of these illicit services also would not exist without cryptocurrency. The ability to send funds via peer-to-peer networks and obfuscate transactions continues to be the main enabling factor for most cybercrime operations. 

Interestingly, the sole administrator of Nemesis Market was sanctioned in March 2025 by the US Treasury OFAC department. The admin was an Iran-based individual named Behrouz Parsarad. Prior to its takedown by law enforcement in March 2024, Nemesis had over 30,000 active users and 1,000 vendors and facilitated the sale of nearly $30 million USD worth of drugs around the world between 2021 and 2024.

Defensive Takeaways

• Blockchain Analytics: While cryptocurrency provides a layer of perceived anonymity for illicit markets it also leaves a permanent, public ledger. Law enforcement and threat intelligence firms, such as TRM Labs and Chainalysis, can leverage blockchain analytics to follow the money and deanonymise the administrators. By mapping transaction inputs and outputs, investigators can trace mixed funds, identify exchanges used to cash out into fiat currency, and map the financial infrastructure of a marketplace.
• Breach Data Pivoting: To catch these cybercriminals, threat intelligence analysts can use historical breach data repositories to pivot from a known dark web alias or leaked credential to find a real-world identity. If an administrator used the same password or a variation of a username on a compromised gaming forum ten years ago, that footprint can blow their operational security (OPSEC).
• Profile Scraping: Dark web vendors and market admins often leave massive digital footprints across forums, marketplaces, and messaging apps like Telegram. Continuous profile scraping can be achieve via automated bots to collect vendor profiles, feedback ratings, PGP keys, styles of writing (stylometry), and active hours. By aggregating this data over time, defenders can create a comprehensive profile of a target and identify them.
• Dark Web Market Sock Puppet Accounts: Law enforcement and threat intelligence analysts can deploy sock puppets accounts, which are undercover, synthetic personas, into these dark web ecosystems. These accounts are kept for long periods of time and actively posting in an attempt to build trust within the cybercrime underground. Investigators can use them to buy products, interact with admins, and gain access to private vendor portals or escrow systems to support evidence gathering for a takedown.
• Infrastructure Analysis: As dark web markets rely on servers, hosting providers, DNS, and Tor is is possible to analyse these attributes and look for configuration mistakes. This can include exposed IP addresses, trackable X509 certificates, or open port banners that reveal the true location of a hidden service. Once a server's true IP is uncovered, law enforcement can issue subpoenas to hosting providers or execute physical raids to seize the hardware and unmask administrators, vendors, and buyer databases.

Relevant Sources

1. https://www.rocu.police.uk/news/2026/may/dark-web-was-used-to-supply-heroin-and-cocaine-to-hundreds-of-users-across-uk/
2. https://web.archive.org/web/20260320135505/https://news.met.police.uk/news/met-seizes-website-making-millions-in-drug-sales-507234
3. https://www.rocu.police.uk/news/2026/january/dark-web-arrests-in-romania-linked-to-portal-which-offered-services-including-murder/

Related CTI Sources

1. https://home.treasury.gov/news/press-releases/sb0040
2. https://www.tripwire.com/state-of-security/notorious-nemesis-market-zapped-video-game-loving-german-police

What Happened

Analyst Comment
ShinyHunters is a prolific feature of current threat landscape. This adversary appears to have a particular focus on the educational sector. Last month in May 2026, ShinyHunters targeted another provider of educational software: Instructure Canvas. A number of other UK universities were also impacted by the Instructure breach.

The education sector in the US and UK has suffered repeated, significant data breaches in recent years. In January 2025, BleepingComputer reported that PowerSchools, a cloud-based software provider, suffered a breach whereby the data of 62.4 million students and 9.5 million teachers was exfiltrated. Also in June 2026, the University of Oxford also disclosed a data breach impacting its CareerConnect platform. Separately, 13 schools in Powys county in Wales were impacted by a data breach in April 2026.

After the Oracle E-Business Suite zero-day campaign by CLOP in October 2025, this campaign by ShinyHunters against Oracle PeopleSoft is yet another blow for Oracle. Google identified over 100 exposed organisations, and noted that 68% are academic institutions, including universities and colleges worldwide. More are likely to have been victimised by ShinyHunters and listed on their Tor data leak site in the coming weeks.

Defensive Takeaways

• Patch Oracle PeopleSoft: Internet-facing applications, such as file transfer servers or cloud-based software need to be prioritised for patches and updates. Checking the integrity of such systems while patching is also key to finding undetected compromises. Proactively ingesting event logs and threat hunting for suspicious activities involving these systems is also key to prevent breaches.
• Prioritise Education Software Security: Education sector firms or cybersecurity companies with education sector clients must react to the elevated threat, by pen-testing, threat hunting, and threat intelligence sharing. Cybercriminal adversaries like ShinyHunters often exploit internet-facing applications or use stolen credentials for initial access. It is therefore critical to focus on these tactics, techniques, and procedures (TTPs) to prevent their attacks.
• Follow the Data Breach Alert Playbook: Impacted victims must begin to rotate credentials, and start the laborious task of requesting new identity documents and codes like national insurance numbers or passports. It is also worth investing in some credit monitoring services as well to prevent loans being taken out in your name.

Relevant Sources

1. https://x.com/politlcsuk/status/2064699766215164241
2. https://www.dailymail.com/news/article-15889587/University-Nottingham-data-major-hack-cybercriminal.html
3. https://www.bbc.co.uk/news/articles/ckg0lkp042zo
4. https://www.bbc.co.uk/news/articles/cnv93j9pv78o
5. https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-raids-nottingham-uni-for-student-alumni-data/5253961

Relevant CTI Resources

1. https://www.ransomware.live/id/bm90dGluZ2hhbS5hYy51a0BzaGlueWh1bnRlcnM
2. https://haveibeenpwned.com/Breach/UniversityOfNottingham
3. https://x.com/nahamike01/status/2064559568018186745
4. https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit 

 What Happened

• Officers from the Dedicated Card and Payment Crime Unit (DCPCU), jointly run by the London Met Police and City of London Police, secured the conviction of a man who used an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London.
• The conviction relates to an investigation that previously led to the sentencing of Ruichen Xiong in July 2025, who was apprehended while driving a vehicle in North London as the device was in operation. During that incident, officers in the vicinity received fraudulent text messages purporting to be from HMRC.
• Ruichen Xiong was a student from China who drove around London using the SMS Blaster between 22 and 27 March 2025, sending messages to tens of thousands of potential victims.
• Following Xiong’s arrest and subsequent conviction, enquiries identified another individual called Di Li who was a key organiser. Li facilitated Xiong’s involvement by arranging access to the device, assisting with obtaining a vehicle, and supporting his day-to-day living costs.
• Xiong had accrued significant gambling debts after arriving in the UK as a student. To pay off his debts, Li instructed that he could repay what he owed by driving routes in a car with the SMS Blaster.
• On 20 August 2025, officers searched Li’s home address, where digital evidence was recovered showing communications between Li and Xiong relating to the deployment of the SMS blaster. Li was arrested on 1 September 2025 and charged with offences linked to the operation.
• At the court trial, Li’s defence was that the device was intended for “advertising” purposes and described himself as a middleman acting on behalf of an individual based in China. He maintained that he had been merely attempting to help Xiong repay his debts.

Analyst Comment

An SMS Blaster acts as a portable mobile phone mast that forces nearby mobile devices to connect to it by silently downgrading it to 2G while they try to connect to 5G or LTE. By doing so, criminals can bypass safeguards designed to block malicious senders and harmful links, enabling them to deliver fraudulent messages directly to victims nearby without needing their phone numbers. The SMS Blaster allow an operator to customise all aspects of the messages, so they can make it look like it has come from a genuine organisation like HMRC, the UK tax authority.

SMS Blasters are a relatively new technology for scammers. Police in the UK only encountered them for the first time in 2025, but they have been used in other parts of the world. SMS Blaster are also a type of IMSI catcher that mirrors the capability of law enforcement tools such as a Stingray.

When used in busy metropolitan areas, they allow criminals to easily send out SMS phishing messages to hundreds of people at a time. These SMS messages typically have a malicious link that host scam websites that trick victims into entering their personal details. These details can then used by fraudsters to make payments, steal funds, or resell it to others.

This report also highlights the concerning trend of organised cybercrime gangs from China are actively hunting for individuals who are financially vulnerable (like students with gambling debts) to conduct high-risk in-person operations. 

Defensive Takeaways

• Block and Report: If you receive a suspicious text message, do not engage with it. Instead, forward it to 7726, a free reporting service, and block the number.
• Move Away from SMS: If your organisation relies on SMS for One-Time Passcodes (OTPs), this threat highlights that the SMS sender ID can be perfectly spoofed locally. Organisations should migrate to authenticator apps, hardware tokens, or application push notifications to avoid spoofing.
• Proactive Takedown Programs: Since the attack relies on hosting malicious links to harvest credentials, defenders can perform proactive domain monitoring. Detecting and taking down lookalike domains immediately minimises the impact.

Relevant Sources

1. https://www.cityoflondon.police.uk/news/city-of-london/news/2026/june/man-jailed-for-role-in-sms-blaster-fraud-operation-following-city-of-london-police-investigation
2. https://www.ukfinance.org.uk/news-and-insight/press-release/police-warn-sms-scams-following-prison-sentence-criminal-who
3. https://www.theguardian.com/money/2025/jun/24/police-sms-scams-blaster-texts-smishing

Relevant CTI Resources

1. https://www.m3aawg.org/blog/SMSBlasterEngagementSeries

Warning: Includes graphic descriptions of animal harm and images of animal parts from the outset.

A Bellingcat investigation has uncovered a Myanmar-based wildlife trafficker who has operated openly across social media for at least six years, claiming to have sold tiger bones, rhino horn, elephant skin and other products from protected and endangered species to customers in Myanmar, China and Thailand.

By analysing hundreds of adverts and customer conversations, Bellingcat traced more than US$21,000 in sales, identified cross-border shipments linked to multiple payment accounts, and geolocated the dealer’s home address. The seller frequently used graphic images to convince buyers that his wildlife products were genuine, sharing footage of animals before and after they were killed as proof of authenticity.

Following this investigation, Meta removed 10 Facebook accounts, WeChat suspended three accounts and revoked their payment functions, TikTok and YouTube each removed one account, and authorities in Myanmar and Thailand said they would examine the findings further.

On December 21 2022, a Facebook account shared a reel of a tiger cub lying unconscious beneath the caption: “Time for winemaking”, followed by several laughing face emojis. Four days later, the same account shared another reel, this time of an adult tiger lying motionless on an orange plastic sheet as a man approaches with a knife.

Two separate videos posted to Facebook by the account known as MB.

The account behind both videos belongs to Mei Ba (hereafter MB), a self-described Traditional Chinese Medicine (TCM) doctor based in Myanmar. In TCM, plants and animal products are used to prepare remedies based on established medicinal formulas. These remedies can take many forms, including herbal teas, simmered concoctions, ingredients steeped in wine, and pills. TCM is also sometimes associated with pseudoscientific beliefs, such as the idea that consuming an animal’s organ can nourish the corresponding organ in the human body.

A Bellingcat investigation has found that MB frequently advertises the trafficked parts of critically endangered and vulnerable species to customers in Myanmar, Thailand and China. An analysis of social media posts published by MB over six years found references to sales involving parts of bears, elephants, leopards, musk deer, otters, pangolins, rhinos, seahorses and tigers, all of which are protected species.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Profiting from Protected Species

For at least six years, MB has used ten different Facebook accounts under versions of his name to advertise animal parts and products for sale, including those derived from vulnerable and protected species. 

MB has advertised tiger body parts and products, including skins and wine made from bones. Myanmar’s wild tiger population was last estimated at a minimum of 22 animals (in a 2019 study published before the civil war). Licensed tiger farms, described as being similar to zoos, also operate in the country. However, Myanmar law prohibits the killing of any tiger, wild or captive. 

Bellingcat has also identified adverts offering leopard body parts, including skin, bones and gallbladders, as well as a product described as a “whip”, a euphemism for a penis. Many of the adverts explicitly stated that the body parts came from wild animals. The Indochinese leopard is classified as critically endangered, with fewer than 800 mature individuals believed to remain in the wild across mainland South-East Asia.

MB has advertised body parts and other products derived from Asian elephants, an endangered species, including skin sold in pieces and powdered form, as well as their genitals.

One of MB’s more graphic posts showed a recently killed and butchered moon bear – a type of Asian black bear which is classified as a vulnerable species. MB has also advertised various bear body parts for sale, including paws, heads, gallbladders, bile and fat.

Whole rhino horns, as well as bracelets and medicinal products made from rhino horn, have been advertised by MB. Although rhinos have been extinct in Myanmar since the 1980s, the country remains a known transit route for rhino products moving from India to China and elsewhere in South-East Asia, suggesting the items advertised by MB originated outside Myanmar.

Rhino products as advertised by MB on Facebook. Labels added by Bellingcat.

Under Myanmar law, anyone convicted of killing, possessing or trading a “completely protected species,” or its parts, faces a minimum prison sentence of three years and a fine under a conservation law introduced in 2018. Completely protected species advertised by MB include Asiatic black bears, elephants, leopards and rhinos.

Bellingcat contacted multiple Myanmar government authorities for comment regarding MB’s wildlife trade. The Myanmar embassy in London confirmed receipt of Bellingcat’s request and said it would consult the relevant authorities in Myanmar. 

Convincing Customers

Counterfeits are common in the illegal wildlife trade. Buffalo horn is often carved to resemble rhino horn, while cattle penises are passed off as tiger parts. Much of MB’s promotional strategy therefore focuses on persuading buyers that his products are genuine. 

To market rhino horn, MB has posted images of the items on scales or held up against a light, which he claims demonstrates the texture of genuine horn. For tiger bones, in one post he said that a patch of skin would be left attached to demonstrate their authenticity. 

MB has also posted videos of recent leopard and tiger kills. He has shared footage of live tigers in cages followed by images of the same animals being butchered for their skins, bones, skulls, claws and fangs.

Bellingcat only analysed open source evidence, including social posts, customer conversations, visible transactions and shipping receipts. Therefore, the authenticity and composition of the wildlife products advertised or sold could not be independently verified.

Nevertheless, given the volume and graphic nature of these posts, MB’s ability to operate on Facebook for at least six years raises questions about why his accounts remained active up until Bellingcat contacted Meta.

Evading Platform Moderation

For years, MB has openly advertised his business on Facebook, posting hundreds of adverts across ten profiles and various groups. He often uses coded language, including Chinese-language euphemisms in his comments. 

For example, he uses “eraser” (橡皮) to refer to “elephant skin” (象皮), a Mandarin homophone with characters that are also visually similar, shown below.

MB also uses pinyin, the phonetic system for spelling Mandarin Chinese words using Latin letters. For example, in one post, he abbreviates the pinyin word for “rhino” (xīniú) as “X”, advertising “X horn powder”, and uses “Y” (pinyin: yào) as shorthand for “medicine”. He also frequently uses animal emojis, including tiger, elephant, rhino, deer and bear, to refer to products derived from those animals without naming them directly.

Asked why MB had been able to operate for so long without being banned and how it detects common evasion tactics such as coded language, Meta responded: “Bad actors constantly evolve their tactics to avoid enforcement, which is why we partner with groups and invest in tools and technology to detect and remove violating content.”

Cross-Border Trade

To map the scale of MB’s business, Bellingcat analysed more than 500 screenshots of customer conversations spanning May 2021 to May 2026. Originally taking place on Facebook, Viber and WeChat, these exchanges were later reposted by MB on Facebook.

Often blurred or cropped, the material appears to have been shared as part of a strategy to present MB as a trusted seller who reliably delivers to customers. However, given the content frequently included shipping labels with names and addresses, product descriptions, and price discussions, Bellingcat was able to trace part of MB’s customer base and income. Notably, only content MB chose to repost was available for analysis, meaning the findings represent only a sample of his overall activity. 

Across the dataset, Bellingcat identified more than 150 transactions totalling US$21,000. The United Nations estimated Myanmar’s annual per capita income at between $300 and $430 in 2023.

Bellingcat analysis of MB’s digital footprint showing revenue earned per species by MB. Currency in US$. Trade values are estimated based on yearly average black market exchange rates.

Based on delivery records, Bellingcat identified 119 deliveries within Myanmar, 27 to mainland China, and nine to Thailand. Within Myanmar, shipments were most often sent to shared pickup points in cities or towns, whereas those to China were more frequently sent directly to individual addresses. 

Shipments within Myanmar most often involved small quantities of powders or medicines, such as 3 to 7 g of rhino horn powder or 5 g of bear gall bladder. By contrast, deliveries to China more often included whole animal parts such as rhino horn or tiger bones, or larger quantities of products, including 500 g to 1 kg of elephant skin powder or 10 to 40 bottles of medicine.

MB’s highest-value recorded transaction was to a customer in Yiyang, Hunan Province, China and involved two tiger femur bones weighing just over 2.5 kg. Sold in July 2022, the bones fetched 23,500 Chinese Yuan (US$3,494). The customer was asked to provide a screenshot as proof of payment. MB later reposted this on Facebook, alongside a photograph of the bones wrapped in cling film and a shipping label for Deppon Logistics attached. 

Bellingcat contacted Deppon Logistics for comment, sharing the image and tracking number shown below, but received no response at the time of publication.

Under Chinese law, buying, transporting, or selling protected or endangered species can, in the most serious cases, carry prison sentences of more than 10 years. Asian elephants and wild tigers are listed as “Class 1” protected animals. A permit system does exist for the use of captive-bred tigers, although it remains controversial. 

Under the Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES) Appendix I, international trade in any endangered species, including Asian elephants and tigers, as well as their derivatives such as skin powder, scales and bones, is prohibited. China, Myanmar and Thailand are all parties to the treaty. 

Bellingcat contacted the General Administration of Customs of China for comment on MB’s wildlife sales to China but did not receive a response at the time of publication.

Related articles by Bellingcat

Asia-Pacific

The Hunt for Malaysia’s Elusive Wildlife Trafficker

Bellingcat also found evidence of nine deliveries to Thailand, including a tiger penis and several TCM powders said to contain dog, yak and seahorse, all species regulated by Thai law and protected under CITES.

The Thai Natural Resources and Environmental Crime Division told Bellingcat that it already monitors packages falsely declared as traditional medicine but found to contain protected wildlife parts or ingredients derived from them. Following Bellingcat’s findings on MB’s activities, the division said it would investigate further.

A large proportion of MB’s exports to all three countries were bottles of TCM powders or tablets. For example, a “kidney replenishing medicine” was purported to contain deer, dog, gecko, praying mantis, seahorse and yak, while a “prostate medicine” was said to include deer, seahorse and dog. 

Under Chinese law, all packaged TCMs must carry labels clearly displaying the manufacturer’s name, full ingredient list, production and expiry dates, and information on side effects and safety. None of these details were present on MB’s labels.

Multiple banks accounts

Over six years of reposted conversations with customers, Bellingcat observed MB requesting payments to at least 15 different accounts, including seven via WeChat Pay, two via Alipay and six via third-party bank accounts, which MB described as belonging to friends or family.

For example, in May 2022, a customer purchased 1kg of elephant skin powder to be shipped to Chiuchow, Guangdong Province, China. MB told the customer his WeChat account could not currently receive the payment and instructed them to send the funds to his “sis” [female associate], shown below.

Both WeChat Pay and Alipay’s terms and conditions prohibit the use of their services to receive payments for illegal activities.

After being contacted by Bellingcat, WeChat suspended three accounts, revoking all payment functions and removing associated content. 

Alipay did not respond to Bellingcat’s request for comment.

Identifying MB

MB’s brazen online activities include operating at least ten Facebook profiles, two TikTok accounts, one WeChat account and one YouTube channel. He is the sole administrator of a Facebook group with nearly 1,000 members. Across these platforms, he has amassed some 12,000 followers. 

While using variations of “Mei Ba” (MB) across most of these accounts, he also uses the Chinese name “Mei Xiangfu” on his personal WeChat account. The name “May Kyin Phu” also appears alongside payment QR codes when customers are asked to transfer funds. Below is a QR code for Myanmar’s largest bank, KBZ, which includes what appears to be MB’s legal name: U May Kyin Phu, with “U” used as an honorific equivalent to Mr.

Since 2019, MB has used the same ID photo as his profile picture across multiple platforms, as well as his wedding photo as his TikTok profile picture and Facebook banner image. His wife, identified in the wedding photo and in other images posted by MB, has also been found advertising vulnerable and protected species via her Facebook account.

With more than 3,100 followers, she frequently reposts MB’s adverts while also sharing screenshots of conversations with customers. For example, in one WeChat exchange later reposted to Facebook, she discusses the cash sale of five “real” tiger penises.

From MB’s posts, Bellingcat geolocated a house in Lashio, eastern Myanmar, used to photograph animal parts for sale in his advertisements. MB has posted content from this property since 2020.

In the images below, what MB describes as “leopard gallbladders” can be seen hanging from a balcony, revealing the layout of the property’s backyard and the rooftops of adjacent buildings. Although Lashio is not covered by Street View, the distinctive roof visible in MB’s images matched with user-uploaded photographs on Google Maps.

Bellingcat contacted both MB and his wife for comment on the findings of this report. Both were reached via WeChat and appear to have received the request, but did not reply at the time of publication.

Data visuals by Galen Reich, Graphics by Merel Zoet, Editor, Claire Press.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Rhino Horn, Leopard Skin and Tiger Claws Sold Openly on Facebook appeared first on bellingcat.

What Happened

• Over the course of September 2025 to May 2026, Hargreaves Lansdown the UK-based investment platform has been the subject of IT glitches, hacker claims, and technical outages that have triggered rumours and customer concerns.
• On 11 September 2025, Hargreaves Lansdown customers reported discrepancies in the balances for their pension and ISA accounts, appearing as if huge sums had been mysteriously withdrawn. Customer began to fear they had been “hacked” after they logged onto their account and saw their life savings reduced. In less than 24 hours, Hargreaves Lansdown, however, swiftly responded that it was a temporary technical issue that only lasted 45 minutes and all client balances were restored.
• On 20 March 2026, Hargreaves Lansdown customers began experiencing technical issues that were affecting some parts of its website and app. The company apologised to customers over IT issues which left them unable to access their accounts during a period of heightened volatility in the financial markets. The company also assured people that there was no evidence of a cyber incident or a data breach and that all customers’ assets and data was secure.
• On 27 April 2026, Hargreaves Lansdown (hl.co.uk) was listed as a victim on the Bashe Tor data leak site. The attacker claimed that they allegedly stole their customer database of 658,259 unique users. They then shared five links to their other servers where other Tor users can download the alleged data.
• On 8 May 2026, the alleged Hargreaves Lansdown data appeared on DarkForums, a cybercrime forum. From the sample posted, the database offered contains addresses, names, emails, phone numbers, and date of birth. However, no Hargreaves Lansdown customer account numbers or transaction details were included in the sample.

Analyst Comment

Defensive Takeaways

• Counter Adversary Threats: To counter this trend, UK firms must integrate their public relations (PR), incident response, and threat intelligence teams. Quick, transparent communication that explicitly decouples internal IT glitches from external cyber threats remains an effective defence against brand-damaging, clout-chasing extortion tactics.
• Precautionary Threat Hunting: Even in a fake breach scenario, it is still important to threat hunt for malicious and suspicious activities involved potentially targeted systems to help prove that the alleged data exfiltration never happened. In this scenario, the attacker claimed to have stolen customer database. Therefore, it would be prudent to hunt for any signs of data theft involving systems hosting customer data specifically.
• Precautionary Password Resets: In a scenario like this, companies may want to trigger a precautionary customer password reset “just to be on the safe side”. However, credential rotation must be calculated, automated, and decoupled from any fear, uncertainty, and doubt (FUD). If an incident response includes this action, it must be a measured approach. Triggering a mass password reset without tailored communications can unintentionally support the cybercriminals fake breach narrative and could trigger mass panic.

Relevant Sources

1. https://archive.is/jXLF1
2. https://www.ransomware.live/id/aGwuY28udWtAYXB0NzM
3. https://uk.finance.yahoo.com/news/hargreaves-lansdown-outage-halts-customer-132845651.html
4. https://www.bbc.co.uk/news/articles/cx2reyjdyjzo
5. https://x.com/hlinvest/status/2034923194176426310
6. https://x.com/ibreaches/status/2052737608153997519

Relevant CTI Resources

1. https://www.ransomware.live/group/apt73
2. https://www.cloudsek.com/blog/unmasking-media-hungry-ransomware-groups-bashe-apt73

What Happened:

• On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec. 
• On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.
• Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project with production payment gateway credentials, and the source code of ArupCompute and Oasys. 
• The FulcrumSec operators also claimed to have spent over half a year analysing the data and went through “email correspondence” with the company before publishing the stolen data.
• On the victim post, FulcrumSec wrote a detailed incident breakdown. In it, they stated they gained initial access in September 2025 via a GitHub personal access token found hardcoded in a JavaScript file on a forgotten subdomain, which provided access to over 10,000 private GitHub repositories belonging to Arup Group.
• From there, they scanned the repositories and found additional hardcoded tokens, API keys, and passwords for AWS, Azure, and databases.
• The adversary stated that Arup detected the Github and Azure Storage intrusions approximately six weeks after they happened and rotated the credentials, but it was too late as the data had been exfiltrated. 
• FulcrumSec also stated they pivoted into the AWS infrastructure using keys they had found belonging to Arup’s subsidiary Neuron.
• FulcrumSec allegedly waited until April 2026 to contact their victim, Arup Group, due to the time it took to analyse the vast amounts of stolen data.
• Impacted client organisations of Arup Group were also mentioned in the post, such as Disney and several other Hong Kong companies. The adversary reportedly uncovered Amazon data center seismic fragility data, British Petroleum (BP) site selection coordinates, and Queensferry Crossing internal documents as well.
• Critically for the UK, the breached data exposed up to 62 HS2 related GitHub repositories. This involved Euston Station pile design files, ground movement assessments, over 14,000 sensor monitoring records, 48 archaeological site GPS coordinates (including Jones Hill Wood, a sensitive site for environmentalists), as well as confidential documents.

Analyst Comment:

Arup Group is a large multinational architectural design and engineering firm based in London who has been involved in constructing the Wembley Football Stadium in London, the HS1 Channel Tunnel Rail Link network, and the Eden Project in Cornwall, among other significant international construction projects.

Active since September 2025, FulcrumSec is a financially motivated data-theft-extortion group that specialises in rapid exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions.

This attack was noteworthy due to its highly targeted nature. FulcrumSec claimed they had access to Arup Group’s data for seven months and they clearly invested significant time to analyse the documents and spent weeks negotiating over email. Plus, to find initial access they also would have had to spend time checking Arup’s domains and Internet-facing assets to eventually find a single leaked credential to exploit. These types of targeted intrusions often only happen to large companies. This is because for it to be worth the cybercriminal’s time, effort, and risk to their freedom they will want a large ransom payment that only rich companies can typically afford.

FulcrumSec is an adversary worth monitoring due to the effort they put into their intrusions compared to other smash-and-grab ransomware campaigns. In October 2025, in a case documented by VX-Underground, FulcrumSec emailed detailed information about the breach they conducted with the aim of those details getting published and exert additional pressure on the victim.

Interestingly, FulcrumSec said the ransom they demanded was less than 1% of Arup’s annual revenue and was less than how much Arup lost to the deepfake fraudsters. This is a reference to Arup reportedly lost over £20 million pounds in 2024 after one of their Hong Kong employees was duped into sending cash to cybercriminals using an AI-generated video call. The fact Arup became publicly known for falling victim to a large scam potentially contributed to the adversary’s decision to select and focus them for this attack.

Defensive Takeaways:

• Asset Inventory and Shadow IT Audits: Identifying the outdated unused domains with hardcoded credentials is standard best practices. All organisations must have processes in place to catalog and retire systems to avoid incidents like this. 
• Hardcoded Credentials in Code: They way FulcrumSec gained access demonstrates the importance of using secret environment variables and features like GitHub Secret Scanning.
• Implement Incident Response Procedures: Importantly, Arup detect the activity too late and it took them a staggering six weeks to rotate credentials (according to the adversary), which shows why having automated systems to check for unauthorised usage and reset tokens and all accounts is crucial to respond to such attacks.
• GitHub Activity Monitoring: The adversary claimed they were able to clone thousands of GitHub repositories containing sensitive data without being detected. These types of activities are available to monitor and detect in GitHub Audit Logs. It’s also important to have a plan in place when suspicious activities are detected.
• Third-Party Risk Management Programs: This incident also had some notable downstream impact. It shows why client organisations of another company’s services need to know what data and how much data is stored by third-parties for when such breaches occur. Knowing what’s potentially exposed will streamline the response to the incident.
• Deception Tech: Arup could have implemented a boobytraps for the adversary such as the use of CanaryTokens inside sensitive documents. As the adversary spent time analysing the Arup’s documents before contacting them, if they open a boobytrapped document, then the incident could been detected much earlier and the damages could have been reduced.

Relevant Sources:

1. https://x.com/darkwebinformer/status/2053281385582891437 
2. https://www.ransomware.live/id/QXJ1cCBHcm91cEBmdWxjcnVtc2Vj 
3. https://en.wikipedia.org/wiki/Arup_Group
4. https://www.theguardian.com/technology/article/2024/may/17/uk-engineering-arup-deepfake-scam-hong-kong-ai-video

Relevant CTI Resources:

1. https://www.ransomware.live/group/fulcrumsec
2. https://x.com/vxunderground/status/1975629199323853027 
3. https://www.reddit.com/r/Scams/s/wfZ3Wp94mY
4. https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files/

What Happened:

• On 3 May 2026, ShinyHunters, the English-speaking adolescent cybercrime collective, claimed they breached Instructure by listing them on their Tor data leak site.
• Instructure is a US-based software provider behind the widely adopted Canvas Learning Management System (LMS). 
• ShinyHunters reportedly exfiltrated 3.65 terabytes of data, spanning 275 million global records from up to 9,000 institutions, before posting extortion messages across university login portals demanding Bitcoin.
• The outage forced prominent UK higher education institutions, including the University of Liverpool, Queen’s University Belfast, and the University of Manchester, to take systems offline and hastily rewrite their end-of-year exam submission schedules.
• Instructure confirmed the affected data includes names, student ID numbers, email addresses, and private student-instructor messages. Instructure also confirmed no passwords, financial data, or government IDs were pilfered.
• When the initial negotiation deadline passed, ShinyHunters then escalated by defacing Canvas login portals at roughly 330 institutions and pivoting to direct school-by-school extortion.
• Following the initial investigation into the breach, Instructure confirmed that ShinyHunters had exploited a vulnerability in its “Free-for-Teacher” account creation system. 
• To prevent the data from being leaked, Instructure announced it had “reached an agreement with the unauthorised actor” behind the data extortion attack.
• According to an expert interviewed by ABC News, while a ransom amount hadn't yet been verified or publicly confirmed, people claiming to have knowledge of the situation estimated the amount was $10 million USD.

Analyst Comment:

Canvas is reportedly the UK’s primary digital learning platform, whose usage grew significantly during the pandemic. The timing of the attack also couldn’t come at a worse time for UK universities. In May, thousands of undergraduate students will be uploading their dissertations and trying to access their course content to prepare for their exams.

Active since 2019, ShinyHunters is a financially motivated data-theft-extortion collective that first emerged publicly in January 2020. Notably, ShinyHunters does not currently deploy ransomware as part of their intrusions. Instead, they exfiltrate data from cloud platforms, software environments, and third-party integrators, then demand a ransom to avoid its public release. SaaS Platforms such as Salesforce, Snowflake, GainSight, SalesLoft Drift and their customers have been targeted by ShinyHunters and adjacent groups in the last couple years.

Instructure is one of the few victims who have likely paid ShinyHunters. Most victims refuse due to not being able to trust that the cybercriminals will stick to their word and delete the stolen data. The consensus across the industry is paying the ransom is never the appropriate option for multiple reasons, such as fuelling future attacks, making your company look like an easy target, and possibly violating sanctions and local ransom payment ban laws. The most likely scenario is that Instructure felt they should pay the ransom to prevent further harm from the release of personal information of millions of students in their system.

Defensive Takeaways:

• Enhance Platform Security: ShinyHunters reportedly exploited a vulnerability in Instructure’s Free-for-Teacher system, which highlights the importance of identity security audits alongside standard application penetration testing. 
• Enhance Logging and Round-the-Clock Monitoring: ShinyHunters reportedly exfiltrated 3.65 terabytes of data from Instructure. Enhanced activity logs and a certified 24/7 SOC monitoring service could have detected these actions by identifying anomalous login events and data exfiltration events to unknown IP addresses. 
• Create and Test Backup Processes: While Canvas was down, the universities shifted to alternative methods like email and printed paper. This case highlights the importance of business continuity plans (BCPs) along with making sure they are updated and tested.
• Be Wary of Second-Order Effects: After a breach of this size, its key to warn users and SOC teams to be vigilant for new waves of phishing emails, brute forcing attacks, and other account takeover methods leveraging the stolen data.
• Never Trust a Cybercriminal: In Instructure’s case, the company says it received “digital confirmation of data destruction (shred logs).” However, as Allison Nixon says, it’s completely unprovable because such shred logs or videos can be easily faked.

Relevant Sources:

1. https://www.instructure.com/incident_update
2. https://www.bbc.com/news/articles/ce3pq0136eqo
3. https://www.academicjobs.com/uk/higher-education-news/canvas-cyber-attack-hits-uk-universities-or-academicjobs-uk-18738
4. https://www.theguardian.com/technology/2026/may/17/canvas-hack-cyber-criminals-data-ransom-paid
5. https://www.abc.net.au/news/2026-05-14/instructure-dealing-with-canvas-cyberhackers-dangerous-tactic/106674686

Relevant CTI Resources:

1. https://www.ransomware.live/id/SW5zdHJ1Y3R1cmUgSG9sZGluZ3MsIEluYy4gKENhbnZhIExNUywgaW5zdHJ1Y3R1cmUuY29tKUBzaGlueWh1bnRlcnM
2. https://www.ransomware.live/group/shinyhunters
3. https://www.halcyon.ai/ransomware-alerts/education-sector-in-the-crosshairs-shinyhunters-extortion-campaign-against-instructure 
4. https://www.halcyon.ai/threat-group/shinyhunters
5. https://blog.unit221b.com/dont-read-this-blog/harassment-scare-tactics-why-victims-should-never-pay-shinyhunters
6. https://www.sans.org/blog/hunting-saas-threats-insights-for589-course-cybercriminal-campaigns