Research reports
1,224 reports from 387 publishers45 added in the past week
28 reports, newest added first
Added Sun 25 Oct
International law enforcement initiate hunt on malware group SocGholish
In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14.971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that…
MalwareTakedowns and arrests
Taking Down Emotet
How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts On Tuesday, January 26, 2021, the number of available controllers talking like Emotet Tier 1 controllers dropped to zero. Team Cymru’s monitoring confirmed that they dropped…
Takedowns and arrests
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
MalwareInfostealersTakedowns and arrests
Added Fri 25 Sep
NSA Joins FBI and Others in Releasing Guidance to Defend Against Gunra Ransomware
FORT MEADE, Md. — Today, the National Security Agency (NSA) joins the Federal Bureau of Investigation (FBI) and others in releasing a joint Cybersecurity Advisory, “#StopRansomware: Gunra Ransomware,” as an ongoing effort to publish information about…
RansomwareTakedowns and arrests
Added Thu 6 Aug
Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater
The operators of Kali365 maintain an active marketing Telegram channel which has actively posted about the kit and advertised its features, including in this post first seen on 12 March 2026: Notably, Kali365 advertised two phishing methods that are…
PhishingTakedowns and arrests
How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account
When Wiz Research published their analysis of the Mini Shai-Hulud supply chain campaign, the focus was on the trojanized npm and PyPI packages used to reach developer machines. What happened after delivery got considerably less coverage. The second-stage…
Supply chainTakedowns and arrests
Added Tue 7 Jul
Added Fri 1 May
Cobalt Renaissance
On March 26, 2018, Europol reported the arrest of the Cobalt gang leader in Alicante, Spain. The Bank of Russia named Cobalt as the main threat to banks. The scale of its activities is fascinating: according to Europol, the group has been linked to thefts of…
Takedowns and arrests
How Russian Spam King Peter Levashov Was Arrested, and His Kelihos Botnet Dismantled
One of the world’s most notorious spammers appears to have been tripped up by a basic cybersecurity no-no, according to the FBI: He used the same log-in credentials to both run his criminal enterprise and also log into sites like iTunes. The Justice…
Botnets and DDoSTakedowns and arrests
Added Thu 23 Apr
Ukrainian Arrested and Charged with Ransomware Attack on Kaseya
The Justice Department announced today recent actions taken against two foreign nationals charged with deploying Sodinokibi/REvil ransomware to attack businesses and government entities in the United States. An indictment unsealed today charges Yaroslav…
RansomwareTakedowns and arrests
Federal Indictment in Chicago Charges Turkish National With Directing Cyber Attack on Multinational Hospitality Company
CHICAGO — An alleged cyber attacker from Turkey has been indicted in federal court in Chicago for allegedly orchestrating a distributed denial-of-service (DDoS) attack on a Chicago-based multinational hospitality company. In August 2017, IZZET MERT OZEK used…
Botnets and DDoSTakedowns and arrests
Lumma Infostealer – Down but Not Out?
The takedown achieved a significant disruption to Lumma infostealers’ infrastructure, but likely didn’t permanently affect most of its Russia-hosted infrastructure. Lumma’s developers are undertaking significant efforts to reinstate the activity and to…
InfostealersTakedowns and arrests
Added Sun 12 Apr
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
RansomwareMalwareTakedowns and arrests
Added Fri 10 Apr
Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses
A Ukrainian national pleaded guilty today to his role in two separate and wide-ranging malware schemes involving tens of millions of dollars in losses. “Vyacheslav Igorevich Penchukov was a leader of two prolific malware groups that infected thousands of…
MalwareTakedowns and arrests
Added Thu 9 Apr
Scattered Spider is NOT quiet. They're just under another name now.
Following recent arrests of alleged Scattered Spider members in the UK, Google Cloud’s Mandiant Consulting has reported a noticeable pause in the group’s activities, offering a “critical window of opportunity” for organizations to bolster their defenses,…
Takedowns and arrests
Alleged member of ShinyHunters held in Morocco on Interpol Red Notice, U.S. seeking extradition -- reports
A report by Vincent Monnier in a French news magazine, L’OBS, claims that an alleged member of ShinyHunters was arrested on June 1 as he attempted to board a flight at Rabat to Brussels. In translation, the report says: Arrested on June 1 at Rabat airport,…
Takedowns and arrests
ALTDOS claims some of their servers were seized but they did not lose data
It would be great if the good guys had backups as good as the threat actors have. Threat actors who call themselves “ALTDOS” have re-emerged after a brief hiatus that had left this site wondering if something had happened to them following a joint advisory…
Takedowns and arrests
Are Scattered Spider and ShinyHunters one group or two? And who did France arrest? (1)
When DataBreaches was a kid, the “new math” they were experimenting with had us learning binary and other systems. It didn’t go over well with us, our teachers, or our parents back then. Now the “new math” for me is UNCs — specifically 6040, 5537, 3944, and…
Takedowns and arrests
Added Wed 8 Apr
Deep Dive into UPAS Kit vs. Kronos
In this post we will be analyzing the UPAS Kit and the Kronos banking Trojan, two malwares that have come under the spotlight recently due to the back story behind them. Background In May 2017, WannaCry wreaked havoc in over 150 countries and brought down…
MalwareTakedowns and arrests
Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign
In recent weeks, a new hacktivist campaign has emerged to demand the release of Telegram CEO Pavel Durov, after his arrest by French authorities. In this report, Check Point Research explores the most prominent and dominant hacking groups involved in the…
Botnets and DDoSTakedowns and arrests
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.