What HappenedIn mid-2026, an emerging cybercriminal group known as ExfilSquad launched a high-profile extortion campaign targeting prominent UK organisations across the public sector, education, and law enforcement, as well as other firms worldwide.Unlike traditional ransomware groups, ExfilSquad does not deploy encryptors or destructive malware. Instead, they operate as a pure data extortion group, stealing data and threatening to publish it on their onion-based Data Leak Site (DLS) if a ransom
In mid-2026, an emerging cybercriminal group known as ExfilSquad launched a high-profile extortion campaign targeting prominent UK organisations across the public sector, education, and law enforcement, as well as other firms worldwide.
Unlike traditional ransomware groups, ExfilSquad does not deploy encryptors or destructive malware. Instead, they operate as a pure data extortion group, stealing data and threatening to publish it on their onion-based Data Leak Site (DLS) if a ransom is not paid.
Several prominent UK entities have confirmed breaches linked to the group:
UK Department for Education (DfE): Approximately 600,000 records stolen from its Help Portal containing parent and staff contact details (names, emails, phone numbers, job titles), plus around 7,000 records from the Turing Portal.
Police National Legal Database (PNLD): Stole 1.9 GB of data (around 135,000 records) containing contact information for over 100,000 serving police officers, staff, and criminal justice professionals, alongside around 21,000 "Ask the Police" public inquiry records.
Newcastle University: Approximately 440,000 records compromised containing applicant and student contact information, personally identifiable information (PII), and admissions database records caused by a technical configuration flaw connecting to an admissions system.
Analysis of the details left on the data leak site revealed that ExfilSquad's primary attack vector involves exploiting misconfigurations in cloud portals, customer relationship management (CRM) platforms, internal case management systems, as well as Microsoft Power Pages data tables left publicly accessible without proper authentication.
To force compliance and prove their claims are real, ExfilSquad uploaded multi-gigabyte torrent files for each victim to their TOR leak site. Resecurity noted that ExfilSquad assigns a distinct Torrent Tracker and initial Web Seed per victim.
Analyst Comment
While ExfilSquad is a new group, they appear to be already experienced at running these types of attacks, suggesting they have a history of cybercrime. Plus, ExfilSquad’s recent campaign highlights the growing trend of transitioning from file-encrypting ransomware to extortion driven entirely by cloud and SaaS misconfigurations. Organisations that have invested in defending against endpoint-based threats are often leaving critical business application interfaces exposed.
SaaS platforms continue to be primary targets of English-speaking cybercrime communities. In recent years, customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have all been extorted. Microsoft Power Pages portals, CRM databases, and customer support helpdesks frequently hold vast repositories of sensitive contact data and interaction histories. When internet-facing API endpoints or data table permissions are left unauthenticated or unpatched, cybercriminals can systematically scrape massive volumes of data without ever needing to drop a payload or escalate privileges internally.
ExfilSquad’s reliance on torrent distribution further amplifies reputational and operational damage. While gangs like LockBit, Clop, and Akira have previously utilised torrents, ExfilSquad’s operational twist of assigning unique Torrent Trackers and dedicated Web Seeds to individual victims ensures that leaked files distribute rapidly across P2P networks, making it extremely difficult to perform a takedown.
While ExfilSquad’s breaches have largely compromised contact directories and administrative support records, the real-world risks remain significant. Exposing work emails, names, and organisational structures for over 100,000 police officers and civil servants poses distinct social engineering, spear-phishing, and physical security concerns that impacted institutions will have to manage long after the breach occurs.
Defensive Takeaways
Audit Microsoft Power Pages and Public SaaS Tables: Regularly review public data table permissions, web API settings, and unauthenticated browser views across Microsoft Power Pages, CRMs, and customer support portals to ensure backend data tables are not exposed to the public internet.
Harden CRM and Case Management Integrations: Treat external-facing admissions portals, helpdesks, and case management systems as high-risk platforms. Implement strict access controls, conduct routine configuration audits, and enforce proper API token security.
Deploy External Attack Surface Management (EASM): Utilise continuous external attack surface scanning to detect newly exposed web endpoints, misconfigured database connectors, and publicly exposed storage buckets before malicious actors locate them.
Incorporate Pure Extortion into Incident Response Plans: Security teams must adapt incident response playbooks for data-theft-only scenarios. Organisations may seek to establish protocols for monitoring peer-to-peer (P2P) networks and managing public disclosures when stolen data is distributed via torrents.
What HappenedOn 7 August 2026, the UK Information Commissioner's Office (ICO) disclosed that between July 2021 and June 2023, the ACRO Criminal Records Office suffered three separate compromises involving its customer portal website (acro.police.uk).ACRO is a national police unit providing public services such as issuing Police Certificates, International Child Protection Certificates, and processing Subject Access Requests.In March 2023, ACRO was notified about an SQL injection attack that repo
On 7 August 2026, the UK Information Commissioner's Office (ICO) disclosed that between July 2021 and June 2023, the ACRO Criminal Records Office suffered three separate compromises involving its customer portal website (acro.police.uk).
ACRO is a national police unit providing public services such as issuing Police Certificates, International Child Protection Certificates, and processing Subject Access Requests.
In March 2023, ACRO was notified about an SQL injection attack that reportedly exposed 15 sets of credentials, the majority of which belonged to its employees.
A subsequent forensic investigation uncovered long-term threat actor activity within the website's environment, spanning from 9 July 2021 to 22 June 2023.
The website was built on the Kentico CMS and was running version 12.0.0 between September 2019 and March 2023. This version had multiple known vulnerabilities at the time of the incident, but suffered from ambiguity around who was accountable for patching led to missed hotfixes and updates.
Between 15 and 16 February 2023, an unknown threat actor staged personal data for exfiltration, which included Police Certificate Applications, Subject Access Request (SAR) forms, and International Child Protection Certificate forms.
Due to insufficient log retention, ACRO could not definitively determine if the data was successfully exfiltrated. A maximum of 10,920 data subjects had their data staged, but ACRO ultimately notified 84,048 data subjects on a precautionary basis in April 2023.
Notably, on 23 February 2023, the ICO learned that ACRO's Trend Micro antivirus software detected and quarantined four attempts to install the well-known credential harvesting tool Mimikatz. However, because ACRO operated without a documented patching policy and lacked a structured process for analyzing security alerts, these warnings were never reviewed or acted upon.
Analyst Comment
The Information Commissioner's Office (ICO) reprimand against the ACRO underscores the persistent issue within many organisations of a breakdown in basic IT governance and accountability. The fact that a threat actor was able to operate within the environment for nearly two years highlights systemic failures in both vulnerability management and security monitoring. Running an outdated content management system with known vulnerabilities for several years is a critical oversight. The ambiguity surrounding patching responsibilities created a dangerous blind spot that adversaries successfully exploited.
Further, the failure to act on critical security alerts is also a classic breakdown in the incident response chain. While the deployed Trend Micro antivirus successfully detected and quarantined a known threat, the alerts were ultimately ignored. Security tools are only as effective as the teams monitoring and responding to them. Without a structured review process, even the most sophisticated detection capabilities fall flat.
It is important to note, however, that while private sector organisations will receive a hefty fine for data protection offences, public sector organisations like ACRO receive a public reprimand from the ICO rather than receive a fine that confiscates public funds.
At the time of writing, the data has not yet appeared on any cybercrime forums or underground chat channels. The use of an open source tool like Mimikatz combined with SQL injection attacks indicates a likely opportunistic adversary rather than a stealthy cyber-espionage operation. However, both cybercriminal and nation state groups are known for opportunistic attacks. Current attribution for who or what was responsible this breach remains uncertain from an open source intelligence (OSINT) perspective.
On a positive note, the ICO highlighted that ACRO’s network segmentation effectively prevented the threat actor from pivoting from the compromised web environment into core policing systems. This containment significantly reduced the scale of harm and demonstrates the immense value of architectural defense-in-depth strategies. Following the breach, ACRO has migrated its portal to the Salesforce Experience Cloud for automated patching and hotfixes and implemented a Security Information and Event Management (SIEM) system to improve visibility.
Defensive Takeaways
Establish Clear Accountability for Patching: Organisations must have a documented patching policy with clearly defined ownership, especially for public-facing web applications and Content Management Systems (CMS). Ambiguity in IT governance directly leads to unpatched vulnerabilities which then get exploited.
Implement Structured Alert Monitoring: Deploying antivirus or Endpoint Detection and Response (EDR) solutions alone is insufficient if alerts are not actively monitored and investigated. It is recommended to establish either structured internal processes or an outsourced 24/7 Managed Detection and Response (MDR) or SOC service to review and respond to critical security alerts promptly.
Maintain Robust Network Segmentation: Ensure that public-facing web infrastructure is strictly segmented from internal corporate networks and core operational systems. As demonstrated in this incident, strict segmentation is a crucial control for stopping an attacker's lateral movement.
Ensure Adequate Log Retention: Insufficient logging severely hinders incident response and forensic investigations. Implement comprehensive logging policies and utilise a SIEM to aggregate logs, ensuring they are retained long enough to accurately determine the scope of data exfiltration during a compromise.
Iran-linked hackers shut down a UK power plant for four days in the first confirmed attack of its kind, concurrent with water infrastructure attacks across 12 US states.
Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure.
“Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published b
Iran-linked hackers shut down a UK power plant for four days in the first confirmed attack of its kind, concurrent with water infrastructure attacks across 12 US states.
Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure.
“Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published by The Telegraph. “It is thought to be the first time that hackers affiliated to the Iranian regime have succeeded in closing down such a facility in the UK, and is believed to be the most successful cyber attack of its kind.”
British officials did not name the power plant because of security concerns. Staff worked for four days to restore it, but the plant was small and the outage did not affect the UK’s wider power supply. Still, the government warned power companies and businesses about the incident and provided guidance on how to respond.
The attack was reported to the National Cyber Security Centre (NCSC), part of GCHQ, which helps protect the UK’s critical infrastructure. The NCSC did not comment on the specific incident.
The US water infrastructure attacks hit dozens of wastewater treatment plants across 12 states, causing flooding and loss of pressure from taps. Authorities in affected areas told customers to boil water. The first reports came from Minnesota on July 26, followed by similar breaches in Michigan, Georgia, South Dakota, and New Jersey. The FBI attributed those incidents to “malicious cyber actors”; US government sources later confirmed the threat most likely originated in Tehran.
The UK attack is not thought to have been designed to harm civilians. The more probable intent was to demonstrate that hackers linked to Iran’s Islamic Revolutionary Guard Corps could gain access to UK infrastructure and shut it down at will. A four-day outage at a small generator that nobody outside the industry noticed is, from that perspective, a successful proof of concept.
Iran has accelerated its cyberattacks on Western countries since the US and Israel began air strikes in February. Suspected Iranian operations have been reported in Germany, Poland, Finland, Belgium, and Albania, with Israel and other Middle Eastern countries remaining the most frequent targets. In March, the NCSC advised British organisations to review their security posture in light of the wider conflict. NCSC chief executive Richard Horne said in June that the agency had handled more than 200 attacks on critical national infrastructure in the previous year alone.
The timing is awkward for the intelligence and security committee, which oversees UK spying agencies.
“Experts have long warned that the UK is unprepared for the scale of the threat of malicious cyber attacks from foreign adversaries, and the intelligence and security committee, which oversees spying agencies, reported last year that the chance of an Iranian cyber attack on British infrastructure was “unlikely”.” continues the report.
A Cabinet Office risk assessment published last month placed the probability of a serious and successful cyberattack on domestic infrastructure at between five and twenty-five percent. The same document warned that AI is making attacks faster and cheaper to run, and is lowering the technical bar for anyone wanting to attempt them.
The government’s public response leaned hard on the size of the target. A government source told The Telegraph: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near. It’s a very small-scale site, less than a rounding error compared to grid capacity.”
A government spokesman said the UK has a strong and resilient energy system and that the incident never threatened the wider power network. While both statements are technically true, they do not answer a key question: should it be considered acceptable for even a small power plant to remain offline for four days?
What HappenedNew data published by the City of London Police in June 2026 reveals that courier fraud losses exceeded £21 million in 2025, with individuals aged over 70 being heavily targeted. The highest concentration of these offenses was recorded in London and the Home Counties.Cybercriminals and fraud syndicates are actively evolving their operational tactics, increasingly pivoting to messaging platforms like WhatsApp to contact their victims and remotely paying for third-party courier servic
New data published by the City of London Police in June 2026 reveals that courier fraud losses exceeded £21 million in 2025, with individuals aged over 70 being heavily targeted. The highest concentration of these offenses was recorded in London and the Home Counties.
Cybercriminals and fraud syndicates are actively evolving their operational tactics, increasingly pivoting to messaging platforms like WhatsApp to contact their victims and remotely paying for third-party courier services to facilitate physical collections.
UK law enforcement also highlighted a dangerous shift in 2025 toward high-value physical goods. Victims are being systematically manipulated into visiting multiple jewellers over an extended period to purchase gold and expensive jewellery, which they then hand directly to fraud couriers.
Recent operational crackdowns by UK Regional Organised Crime Units (ROCUs) showcase the nationwide scale of these networks:
North West ROCU Operations (July 2026): Police executed coordinated search warrants in Huddersfield and Manchester, arresting two men (aged 21 and 25) on suspicion of Conspiracy to Defraud and Money Laundering. In this specific series, the suspects impersonated bank fraud departments, convinced a victim her card was compromised, sent a courier to collect it, and immediately exploit the physical card to make numerous fraudulent transactions.
North East ROCU (NEROCU) Sentencing (June 2026): A complex, cross-country courier fraud operation spanning March to May 2022 concluded with a prison sentence for a primary operative. The network targeted 14 separate victims, convincing them to hand over physical bank cards and PIN numbers under the guise of an internal "investigation" by their bank's fraud department. The group scammed a total of £56,000, which was then rapidly laundered through the high street purchase of smartphones, designer clothing, and luxury jewellery.
Analyst Comment
Courier fraud is effectively a hybrid cyber-physical social engineering campaign. While the final phase relies on a physical courier arriving at a victim’s doorstep, the initial approach relies heavily on psychological manipulation and email, message, or phone call-based deception.
This type of fraud is notable as it follows a structured cybercriminal playbook that bypasses detection systems and takes advantage of the vulnerable in society. The victim is instructed to bypass normal banking security controls by withdrawing cash, disclosing sensitive credentials (like PINs), or purchasing high-value physical commodities like gold or luxury jewellery. This makes it difficult to proactively detect and prevent.
The other concerning factor is the couriers themselves. According to reports, they can be an unwitting third-party courier service that is paid to go to the victim's home to collect the assets. Online services enable cybercriminals to organise these pickups remotely, lowering their risk of being caught.
The £21 million sizeable loss metric from 2025 shows how profitable this low-tech, high manipulation vector remains. The recent shift to targeting gold and luxury jewellery is a deliberate evasion tactic against traditional anti-money laundering (AML) and banking fraud detection algorithms. While banks have grown adept at flagging unusual rapid bank transfers, they cannot easily stop an account holder from physically withdrawing funds or using a card over several days at different brick-and-mortar luxury retailers. This tactic serves as a highly liquid physical laundering pipeline for these syndicates that remains a challenge to prevent.
Defensive Takeaways
Implement Bank Transfer and Purchase Outlier Alerts: Financial institutions can focus on further behavioural monitoring for elderly demographics, looking specifically for sudden, consecutive high-value transactions at physical luxury retail or jewellery establishments and flag patterns on unusual activity for review.
Public Awareness on Cross-Media Scams: Security awareness campaigns must make it clear that legitimate institutions, specifically the Police and Banking Fraud teams, will never send a courier to a residential address to collect cash, PIN numbers, bank cards, or purchased items.
Vetting of Courier Logistics: Commercial courier services are increasingly being abused as infrastructure by these threat groups. Logistics firms must implement logging and analysis systems to detect unusual residential pickups booked via suspicious accounts and forged identities.
Note The July 2026 Dark Web Breach Incident Trend Report was compiled based on data breach cases posted on deep web and dark web forums. Due to the nature of some posts, it is difficult to fully verify their accuracy; some posts related to South Korea included AI-generated false data or cases where it could […]
Note The July 2026 Dark Web Breach Incident Trend Report was compiled based on data breach cases posted on deep web and dark web forums. Due to the nature of some posts, it is difficult to fully verify their accuracy; some posts related to South Korea included AI-generated false data or cases where it could […]
UK researchers reported 19 unsanctioned actions by Anthropic and OpenAI agents during permissive cyber tests involving real external systems.
The post UK AI tests found 19 unauthorized agent actions involving Anthropic and OpenAI models appeared first on TechRepublic.
What HappenedThroughout H1 2026, the Qilin ransomware-as-a-service (RaaS) Tor data leak site (DLS) listed the most UK-based victims out of all ransomware gangs, with up to 37 British organisations hit in total. Qilin's victim count is followed by DragonForce with 21 victims listed, and TheGentlemen with 18 listed.The fallout from the Qilin attack on the UK National Health Service (NHS) supplier, Synnovis, in 2024 persists as well. On 1 June 2026, the Bedfordshire Hospitals NHS Foundation Trust
Throughout H1 2026, the Qilin ransomware-as-a-service (RaaS) Tor data leak site (DLS) listed the most UK-based victims out of all ransomware gangs, with up to 37 British organisations hit in total. Qilin's victim count is followed by DragonForce with 21 victims listed, and TheGentlemen with 18 listed.
The fallout from the Qilin attack on the UK National Health Service (NHS) supplier, Synnovis, in 2024 persists as well. On 1 June 2026, the Bedfordshire Hospitals NHS Foundation Trustdisclosed that over 32,000 patient data records related to Synnovis tests were exfiltrated and took over a year to analyse what information was related to which patient. The breached data includes patient name and number, date of birth, postcode, and test results.
In H1 2026, Qilin averaged between seven and nine published UK victims per month. For the entries listing an estimated attack date, there was a roughly six-week extortion lifecycle on average, from initial intrusion to the date the victim is publicly named.
This UK footprint highlights their aggressive pursuit of Small-to-Medium Enterprises (SMEs) as most organisations had a revenue between £10m and £250m.
Interestingly, one of the Qilin victims, Salford City College, also appeared on both the Qilin and DragonForce Tor data leak site (DLS) only a few days apart from 6 March to 10 March 2026, respectively.
Qilin’s UK-based victims from H1 2026 spanned a diverse range of sectors:
Construction & Property Development
Manufacturing & Engineering
Legal & Professional Services
Technology & IT Infrastructure
Education
Healthcare
Analyst Comment
Many of the organisations targeted by Qilin operators are just large enough to have the funds to pay mid-tier ransoms but often never got around to making an investment into a 24/7 dedicated threat detection service, such as an outsourced Security Operations Centre (SOC). Such services are usually enough protection to prevent an attack. If a ransomware affiliate faces tough resistance from a target, they often move on to a weaker and easier one.
One key face to also note about Tor data leak sites operated by ransomware groups is that they include victims who failed to pay the ransom. The total number of victims by each group is often going to be higher.
The reason for the cross-posting of Salford City College is unknown for now. However, it could indicate that an affiliate may be using both Qilin and DragonForce RaaS platforms. An alternative theory could be that the college was hit by two affiliates of each RaaS. Interestingly, cross-posting on multiple leak sites is not as uncommon as it seems. Some victims listed on the Qilin leak site have historically appeared on the leak sites of ALPHV/BlackCat and Conti as well.
The Ransomware Vulnerability Matrix Group Profile for Qilin reveals a diverse set of exploits leveraged by its operators. Like many other ransomware gangs, Qilin operators have exploited corporate VPN gateways such as Fortinet, Check Point, and WatchGuard for initial access. Interestingly, the exploitation of SmarterTools SmarterMail and SolarWinds Web Help Desk is less common but are also exploited by the Warlock ransomware gang. Another common theme from Qilin's Ransomware Tool Matrix Group Profile is their regular abuse of Bring Your Own Vulnerable Driver (BYOVD) tactics to bypass Endpoint Detection and Response (EDR) and Antivirus software.
Defensive Takeaways
Harden Common Attack Paths: Treat any web-facing helpdesk or mail server as a high-risk device. If it does not absolutely require open internet access, place it behind a zero-trust network access gateway or a strict VPN. Enforce strict phishing-resistant Multi-Factor Authentication (MFA) on all remote access points. Ensure processes are in place for rapid patching and integrity checks for all corporate VPN gateways.
Overcoming SME Resource Caps: Organisations must bridge the gap with an outsourced MDR service. Ransomware execution routinely happens at 2:00 AM on Fridays and weekends. Outdated antivirus agents alone are not enough to stop a motivated human adversary.
Utilise Free Support Services:Capitalise on sovereign and community-vetted threat intelligence feeds to block attacker infrastructure early. UK defenders should actively enroll in the National Cyber Security Centre’s MyNCSC portal and integrate community resources like the Spamhaus DROP list and Abuse.ch tracking into their perimeter firewalls to automatically block known ransomware command-and-control (C2) nodes. ShadowServer and Team Cymru also offer useful free community resources.
What HappenedOn 9 June 2026, the University of Nottingham was listed as a victim on the ShinyHunters Tor data leak site.The attackers leaked over 40GB of billing and payment records, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses.The data stolen includes contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data.
On 9 June 2026, the University of Nottingham was listed as a victim on the ShinyHunters Tor data leak site.
The attackers leaked over 40GB of billing and payment records, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses.
The data stolen includes contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data.
Further analysis of the leaked data by Have I Been Pwned revealed it also contained over 455,000 unique email addresses along with extensive personal information including ethnicities, disabilities, and passport numbers.
On 10 June 2026, security researcher @nahamike01 uncovered an exposed server belonging to ShinyHunters and found them targeting Oracle PeopleSoft servers using MeshCentral agents. Plus, analysis the bash_history logs on the server uncovered SSH connections to the IP address hosting the ShinyHunters Tor data leak site.
On 11 June 2026, Mandiant and Google Threat Intelligence Group (GTIG) disclosed they have observed active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure via a zero-day now tracked as CVE-2026-35273, a critical remote code execution (RCE) vulnerability (CVSS 9.8).
Analyst Comment ShinyHunters is a prolific feature of current threat landscape. This adversary appears to have a particular focus on the educational sector. Last month in May 2026, ShinyHunters targeted another provider of educational software: Instructure Canvas. A number of other UK universities were also impacted by the Instructure breach.
The education sector in the US and UK has suffered repeated, significant data breaches in recent years. In January 2025, BleepingComputer reported that PowerSchools, a cloud-based software provider, suffered a breach whereby the data of 62.4 million students and 9.5 million teachers was exfiltrated. Also in June 2026, the University of Oxford also disclosed a data breach impacting its CareerConnect platform. Separately, 13 schools in Powys county in Wales were impacted by a data breach in April 2026.
After the Oracle E-Business Suite zero-day campaign by CLOP in October 2025, this campaign by ShinyHunters against Oracle PeopleSoft is yet another blow for Oracle. Google identified over 100 exposed organisations, and noted that 68% are academic institutions, including universities and colleges worldwide. More are likely to have been victimised by ShinyHunters and listed on their Tor data leak site in the coming weeks.
Defensive Takeaways
Patch Oracle PeopleSoft: Internet-facing applications, such as file transfer servers or cloud-based software need to be prioritised for patches and updates. Checking the integrity of such systems while patching is also key to finding undetected compromises. Proactively ingesting event logs and threat hunting for suspicious activities involving these systems is also key to prevent breaches.
Prioritise Education Software Security: Education sector firms or cybersecurity companies with education sector clients must react to the elevated threat, by pen-testing, threat hunting, and threat intelligence sharing. Cybercriminal adversaries like ShinyHunters often exploit internet-facing applications or use stolen credentials for initial access. It is therefore critical to focus on these tactics, techniques, and procedures (TTPs) to prevent their attacks.
Follow the Data Breach Alert Playbook: Impacted victims must begin to rotate credentials, and start the laborious task of requesting new identity documents and codes like national insurance numbers or passports. It is also worth investing in some credit monitoring services as well to prevent loans being taken out in your name.
Apple lost a bid to narrow a UK iCloud lawsuit from Which?, keeping a £3 billion competition claim on track for an October 2028 trial.
The post Apple’s £3B iCloud Lawsuit Could Affect 40M UK Users appeared first on TechRepublic.
Ransomware Preparedness must become a strategic priority for organizations as cyberattacks grow more disruptive and difficult to contain, according to Richard Horne, CEO of the UK's NCSC (National Cyber Security Centre).
Speaking during the FBI's Ahead of the Threat podcast, Horne urged business leaders to assess whether their organizations could continue operating if critical IT systems were unavailable for four weeks. His remarks come amid growing concerns over ransomware, AI-driven cyber t
Ransomware Preparedness must become a strategic priority for organizations as cyberattacks grow more disruptive and difficult to contain, according to Richard Horne, CEO of the UK's NCSC (National Cyber Security Centre).
Speaking during the FBI's Ahead of the Threat podcast, Horne urged business leaders to assess whether their organizations could continue operating if critical IT systems were unavailable for four weeks. His remarks come amid growing concerns over ransomware, AI-driven cyber threats, and the increasing speed at which attackers exploit known vulnerabilities.
Ransomware Preparedness Requires Planning Beyond Paying a Ransom
A key message from Horne was that organizations should not view ransom payments as a recovery strategy. Instead, effective Ransomware Preparedness depends on resilience, tested recovery plans, and executive support.
According to Horne, ransomware attacks typically involve two forms of extortion. Attackers steal sensitive data and threaten to publish it, while also encrypting systems and demanding payment for decryption keys. He noted that paying criminals does not guarantee data will be deleted or systems fully restored.
Referencing lessons learned from Operation Cronos, the international law enforcement operation that disrupted the LockBit ransomware group, Horne said investigators found instances where victim data remained on criminal infrastructure even after ransom payments had been made.
NCSC Warns Organizations About the Coming Patch Wave
The discussion also highlighted concerns about a growing Patch Wave, a term used by the NCSC to describe the anticipated surge in vulnerability disclosures and exploitation attempts fueled by artificial intelligence.
FBI Cyber Division Assistant Director Brett Leatherman pointed to recent industry findings showing that attackers are exploiting known vulnerabilities faster than defenders can remediate them. Internet-facing devices and VPNs have become increasingly attractive targets, while the window between disclosure and exploitation continues to shrink.
Horne stressed that organizations need long-term planning rather than short-term reactions. He encouraged businesses to develop multi-year cybersecurity roadmaps and ensure security investments remain a priority across budget cycles.
CyberUK Discussions Focused on Executive Accountability
Reflecting on discussions held during CyberUK, the UK's flagship cybersecurity conference hosted by the NCSC, Horne emphasized that cybersecurity cannot remain solely the responsibility of technical teams.
He noted that many Chief Information Security Officers face challenges securing organizational support despite having visibility into technology risks. According to Horne, leadership teams must actively participate in managing cyber risk rather than treating it as an isolated IT issue.
The conversation also addressed burnout among cybersecurity professionals, with both Horne and FBI officials acknowledging the operational strain placed on defenders during major incidents, including ransomware attacks and large-scale vulnerability disclosures.
Public-Private Cooperation Remains Critical
Beyond technical defenses, Horne highlighted the importance of collaboration between governments, law enforcement agencies, and the private sector.
He said threat intelligence sharing creates a continuous cycle in which organizations identify threats, share findings, improve defenses, and generate new intelligence that benefits the wider cybersecurity community. Horne also pointed to growing opportunities to use artificial intelligence to accelerate threat detection and response efforts.
As ransomware groups continue targeting businesses worldwide, the message from both the FBI and the NCSC was clear: organizations must invest in Ransomware Preparedness, strengthen resilience plans, and prepare for a future where cyber incidents are not a possibility but an expectation.
What Happened:On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec. On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project w
On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec.
On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.
Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project with production payment gateway credentials, and the source code of ArupCompute and Oasys.
The FulcrumSec operators also claimed to have spent over half a year analysing the data and went through “email correspondence” with the company before publishing the stolen data.
On the victim post, FulcrumSec wrote a detailed incident breakdown. In it, they stated they gained initial access in September 2025 via a GitHub personal access token found hardcoded in a JavaScript file on a forgotten subdomain, which provided access to over 10,000 private GitHub repositories belonging to Arup Group.
From there, they scanned the repositories and found additional hardcoded tokens, API keys, and passwords for AWS, Azure, and databases.
The adversary stated that Arup detected the Github and Azure Storage intrusions approximately six weeks after they happened and rotated the credentials, but it was too late as the data had been exfiltrated.
FulcrumSec also stated they pivoted into the AWS infrastructure using keys they had found belonging to Arup’s subsidiary Neuron.
FulcrumSec allegedly waited until April 2026 to contact their victim, Arup Group, due to the time it took to analyse the vast amounts of stolen data.
Impacted client organisations of Arup Group were also mentioned in the post, such as Disney and several other Hong Kong companies. The adversary reportedly uncovered Amazon data center seismic fragility data, British Petroleum (BP) site selection coordinates, and Queensferry Crossing internal documents as well.
Critically for the UK, the breached data exposed up to 62 HS2 related GitHub repositories. This involved Euston Station pile design files, ground movement assessments, over 14,000 sensor monitoring records, 48 archaeological site GPS coordinates (including Jones Hill Wood, a sensitive site for environmentalists), as well as confidential documents.
Analyst Comment:
Arup Group is a large multinational architectural design and engineering firm based in London who has been involved in constructing the Wembley Football Stadium in London, the HS1 Channel Tunnel Rail Link network, and the Eden Project in Cornwall, among other significant international construction projects.
Active since September 2025, FulcrumSec is a financially motivated data-theft-extortion group that specialises in rapid exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions.
This attack was noteworthy due to its highly targeted nature. FulcrumSec claimed they had access to Arup Group’s data for seven months and they clearly invested significant time to analyse the documents and spent weeks negotiating over email. Plus, to find initial access they also would have had to spend time checking Arup’s domains and Internet-facing assets to eventually find a single leaked credential to exploit. These types of targeted intrusions often only happen to large companies. This is because for it to be worth the cybercriminal’s time, effort, and risk to their freedom they will want a large ransom payment that only rich companies can typically afford.
FulcrumSec is an adversary worth monitoring due to the effort they put into their intrusions compared to other smash-and-grab ransomware campaigns. In October 2025, in a case documented by VX-Underground, FulcrumSec emailed detailed information about the breach they conducted with the aim of those details getting published and exert additional pressure on the victim.
Interestingly, FulcrumSec said the ransom they demanded was less than 1% of Arup’s annual revenue and was less than how much Arup lost to the deepfake fraudsters. This is a reference to Arup reportedly lost over £20 million pounds in 2024 after one of their Hong Kong employees was duped into sending cash to cybercriminals using an AI-generated video call. The fact Arup became publicly known for falling victim to a large scam potentially contributed to the adversary’s decision to select and focus them for this attack.
Defensive Takeaways:
Asset Inventory and Shadow IT Audits: Identifying the outdated unused domains with hardcoded credentials is standard best practices. All organisations must have processes in place to catalog and retire systems to avoid incidents like this.
Hardcoded Credentials in Code: They way FulcrumSec gained access demonstrates the importance of using secret environment variables and features like GitHub Secret Scanning.
Implement Incident Response Procedures: Importantly, Arup detect the activity too late and it took them a staggering six weeks to rotate credentials (according to the adversary), which shows why having automated systems to check for unauthorised usage and reset tokens and all accounts is crucial to respond to such attacks.
GitHub Activity Monitoring: The adversary claimed they were able to clone thousands of GitHub repositories containing sensitive data without being detected. These types of activities are available to monitor and detect in GitHub Audit Logs. It’s also important to have a plan in place when suspicious activities are detected.
Third-Party Risk Management Programs: This incident also had some notable downstream impact. It shows why client organisations of another company’s services need to know what data and how much data is stored by third-parties for when such breaches occur. Knowing what’s potentially exposed will streamline the response to the incident.
Deception Tech: Arup could have implemented a boobytraps for the adversary such as the use of CanaryTokens inside sensitive documents. As the adversary spent time analysing the Arup’s documents before contacting them, if they open a boobytrapped document, then the incident could been detected much earlier and the damages could have been reduced.
What Happened:On 3 May 2026, ShinyHunters, the English-speaking adolescent cybercrime collective, claimed they breached Instructure by listing them on their Tor data leak site.Instructure is a US-based software provider behind the widely adopted Canvas Learning Management System (LMS). ShinyHunters reportedly exfiltrated 3.65 terabytes of data, spanning 275 million global records from up to 9,000 institutions, before posting extortion messages across university login portals demanding Bitcoin.T
On 3 May 2026, ShinyHunters, the English-speaking adolescent cybercrime collective, claimed they breached Instructure by listing them on their Tor data leak site.
Instructure is a US-based software provider behind the widely adopted Canvas Learning Management System (LMS).
ShinyHunters reportedly exfiltrated 3.65 terabytes of data, spanning 275 million global records from up to 9,000 institutions, before posting extortion messages across university login portals demanding Bitcoin.
The outage forced prominent UK higher education institutions, including the University of Liverpool, Queen’s University Belfast, and the University of Manchester, to take systems offline and hastily rewrite their end-of-year exam submission schedules.
Instructure confirmed the affected data includes names, student ID numbers, email addresses, and private student-instructor messages. Instructure also confirmed no passwords, financial data, or government IDs were pilfered.
When the initial negotiation deadline passed, ShinyHunters then escalated by defacing Canvas login portals at roughly 330 institutions and pivoting to direct school-by-school extortion.
Following the initial investigation into the breach, Instructure confirmed that ShinyHunters had exploited a vulnerability in its “Free-for-Teacher” account creation system.
To prevent the data from being leaked, Instructure announced it had “reached an agreement with the unauthorised actor” behind the data extortion attack.
According to an expert interviewed by ABC News, while a ransom amount hadn't yet been verified or publicly confirmed, people claiming to have knowledge of the situation estimated the amount was $10 million USD.
Analyst Comment:
Canvas is reportedly the UK’s primary digital learning platform, whose usage grew significantly during the pandemic. The timing of the attack also couldn’t come at a worse time for UK universities. In May, thousands of undergraduate students will be uploading their dissertations and trying to access their course content to prepare for their exams.
Active since 2019, ShinyHunters is a financially motivated data-theft-extortion collective that first emerged publicly in January 2020. Notably, ShinyHunters does not currently deploy ransomware as part of their intrusions. Instead, they exfiltrate data from cloud platforms, software environments, and third-party integrators, then demand a ransom to avoid its public release. SaaS Platforms such as Salesforce, Snowflake, GainSight, SalesLoft Drift and their customers have been targeted by ShinyHunters and adjacent groups in the last couple years.
Instructure is one of the few victims who have likely paid ShinyHunters. Most victims refuse due to not being able to trust that the cybercriminals will stick to their word and delete the stolen data. The consensus across the industry is paying the ransom is never the appropriate option for multiple reasons, such as fuelling future attacks, making your company look like an easy target, and possibly violating sanctions and local ransom payment ban laws. The most likely scenario is that Instructure felt they should pay the ransom to prevent further harm from the release of personal information of millions of students in their system.
Defensive Takeaways:
Enhance Platform Security: ShinyHunters reportedly exploited a vulnerability in Instructure’s Free-for-Teacher system, which highlights the importance of identity security audits alongside standard application penetration testing.
Enhance Logging and Round-the-Clock Monitoring: ShinyHunters reportedly exfiltrated 3.65 terabytes of data from Instructure. Enhanced activity logs and a certified 24/7 SOC monitoring service could have detected these actions by identifying anomalous login events and data exfiltration events to unknown IP addresses.
Create and Test Backup Processes: While Canvas was down, the universities shifted to alternative methods like email and printed paper. This case highlights the importance of business continuity plans (BCPs) along with making sure they are updated and tested.
Be Wary of Second-Order Effects: After a breach of this size, its key to warn users and SOC teams to be vigilant for new waves of phishing emails, brute forcing attacks, and other account takeover methods leveraging the stolen data.
Never Trust a Cybercriminal: In Instructure’s case, the company says it received “digital confirmation of data destruction (shred logs).” However, as Allison Nixon says, it’s completely unprovable because such shred logs or videos can be easily faked.
Anna Turley gives Reform leader 24 hours to report Russian hacking claim in ‘public and national interest’The Labour chair has given Nigel Farage 24 hours to report to security services the claim that his phone was hacked by Russia-linked actors or the party will do it for him.In a letter to the Reform UK leader, Anna Turley said it was “in the public and national interest” to ensure that a suspected overseas hack of a senior politician’s phone by a hostile state was properly investigated. Conti
Anna Turley gives Reform leader 24 hours to report Russian hacking claim in ‘public and national interest’
The Labour chair has given Nigel Farage 24 hours to report to security services the claim that his phone was hacked by Russia-linked actors or the party will do it for him.
In a letter to the Reform UK leader, Anna Turley said it was “in the public and national interest” to ensure that a suspected overseas hack of a senior politician’s phone by a hostile state was properly investigated.
What HappenedOn 5 May 2026, new data revealed that British romance scam victims were defrauded of a staggering £102 million last year, representing a 29% surge in reported cases.The figures come from information gathered by Report Fraud (f.k.a ActionFraud), which is a City of London Police-run service that logged 10,784 romance scam reports in 2025.According to the data, cybercriminals are reportedly pocketing roughly £280,000 everyday by exploiting online relationships, with individual losses
On 5 May 2026, new data revealed that British romance scam victims were defrauded of a staggering £102 million last year, representing a 29% surge in reported cases.
The figures come from information gathered by Report Fraud (f.k.a ActionFraud), which is a City of London Police-run service that logged 10,784 romance scam reports in 2025.
According to the data, cybercriminals are reportedly pocketing roughly £280,000 everyday by exploiting online relationships, with individual losses averaging £9,500 and in extreme cases, reaching up to £1 million per victim.
This wave of scam victims is part of the growing trend where scammers blend emotional manipulation with fake cryptocurrency investment schemes, heavily weaponising AI-generated profiles, and focusing on lonely victims aged 55 to 74.
Analyst Comment
When analysing fraud statistics, it is important to remember that underreporting is very common, with many victims staying silent out of shame. Therefore, this is likely only a fraction of the real figures and the problem is likely much worse than we know. The data we do have, however, still reveals there is essentially an army of digital scammers routinely bleeding UK citizens dry, using not much more than a Midjourney AI subscription, a ChatGPT script, face-swapping services, and an entirely fictitious character with an emotional backstory.
Losing £102 million in a single year to fake internet characters is a truly wild national milestone. The fact that reports surged by nearly a third (29%) proves that in our society, emotional vulnerability is being monetised at industrial scale. We aren’t just looking at a clumsy email from a Nigerian prince anymore. This is industrial-grade social engineering. Scammers are playing the long game, spending months "love-bombing" victims before dropping the inevitable bombshell that they need a quick bank transfer to cover a “medical emergency” or an unmissable cryptocurrency investment opportunity.
In March 2026, the UK Government took some action against this threat and sanctioned Xinbi, a Chinese-language cryptocurrency marketplace accused of enabling large-scale online fraud and human exploitation. Xinbi reportedly processed more than $19.9 billion in transactions between 2021 and 2025, highlighting how much money the scam industry is generating globally.
Until we treat the underground scam economy with the same significance we treat ransomware or nation state attacks, the UK will continue to be one of the world's most lucrative money spinners for heartless cybercriminals.
Defensive Takeaways
Enforce the "Face-to-Face" Financial Boundary: If you are advising family members (especially those in vulnerable demographics), establish an unshakeable, non-negotiable rule: if you have not looked a person in their physical eyeballs, you do not send them money, gift cards, or cryptocurrency.
Teach Others Digital Sanity Checks: Teach your friends and family the art of basic digital literacy. Run profile images through reverse-image search tools (Google Lens or TinEye) and consciously flag the platform migration trap. Scammers desperately want to move targets off monitored apps like Tinder or Bumble and onto unmoderated WhatsApp or Telegram channels as fast as possible to avoid automated dating app ban filters.
Learn From the Mistakes of Others: To find examples of victims falling for these scams, the UK Financial Ombudsman Service’s database of decisions can act as a useful resource. The decision details can help you understand how these scams work, how much money individuals can lose, and the rate at which UK banks offer refunds or compensation. More examples can be found in my talk on this topic here.
Leverage Stripe’s FT3 Framework: If your organisation or team is tasked with combating fraud, then categorising these scammers TTPs is crucial. That’s why Stripe has developed the Fraud Tools, Tactics, and Techniques (FT3) framework. It’s designed to help security teams understand the landscape, spot gaps, develop detections, improve incident response, and foster collaboration.
What Happened:On 11 May 2026, the UK Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 after the Cl0p ransomware group lurked completely undetected in its network for nearly two years.Initial access reportedly occurred via a malicious phishing email in September 2020, which downloaded Cl0p’s Get2Loader malware and their SDBBOT backdoor to establish persistence.The breach itself, however, was only discovered two years later in July 2022 when staff began investigati
On 11 May 2026, the UK Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 after the Cl0p ransomware group lurked completely undetected in its network for nearly two years.
Initial access reportedly occurred via a malicious phishing email in September 2020, which downloaded Cl0p’s Get2Loader malware and their SDBBOT backdoor to establish persistence.
The breach itself, however, was only discovered two years later in July 2022 when staff began investigating IT performance slowdowns and ultimately found out that 4.1 terabytes of data was exfiltrated and the personal data of 633,887 customers and employees being published in August 2022 on Cl0p’s Tor data leak site.
The ICO’s investigation also revealed a staggering list of systemic failures, such as South Staff’s outsourced Security Operations Center (SOC) was blind to 95% of the network and that they conducted zero internal or external vulnerability scans over an 18-month window.
At the time of the attack they were still running Windows Server 2003 machines long after extended support ended. Further, two of their domain controllers were left completely unpatched against ZeroLogon (CVE-2020-1472), a critical, easily exploitable vulnerability published years before the intrusion.
Analyst Comment:
This case is a sobering look at the technical debt hiding inside the UK’s Critical National Infrastructure (CNI). A dwell time of nearly two years is practically unheard of in modern ransomware operations, and the TTPs used by the adversary points to a total breakdown of their defences. Cl0p didn’t need sophisticated, state-sponsored techniques or zero-days to pull this one off, they just walked back in through an infection that went undetected.
The ICO’s findings also reveal the reality that many UK organisations still treat cybersecurity as a set-and-forget compliance check rather than routine efforts to mature and upgrade systems or proactive measures to hunt and detect threats lurking inside the network.
Defensive Takeaways:
Audit Your Outsourced SOC: As we learned from this incident, never assume the third-party security provider sees everything or is doing everything right. Establish audits to verify that endpoint telemetry and logs from your entire estate are actively ingested, retained, and monitored in the right platform.
Harden Your Crown Jewels Against Old Flaws: Ensure that active directory and domain controllers are strictly monitored and prioritised for critical patches. Vulnerabilities like ZeroLogon remain a ransomware operator’s favourite tool for fast lateral movement and escalation to Domain Admin access. This is exactly what Cl0p and a dozen or so other groups use.
ASEC Blog publishes Ransom & Dark Web Issues Week 5, April 2026 Emergence of a new ransomware group, M3RX Data from a South Korean religious organization sold on DarkForums ShinyHunters claims a data leak from a US interactive media company
ASEC Blog publishes Ransom & Dark Web Issues Week 5, April 2026 Emergence of a new ransomware group, M3RX Data from a South Korean religious organization sold on DarkForums ShinyHunters claims a data leak from a US interactive media company
An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.
Shchukin was named as UNKN (a.k.a. UNKNOWN) in an advisory published by the German Federal Criminal Police (the “Bundeskrimina
An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021.
Shchukin was named as UNKN (a.k.a. UNKNOWN) in an advisory published by the German Federal Criminal Police (the “Bundeskriminalamt” or BKA for short). The BKA said Shchukin and another Russian — 43-year-old Anatoly Sergeevitsch Kravchuk — extorted nearly $2 million euros across two dozen cyberattacks that caused more than 35 million euros in total economic damage.
Daniil Maksimovich SHCHUKIN, a.k.a. UNKN, and Anatoly Sergeevitsch Karvchuk, alleged leaders of the GandCrab and REvil ransomware groups.
Germany’s BKA said Shchukin acted as the head of one of the largest worldwide operating ransomware groups GandCrab and REvil, which pioneered the practice of double extortion — charging victims once for a key needed to unlock hacked systems, and a separate payment in exchange for a promise not to publish stolen data.
Shchukin’s name appeared in a Feb. 2023 filing (PDF) from the U.S. Justice Department seeking the seizure of various cryptocurrency accounts associated with proceeds from the REvil ransomware gang’s activities. The government said the digital wallet tied to Shchukin contained more than $317,000 in ill-gotten cryptocurrency.
The GandCrab ransomware affiliate program first surfaced in January 2018, and paid enterprising hackers huge shares of the profits just for hacking into user accounts at major corporations. The GandCrab team would then try to expand that access, often siphoning vast amounts of sensitive and internal documents in the process. The malware’s curators shipped five major revisions to the GandCrab code, each corresponding with sneaky new features and bug fixes aimed at thwarting the efforts of computer security firms to stymie the spread of the malware.
On May 31, 2019, the GandCrab team announced the group was shutting down after extorting more than $2 billion from victims. “We are a living proof that you can do evil and get off scot-free,” GandCrab’s farewell address famously quipped. “We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.”
The REvil ransomware affiliate program materialized around the same as GandCrab’s demise, fronted by a user named UNKNOWN who announced on a Russian cybercrime forum that he’d deposited $1 million in the forum’s escrow to show he meant business. By this time, many cybersecurity experts had concluded REvil was little more than a reorganization of GandCrab.
UNKNOWN also gave an interview to Dmitry Smilyanets, a former malicious hacker hired by Recorded Future, wherein UNKNOWN described a rags-to-riches tale unencumbered by ethics and morals.
“As a child, I scrounged through the trash heaps and smoked cigarette butts,” UNKNOWN told Recorded Future. “I walked 10 km one way to the school. I wore the same clothes for six months. In my youth, in a communal apartment, I didn’t eat for two or even three days. Now I am a millionaire.”
As described in The Ransomware Hunting Team by Renee Dudley and Daniel Golden, UNKNOWN and REvil reinvested significant earnings into improving their success and mirroring practices of legitimate businesses. The authors wrote:
“Just as a real-world manufacturer might hire other companies to handle logistics or web design, ransomware developers increasingly outsourced tasks beyond their purview, focusing instead on improving the quality of their ransomware. The higher quality ransomware—which, in many cases, the Hunting Team could not break—resulted in more and higher pay-outs from victims. The monumental payments enabled gangs to reinvest in their enterprises. They hired more specialists, and their success accelerated.”
“Criminals raced to join the booming ransomware economy. Underworld ancillary service providers sprouted or pivoted from other criminal work to meet developers’ demand for customized support. Partnering with gangs like GandCrab, ‘cryptor’ providers ensured ransomware could not be detected by standard anti-malware scanners. ‘Initial access brokerages’ specialized in stealing credentials and finding vulnerabilities in target networks, selling that access to ransomware operators and affiliates. Bitcoin “tumblers” offered discounts to gangs that used them as a preferred vendor for laundering ransom payments. Some contractors were open to working with any gang, while others entered exclusive partnerships.”
REvil would evolve into a feared “big-game-hunting” machine capable of extracting hefty extortion payments from victims, largely going after organizations with more than $100 million in annual revenues and fat new cyber insurance policies that were known to pay out.
Over the July 4, 2021 weekend in the United States, REvil hacked into and extorted Kaseya, a company that handled IT operations for more than 1,500 businesses, nonprofits and government agencies. The FBI would later announce they’d infiltrated the ransomware group’s servers prior to the Kaseya hack but couldn’t tip their hand at the time. REvil never recovered from that core compromise, or from the FBI’s release of a free decryption key for REvil victims who couldn’t or didn’t pay.
Shchukin is from Krasnodar, Russia and is thought to reside there, the BKA said.
“Based on the investigations so far, it is assumed that the wanted person is abroad, presumably in Russia,” the BKA advised. “Travel behaviour cannot be ruled out.”
There is little that connects Shchukin to UNKNOWN’s various accounts on the Russian crime forums. But a review of the Russian crime forums indexed by the cyber intelligence firm Intel 471 shows there is plenty connecting Shchukin to a hacker identity called “Ger0in” who operated large botnets and sold “installs” — allowing other cybercriminals to rapidly deploy malware of their choice to thousands of PCs in one go. However, Ger0in was only active between 2010 and 2011, well before UNKNOWN’s appearance as the REvil front man.
A review of the mugshots released by the BKA at the image comparison site Pimeyes found a match on this birthday celebration from 2023, which features a young man named Daniel wearing the same fancy watch as in the BKA photos.
Images from Daniil Shchukin’s birthday party celebration in Krasnodar in 2023.
Update, April 6, 12:06 p.m. ET: A reader forwarded this English-dubbed audio recording from a ccc.de (37C3) conference talk in Germany from 2023 that previously outed Shchukin as the REvil leader (Shchuckin is mentioned at around 24:25).
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.
Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable, this year marks the
Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities.
Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024. According to Satnam Narang at Tenable, this year marks the second consecutive year that Microsoft patched over one thousand vulnerabilities, and the third time it has done so since its inception.
The zero-day flaw patched today is CVE-2025-62221, a privilege escalation vulnerability affecting Windows 10 and later editions. The weakness resides in a component called the “Windows Cloud Files Mini Filter Driver” — a system driver that enables cloud applications to access file system functionalities.
“This is particularly concerning, as the mini filter is integral to services like OneDrive, Google Drive, and iCloud, and remains a core Windows component, even if none of those apps were installed,” said Adam Barnett, lead software engineer at Rapid7.
Only three of the flaws patched today earned Microsoft’s most-dire “critical” rating: Both CVE-2025-62554 and CVE-2025-62557 involve Microsoft Office, and both can exploited merely by viewing a booby-trapped email message in the Preview Pane. Another critical bug — CVE-2025-62562 — involves Microsoft Outlook, although Redmond says the Preview Pane is not an attack vector with this one.
But according to Microsoft, the vulnerabilities most likely to be exploited from this month’s patch batch are other (non-critical) privilege escalation bugs, including:
Kev Breen, senior director of threat research at Immersive, said privilege escalation flaws are observed in almost every incident involving host compromises.
“We don’t know why Microsoft has marked these specifically as more likely, but the majority of these components have historically been exploited in the wild or have enough technical detail on previous CVEs that it would be easier for threat actors to weaponize these,” Breen said. “Either way, while not actively being exploited, these should be patched sooner rather than later.”
One of the more interesting vulnerabilities patched this month is CVE-2025-64671, a remote code execution flaw in the Github Copilot Plugin for Jetbrains AI-based coding assistant that is used by Microsoft and GitHub. Breen said this flaw would allow attackers to execute arbitrary code by tricking the large language model (LLM) into running commands that bypass the user’s “auto-approve” settings.
CVE-2025-64671 is part of a broader, more systemic security crisis that security researcher Ari Marzuk has branded IDEsaster (IDE stands for “integrated development environment”), which encompasses more than 30 separate vulnerabilities reported in nearly a dozen market-leading AI coding platforms, including Cursor, Windsurf, Gemini CLI, and Claude Code.
The other publicly-disclosed vulnerability patched today is CVE-2025-54100, a remote code execution bug in Windows Powershell on Windows Server 2008 and later that allows an unauthenticated attacker to run code in the security context of the user.
For anyone seeking a more granular breakdown of the security updates Microsoft pushed today, check out the roundup at the SANS Internet Storm Center. As always, please leave a note in the comments if you experience problems applying any of this month’s Windows patches.
The scourge of ransomware continues primarily because of
three main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.Cryptocurrency enables cybercriminals to receive funds from victims around the world without the option to freeze or refund them due to the immutable nature of the virtual funds.Safe havens are
The scourge of ransomware continues primarily because of
three main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.
RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.
Cryptocurrency enables cybercriminals to receive funds from victims around the world without the option to freeze or refund them due to the immutable nature of the virtual funds.
Safe havens are countries that permit cybercriminals to launch attacks without immediate fear of arrest, enabling them to earn vast fortunes through ransomware campaigns.
With these three challenges in mind, law enforcement and
governments have a very difficult job to do when it comes to fighting ransomware
but fight it they must. In this blog we shall recall what counter-ransomware
activities took place in 2024, analyse their effectiveness, and assess how the
landscape shall evolve as a result.
A podcast version of this blog is also available here.
Ransomware Operator Arrests and Sanctions
During 2024, there were significant disruption operations by
law enforcement and financial authorities targeting individuals behind
ransomware campaigns (see the Table below). The main focus of 2024 for Western
law enforcement was squarely on the LockBit RaaS and its affiliates as it was
the largest and highest earning ransomware operation to date.
Several key players of the ransomware ecosystem were
arrested, including the main developer of LockBit ransomware. Interestingly,
Russian law enforcement also decided to arrest ransomware threat actors located
in Moscow and Kaliningrad as well.
European police took down malicious spam botnets that support ransomware campaigns. This resulted in 4 arrests (1 in Armenia and 3 in Ukraine), over 100 servers and 2,000 domains being seized. One of the main suspects earned €69 million by renting out infrastructure sites to deploy ransomware.
Deniss Zolotarjovs, a Latvian national was arrested and extradited to the US from Georgia for running the Karakurt data extortion gang linked to Conti.
Mikhail “Wazawaka” Matveev was arrested in Russia for violating domestic laws against the creation and use of malware. He was fined and had his cryptocurrency seized and is awaiting trial.
The ransomware ecosystem has fragmented due to the law enforcement disruptions of the largest players, such as
ALPHV/BlackCat and LockBit. In the case of ALPHV/BlackCat, the operators staged
a law enforcement takedown as they put up a fake seizure notice as part of
an exit scam in March 2024 after the attack on UnitedHealth.
Following these disruptions, some affiliates have migrated
to less effective strains or launched their own strains. This includes
Akira and RansomHub at the top of the list as well as Hunters International and
PLAY.
Cryptocurrency Exchanges Disrupted
During 2024, law enforcement seized funds from and
sanctioned a number of cryptocurrency exchanges and individuals running payment
processors using cryptocurrency (see the Table below).
One of the most interesting disclosures this year came from
the UK National Crime Agency (NCA) around Operation Destablise. The NCA linked
payments to ransomware gangs to money laundering networks used by Russian
oligarchs to covertly purchase property and Russia Today, the state-run media
organization, to covertly fund pro-Russia foreign entities.
Another notable investigation in 2024 was when the US
Treasury sanctioned more Russian cryptocurrency exchanges, such as PM2BTC and
Cryptex, that led to money launderers that facilitate the cashing out of ransom
payments being arrested by Russian law enforcement.
The US Justice Department indicted Russian national Roman Pikulev and Cryptonator, which processed a total of $1.4 billion in transactions, of which $8 million were ransom payments. Cryptonator also has ties to other sanctioned entities including Blender, Hydra Market, Bitzlato, and Garantex, among others.
FinCEN identified PM2BTC as being of “primary money laundering concern” in connection with Russian illicit finance. This was alongside Cryptex and Sergey Sergeevich Ivanov, a Russian national, who is associated with UAPS and PinPays, as well as Genesis Market. Cryptex also facilitated more than $115 million of proceeds from ransomware payments.
In Operation Final Exchange, German federal police (BKA) shut down 47 cryptocurrency exchange services that ransomware gangs use that operated without requiring registration or identity verification.
Russian authorities have arrested nearly 100 suspected cybercriminals linked to the anonymous payment system UAPS and the cryptocurrency exchange Cryptex.
The NCA uncovered a Russian money-laundering network operated by two companies called Smart and TGR Group as part of Operation Destabilise that involved UK-based cash-to-crypto networks that laundered Ryuk ransom payments as well as the money of Russian oligarchs and Russia Today.
Safe Havens Enabling Ransomware
While ransomware is a global problem, there are only a few
countries that are to blame for this rapid expansion of the ransomware
ecosystem. The state that is blamed the most for preventing many ransomware operators
from facing justice is Russia. There are explicit rules posted to
Russian-speaking cybercrime forums that state as long as members avoid
targeting Russia and the Commonwealth of Independent States (CIS), they are
free to operate.
The Russian ransomware safe haven theory was further proven
following sanctions levied against Evil Corp by the UK, US, and Australia. One
of the sanctioned men connected to Evil Corp was Eduard
Benderskiy, a former Russian federal security service (FSB) official.
Benderskiy is reportedly
the father-in-law of Maksim Yakubets, the leader of Evil Corp, an organized cybercrime
group responsible for multiple
ransomware strains including BitPaymer, WastedLocker, Hades, PhoenixLocker,
and MacawLocker. In total, Evil Corp has reportedly extorted at least $300
million from victims globally, according to the UK NCA. It is now clear that
Evil Corp has protection from a highly connected Russian FSB official who has
also been involved
in multiple overseas assassinations on behalf of the Kremlin, according to
Bellingcat investigators.
While a number of ransomware operators were arrested in 2024
and some were extradited to the US, the work done by law enforcement
specializing in cybercrime was put in the spotlight during the August
2024 prisoner swap. Multiple countries decided to release cybercriminals,
spies and an assassin as part of a historic
prisoner exchange with Russia at an airport in Ankara, Turkey. The US negotiated
the release of 16 people from Russia, including five Germans as well as seven
Russian citizens who were political prisoners in their own country.
Notably, from a cybercrime intelligence perspective, the Russian
nationals released from the West included the infamous cybercriminals Roman
Seleznev and Vladislav Klyushin. The latter, Klyushin, was sentenced
in 2023 to nine years in US prison after he was caught in a $93 million stock
market cheating scheme that involved hacking into US companies for insider
knowledge. The other cybercriminal, Seleznev, was sentenced
to 27 years in prison in 2017 for stealing and selling millions of credit card
numbers from 500 businesses using point-of-sale (POS) malware and causing more
than $169 million in damage to small businesses and financial institutions,
including those in the US.
In 2024, we saw several more Russian nationals get
extradited to the US after being arrested by law enforcement in the country
they were residing in. This includes the Phobos operator living in South Korea
and the LockBit developer living in Israel. This follows others arrested in
previous years such as a TrickBot developer arrested
in South Korea as well as the two LockBit affiliates extradited
to the US. There is a potential that these Russian nationals involved in
ransomware could be used in prisoner exchanges in the future.
Further, another curious trend in 2024 was that some Russians
inside Russia, which is firmly considered a safe haven for ransomware gang, did
get arrested. This includes the SugarLocker operators arrested in Moscow and
the LockBit affiliate Wazawaka who was arrested in Kaliningrad. This is
alongside the money launderers arrested around Russia linked to the Cryptex
exchange.
The arrests of Russian nationals in Russia for ransomware
activities appear to be more symbolic than a true crackdown on this type of
activity. This is because there are several dozen Russian-speaking ransomware
gangs that continue to operate, as well as a plethora of other types of cybercrime
in the Russian-speaking underground.
Outlook
In 2024, there was lots of significant action by law
enforcement to shake up the ransomware economy. One of the main successes of the
notable Operation Cronos action taken against LockBit was the sowing of
distrust and disharmony in the ransomware ecosystem. Despite the admins of
LockBit trying to recover, their reputation and army of affiliates have been
smashed.
Many of Russian law enforcement activities could all be
related to the costs of the Russian invasion of Ukraine. Russian authorities seizing funds of the illicit cryptocurrency exchanges could be to pay for
the war in Ukraine and they could be recruiting arresting cybercriminals for offensive
cyber operations related to the war in Ukraine. The true motivations of Russian law enforcement arresting these specific ransomware operators but allowing others to operate are unclear. The cybercriminals could also simply have not paid their protection money or lack connections in the FSB like Evil Corp has.
Due to the fall of LockBit and ALPHV/BlackCat
in 2024, there has been a rise of other ransomware groups like RansomHub and
Akira to fill the vacuum. However, the rate of attacks by these emerging groups
is still noticeably lower than when LockBit was operating at full force. This
should be perceived as a success for law enforcement operations in 2024 due to the overall
number of ransomware attacks lowering, which we should all be thankful
for.
Entrar
