Cybercrime

Cryptomus and Heleket: Following Cybercrime's Payment Rails Through a Rebrand

UK sanctions connect Cryptomus and Heleket. The evidence shows why investigators must track payment infrastructure, corporate identities, and customer migration together.

187 Laptops in Texas: How North Korean IT Workers Borrowed a Local Presence

Operation Lonestar Roundup exposes the gap between a local company laptop and the person operating it. Follow the access chain, its evidence limits, and the checks employers need.

Following ShinyHunters: The Digital Breadcrumbs Behind the Investigation

A screenshot, stolen credentials, archived aliases and interviews helped researchers identify Rey. Krebs's latest reporting adds a new chapter to the ShinyHunters investigation.

ShinyHunters Arrest in the Netherlands: What the Evidence Shows and What Defenders Should Check

Dutch police have arrested a suspect in the ShinyHunters investigation. The arrest does not settle who carried out the Odido or FBI incidents; the documented access paths still demand action.

ShinyHunters Claims an FBI Breach: What the Jobs-Site Evidence Actually Shows

The FBI now describes a cyber incident involving FBIJobs.gov. New reporting strengthens the evidence of personnel data theft, while the full scope and entry path remain unresolved.

Initial Access Brokers: The Middlemen Selling Your Network to Ransomware Gangs

IABs breach networks and sell the keys on forums like Exploit and XSS for a few hundred to over $100,000. Here's how the market prices, verifies, and moves access.

FBI Seizes NetNut: How a 2-Million-Device Proxy Botnet Hid Inside Smart TVs

The FBI seized hundreds of domains tied to NetNut after Google and security researchers linked the residential proxy network to Popa, a 2-million-device botnet of smart TVs and streaming boxes.

Operation Endgame Hits SocGholish: FakeUpdates Takedown

Operation Endgame's June 2026 action against SocGholish shows why fake browser updates, compromised WordPress sites, and criminal loader infrastructure still matter to defenders.

How Europol Is Catching Cybercriminals in 2026

Europol does not usually kick down the door. It makes cybercrime investigations cross-border, evidence-rich, and harder for offenders to escape.

Netherlands Seized 800 Servers: Bulletproof Hosting Is Now a Sanctions Problem

Dutch investigators seized more than 800 servers in a sanctions case tied to Stark Industries. The lesson for defenders is simple: attacker infrastructure is a business ecosystem.

Violence-as-a-Service: How Organized Crime Borrowed the Cybercrime Playbook

Europol's OTF GRIMM has made 280 arrests in one year targeting criminal networks that outsource violence like a SaaS product. The model mirrors ransomware-as-a-service — and it's recruiting teenagers through Discord and encrypted apps.