Behind many online trading scams sits a question most victims never think to ask: who built the website they trusted? On 3 November, authorities in seven countries moved against a company suspected of supplying exactly that. The action against an investment fraud scheme with potential victims in more than 50 countries led to the seizure of over 100 servers and the arrest of seven suspects. The operation was led by Germany's Itzehoe Public Prosecutor's Office, with support from Europol and Eurojust. Authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia took part. They searched 17 locations and seized servers, evidence and assets. The seven suspects were arrested with a view to extradition to Germany. Investigators estimate losses of more than EUR 4 million.

The Investment Fraud Supply Chain

The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel. Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.

How Victims Were Drawn In

The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks. It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions. The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.

Why Victims Kept Paying in This Investment Fraud

The method relied on making the scam look like it was working. Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums. The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.

How a Couple's Complaint Exposed the Network

The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform. A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month's operation. In total, the case took four years to reach the company allegedly behind the platforms.

The Role of Europol and Eurojust

Europol's European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol's databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention. Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust's headquarters in The Hague.

The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and other organizations. The seizure followed a court-authorized operation against Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. According to court records, the service offered hosting, server solutions and domain purchasing options while advertising its ability to protect customers from law enforcement intervention.

FBI Seizes Virtualine Over Alleged Cybercrime Activity

Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced the seizure of Virtualine.net. Authorities said the domain had been used to facilitate multiple forms of criminal activity, including advertising sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images involving adults and minors, and international money laundering.

Virtualine marketed its services on cybercrime forums, where it openly promoted hosting options for users engaged in illegal activities. In September 2024, the service told a user on Exploit.in that its infrastructure could be used for activities including phishing, carding, email spam and port scanning, while claiming to prohibit child sexual abuse material and terrorism-related content. However, court records allege that Virtualine knowingly hosted a criminal online forum, identified as Vendor 1, that allowed users to post and sell access to nude, sexually suggestive and sexually explicit images and videos involving minors and adults.

Hosting Provider Allegedly Ignored Repeated Abuse Reports

The investigation found that Virtualine continued hosting Vendor 1 despite receiving multiple notifications about sexually explicit images and videos of minors. According to court records, Virtualine assigned an IP address to Vendor 1 around December 2025, with notifications about the material beginning in January 2026. Reports came from law enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and an attorney representing a victim. Despite these notifications, Virtualine allegedly continued providing hosting services to the forum. The records also state that Virtualine worked directly with Vendor 1 to develop another website that allowed customers to upload illicit content and download it after making a purchase. Authorities said Virtualine continued hosting this website and had received at least one abuse complaint concerning sexually explicit images of children found on the platform. Vendor 1 also promoted a hack-for-hire service, through which customers could pay hackers to gain unauthorized access to victims’ online accounts and obtain explicit images and videos.

Virtualine Advertised Measures to Evade Law Enforcement

Beyond its hosting services, Virtualine allegedly offered customers additional protection designed to keep criminal infrastructure operational when authorities intervened. In March 2026, the provider advertised an “additional protection plan” that it said could be activated after receiving an official request from law enforcement agencies. Under the arrangement, Virtualine would move a customer’s criminal infrastructure to another shell company not affiliated with the provider, after which the server would be reactivated. The alleged practice illustrates how bulletproof hosting services can be used to maintain online criminal operations by moving infrastructure when enforcement or abuse complaints threaten existing arrangements. Virtualine also promoted its tolerance of abuse on underground forums. In a June 2025 post on HackForums, it claimed to have ignored more abuse reports than other providers.

Cryptocurrency Payments Linked to Money Laundering

Investigators also examined Virtualine’s payment arrangements and their alleged role in concealing criminal proceeds. According to court records, Virtualine accepted payments through Bitcoin, including specific unhosted Bitcoin addresses that allowed customers to make direct payments without their funds being flagged as illicit. The service received payments from criminal customers, some of which investigators could trace directly to various criminal groups. Virtualine then allegedly laundered the funds further to conceal their origin. Authorities identified international money laundering as one of the criminal activities facilitated through the service.

International Cooperation Behind Virtualine Takedown

The FBI’s Washington Field Office led the investigation, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the United Kingdom’s National Crime Agency. Private-sector partners OverRIPE and Lumen also assisted, while the Justice Department’s Office of International Affairs provided additional support. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz are representing the government in the matter. The seizure of Virtualine.net disrupts a hosting service that authorities allege provided infrastructure and financial services to support criminal activity. The case also highlights the role of international law enforcement cooperation in targeting providers accused of enabling cybercrime across multiple jurisdictions.

No travel, no lessons, no test, and a UAE licence at the end of it. That was the promise behind a fake driving licence scheme that Dubai Police say has now been shut down. An eight-member criminal gang has been arrested for fraudulently obtaining driving licences from a neighbouring country for customers who had never been there, then helping them swap those licences for a UAE driving licence.

The gang charged AED 10,000 per licence. The arrests were made by Dubai Police’s General Department of Criminal Investigation, in cooperation with the UAE Ministry of Foreign Affairs and Dubai’s Roads and Transport Authority (RTA).

How the Fake Driving Licence Scheme Worked

Dubai Police’s Economic Crimes Department found that the gang exploited legitimate licence exchange agreements. These arrangements allow holders of driving licences issued by certain countries to exchange them for UAE licences without additional training or testing, provided they meet the necessary requirements.

The suspects used offices belonging to transaction processing companies in the UAE to approach potential customers and promote their services. They offered to arrange licences from a neighbouring country without customers needing to travel there, learn to drive or pass mandatory tests.

Once obtained, the licences could be presented for exchange through Dubai’s RTA. In effect, the scheme used an agreement designed to simplify the process for eligible drivers to bypass the training and testing meant to confirm that drivers are qualified.

Why Police Call It a Risk to Road Safety

Dubai Police warned that obtaining a licence through illegal means is more than a procedural violation. It can pose a serious threat to road safety.

Driving lessons and examinations assess whether motorists have the skills, knowledge and ability to handle different traffic situations. Skipping them could put unqualified drivers on public roads, endangering motorists, passengers, pedestrians and other road users.

The force urged residents to be cautious of individuals or businesses promising licences without the required training, testing or legal procedures.

Fake Driving Licence Buyers Could Face Legal Action

Police stressed that legal responsibility does not stop with those arranging the licences. Anyone who knowingly pays for a fake driving licence obtained through unlawful procedures may also face penalties and legal action.

Dubai Police also clarified a key point for buyers. Exchanging an illegally obtained foreign licence for a UAE licence does not make the original licence legitimate, and it does not exempt the holder from responsibility. Completing the official exchange process cannot be used to justify violations committed when the foreign licence was obtained.

What the Exchange Agreements Actually Allow

According to Dubai Police, international licence exchange agreements exist to make it easier to exchange legally issued licences that meet the relevant requirements. They do not allow applicants to bypass the rules that govern how licences are originally issued in their home countries.

The force urged anyone seeking a driving licence to follow approved procedures and deal only with authorised entities. Residents were also encouraged to report individuals or companies offering licences through unlawful means, to help authorities identify fraud and protect the community.

Dubai Police reaffirmed that properly trained and qualified drivers are fundamental to road safety, and that licence exchange arrangements must never be used to get around these requirements.

site-verification-ok

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

Law enforcement agencies in the United States and France have seized two CSAM domains linked to NudeLeaksTeens (NLT), a website that advertised hacked and stolen sexually explicit images and videos of young women and girls for sale. French authorities simultaneously arrested a 25-year-old man in Northern France suspected of being the site's main administrator. The action was announced by the U.S. Attorney's Office for the Eastern District of Virginia (EDVA), the FBI Washington Field Office, and the Cybercrime Division of France's Parquet de Paris. It was carried out under Operation Inevitable, a coordinated effort against the spread of child sexual abuse material (CSAM) and the non-consensual publication of intimate images. The seizure notice now displayed on the sites also references Operation Torch.

What the Seized CSAM Domains Offered

According to the seizure warrant, NLT sold leaked content that had been hacked and stolen from victims. Investigators found that despite warnings on the website against CSAM, the site also offered sexually explicit images and videos of children. [caption id="attachment_114652" align="aligncenter" width="600"] Image Source: FBI[/caption] The site sold content in packages it called "albums" and "collections." Many included victims' personal identifying information alongside explicit material. Some victims have been identified and confirmed to have been minors when the images were created. One package named after the site claimed to contain 6,200 private files of teenagers and adults, mostly American, taken from hacked Snapchat, Instagram, TikTok, and Facebook accounts. Authorities say this collection also contained CSAM.

How the CSAM Domains Were Taken Down

The United States obtained court authorization to seize both domains. Visitors now see a notice stating that the FBI took control of the sites under a seizure warrant issued by the U.S. District Court for the Eastern District of Virginia, citing several federal statutes. The notice carries the insignia of the FBI, the Department of Justice, the Arlington County Police Department, the Parquet de Paris, and the French Gendarmerie's national cyber unit, UNCyber. In France, police arrested a 25-year-old man living in the northern part of the country who is suspected to have been NLT's main administrator. The arrest was carried out at the same time as the seizure of the CSAM domains.

FBI Comments on CSAM Domains Seizure

Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, said, "The seizure of these domains represents a decisive step in dismantling the criminal networks that hide behind anonymous online platforms to exploit victims." Cox said the operation cut off the infrastructure used to distribute images and videos obtained by hacking victims' social media accounts, striking at the core of the illicit marketplace. He added that the FBI will continue to act against those who use the internet to cause harm, wherever they operate and whoever they target. The announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for EDVA; Cox; and Charles "Andy" Penn, Arlington County Chief of Police. The Justice Department's Office of International Affairs provided significant assistance. Assistant U.S. Attorneys April Russo, Lauren Halper, and Meredith Clement are representing the United States.

A Joint Effort Against Online Exploitation

Officials credited cooperation among national, international, and private sector partners for the operation. The case shows how hacked social media accounts can become a source of material sold on illicit sites, affecting both adults and minors.

The U.S. Department of State's Rewards for Justice (RFJ) program is offering up to $10 million for information on Zhang Yu, a Chinese national accused of hacking COVID-19 research at U.S. universities on behalf of China's Ministry of State Security (MSS). U.S. officials also describe Zhang as a key figure in the HAFNIUM hacking campaign, which compromised thousands of computers worldwide.

His alleged partner, Xu Zewei, was arrested in Italy in July 2025 and extradited to the United States in April 2026. Zhang remains at large.

Who Is Zhang Yu

Zhang is a director at Shanghai Firetech Information Science and Technology Company, Ltd. U.S. officials say he worked at the direction of the MSS Shanghai State Security Bureau (SSSB). According to RFJ, the MSS and SSSB are Chinese intelligence services responsible for domestic counterintelligence, non-military foreign intelligence, and parts of the country's political and domestic security.

[caption id="attachment_114641" align="aligncenter" width="600"] Image Source: Rewards for Justice[/caption]

The reward covers information leading to the identification or location of anyone who, while acting under the direction or control of a foreign government, takes part in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. The State Department says Zhang's cyberattacks violated that law.

Zhang Yu and the COVID-19 Research Intrusions

Starting in early 2020, Zhang and Xu allegedly gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists in order to steal sensitive information. At the time, Xu was a general manager at Shanghai Powerock Network Co. Ltd.

Prosecutors say the two men carried out the hacks at the behest of the MSS and SSSB and reported back to supervising officers at the SSSB. In one instance, Xu allegedly confirmed to his handlers that he had compromised the network of a research university in the Southern District of Texas.

The HAFNIUM Campaign Linked to Zhang Yu

In 2021, Zhang and Xu allegedly exploited vulnerabilities in computers running Microsoft Exchange Server, software used to store and retrieve emails. These intrusions were part of the mass hacking campaign publicly known as HAFNIUM. Victims included a university and a law firm, both based in the United States.

A nine-count indictment unveiled by the Justice Department in 2025 accused both men of computer intrusions between February 2020 and June 2021, including the HAFNIUM campaign, which prosecutors described as indiscriminate.

The scale of the campaign was significant. Brett Leatherman, assistant director of the FBI's Cyber Division, said in 2025 that through HAFNIUM, the Chinese Communist Party targeted more than 60,000 U.S. entities and successfully victimized more than 12,700 of them to steal sensitive information.

Zhang Yu Remains at Large as Partner Faces U.S. Charges

Xu was arrested by Italian authorities in July 2025 while on vacation in Milan. He was extradited to the United States in April 2026, while Zhang has not been apprehended.

According to RFJ, China uses an extensive network of private companies and contractors to hack and steal information in a way that hides the government's involvement. Both men worked for private Shanghai firms while allegedly acting on behalf of state intelligence services.

RFJ is asking anyone with information on Zhang, his associates, or their malicious cyber activities to submit a tip through its Tor-based tip line. Rewards of up to $10 million are available for information that meets the program's criteria.

Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. The focus is not only on stopping attacks after they are detected, but on finding signs that an attacker has gained access and is quietly moving through a system without triggering an alert. The government will develop ways to detect these threats and share the methods with private-sector operators, while the Defense Ministry will be able to provide personnel to assist companies when requested.

Japan Threat Hunting to Target Hidden Cyber Threats

The initiative forms part of Japan’s broader active cyber defense efforts. Threat hunting involves actively searching systems for signs of malicious activity rather than waiting for an alert or confirmed attack. Japan’s National Cybersecurity Office plans to use information about potential threats to recreate attack scenarios in a virtual environment. The office will then develop and test detection methods that can be used by private-sector companies. The aim is to help critical infrastructure operators identify attackers that may have already entered their systems and remained undetected. Detecting such activity could also help reduce the risk of a cyberattack disrupting essential services during an emergency. Legislation related to active cyber defense took effect on Thursday, giving the government a framework for expanding these cybersecurity measures.

Defense Ministry to Assist Critical Infrastructure Operators

Japan’s Defense Ministry is also preparing to provide direct support to operators of critical infrastructure. Companies will be able to request assistance, after which the ministry could dispatch personnel with threat-hunting experience developed through the information systems of Japan’s Self-Defense Forces. The National Cybersecurity Office and Defense Ministry have included the related costs in their fiscal 2027 budget requests. Threat hunting can require considerable resources because security teams need to collect and examine large amounts of system event logs. The purpose is to identify unusual activity that may otherwise go unnoticed. NTT Data Japan has been carrying out proactive threat hunting on its own systems since 2024. The company checks system logs for suspicious activity even when there has been no security alert. A representative of the National Cybersecurity Office also said threat-hunting methods could help address ransomware. Such attacks can involve attackers exploring a victim’s systems after gaining initial access, meaning suspicious activity may exist before the ransomware itself is deployed.

Recent Cyberattacks Add to Japan’s Concerns

Japan’s planned expansion of threat hunting comes as cyber incidents have affected government networks and companies across different sectors. In September 2026, the government disclosed that its common infrastructure network had been targeted in a cyberattack that began in May. Digital Minister Hisashi Matsumoto said about 246,000 personal records could have been leaked. The affected Government Solution Service, or GSS, is used by government agencies and independent administrative agencies. The potentially exposed information included about 189,000 employee records and around 57,000 records belonging to businesses and individuals involved in agency operations. An analysis found that a third party had compromised the system by exploiting a bypass involving a virtual private network, or VPN. Other recent incidents have affected private-sector operations. The Nichirei cyberattack in July disrupted food deliveries after the frozen food and logistics company confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan. Nihon Kotsu also recently reported a malware-related incident that disrupted taxi dispatch services after parts of its IT infrastructure were taken offline. Earlier incidents involving Aflac Japan, KDDI, Sapporo Holdings and Nidec showed that attackers could gain access through subsidiaries, overseas operations or third-party infrastructure. Japan’s fiscal 2027 plans therefore put greater emphasis on looking for attackers that may already be inside a network, rather than relying only on alerts after suspicious activity has become visible.

OpenSSL has disclosed a high-severity vulnerability in its Datagram Transport Layer Security (DTLS) implementation. The flaw could let a remote peer read unintended plaintext heap memory during handshake data transmission, or cause a denial-of-service condition. Tracked as CVE-2026-84782, it stems from an out-of-bounds read in how DTLS handshake message retransmissions are handled.  According to the Security Advisory published on September 29, 2026, the bug affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. 

How CVE-2026-84782 Breaks OpenSSL's DTLS Retransmission Logic 

DTLS is built for datagram-based transports, where packets can go missing, so it includes retransmission mechanisms to recover lost handshake packets. That recovery feature is where the problem lies.  The trouble starts when an application sends a DTLS handshake message in several fragments and the transport temporarily stops accepting data. OpenSSL may then return a WANT_WRITE status, pausing the handshake write partway through. While the write is suspended, a DTLS retransmission timer can expire and try to resend an earlier handshake message from the retransmission queue.  At that point, OpenSSL's retransmission code wrongly reuses the internal buffer and tracking state tied to the paused write. Instead of resetting its read position to the start of the queued message, it may begin at the offset the in-progress write had already reached.  As a result, a peer can receive a malformed or mislabeled DTLS handshake message containing leftover bytes from an unrelated, larger message still in transit. In some cases, the read extends past the intended buffer, exposing heap-resident data in plaintext. 

Memory Disclosure and Crash Risks 

The weakness is classified as CWE-125, an out-of-bounds read, and its main security impact is unintended disclosure of heap memory to the remote DTLS peer. What leaks depends on the process's memory contents and runtime conditions, and it could include fragments of previously allocated application or library data. The advisory, however, has not confirmed any reliable arbitrary-memory disclosure capability.  The bug can also crash a process if the retransmission logic reads from an unmapped memory region, creating a denial-of-service risk for applications that handle attacker-controlled DTLS traffic.  A related issue in the same retransmission path can corrupt the bookkeeping needed to resume the suspended handshake write. If a retransmission occurs while another write is still paused, later calls to SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() may run into inconsistent states, triggering an abort in debugging builds. 

OpenSSL Releases Fixes for the DTLS Vulnerability 

OpenSSL fixed the problem by resetting the retransmission read position before a message is resent. The patch also skips retransmissions while a handshake write is suspended, deferring them until the application resumes the pending operation. 

Affected branch	Fixed release
OpenSSL 4.0	4.0.3
OpenSSL 3.6	3.6.5
OpenSSL 3.5	3.5.9
OpenSSL 3.4	3.4.8
OpenSSL 3.0 Premium Support	3.0.23
OpenSSL 1.1.1 Premium Support	1.1.1zj
OpenSSL 1.0.2 Premium Support	1.0.2zs

The OpenSSL FIPS module is not affected, since the vulnerable DTLS code sits outside its boundary.  Organizations are advised to identify internet-facing services, VPNs, VoIP systems, IoT deployments, and custom applications that rely on DTLS, and to promptly upgrade their bundled or system-provided OpenSSL packages.  Laurent Gaffie of SecuRizon reported CVE-2026-84782 on August 17, 2026, and Ryan Hooper developed the fix. 

The UK Ukraine AI partnership will give Britain access to Ukraine’s Avengers AI Labs, bringing together Ukrainian battlefield experience, operational data and engineering expertise with the UK’s AI ecosystem. The agreement, signed by President Volodymyr Zelenskyy and Prime Minister Andy Burnham in Ukraine, will focus initially on defence and national security. Under the partnership, British innovators and researchers will gain access to data and insights collected across the battlefield. The UK government described Avengers AI Labs as a “goldmine of battlefield data,” offering researchers access to real-world operational information used to train AI models.

How Avengers AI Labs Uses Battlefield Data

The data is collected through thousands of daylight cameras and infrared sensors deployed across the battlefield. The systems capture images and information involving tanks, artillery, air defence systems, infantry and aerial targets, including Shahed drones and reconnaissance UAVs. The data is used to train AI models to recognize and classify battlefield objects. Ukraine’s Defense Ministry has previously said that systems trained using the Avengers Labs platform analyze more than 100,000 drone video feeds each month and help identify about 70% of enemy targets in real time. The UK’s access to the platform is intended to allow British startups, researchers and engineers to work with operational insights and develop technologies based on real-world datasets. The partnership will initially bring together engineers, academics, businesses and military operational expertise from both countries to address national security challenges. The two countries will also explore additional platforms for future collaboration.

UK Ukraine AI Partnership Test New Defence Technology

Several pilot projects involving British startups have already been rolled out as part of the agreement. The companies named are Bristol-based Sintela, Oxford’s Mind Foundry and London’s Skyral. The first technology is due to be deployed at a UK defence site to help protect bases from protestors and hostile actors seeking intelligence. The project combines Ukrainian data with UK technology and turns buried fibre-optic cables into an AI-enabled sensor. The technology could also be used in other critical locations, including airports, prisons, railways and energy plants, according to the information released about the partnership. A second project will examine the development of next-generation low-power AI chips designed for future drones, robotics and autonomous systems. If successful, the technology could support machines designed to operate for longer, respond faster and function in environments where conventional systems face limitations.

AI Sovereignty and Defence Innovation

The agreement forms part of the UK and Ukraine’s 100 Year Partnership and expands cooperation between the two countries in AI and defence technology. The UK will provide access to its universities, researchers, technology companies and AI ecosystem, while Ukraine will provide access to operational experience and datasets generated during the war. Minister for AI Kanishka Narayan described the arrangement as AI sovereignty in practice, focused on developing national capabilities and turning frontline experience into technologies for military and critical infrastructure protection. The partnership also follows the UK government’s announcement that defence firm MBDA can release classified information on UK components for the long-range SCALP missile to establish local assembly lines in Ukraine. The broader agreement is intended to combine Ukrainian battlefield data with British scientific, engineering and technology expertise, with the initial focus remaining on defence, national security and the development of future defence technology.

The FBI is warning the public about sexual exploitation actors illegally accessing social media and personal accounts to steal explicit images and videos from adult and underage victims. The stolen material, also known as non-consensual intimate images (NCII), is being posted or sold on criminal marketplaces, often without the victim's knowledge.

According to the FBI, these actors use social engineering and cyber intrusion tactics to target specific individuals or general targets of opportunity. After gaining access to accounts, they steal explicit content and share it through community forums or illicit marketplaces.

The FBI said personally identifiable information, including a victim's name, date of birth, email address, phone number and social media username, is often posted alongside the stolen material. This can expose victims to continued harassment and re-victimization.

How Sexual Exploitation Actors Access Accounts

The FBI has identified several methods used by sexual exploitation actors to gain access to victims' accounts.

Password and PIN Targeting

In password/PIN targeting, actors use high-volume password and PIN attempts against social media and personal accounts. The information used in these attempts can come from data leak sites, social media and open-source information.

When victims are known to the actors, curated lists may include personal details such as names, date of birth or variations of those details.

Social Media Customer Service Impersonation

Another tactic involves social media customer service impersonation through text messages. Victims may receive messages claiming their account is being disabled or locked unless they provide a verification code.

The actor then requests a password reset, causing a code to be sent to the victim. If the victim shares the code, the actor can reset the password and access the account.

Phishing Emails

The FBI also warns about phishing campaigns using look-alike domains and email accounts designed to appear as social media customer support.

These messages may claim there has been a new login and contain an embedded link asking the victim to change their password. Clicking the malicious link can give the actor access to the account.

Stolen Content Can Lead to Further Attacks

Once explicit content is stolen, sexual exploitation actors may post or sell it while including personal information about the victim. The FBI said victims can subsequently face harassment, sextortion, stalking or other targeted attacks.

The actors may also advertise stolen content through a victim's own social media page, increasing the potential for further exposure.

FBI Shares Steps to Protect Accounts

The FBI advises people to avoid storing sensitive images or videos on social media platforms or other internet-accessible sites.

It recommends using unique, complex passphrases and PINs along with multi-factor authentication (MFA). Password information directly associated with a person's identity, including names or birthdays, should be avoided.

Users should also be cautious with links received through emails and text messages. The FBI recommends going directly to the relevant website to address account concerns and checking URLs before clicking.

Unrequested temporary passwords, PIN resets or access codes should also be treated with caution. The FBI advises users not to share login information, even when someone claims to represent a platform or service.

People who believe their explicit content was stolen or leaked can provide information through the FBI's NCII reporting site. The FBI also advises the public to continue reporting fraud, scams and cyber threats to the Internet Crime Complaint Center or a local FBI Field Office.

Gunra ransomware has expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program, prompting the FBI, CISA and other agencies to issue a joint advisory warning organizations about the threat. The Gunra ransomware variant uses a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site if ransom demands are not met. The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from leaked Conti ransomware source code.

Gunra Ransomware Shifts to Affiliate Model

By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.

VPN Vulnerabilities Used for Initial Access

According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.

Data Theft Precedes Encryption

The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the .ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.

Agencies Urge Patching and Network Segmentation

The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.

The PNLD data breach has exposed contact information belonging to police officers, government partners, criminal justice professionals and customers after data from the Police National Legal Database (PNLD) was published on the dark web. The data breach at PNLD, identified on July 26, 2026, also affected some users of Ask the Police, raising concerns about targeted phishing attacks. 

PNLD Data Breach Exposes Police and Contact Details 

According to PNLD, the compromised data includes names, organizations and work email addresses of police officers, police staff, criminal justice professionals, government partners and customers. The incident also exposed the names and email addresses of some individuals who had previously submitted questions through Ask the Police. UK government guidance warns that such information could enable attackers to craft more convincing phishing emails targeting named officers and affected individuals.  In its official statement, PNLD said, "There is no evidence to suggest that passwords or other security credentials have been compromised." The organisation clarified that it provides legal information, products and services to UK police forces and criminal justice organisations. It also stressed that PNLD is not the Police National Computer or the Police National Database, is not a crime-recording system, and does not store confidential information relating to victims, witnesses or offenders. 

PNLD Notifies Authorities and Affected Users 

Following the PNLD data breach, the organization said it had contacted all affected organizations and provided additional guidance. Individuals impacted through Ask the Police have also received notification emails with further information PNLD confirmed that it has informed the Information Commissioner's Office (ICO) and is working with the National Crime Agency (NCA) and specialist cybersecurity organizations as the investigation continues.  Its statement noted: "We are continuing to investigate a data security incident affecting the Police National Legal Database (PNLD), which was identified on Sunday 26 July." It added that compromised information had been published on the dark web and reiterated that there is no evidence that passwords or other security credentials were accessed.  Regarding Ask the Police, PNLD said the platform was affected because it is hosted on the same infrastructure, resulting in the publication of some users' names and email addresses. 

Investigation Continues as Key Questions Remain 

As of August 3, 2026, PNLD had not disclosed how many people were affected by the data breach at PNLD, when the intrusion began, how long unauthorized access lasted or the total volume of data obtained. Its public breach notice lists the categories of exposed information but does not include a victim count.  PNLD's 2025-26 annual summary reported 108,429 police registrations and support for all 43 Home Office police forces. However, the organization emphasized that this figure represents its user base and should not be interpreted as the number of people affected by the breach.  The organization's 2023-24 annual summary stated that PNLD uses Microsoft Power Platform technology. On August 3, 2026, The Hacker News reported that the breach notification page referenced assets hosted on Microsoft's content.powerapps.com domain. While this supports the platform connection, it does not indicate how the attackers accessed or extracted the compromised data.