Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks.

The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.

The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts.

The post Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts appeared first on SecurityWeek.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications.

Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.

The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.

South Africans who fall victim to cybercrime now have more support available. MiDO Academy, The Cyber Helpline (UK) and Amazon Web Services (AWS) launched the pilot of The Cyber Helpline in South Africa, a free, confidential service providing practical guidance and compassionate support to individuals affected by online fraud, investment and employment scams, hacked accounts, phishing and smishing, social media fake profiles, sextortion, online harassment, identity theft, malware and ransomware incidents.

The company has restored many websites and apps in Europe and expects e-commerce brands in the US to be restored in days.

The post Ahold Delhaize Restoring Services Disrupted by Cyberattack appeared first on SecurityWeek.

The arrest count is striking, but the scale of the online infrastructure removed may be the bigger story. An international effort against West African scam networks has resulted in 28 arrests, while technology companies say they removed more than 3.7 million accounts, pages and groups linked to fraudulent activity.

TL;DR: The US Justice Department says its October crackdown led to 28 arrests in Ghana and Nigeria. Binance and Coinbase were among the industry participants, and partners identified more than $11 million in potentially freezable funds, not confirmed recoveries.

The operation, called Joint Disruption Week, brought investigators together at the UK’s National Crime Agency in London during the week beginning October 6. Authorities targeted networks accused of investment fraud, impersonation and other online schemes that reach victims well beyond West Africa.

According to the Justice Department’s October 13 announcement, Ghanaian authorities arrested 19 people and seized 303 electronic devices in an operation near Accra. Nine more arrests were reported in Nigeria. Investigators also identified 117 trafficking victims in Ghana, a reminder that scam-centre operations can involve people held against their will as well as the victims losing money online.

Binance and Coinbase joined companies including Chainalysis, Elliptic, Meta, Google and Microsoft in sharing intelligence or disrupting the infrastructure used by scammers. That collaboration can help investigators connect social-media accounts, payments and wallet activity, but it should not be confused with proof that every suspect used cryptocurrency.

There is also an important distinction in the money figure. Officials said private-sector partners identified more than $11 million in funds that could potentially be frozen. They did not say that $11 million had been seized or returned to victims.

The real test now is how much of the identified money authorities can actually secure and how many disrupted operations stay offline.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Investigators have raised new concerns about stolen crypto flowing into Zcash, following earlier tracing of roughly 2,746 ZEC linked to the Bitget breach. Shielded transactions obscure details after entry, but do not prove that the underlying network has been compromised.

Privacy is a legitimate feature of cryptocurrency. It is also what makes Zcash a difficult destination for investigators trying to follow money stolen in a hack.

An October 17 warning from on-chain investigator Specter drew attention to reported flows tied to several crypto security incidents, including Bitget and other reported thefts. The warning follows a more detailed September 30 tracing of approximately 2,746 ZEC, then valued at about $3.9 million, entering Zcash’s Ironwood shielded pool from wallets linked by investigators to the Bitget attacker.

Before assets reach a shielded pool, analysts can sometimes identify funding wallets, transfers and swapping patterns on public chains. Once inside the pool, the usual visible trail becomes harder to follow because shielded transfers do not publicly reveal the same information about sender, recipient and amount.

That does not make Zcash’s cryptography broken. Nor does the appearance of suspect funds establish wrongdoing by every person who uses private transactions. It illustrates the longstanding tension between financial privacy and investigations into theft.

The precise combined total for flows from the newer incidents remains less firmly established than the earlier Bitget transactions. Estimates should not be lumped together without transaction-level verification, particularly when the same funds may move repeatedly through intermediaries.

What investigators are highlighting is a recurring tactic: thieves may leave clues before entering a privacy system, but tracing the subsequent path becomes substantially more difficult. For exchanges and forensic teams, the most useful intervention may happen before stolen assets disappear from public view.

"Someone online shows a 'trick' that feels harmless at first. Then the community pulls you in. Everyone's doing it. It feels like skill, not crime."

A young person from South Africa, describing how their peers slide into cybercrime.

Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.

The post Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages appeared first on SecurityWeek.

Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.

The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek.

The company says it took some of its systems offline to contain a security issue within its network.

The post Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems appeared first on SecurityWeek.

The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal.

The post Canonical Websites Disrupted in Second DDoS Attack This Year appeared first on SecurityWeek.

Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.

The post Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US appeared first on SecurityWeek.

The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.

The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek.

The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers.

The post Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison appeared first on SecurityWeek.