Happy 16th Birthday, KrebsOnSecurity.com!

KrebsOnSecurity[.]com marked its 16th anniversary on 29 December 2025, highlighting a year that focused on dismantling cybercrime services and the actors behind them. In May 2024, the site examined Stark Industries Solutions Ltd., a bulletproof hosting provider that launched two weeks before Russia invaded Ukraine and later saw its co-owners sanctioned by the European Union, with penalties that did not stop further rebranding and asset transfers.

December 2024 saw KrebsOnSecurity profile Cryptomus, a Canadian-registered financial firm that later faced a record $176 million fine from Canadian regulators in October 2025 for anti-money laundering violations. The year also tied to LastPass findings from a 2023 study, with a March 2025 court filing confirming that U.S. federal agents investigating a $150 million cryptocurrency heist reached the same conclusion.

Phishing remained a major theme, including voice phishing gangs and smishing tied to China-based kit vendors, while a six-figure set of content from January 2025 examined Funnull, later sanctioned by the U.S. in May 2025 as a top source of pig-butchering scams.

In June 2025, KrebsOnSecurity reported the largest DDoS attack Google had mitigated at the time, blamed on the IoT botnet Aisuru, with a subsequent shift in October toward proxy services; and Chinese security firm XLab later profiled Kimwolf as the world’s biggest botnet with about 1.83 million devices as of 17 December, a finding the author linked to the botnet’s alleged fixation on Krebs.