Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas.

A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files.

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks.

The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records…

Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers.

Highway thieves have stolen more than $100 million in data center equipment since June, employing increasingly sophisticated tactics such as forging driver IDs and spoofing GPS tracking systems. NBC News (paywalled) reports that thieves have "made away with more than $100 million in data center freight." Ars Technica reports: Here's how they said thieves get away with it: First, thieves hack freight brokers' accounts on shipment-listing websites and post fake shipments to lure real bids, then send a malicious link to any trucking companies that respond. Once victims click, thieves install software to take control of their accounts and start bidding on real shipments. Sometimes, a real delivery driver is hired to collect the cargo, unaware of the scam, and other times fake driver's licenses are used to get accomplices hired. Either way, the goods are eventually transferred to a driver working with the thieves to resell the gear, and, in one of the largest thefts, tracking coordinates were spoofed to prevent digital monitoring. Equipment commonly targeted includes "servers, fiber-optic cables, computer memory chips, copper wires, and bitcoin mining machines," NBC News reported. Some trailers hit seem to be carrying only data center equipment, like two stolen freights found in Illinois. The Cook County Sheriff's Office estimated those contained $300,000 worth of copper wire spools and about $1 million in "custom-made data center modular power solutions equipment," NBC News reported. Other trucks impacted were carrying additional freight, like a Los Angeles County Sheriff's Department case where "data center cooling equipment" bound for Deepcool AI was recovered among nicotine pouches, televisions, shoes, printers, speakers, and skin care cosmetics. Experts worry that means Americans may be broadly harmed by the thefts, not just the AI industry. While some stolen goods have been recovered, in two of the largest thefts that NBC News found, none of the equipment was found, and off-duty cops hired to escort the shipments were targeted in hit-and-runs. [...] Broadly, cargo thieves are infiltrating email accounts to find lucrative shipments, misdirecting shipments, disrupting GPS tracking, and using AI to create fake driver's licenses to get accomplices hired as delivery drivers. LASD's Sgt. David Pantoja told NBC News "that's how most of it is being done," which is a big shift from the past when highway thefts were largely opportunistic.

Read more of this story at Slashdot.

The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts.

The post Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts appeared first on SecurityWeek.

StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…

Senator Cynthia Lummis accuses Democrats of blocking tougher crypto penalties and custody rules under the CLARITY Act after its failed Senate vote.

TL;DR: A Colombian crypto broker received a 160-month prison sentence in a US laundering and narcotics case, prosecutors announced October 21. The account describes a scheme moving criminal proceeds through Tether and US shell companies.

A New York federal judge has sentenced Leonardo de Jesus Zuluaga Duque to 160 months in prison in a case involving cryptocurrency, drug proceeds and transfers through the US banking system.

The US Attorney’s Office for the Southern District of New York announced the sentence on Wednesday. Judge Mary Kay Vyskocil also imposed five years of supervised release and ordered forfeiture of $14,751,846, according to prosecutors.

The office described Zuluaga Duque as a Colombia-based crypto broker with a supervisory role in the network. It said he and others helped launder approximately $14.5 million in Tether derived from drug trafficking between May and November 2023.

The Route Ran Through Both Crypto And Banks

Prosecutors’ account describes proceeds converted into Tether, passed to an unlicensed money-transmission business and exchanged for US dollars. US shell companies then transferred funds to Colombian companies before the money was converted into pesos and distributed.

The token transfer was one link in a chain that also depended on companies, currency conversion and banking access. The proceeds ultimately reached recipients in local currency, prosecutors said.

Monitoring a blockchain address alone would not necessarily explain the commercial purpose of an associated bank transfer. Conversely, a bank record might show the receiving company without revealing the earlier token movement. Reconstructing the entire route requires connecting those pieces.

The approximately $14.5 million laundering figure describes the Tether transactions attributed to the group. The separate forfeiture order sets the amount Zuluaga Duque must surrender under the sentence; adding those figures would overstate the proceeds described in the case.

The prison term exceeds 13 years. Afterward, Zuluaga Duque faces the additional five-year period of supervised release announced by prosecutors.

Related Reading

• Crypto ‘Godfather’ Gets 78 Months For $37M Meta Fraud Scheme
• Tether Freezes USDT In 131 TRON Wallets After OFAC Sanctions Update
• Mastercard Introduces Fraud Screening Before Stablecoin Payments Go On-Chain

This article was written by the News Desk and edited by Samuel Rae.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications.

Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

INTERPOL’s Operation Serengeti III targeted cybercrime in 21 African countries, recovering over $105 million and identifying 65,929 victims…

Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.

A CBC investigation found that more than 1.5 million Canadian Crime Stoppers tips spanning 25 years were exposed in a breach of the P3 Global Intel tip-management platform. About 850,000 records contained personally identifiable information, including addresses, phone numbers, emails, license plates and some banking details. Longtime Slashdot reader doconnor shares the report: The data was stolen last March by hacktivist collective Internet Yiff Machine. In a manifesto, the group said it wanted to disprove the claim by P3 Global Intel -- the company hired by Crime Stoppers to manage its tips -- that the platform was "anonymous" and "secure." A copy of the hacked data was made available to researchers and journalists, including CBC, by Distributed Denial of Secrets, a U.S. non-profit that archives and publishes hacked and leaked documents it deems to be in the public interest. The report found that more than 4,300 Crime Stoppers tipsters identified themselves by their full name, with hundreds of records containing staff warnings that individuals had "self-identified" or been "exposed," yet their information remained unredacted. The leaked data included sensitive allegations involving murder, terrorism, drug trafficking and organized crime, with nearly 49,000 tips linked to cases cleared through arrests or criminal charges. Cybersecurity experts criticized the retention of decades-old records... "If a tip is closed, does that need to stay online?" asked cybersecurity expert Ben Coon. "The answer to that, to me, is no." The RCMP was initially told Canadian data was unaffected, then assured that exposed Canadian records contained no personally identifiable information. This appears to contradict the CBC's findings. Furthermore, affected individuals have not been systematically notified because contacting them could further jeopardize their anonymity. "For a system that has been designed to promise anonymity to the users, that has failed categorically," said Prof. Ali Dehghantanha, the Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph.

Read more of this story at Slashdot.

The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.

SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen…

New court records reportedly show that DHS targeted Stop Cop City activist Samuel Tunick at an Atlanta airport because he was under investigation for suspected "terrorist activities." However, the CBP officers told him instead that they wanted to search his phone for child sexual abuse material (CSAM). Tunick, who is not accused of terrorism or any other crime beyond allegedly wiping his GrapheneOS phone during the encounter, faces up to five years in prison. 404 Media reports: Instead of saying he was being targeted for suspected terrorism -- although this search happened just at the start of the second Trump administration, it has dramatically broadened what organizations or people may be considered such -- they said they needed his phone to look for "kiddie p*rn." "Good afternoon," an email sent from a Homeland Security Investigations (HSI) official, part of Immigration and Customs Enforcement (ICE), to CBP and other officials reads. "The following subject is scheduled to arrive in ATL [Hartsfield-Jackson Atlanta International Airport] today via DL 1778 @ 1930 Hours. TUNICK is under investigation by HSI/JTTF for suspected terrorist activities." The email includes a photo of Tunick, and asks the officials to direct him to secondary inspection, retain all of his electronics, and collect their passcodes. As 404 Media first revealed in December, Tunick was charged because he allegedly "did knowingly destroy, damage, waste, dispose of, and otherwise take any action to delete the digital contents of a Google Pixel cellular phone, for the purpose of preventing and impairing the Government's lawful authority to take said property into its custody and control." Matthew Dodge, one of Tunick's lawyers, previously told 404 Media he only found one other case using the same obscure law, a drug trafficking case. "This is extraordinarily rare," Dodge said. Tunick was part of the Stop Cop City movement in Atlanta, which broadly protested the building of a large police training center, and which authorities investigated for arson, vandalism, and doxing. Tunick is not suspected of any crime beyond the alleged wiping of the phone, and has previously put his current prosecution in the context of the wide spanning cases against other Stop Cop City protesters. The newly filed court record, in which Tunick's lawyers argue that evidence should be thrown out, include new photos and descriptions of the airport encounter. The CBP officials asked Tunick if they were going to find "kiddie p*rn" on his phone, which Tunick immediately denied. "As the evidentiary hearing made clear, these unfounded accusations were nothing more than pretext for a fishing expedition into the depths of Mr. Tunick's devices," the lawyers wrote. They added, "Officer Findley acknowledged that officers had no reason whatsoever to believe Mr. Tunick possessed child p*rnography," referring to one of the officials.

Read more of this story at Slashdot.

South Africans who fall victim to cybercrime now have more support available. MiDO Academy, The Cyber Helpline (UK) and Amazon Web Services (AWS) launched the pilot of The Cyber Helpline in South Africa, a free, confidential service providing practical guidance and compassionate support to individuals affected by online fraud, investment and employment scams, hacked accounts, phishing and smishing, social media fake profiles, sextortion, online harassment, identity theft, malware and ransomware incidents.