Behind many online trading scams sits a question most victims never think to ask: who built the website they trusted? On 3 November, authorities in seven countries moved against a company suspected of supplying exactly that. The action against an investment fraud scheme with potential victims in more than 50 countries led to the seizure of over 100 servers and the arrest of seven suspects. The operation was led by Germany's Itzehoe Public Prosecutor's Office, with support from Europol and Eurojust. Authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia took part. They searched 17 locations and seized servers, evidence and assets. The seven suspects were arrested with a view to extradition to Germany. Investigators estimate losses of more than EUR 4 million.

The Investment Fraud Supply Chain

The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel. Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.

How Victims Were Drawn In

The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks. It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions. The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.

Why Victims Kept Paying in This Investment Fraud

The method relied on making the scam look like it was working. Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums. The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.

How a Couple's Complaint Exposed the Network

The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform. A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month's operation. In total, the case took four years to reach the company allegedly behind the platforms.

The Role of Europol and Eurojust

Europol's European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol's databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention. Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust's headquarters in The Hague.

The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and other organizations. The seizure followed a court-authorized operation against Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. According to court records, the service offered hosting, server solutions and domain purchasing options while advertising its ability to protect customers from law enforcement intervention.

FBI Seizes Virtualine Over Alleged Cybercrime Activity

Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced the seizure of Virtualine.net. Authorities said the domain had been used to facilitate multiple forms of criminal activity, including advertising sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images involving adults and minors, and international money laundering.

Virtualine marketed its services on cybercrime forums, where it openly promoted hosting options for users engaged in illegal activities. In September 2024, the service told a user on Exploit.in that its infrastructure could be used for activities including phishing, carding, email spam and port scanning, while claiming to prohibit child sexual abuse material and terrorism-related content. However, court records allege that Virtualine knowingly hosted a criminal online forum, identified as Vendor 1, that allowed users to post and sell access to nude, sexually suggestive and sexually explicit images and videos involving minors and adults.

Hosting Provider Allegedly Ignored Repeated Abuse Reports

The investigation found that Virtualine continued hosting Vendor 1 despite receiving multiple notifications about sexually explicit images and videos of minors. According to court records, Virtualine assigned an IP address to Vendor 1 around December 2025, with notifications about the material beginning in January 2026. Reports came from law enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and an attorney representing a victim. Despite these notifications, Virtualine allegedly continued providing hosting services to the forum. The records also state that Virtualine worked directly with Vendor 1 to develop another website that allowed customers to upload illicit content and download it after making a purchase. Authorities said Virtualine continued hosting this website and had received at least one abuse complaint concerning sexually explicit images of children found on the platform. Vendor 1 also promoted a hack-for-hire service, through which customers could pay hackers to gain unauthorized access to victims’ online accounts and obtain explicit images and videos.

Virtualine Advertised Measures to Evade Law Enforcement

Beyond its hosting services, Virtualine allegedly offered customers additional protection designed to keep criminal infrastructure operational when authorities intervened. In March 2026, the provider advertised an “additional protection plan” that it said could be activated after receiving an official request from law enforcement agencies. Under the arrangement, Virtualine would move a customer’s criminal infrastructure to another shell company not affiliated with the provider, after which the server would be reactivated. The alleged practice illustrates how bulletproof hosting services can be used to maintain online criminal operations by moving infrastructure when enforcement or abuse complaints threaten existing arrangements. Virtualine also promoted its tolerance of abuse on underground forums. In a June 2025 post on HackForums, it claimed to have ignored more abuse reports than other providers.

Cryptocurrency Payments Linked to Money Laundering

Investigators also examined Virtualine’s payment arrangements and their alleged role in concealing criminal proceeds. According to court records, Virtualine accepted payments through Bitcoin, including specific unhosted Bitcoin addresses that allowed customers to make direct payments without their funds being flagged as illicit. The service received payments from criminal customers, some of which investigators could trace directly to various criminal groups. Virtualine then allegedly laundered the funds further to conceal their origin. Authorities identified international money laundering as one of the criminal activities facilitated through the service.

International Cooperation Behind Virtualine Takedown

The FBI’s Washington Field Office led the investigation, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the United Kingdom’s National Crime Agency. Private-sector partners OverRIPE and Lumen also assisted, while the Justice Department’s Office of International Affairs provided additional support. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz are representing the government in the matter. The seizure of Virtualine.net disrupts a hosting service that authorities allege provided infrastructure and financial services to support criminal activity. The case also highlights the role of international law enforcement cooperation in targeting providers accused of enabling cybercrime across multiple jurisdictions.

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.

OpenSSL has disclosed a high-severity vulnerability in its Datagram Transport Layer Security (DTLS) implementation. The flaw could let a remote peer read unintended plaintext heap memory during handshake data transmission, or cause a denial-of-service condition. Tracked as CVE-2026-84782, it stems from an out-of-bounds read in how DTLS handshake message retransmissions are handled.  According to the Security Advisory published on September 29, 2026, the bug affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2. 

How CVE-2026-84782 Breaks OpenSSL's DTLS Retransmission Logic 

DTLS is built for datagram-based transports, where packets can go missing, so it includes retransmission mechanisms to recover lost handshake packets. That recovery feature is where the problem lies.  The trouble starts when an application sends a DTLS handshake message in several fragments and the transport temporarily stops accepting data. OpenSSL may then return a WANT_WRITE status, pausing the handshake write partway through. While the write is suspended, a DTLS retransmission timer can expire and try to resend an earlier handshake message from the retransmission queue.  At that point, OpenSSL's retransmission code wrongly reuses the internal buffer and tracking state tied to the paused write. Instead of resetting its read position to the start of the queued message, it may begin at the offset the in-progress write had already reached.  As a result, a peer can receive a malformed or mislabeled DTLS handshake message containing leftover bytes from an unrelated, larger message still in transit. In some cases, the read extends past the intended buffer, exposing heap-resident data in plaintext. 

Memory Disclosure and Crash Risks 

The weakness is classified as CWE-125, an out-of-bounds read, and its main security impact is unintended disclosure of heap memory to the remote DTLS peer. What leaks depends on the process's memory contents and runtime conditions, and it could include fragments of previously allocated application or library data. The advisory, however, has not confirmed any reliable arbitrary-memory disclosure capability.  The bug can also crash a process if the retransmission logic reads from an unmapped memory region, creating a denial-of-service risk for applications that handle attacker-controlled DTLS traffic.  A related issue in the same retransmission path can corrupt the bookkeeping needed to resume the suspended handshake write. If a retransmission occurs while another write is still paused, later calls to SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() may run into inconsistent states, triggering an abort in debugging builds. 

OpenSSL Releases Fixes for the DTLS Vulnerability 

OpenSSL fixed the problem by resetting the retransmission read position before a message is resent. The patch also skips retransmissions while a handshake write is suspended, deferring them until the application resumes the pending operation. 

Affected branch	Fixed release
OpenSSL 4.0	4.0.3
OpenSSL 3.6	3.6.5
OpenSSL 3.5	3.5.9
OpenSSL 3.4	3.4.8
OpenSSL 3.0 Premium Support	3.0.23
OpenSSL 1.1.1 Premium Support	1.1.1zj
OpenSSL 1.0.2 Premium Support	1.0.2zs

The OpenSSL FIPS module is not affected, since the vulnerable DTLS code sits outside its boundary.  Organizations are advised to identify internet-facing services, VPNs, VoIP systems, IoT deployments, and custom applications that rely on DTLS, and to promptly upgrade their bundled or system-provided OpenSSL packages.  Laurent Gaffie of SecuRizon reported CVE-2026-84782 on August 17, 2026, and Ryan Hooper developed the fix. 

The FBI is warning the public about sexual exploitation actors illegally accessing social media and personal accounts to steal explicit images and videos from adult and underage victims. The stolen material, also known as non-consensual intimate images (NCII), is being posted or sold on criminal marketplaces, often without the victim's knowledge.

According to the FBI, these actors use social engineering and cyber intrusion tactics to target specific individuals or general targets of opportunity. After gaining access to accounts, they steal explicit content and share it through community forums or illicit marketplaces.

The FBI said personally identifiable information, including a victim's name, date of birth, email address, phone number and social media username, is often posted alongside the stolen material. This can expose victims to continued harassment and re-victimization.

How Sexual Exploitation Actors Access Accounts

The FBI has identified several methods used by sexual exploitation actors to gain access to victims' accounts.

Password and PIN Targeting

In password/PIN targeting, actors use high-volume password and PIN attempts against social media and personal accounts. The information used in these attempts can come from data leak sites, social media and open-source information.

When victims are known to the actors, curated lists may include personal details such as names, date of birth or variations of those details.

Social Media Customer Service Impersonation

Another tactic involves social media customer service impersonation through text messages. Victims may receive messages claiming their account is being disabled or locked unless they provide a verification code.

The actor then requests a password reset, causing a code to be sent to the victim. If the victim shares the code, the actor can reset the password and access the account.

Phishing Emails

The FBI also warns about phishing campaigns using look-alike domains and email accounts designed to appear as social media customer support.

These messages may claim there has been a new login and contain an embedded link asking the victim to change their password. Clicking the malicious link can give the actor access to the account.

Stolen Content Can Lead to Further Attacks

Once explicit content is stolen, sexual exploitation actors may post or sell it while including personal information about the victim. The FBI said victims can subsequently face harassment, sextortion, stalking or other targeted attacks.

The actors may also advertise stolen content through a victim's own social media page, increasing the potential for further exposure.

FBI Shares Steps to Protect Accounts

The FBI advises people to avoid storing sensitive images or videos on social media platforms or other internet-accessible sites.

It recommends using unique, complex passphrases and PINs along with multi-factor authentication (MFA). Password information directly associated with a person's identity, including names or birthdays, should be avoided.

Users should also be cautious with links received through emails and text messages. The FBI recommends going directly to the relevant website to address account concerns and checking URLs before clicking.

Unrequested temporary passwords, PIN resets or access codes should also be treated with caution. The FBI advises users not to share login information, even when someone claims to represent a platform or service.

People who believe their explicit content was stolen or leaked can provide information through the FBI's NCII reporting site. The FBI also advises the public to continue reporting fraud, scams and cyber threats to the Internet Crime Complaint Center or a local FBI Field Office.

Gunra ransomware has expanded its operations through a structured ransomware-as-a-service (RaaS) affiliate program, prompting the FBI, CISA and other agencies to issue a joint advisory warning organizations about the threat. The Gunra ransomware variant uses a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site if ransom demands are not met. The FBI first observed Gunra in April 2025 as a double-extortion ransomware variant derived from leaked Conti ransomware source code.

Gunra Ransomware Shifts to Affiliate Model

By early 2026, the group had expanded through a formal ransomware-as-a-service affiliate program advertised on dark web forums. The program provides affiliates with a management panel, configurable ransomware builder, cross-platform locker payloads and affiliate documentation. The FBI also observed Gunra operating under new branding aliases, including Golden Community, while recruiting penetration testers and ethical hackers as initial access brokers. Gunra initially focused on Windows environments before introducing a Linux variant and moving toward broader cross-platform targeting. Victims observed on the group’s dedicated leak site include organizations across the Americas, Europe, the Middle East, Africa and the Asia-Pacific. Targeted sectors include healthcare and public health, financial services and insurance, critical manufacturing, transportation, government services, utilities, academia, media and communications, retail, and professional and nonprofit services.

VPN Vulnerabilities Used for Initial Access

According to the advisory, Gunra actors primarily gained initial access by exploiting known vulnerabilities in internet-facing devices, including firewall and VPN gateways. The FBI observed exploitation of CVE-2024-55591 and CVE-2025-24472, authentication bypass vulnerabilities affecting specific FortiOS and FortiProxy versions. The Republic of Korea’s National Police Agency also observed Gunra actors exploiting credential exposure and SSH access control weaknesses in internet-facing VPN gateways to obtain unauthorized remote access. After gaining access, attackers used tools including Impacket utilities to move laterally through victim networks using SMB. In one case, actors compromised an SSL-VPN appliance using default credentials where account lockout controls were absent. They later used stolen session information to access internal virtual desktop infrastructure and move through systems including Active Directory servers and IT personnel workstations.

Data Theft Precedes Encryption

The double-extortion ransomware operation involves stealing sensitive information before encrypting systems. The FBI observed Gunra actors collecting business-critical documents, databases, personally identifiable information, and internal email communications. In at least one case, the actors used a malicious executable called main.exe to exfiltrate data from Microsoft OneDrive and SharePoint. Compressed archives containing sensitive information were also transferred to the Mega file-sharing service, with the volume of exfiltrated data reaching tens of terabytes. For encryption, Gunra uses ChaCha20 and RSA-4096 algorithms and has been observed using the .ENCRT extension for encrypted files. A documented sample from July 2025 used the .CRYPT extension. The ransomware also uses Windows Management Instrumentation to delete volume shadow copies before encryption, while one victim had backup and archived data deleted from both primary and disaster recovery infrastructure.

Agencies Urge Patching and Network Segmentation

The authoring agencies recommend that organizations prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure. They also advise implementing and testing offline, immutable backups stored in physically separate and segmented locations. Network segmentation is another key recommendation, intended to restrict lateral movement and limit the spread of ransomware between systems. The agencies also recommend reviewing domain controllers, servers, workstations and Active Directory environments for unrecognized accounts, auditing administrative privileges, requiring MFA where possible and testing security controls against the Gunra techniques mapped to the MITRE ATT&CK framework. The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.