Cybersecurity News
Filters
Filtered by tag: cybercrime × Clear
Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms
Matched: Artificial Intelligence, Claude
Cybersecurity firm Straiker reports that a Latin American cybercrime group called CyberCartel used AI models from Anthropic, xAI, and Moonshot AI to coordinate attacks against over 400 financial institutions. Their framework, CARLIY0S, assigned AI agents distinct roles to research targets, suggest actions, and manage stolen credentials. The group used fallback methods when AI models refused requests. Anthropic revoked a linked credential; xAI said it was investigating.
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Matched: cryptocurrency, medical
U.S. federal investigators suspect executives at two ransomware negotiation firms had unusually close ties to the ShinyHunters hacking group, with one U.S.-based executive allegedly helping operate the group's victim extortion website. Canadian cybersecurity executive Edward Dubrovsky has been charged with extortion-related offenses. Investigators also identified connections to Daniel Tobok, linked to the alias "Ghostbyte," which appeared in communications from the Dharma ransomware group. ShinyHunters has extorted over $70 million this year.
Australian Cybersecurity Magazine
Queensland students put cyber skills to the test at ANZ Hackathon
Over 100 students, academics and industry experts are gathering in Brisbane on 19-20 October for the second ANZ Cybercrime Hackathon. The event gives participants hands-on experience tackling real-world cybersecurity challenges, helping build practical skills and connections within the industry.
Shopify tells Australian store to stay shut after hijacked extensions divert shoppers
Matched: Australia
Shopify ordered an Australian retailer to keep its store offline after hackers compromised third-party extensions, injecting malicious JavaScript that redirected customers to fake checkout pages designed to steal payment details. The incident highlights supply chain risks from third-party plugins, which can introduce vulnerabilities even when the core platform itself remains secure.
U.K. Sanctions Cryptomus for RU Money Laundering
Matched: Australia, cryptocurrency
The U.K. sanctioned Cryptomus, a cryptocurrency platform accused of processing payments for ransomware, drug markets, cybercrime, and helping Russia evade financial restrictions. The sanctions freeze U.K.-held assets and bar British firms from doing business with it. Also targeted were VexPay, TokenSpot, and Tsunami Payments. Cryptomus, which has operated under multiple names including Certa Payments and now Heleket, processed over $7 billion since 2022. Analysts say sanctions are more effective than Canada's earlier $176 million fine, which proved unenforceable.
FBI Arrests Executive at Ransomware Negotiation Firm
Matched: medical
FBI agents arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, in Pennsylvania on cyber extortion and conspiracy charges. Dubrovsky, associated with firms Cypfer and CyberSteward, was attending a cyber insurance conference when arrested. His case has been moved to Texas, the center of the FBI's investigation into ShinyHunters, a hacking group that has extorted over $70 million this year and recently stole sensitive FBI personnel data.
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
Matched: health, medical
A teenager from Amman, Jordan, suspected of leading ShinyHunters, was detained and is reportedly cooperating with the FBI. Saif Al-Din Khader, known as "Rey," was apprehended while the group was extorting Jeppesen ForeFlight, a former Boeing subsidiary, over allegedly stolen sensitive aviation data. Separately, Dutch cybercriminal Pepijn van der Stap faces new allegations of ordering murders abroad. Experts describe ShinyHunters as a franchise-style operation, with Rey accused of exploiting the brand's reputation after its original French members were arrested.
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Matched: Artificial Intelligence, Australia, health, medical
Dutch police arrested 24-year-old Pepijn van der Stap, a previously convicted hacker known as "Umbreon," on suspicion of involvement with the hacking group ShinyHunters. Van der Stap had served prison time for data theft and extortion, claimed rehabilitation, and worked in cybersecurity. Following his arrest, ShinyHunters escalated attacks, breaching the FBI's jobs site and extorting Russian ransomware group Cl0p. Investigators also suspect van der Stap may have ordered two murders abroad.
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
U.S. Army soldier Cameron Wagenius, 22, was sentenced to 70 months in prison and ordered to pay nearly $300,000 in restitution for hacking telecoms including AT&T and Verizon. Operating as "Kiberphant0m" while stationed in South Korea, he stole call and text metadata from over 100 million AT&T customers via Snowflake cloud storage breaches and extorted companies. Despite the massive scale, he earned only around $1,500. While awaiting sentencing, he was caught attempting to research prison network vulnerabilities using other inmates' email accounts to query AI tools.
Two Australians Charged Over TeamPCP Supply-Chain Attacks That Hit 1,000+ Organizations
Matched: Australia, cryptocurrency
Two Western Australian men have been charged with 14 offenses over alleged supply-chain attacks attributed to TeamPCP. Investigators say the pair planted malicious code in open-source repositories, compromising over 1,000 organizations globally, stealing 500,000+ credentials and exfiltrating 300GB of data. Remediation costs are estimated in the hundreds of millions. Warrants were executed in Cottesloe, Hamilton Hill, and Mandurah on 26 August 2026, with FBI involvement. Both men appeared in Perth Magistrates Court on 27 August 2026.
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Matched: Australia
Two Western Australian men have been charged with 14 offences over their alleged roles in TeamPCP, a cybercrime group accused of compromising open-source security tools Trivy, Checkmarx KICS, and AI gateway LiteLLM in March 2026. Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court on August 27.
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Matched: Australia
Two Australian men, aged 21 and 23, have been arrested by the Australian Federal Police over alleged ties to TeamPCP, a cybercrime group responsible for a prolonged series of software supply chain attacks. The group embedded malicious code in open source tools, using a self-propagating worm called Shai-Hulud to steal developer credentials and spread further. Investigators identified the 21-year-old as Ruben Thomson of Perth, whose online activity and poor operational security linked him to multiple cybercrime aliases. The pair face 14 combined charges and appeared in Perth Magistrates Court.
Two Aussies alleged to be "principal participants" of TeamPCP hacking group
Matched: Australia
Australian and US authorities have taken coordinated action against two Australians allegedly identified as principal participants in the TeamPCP hacking group. No further details about the nature of the charges, the individuals named, or the specific actions taken by authorities were provided beyond their alleged central roles in the group.
Two WA men charged after AFP-FBI-WAPF probe into alleged open-source supply-chain attack
Matched: Australia
Two Western Australian men have been charged with 14 offences following a joint investigation by the AFP, FBI, and WA Police into an alleged cybercrime syndicate. The group allegedly tampered with open-source software to gain unauthorised access to corporate networks, stealing data and extorting victims. The investigation highlights growing concerns about supply-chain vulnerabilities in widely used open-source tools.
Are employees to blame for rise in insider access threats? This new study claims so
Flashpoint research found roughly 34 daily dark web posts related to insider threats between July 2025 and 2026, with July 2026 alone seeing 12,653 posts. Notably, 75% originated from insiders actively selling access rather than criminals recruiting them. Telecom, retail, and finance were primary targets. Flashpoint warns that as security software improves, attackers increasingly exploit employees, recommending organizations monitor dark web forums and encrypted platforms for credential trading.
New 'AnonyMous' phishing campaign targets iPhone users with fake AI Apple support calls
AnonyMousKIT is a phishing kit targeting iPhone theft victims by exploiting Apple's Lost Mode contact feature. Attackers use victims' displayed contact info to impersonate Apple support via email, SMS, or AI-powered calls, directing them to fake Find My pages to steal credentials. Active since 2024, the operation runs 500+ domains, 150+ reseller brands, and AI voice agents costing $0.10 per call, primarily targeting Brazil, South Africa, India, Indonesia, Kenya, and Italy.
Busted! Interpol-led operation targeting West African cybercrime groups nets 58 arrests
Matched: Australia, cryptocurrency
An Interpol-led operation involving 22 countries across six continents resulted in 58 arrests targeting West African cybercrime groups. Operation Jackal IV focused on dismantling romance scam and cryptocurrency fraud networks. Australia was among the participating nations. The operation also led to the identification of hundreds of additional suspects and the seizure of assets linked to the criminal organizations.
Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring
Around 2,000 hacked WordPress sites were used as infrastructure for a global cybercrime operation. The compromised sites served multiple roles: delivering malware to victims, acting as command-and-control servers for infected devices, and storing stolen data. Security experts warn the scheme exploited the sites' legitimacy to avoid detection, highlighting risks for website owners who neglect security updates.
Exclusive: Ransomware newcomers list South Australia’s Ramsey Bros as hacking victim
Matched: Australia
Ransomware group Storm claims to have hacked Ramsey Bros, a South Australian farm machinery supplier. The group says it has published stolen data as proof, including alleged customer information and vehicle inspection records. Ramsey Bros has not yet publicly commented. Storm is considered a newcomer among ransomware groups, which typically steal and threaten to leak data to pressure victims into paying.
No-Filter 'Kriminal' AI Platform Raises Cybercrime Concerns
Matched: cryptocurrency
A platform called "Kriminal" offers an AI service with no content restrictions, marketed toward cybercriminals. Accessible via cryptocurrency, it provides social engineering scripts, offensive hacking tools, and open-source intelligence scanning. Despite official terms prohibiting illegal use, researchers warn the guardrail-free system meaningfully lowers the barrier for cybercrime, enabling even unskilled actors to conduct sophisticated attacks.
US charges 17 Iranian nationals over “massive cyber theft campaign”
Matched: Australia
The US Justice Department has charged 17 Iranians linked to a company called Emennet Pasargad over a large-scale cyber theft campaign targeting academics worldwide, including in Australia. The hackers allegedly stole research, credentials, and other sensitive data. Several of those charged are also accused of previous interference in US elections.
Australia & Thailand to strengthen cooperation on fighting cybercrime
Matched: Australia
Australia and Thailand have agreed to strengthen cooperation on combating cybercrime and transnational crime, following talks between Prime Minister Anthony Albanese and Thai PM Anutin Charnvirakul. The two leaders released a joint statement outlining their commitment to deeper collaboration on cross-border criminal activity, reflecting shared security concerns in the region.
17th August – Threat Intelligence Report
Colombia's Ministry of Justice suffered a ransomware attack disrupting technology infrastructure and public services tied to drug monitoring and legal processes, with officials confirming file compromise. Other notable incidents include additional breaches and cyberattacks detailed in Check Point Research's weekly Threat Intelligence Bulletin, covering top attacks, emerging vulnerabilities, and threat actor activity for the week of 17th August.
The State of Ransomware Q2 2026
Ransomware activity in Q2 2026 shows signs of shifting dynamics, according to Check Point Research. While dominant ransomware-as-a-service operations continue leading the space, the previously consolidating landscape is beginning to fragment. Established groups maintain their dominance, but emerging players are increasingly challenging the concentration of power that has defined the ransomware ecosystem over the past year.
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft
Matched: cryptocurrency
Researchers have identified a threat actor dubbed "Jewelbug," a hackers-for-hire group conducting both state-sponsored espionage and cryptocurrency theft through the same infrastructure. The dual-purpose operation — mixing intelligence gathering with financial crime — is unusual, suggesting the group serves government clients while simultaneously running independent profit-driven attacks, blurring the line between nation-state and cybercriminal activity.