What HappenedIn mid-2026, an emerging cybercriminal group known as ExfilSquad launched a high-profile extortion campaign targeting prominent UK organisations across the public sector, education, and law enforcement, as well as other firms worldwide.Unlike traditional ransomware groups, ExfilSquad does not deploy encryptors or destructive malware. Instead, they operate as a pure data extortion group, stealing data and threatening to publish it on their onion-based Data Leak Site (DLS) if a ransom
In mid-2026, an emerging cybercriminal group known as ExfilSquad launched a high-profile extortion campaign targeting prominent UK organisations across the public sector, education, and law enforcement, as well as other firms worldwide.
Unlike traditional ransomware groups, ExfilSquad does not deploy encryptors or destructive malware. Instead, they operate as a pure data extortion group, stealing data and threatening to publish it on their onion-based Data Leak Site (DLS) if a ransom is not paid.
Several prominent UK entities have confirmed breaches linked to the group:
UK Department for Education (DfE): Approximately 600,000 records stolen from its Help Portal containing parent and staff contact details (names, emails, phone numbers, job titles), plus around 7,000 records from the Turing Portal.
Police National Legal Database (PNLD): Stole 1.9 GB of data (around 135,000 records) containing contact information for over 100,000 serving police officers, staff, and criminal justice professionals, alongside around 21,000 "Ask the Police" public inquiry records.
Newcastle University: Approximately 440,000 records compromised containing applicant and student contact information, personally identifiable information (PII), and admissions database records caused by a technical configuration flaw connecting to an admissions system.
Analysis of the details left on the data leak site revealed that ExfilSquad's primary attack vector involves exploiting misconfigurations in cloud portals, customer relationship management (CRM) platforms, internal case management systems, as well as Microsoft Power Pages data tables left publicly accessible without proper authentication.
To force compliance and prove their claims are real, ExfilSquad uploaded multi-gigabyte torrent files for each victim to their TOR leak site. Resecurity noted that ExfilSquad assigns a distinct Torrent Tracker and initial Web Seed per victim.
Analyst Comment
While ExfilSquad is a new group, they appear to be already experienced at running these types of attacks, suggesting they have a history of cybercrime. Plus, ExfilSquad’s recent campaign highlights the growing trend of transitioning from file-encrypting ransomware to extortion driven entirely by cloud and SaaS misconfigurations. Organisations that have invested in defending against endpoint-based threats are often leaving critical business application interfaces exposed.
SaaS platforms continue to be primary targets of English-speaking cybercrime communities. In recent years, customers of major SaaS providers, such as Salesloft, Salesforce, and Snowflake have all been extorted. Microsoft Power Pages portals, CRM databases, and customer support helpdesks frequently hold vast repositories of sensitive contact data and interaction histories. When internet-facing API endpoints or data table permissions are left unauthenticated or unpatched, cybercriminals can systematically scrape massive volumes of data without ever needing to drop a payload or escalate privileges internally.
ExfilSquad’s reliance on torrent distribution further amplifies reputational and operational damage. While gangs like LockBit, Clop, and Akira have previously utilised torrents, ExfilSquad’s operational twist of assigning unique Torrent Trackers and dedicated Web Seeds to individual victims ensures that leaked files distribute rapidly across P2P networks, making it extremely difficult to perform a takedown.
While ExfilSquad’s breaches have largely compromised contact directories and administrative support records, the real-world risks remain significant. Exposing work emails, names, and organisational structures for over 100,000 police officers and civil servants poses distinct social engineering, spear-phishing, and physical security concerns that impacted institutions will have to manage long after the breach occurs.
Defensive Takeaways
Audit Microsoft Power Pages and Public SaaS Tables: Regularly review public data table permissions, web API settings, and unauthenticated browser views across Microsoft Power Pages, CRMs, and customer support portals to ensure backend data tables are not exposed to the public internet.
Harden CRM and Case Management Integrations: Treat external-facing admissions portals, helpdesks, and case management systems as high-risk platforms. Implement strict access controls, conduct routine configuration audits, and enforce proper API token security.
Deploy External Attack Surface Management (EASM): Utilise continuous external attack surface scanning to detect newly exposed web endpoints, misconfigured database connectors, and publicly exposed storage buckets before malicious actors locate them.
Incorporate Pure Extortion into Incident Response Plans: Security teams must adapt incident response playbooks for data-theft-only scenarios. Organisations may seek to establish protocols for monitoring peer-to-peer (P2P) networks and managing public disclosures when stolen data is distributed via torrents.
What HappenedOn 7 August 2026, the UK Information Commissioner's Office (ICO) disclosed that between July 2021 and June 2023, the ACRO Criminal Records Office suffered three separate compromises involving its customer portal website (acro.police.uk).ACRO is a national police unit providing public services such as issuing Police Certificates, International Child Protection Certificates, and processing Subject Access Requests.In March 2023, ACRO was notified about an SQL injection attack that repo
On 7 August 2026, the UK Information Commissioner's Office (ICO) disclosed that between July 2021 and June 2023, the ACRO Criminal Records Office suffered three separate compromises involving its customer portal website (acro.police.uk).
ACRO is a national police unit providing public services such as issuing Police Certificates, International Child Protection Certificates, and processing Subject Access Requests.
In March 2023, ACRO was notified about an SQL injection attack that reportedly exposed 15 sets of credentials, the majority of which belonged to its employees.
A subsequent forensic investigation uncovered long-term threat actor activity within the website's environment, spanning from 9 July 2021 to 22 June 2023.
The website was built on the Kentico CMS and was running version 12.0.0 between September 2019 and March 2023. This version had multiple known vulnerabilities at the time of the incident, but suffered from ambiguity around who was accountable for patching led to missed hotfixes and updates.
Between 15 and 16 February 2023, an unknown threat actor staged personal data for exfiltration, which included Police Certificate Applications, Subject Access Request (SAR) forms, and International Child Protection Certificate forms.
Due to insufficient log retention, ACRO could not definitively determine if the data was successfully exfiltrated. A maximum of 10,920 data subjects had their data staged, but ACRO ultimately notified 84,048 data subjects on a precautionary basis in April 2023.
Notably, on 23 February 2023, the ICO learned that ACRO's Trend Micro antivirus software detected and quarantined four attempts to install the well-known credential harvesting tool Mimikatz. However, because ACRO operated without a documented patching policy and lacked a structured process for analyzing security alerts, these warnings were never reviewed or acted upon.
Analyst Comment
The Information Commissioner's Office (ICO) reprimand against the ACRO underscores the persistent issue within many organisations of a breakdown in basic IT governance and accountability. The fact that a threat actor was able to operate within the environment for nearly two years highlights systemic failures in both vulnerability management and security monitoring. Running an outdated content management system with known vulnerabilities for several years is a critical oversight. The ambiguity surrounding patching responsibilities created a dangerous blind spot that adversaries successfully exploited.
Further, the failure to act on critical security alerts is also a classic breakdown in the incident response chain. While the deployed Trend Micro antivirus successfully detected and quarantined a known threat, the alerts were ultimately ignored. Security tools are only as effective as the teams monitoring and responding to them. Without a structured review process, even the most sophisticated detection capabilities fall flat.
It is important to note, however, that while private sector organisations will receive a hefty fine for data protection offences, public sector organisations like ACRO receive a public reprimand from the ICO rather than receive a fine that confiscates public funds.
At the time of writing, the data has not yet appeared on any cybercrime forums or underground chat channels. The use of an open source tool like Mimikatz combined with SQL injection attacks indicates a likely opportunistic adversary rather than a stealthy cyber-espionage operation. However, both cybercriminal and nation state groups are known for opportunistic attacks. Current attribution for who or what was responsible this breach remains uncertain from an open source intelligence (OSINT) perspective.
On a positive note, the ICO highlighted that ACRO’s network segmentation effectively prevented the threat actor from pivoting from the compromised web environment into core policing systems. This containment significantly reduced the scale of harm and demonstrates the immense value of architectural defense-in-depth strategies. Following the breach, ACRO has migrated its portal to the Salesforce Experience Cloud for automated patching and hotfixes and implemented a Security Information and Event Management (SIEM) system to improve visibility.
Defensive Takeaways
Establish Clear Accountability for Patching: Organisations must have a documented patching policy with clearly defined ownership, especially for public-facing web applications and Content Management Systems (CMS). Ambiguity in IT governance directly leads to unpatched vulnerabilities which then get exploited.
Implement Structured Alert Monitoring: Deploying antivirus or Endpoint Detection and Response (EDR) solutions alone is insufficient if alerts are not actively monitored and investigated. It is recommended to establish either structured internal processes or an outsourced 24/7 Managed Detection and Response (MDR) or SOC service to review and respond to critical security alerts promptly.
Maintain Robust Network Segmentation: Ensure that public-facing web infrastructure is strictly segmented from internal corporate networks and core operational systems. As demonstrated in this incident, strict segmentation is a crucial control for stopping an attacker's lateral movement.
Ensure Adequate Log Retention: Insufficient logging severely hinders incident response and forensic investigations. Implement comprehensive logging policies and utilise a SIEM to aggregate logs, ensuring they are retained long enough to accurately determine the scope of data exfiltration during a compromise.
What HappenedNew data published by the City of London Police in June 2026 reveals that courier fraud losses exceeded £21 million in 2025, with individuals aged over 70 being heavily targeted. The highest concentration of these offenses was recorded in London and the Home Counties.Cybercriminals and fraud syndicates are actively evolving their operational tactics, increasingly pivoting to messaging platforms like WhatsApp to contact their victims and remotely paying for third-party courier servic
New data published by the City of London Police in June 2026 reveals that courier fraud losses exceeded £21 million in 2025, with individuals aged over 70 being heavily targeted. The highest concentration of these offenses was recorded in London and the Home Counties.
Cybercriminals and fraud syndicates are actively evolving their operational tactics, increasingly pivoting to messaging platforms like WhatsApp to contact their victims and remotely paying for third-party courier services to facilitate physical collections.
UK law enforcement also highlighted a dangerous shift in 2025 toward high-value physical goods. Victims are being systematically manipulated into visiting multiple jewellers over an extended period to purchase gold and expensive jewellery, which they then hand directly to fraud couriers.
Recent operational crackdowns by UK Regional Organised Crime Units (ROCUs) showcase the nationwide scale of these networks:
North West ROCU Operations (July 2026): Police executed coordinated search warrants in Huddersfield and Manchester, arresting two men (aged 21 and 25) on suspicion of Conspiracy to Defraud and Money Laundering. In this specific series, the suspects impersonated bank fraud departments, convinced a victim her card was compromised, sent a courier to collect it, and immediately exploit the physical card to make numerous fraudulent transactions.
North East ROCU (NEROCU) Sentencing (June 2026): A complex, cross-country courier fraud operation spanning March to May 2022 concluded with a prison sentence for a primary operative. The network targeted 14 separate victims, convincing them to hand over physical bank cards and PIN numbers under the guise of an internal "investigation" by their bank's fraud department. The group scammed a total of £56,000, which was then rapidly laundered through the high street purchase of smartphones, designer clothing, and luxury jewellery.
Analyst Comment
Courier fraud is effectively a hybrid cyber-physical social engineering campaign. While the final phase relies on a physical courier arriving at a victim’s doorstep, the initial approach relies heavily on psychological manipulation and email, message, or phone call-based deception.
This type of fraud is notable as it follows a structured cybercriminal playbook that bypasses detection systems and takes advantage of the vulnerable in society. The victim is instructed to bypass normal banking security controls by withdrawing cash, disclosing sensitive credentials (like PINs), or purchasing high-value physical commodities like gold or luxury jewellery. This makes it difficult to proactively detect and prevent.
The other concerning factor is the couriers themselves. According to reports, they can be an unwitting third-party courier service that is paid to go to the victim's home to collect the assets. Online services enable cybercriminals to organise these pickups remotely, lowering their risk of being caught.
The £21 million sizeable loss metric from 2025 shows how profitable this low-tech, high manipulation vector remains. The recent shift to targeting gold and luxury jewellery is a deliberate evasion tactic against traditional anti-money laundering (AML) and banking fraud detection algorithms. While banks have grown adept at flagging unusual rapid bank transfers, they cannot easily stop an account holder from physically withdrawing funds or using a card over several days at different brick-and-mortar luxury retailers. This tactic serves as a highly liquid physical laundering pipeline for these syndicates that remains a challenge to prevent.
Defensive Takeaways
Implement Bank Transfer and Purchase Outlier Alerts: Financial institutions can focus on further behavioural monitoring for elderly demographics, looking specifically for sudden, consecutive high-value transactions at physical luxury retail or jewellery establishments and flag patterns on unusual activity for review.
Public Awareness on Cross-Media Scams: Security awareness campaigns must make it clear that legitimate institutions, specifically the Police and Banking Fraud teams, will never send a courier to a residential address to collect cash, PIN numbers, bank cards, or purchased items.
Vetting of Courier Logistics: Commercial courier services are increasingly being abused as infrastructure by these threat groups. Logistics firms must implement logging and analysis systems to detect unusual residential pickups booked via suspicious accounts and forged identities.
What HappenedThroughout H1 2026, the Qilin ransomware-as-a-service (RaaS) Tor data leak site (DLS) listed the most UK-based victims out of all ransomware gangs, with up to 37 British organisations hit in total. Qilin's victim count is followed by DragonForce with 21 victims listed, and TheGentlemen with 18 listed.The fallout from the Qilin attack on the UK National Health Service (NHS) supplier, Synnovis, in 2024 persists as well. On 1 June 2026, the Bedfordshire Hospitals NHS Foundation Trust
Throughout H1 2026, the Qilin ransomware-as-a-service (RaaS) Tor data leak site (DLS) listed the most UK-based victims out of all ransomware gangs, with up to 37 British organisations hit in total. Qilin's victim count is followed by DragonForce with 21 victims listed, and TheGentlemen with 18 listed.
The fallout from the Qilin attack on the UK National Health Service (NHS) supplier, Synnovis, in 2024 persists as well. On 1 June 2026, the Bedfordshire Hospitals NHS Foundation Trustdisclosed that over 32,000 patient data records related to Synnovis tests were exfiltrated and took over a year to analyse what information was related to which patient. The breached data includes patient name and number, date of birth, postcode, and test results.
In H1 2026, Qilin averaged between seven and nine published UK victims per month. For the entries listing an estimated attack date, there was a roughly six-week extortion lifecycle on average, from initial intrusion to the date the victim is publicly named.
This UK footprint highlights their aggressive pursuit of Small-to-Medium Enterprises (SMEs) as most organisations had a revenue between £10m and £250m.
Interestingly, one of the Qilin victims, Salford City College, also appeared on both the Qilin and DragonForce Tor data leak site (DLS) only a few days apart from 6 March to 10 March 2026, respectively.
Qilin’s UK-based victims from H1 2026 spanned a diverse range of sectors:
Construction & Property Development
Manufacturing & Engineering
Legal & Professional Services
Technology & IT Infrastructure
Education
Healthcare
Analyst Comment
Many of the organisations targeted by Qilin operators are just large enough to have the funds to pay mid-tier ransoms but often never got around to making an investment into a 24/7 dedicated threat detection service, such as an outsourced Security Operations Centre (SOC). Such services are usually enough protection to prevent an attack. If a ransomware affiliate faces tough resistance from a target, they often move on to a weaker and easier one.
One key face to also note about Tor data leak sites operated by ransomware groups is that they include victims who failed to pay the ransom. The total number of victims by each group is often going to be higher.
The reason for the cross-posting of Salford City College is unknown for now. However, it could indicate that an affiliate may be using both Qilin and DragonForce RaaS platforms. An alternative theory could be that the college was hit by two affiliates of each RaaS. Interestingly, cross-posting on multiple leak sites is not as uncommon as it seems. Some victims listed on the Qilin leak site have historically appeared on the leak sites of ALPHV/BlackCat and Conti as well.
The Ransomware Vulnerability Matrix Group Profile for Qilin reveals a diverse set of exploits leveraged by its operators. Like many other ransomware gangs, Qilin operators have exploited corporate VPN gateways such as Fortinet, Check Point, and WatchGuard for initial access. Interestingly, the exploitation of SmarterTools SmarterMail and SolarWinds Web Help Desk is less common but are also exploited by the Warlock ransomware gang. Another common theme from Qilin's Ransomware Tool Matrix Group Profile is their regular abuse of Bring Your Own Vulnerable Driver (BYOVD) tactics to bypass Endpoint Detection and Response (EDR) and Antivirus software.
Defensive Takeaways
Harden Common Attack Paths: Treat any web-facing helpdesk or mail server as a high-risk device. If it does not absolutely require open internet access, place it behind a zero-trust network access gateway or a strict VPN. Enforce strict phishing-resistant Multi-Factor Authentication (MFA) on all remote access points. Ensure processes are in place for rapid patching and integrity checks for all corporate VPN gateways.
Overcoming SME Resource Caps: Organisations must bridge the gap with an outsourced MDR service. Ransomware execution routinely happens at 2:00 AM on Fridays and weekends. Outdated antivirus agents alone are not enough to stop a motivated human adversary.
Utilise Free Support Services:Capitalise on sovereign and community-vetted threat intelligence feeds to block attacker infrastructure early. UK defenders should actively enroll in the National Cyber Security Centre’s MyNCSC portal and integrate community resources like the Spamhaus DROP list and Abuse.ch tracking into their perimeter firewalls to automatically block known ransomware command-and-control (C2) nodes. ShadowServer and Team Cymru also offer useful free community resources.
What HappenedHMRC Issues Warning to TikTok UsersOn 4 June 2026, HM Revenue and Customs (HMRC) uncovered a suspected £153 million tax fraud scam involving TikTok.The scheme allegedly involved individuals posting advertisements on the TikTok, enticing users to hand over sensitive tax information, including business VAT registration details or personal self-assessment credentials for a financial reward.Using the stolen tax details, the fraudsters could file bogus repayment requests with HMRC.The wa
On 4 June 2026, HM Revenue and Customs (HMRC) uncovered a suspected £153 million tax fraud scam involving TikTok.
The scheme allegedly involved individuals posting advertisements on the TikTok, enticing users to hand over sensitive tax information, including business VAT registration details or personal self-assessment credentials for a financial reward.
Using the stolen tax details, the fraudsters could file bogus repayment requests with HMRC.
The warning comes after two Romanian men, aged 22 and 25, were apprehended by HMRC officers in east London on 23 April 2026 in connection with the alleged fraud.
Lloyds Bank found Two Thirds of Fraud Cases Started on Meta
On 6 June 2026, Liz Ziegler, the Lloyds fraud prevention director disclosed that 68% of fraud reports from their customers started on a Meta platform, including Facebook, Instagram, and WhatsApp.
The average claim value submitted to Lloyds Bank is now above £500, an increase of about £100 from last year. Plus, victims were sending up to £66 million a year to fraudsters after falling victim to a scam advert via Meta, up from £27 million in 2023.
The most common scams involve fake tickets for concerts, festivals and sporting events. Meta’s Facebook Marketplace is also plagued by fake adverts for cars, bikes, campervans and mobility vehicles.
Other categories of fraud on Meta platforms, collected by Lloyds between March 2025 and 2026, include: wedding photobooths, tattoo deposits, vapes, wigs, Moncler jackets, football shirts, Dyson products and Amazon Alexas. Fraudulent transactions for deposits for flats, mobile phones, household furniture and gym equipment have also been observed.
UK Finance Recorded £221.5m Lost to Investment Scams
In June 2026, UK Finance's Annual Fraud Report recorded the highest loss total ever recorded and the highest total number of cases ever reported at 14,893, which was 26% higher than 2025.
Up to £221.5m was lost to scams in which victims were persuaded to transfer funds to a fake investment or fictitious fund. This figure also marked a 40% rise more than 2025.
The primary observed tactics involved in investment scams include traditional cold calling to pressurise victims into acting quickly to claim an opportunity before it expires, as well as adverts on social media offering unrealistic rates of returns on investments, and hand-delivered letters.
The types of investments fraudsters used as bait in 2026 involved gold, property, carbon credits, cryptocurrencies, land banks, and wine.
Fraudsters arrested in Nigeria following NCA intelligence sharing
In February 2026, the National Crime Agency (NCA) announced that seven men were arrested in Nigeria after intelligence identified an online investment scam compound targeting UK victims. These arrests were the result of co-operation between the National Crime Agency, Meta and the Nigerian Police.
Using hundreds of fake Facebook accounts accounts to impersonate cryptocurrency traders, the Nigeria-based scammers targeted people who used legitimate investment platforms.
The scam compound was also allegedly recruiting and training young people in targeting victims for future investment frauds and phishing attacks. A total of 26 phones, 42 sim cards and a laptop were seized on 13 January.
Analyst Comment
H1 2026 reinforces the transition from email-centric fraud campaigns to social-media-powered fraud operations, with platforms increasingly serving as the primary source of victims for organised cybercriminal groups. Fraudsters are also adapting scams to the culture and user behaviour of individual platforms, such as generate short promotional videos on TikTok or listing fake items for sale on Facebook Marketplace. Rather than deploying identical scams everywhere, criminals tailor campaigns to the platform's intended purpose. Recommendation algorithms and advertising ecosystems provide fraudsters with scalable victim acquisition channels that were previously unavailable through traditional phishing campaigns.
Advances in artificial intelligence (AI) and large language models (LLMs) has also meant it is much easier for cybercriminals to carry out scams on a much larger scale than they were previously able to. Autonomous systems can enable them to send out messages at scale and contact users by telephone at scale. Plus the scam attempts are also more convincing as they can mimic voices and appearance of celebrities or even a target’s friends and family.
The scale of fraudulent activities across social media is so large, it requires vast resources and expertise to monitor, detect, and prevent. At the same time, the response from HMRC, banks, social media companies, the NCA, and international law enforcement suggests increasing recognition that combating social media fraud requires coordinated action.
The volume of fake accounts on social media used for scams does also validate the calls for increased verification and security checks on such platforms. The UK Government's proposal to introduce a national digital ID system, however, was met with fierce opposition. Up to 2.9 million people signed a UK parliament petition to show their disagreement with such a system.
Defensive Takeaways
Reduce Public Exposure: Fraudsters increasingly use information shared on social media to personalise scams and identify potential victims. Consider making profiles private or limiting visibility to trusted contacts and if you no longer actively use a social media platform, consider deleting the account entirely.
Be on Guard for Scams: Sponsored advertisements should not automatically be considered legitimate. Refuse any financial rewards in exchange for your login credentials. Be cautious of investment opportunities promoted solely through social media. Assume Facebook Marketplace listings can be fraudulent.
Report Suspicious Activity: Reporting scams helps remove fraudulent content and supports law enforcement investigations. Useful UK reporting channels include Report Fraud and the UK NCSC's Suspicious Email Reporting Service report@phishing.gov.uk.
Seek Support after a Scam: Victims should not assume financial losses are unrecoverable. It can be possible to get funds returned if they contact their bank immediately, preserve screenshots and transactions records, and report the incident to Report Fraud. Further, if a victim is dissatisfied with how their bank handled their case, they can complain to the Financial Ombudsman Service.
What HappenedNemesis Dark Web Drug Dealers ArrestedOn 14 May 2026, two Cambridgeshire drug dealers were sentenced after being arrested in July 2024 by the Eastern Region Special Operations Unit (ERSOU).ERSOU officers recovered Royal Mail parcel labels, order lists, Gorgonites-branded packaging, and a USB memory stick containing login credentials for multiple dark web marketplace accounts.The dealers reportedly used the dark web to supply heroin, cocaine, and amphetamine to hundreds of users acro
On 14 May 2026, two Cambridgeshire drug dealers were sentenced after being arrested in July 2024 by the Eastern Region Special Operations Unit (ERSOU).
ERSOU officers recovered Royal Mail parcel labels, order lists, Gorgonites-branded packaging, and a USB memory stick containing login credentials for multiple dark web marketplace accounts.
The dealers reportedly used the dark web to supply heroin, cocaine, and amphetamine to hundreds of users across the UK.
The drug deals were initially arranged via a Telegram channel under the handle Gorgonites, which was linked to at least 570 individual sales on Nemesis Market since September 2023.
AEGIS Dark Web Drug Market Seizure
On 17 March 2026, the London Metropolitan Police’s Cyber Crime Unit announced the seizure of AEGIS Marketplace.
In June 2025, the Met Cyber Crime Unit became aware of AEGIS Marketplace, which was a site where individual sellers could market drugs for sale to users who could make purchases using cryptocurrency.
By March 2026, the website had 30 active sellers and was estimated to have generated 10,000 drug sales in ten months, leading to an estimated annual turnover of almost £2 million.
Officers from the Met managed to infiltrate the site, retrieving server data that led to the identification of administrators, sellers and customers.
Online Killers Marketplace (OKM) Admins Arrested
On 19 January 2026, two suspects were arrested in Romania as part of an ERSOU investigation into a bogus ‘harm-for-hire’ website which offered services including murder.
The arrests were connected to a dark web scam website called Online Killers Marketplace (OKM), which purported to facilitate criminal activities including the hiring of hitmen and extortion.
ERSOU noted that even though none of the services OKM offered were genuine, successful prosecutions have previously been pursued by police forces of individuals attempting to use it to cause harm to others.
The investigation led to the seizure of US crypto currency worth at least $600,000, as well as cash which included almost €50,000 Euros, and around £48,000 worth of Romanian Leu.
Analyst Comment
The anonymity and connectivity of encrypted messaging apps, the Tor network, cryptocurrency, and online marketplaces makes it nearly impossible to prevent such crime. However, law enforcement can achieve strategic containment by targeting specific infrastructure for seizure and individuals for arrest. These activities support the overall strategy for national law enforcement agencies is to deter criminals from being active in their country.
Telegram is increasingly used as a front-end service for all sorts of cybercrime activities. As seen in the Nemesis investigation, the dealers operated a Telegram channel under the handle Gorgonites to coordinate and funnel buyers toward more secure transactions. It is an easy-to-use mobile application that makes access to such illicit services simple for buyers. It is more accessible than having to download the Tor browser and use a desktop or laptop browser. Many of these illicit services also would not exist without cryptocurrency. The ability to send funds via peer-to-peer networks and obfuscate transactions continues to be the main enabling factor for most cybercrime operations.
Interestingly, the sole administrator of Nemesis Market was sanctioned in March 2025 by the US Treasury OFAC department. The admin was an Iran-based individual named Behrouz Parsarad. Prior to its takedown by law enforcement in March 2024, Nemesis had over 30,000 active users and 1,000 vendors and facilitated the sale of nearly $30 million USD worth of drugs around the world between 2021 and 2024.
Defensive Takeaways
Blockchain Analytics:While cryptocurrency provides a layer of perceived anonymity for illicit markets it also leaves a permanent, public ledger. Law enforcement and threat intelligence firms, such as TRM Labs and Chainalysis, can leverage blockchain analytics to follow the money and deanonymise the administrators. By mapping transaction inputs and outputs, investigators can trace mixed funds, identify exchanges used to cash out into fiat currency, and map the financial infrastructure of a marketplace.
Breach Data Pivoting: To catch these cybercriminals, threat intelligence analysts can use historical breach data repositories to pivot from a known dark web alias or leaked credential to find a real-world identity. If an administrator used the same password or a variation of a username on a compromised gaming forum ten years ago, that footprint can blow their operational security (OPSEC).
Profile Scraping: Dark web vendors and market admins often leave massive digital footprints across forums, marketplaces, and messaging apps like Telegram. Continuous profile scraping can be achieve via automated bots to collect vendor profiles, feedback ratings, PGP keys, styles of writing (stylometry), and active hours. By aggregating this data over time, defenders can create a comprehensive profile of a target and identify them.
Dark Web Market Sock Puppet Accounts: Law enforcement and threat intelligence analysts can deploy sock puppets accounts, which are undercover, synthetic personas, into these dark web ecosystems. These accounts are kept for long periods of time and actively posting in an attempt to build trust within the cybercrime underground. Investigators can use them to buy products, interact with admins, and gain access to private vendor portals or escrow systems to support evidence gathering for a takedown.
Infrastructure Analysis: As dark web markets rely on servers, hosting providers, DNS, and Tor is is possible to analyse these attributes and look for configuration mistakes. This can include exposed IP addresses, trackable X509 certificates, or open port banners that reveal the true location of a hidden service. Once a server's true IP is uncovered, law enforcement can issue subpoenas to hosting providers or execute physical raids to seize the hardware and unmask administrators, vendors, and buyer databases.
What HappenedOn 9 June 2026, the University of Nottingham was listed as a victim on the ShinyHunters Tor data leak site.The attackers leaked over 40GB of billing and payment records, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses.The data stolen includes contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data.
On 9 June 2026, the University of Nottingham was listed as a victim on the ShinyHunters Tor data leak site.
The attackers leaked over 40GB of billing and payment records, student finance data, and campus portal exports from the University of Nottingham and its Malaysia and China campuses.
The data stolen includes contact information, transaction amounts, IP addresses, full names, home addresses, postcodes, email addresses, phone numbers, dates of birth, and other internal campus data.
Further analysis of the leaked data by Have I Been Pwned revealed it also contained over 455,000 unique email addresses along with extensive personal information including ethnicities, disabilities, and passport numbers.
On 10 June 2026, security researcher @nahamike01 uncovered an exposed server belonging to ShinyHunters and found them targeting Oracle PeopleSoft servers using MeshCentral agents. Plus, analysis the bash_history logs on the server uncovered SSH connections to the IP address hosting the ShinyHunters Tor data leak site.
On 11 June 2026, Mandiant and Google Threat Intelligence Group (GTIG) disclosed they have observed active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure via a zero-day now tracked as CVE-2026-35273, a critical remote code execution (RCE) vulnerability (CVSS 9.8).
Analyst Comment ShinyHunters is a prolific feature of current threat landscape. This adversary appears to have a particular focus on the educational sector. Last month in May 2026, ShinyHunters targeted another provider of educational software: Instructure Canvas. A number of other UK universities were also impacted by the Instructure breach.
The education sector in the US and UK has suffered repeated, significant data breaches in recent years. In January 2025, BleepingComputer reported that PowerSchools, a cloud-based software provider, suffered a breach whereby the data of 62.4 million students and 9.5 million teachers was exfiltrated. Also in June 2026, the University of Oxford also disclosed a data breach impacting its CareerConnect platform. Separately, 13 schools in Powys county in Wales were impacted by a data breach in April 2026.
After the Oracle E-Business Suite zero-day campaign by CLOP in October 2025, this campaign by ShinyHunters against Oracle PeopleSoft is yet another blow for Oracle. Google identified over 100 exposed organisations, and noted that 68% are academic institutions, including universities and colleges worldwide. More are likely to have been victimised by ShinyHunters and listed on their Tor data leak site in the coming weeks.
Defensive Takeaways
Patch Oracle PeopleSoft: Internet-facing applications, such as file transfer servers or cloud-based software need to be prioritised for patches and updates. Checking the integrity of such systems while patching is also key to finding undetected compromises. Proactively ingesting event logs and threat hunting for suspicious activities involving these systems is also key to prevent breaches.
Prioritise Education Software Security: Education sector firms or cybersecurity companies with education sector clients must react to the elevated threat, by pen-testing, threat hunting, and threat intelligence sharing. Cybercriminal adversaries like ShinyHunters often exploit internet-facing applications or use stolen credentials for initial access. It is therefore critical to focus on these tactics, techniques, and procedures (TTPs) to prevent their attacks.
Follow the Data Breach Alert Playbook: Impacted victims must begin to rotate credentials, and start the laborious task of requesting new identity documents and codes like national insurance numbers or passports. It is also worth investing in some credit monitoring services as well to prevent loans being taken out in your name.
What HappenedOfficers from the Dedicated Card and Payment Crime Unit (DCPCU), jointly run by the London Met Police and City of London Police, secured the conviction of a man who used an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London.The conviction relates to an investigation that previously led to the sentencing of Ruichen Xiong in July 2025, who was apprehended while driving a vehicle in North London as the device was in operation. Duri
Officers from the Dedicated Card and Payment Crime Unit (DCPCU), jointly run by the London Met Police and City of London Police, secured the conviction of a man who used an SMS Blaster device to send fraudulent text messages as part of an organised criminal operation in London.
The conviction relates to an investigation that previously led to the sentencing of Ruichen Xiong in July 2025, who was apprehended while driving a vehicle in North London as the device was in operation. During that incident, officers in the vicinity received fraudulent text messages purporting to be from HMRC.
Ruichen Xiong was a student from China who drove around London using the SMS Blaster between 22 and 27 March 2025, sending messages to tens of thousands of potential victims.
Following Xiong’s arrest and subsequent conviction, enquiries identified another individual called Di Li who was a key organiser. Li facilitated Xiong’s involvement by arranging access to the device, assisting with obtaining a vehicle, and supporting his day-to-day living costs.
Xiong had accrued significant gambling debts after arriving in the UK as a student. To pay off his debts, Li instructed that he could repay what he owed by driving routes in a car with the SMS Blaster.
On 20 August 2025, officers searched Li’s home address, where digital evidence was recovered showing communications between Li and Xiong relating to the deployment of the SMS blaster. Li was arrested on 1 September 2025 and charged with offences linked to the operation.
At the court trial, Li’s defence was that the device was intended for “advertising” purposes and described himself as a middleman acting on behalf of an individual based in China. He maintained that he had been merely attempting to help Xiong repay his debts.
Analyst Comment
An SMS Blaster acts as a portable mobile phone mast that forces nearby mobile devices to connect to it by silently downgrading it to 2G while they try to connect to 5G or LTE. By doing so, criminals can bypass safeguards designed to block malicious senders and harmful links, enabling them to deliver fraudulent messages directly to victims nearby without needing their phone numbers. The SMS Blaster allow an operator to customise all aspects of the messages, so they can make it look like it has come from a genuine organisation like HMRC, the UK tax authority.
SMS Blasters are a relatively new technology for scammers. Police in the UK only encountered them for the first time in 2025, but they have been used in other parts of the world. SMS Blaster are also a type of IMSI catcher that mirrors the capability of law enforcement tools such as a Stingray.
When used in busy metropolitan areas, they allow criminals to easily send out SMS phishing messages to hundreds of people at a time. These SMS messages typically have a malicious link that host scam websites that trick victims into entering their personal details. These details can then used by fraudsters to make payments, steal funds, or resell it to others.
This report also highlights the concerning trend of organised cybercrime gangs from China are actively hunting for individuals who are financially vulnerable (like students with gambling debts) to conduct high-risk in-person operations.
Defensive Takeaways
Block and Report: If you receive a suspicious text message, do not engage with it. Instead, forward it to 7726, a free reporting service, and block the number.
Move Away from SMS: If your organisation relies on SMS for One-Time Passcodes (OTPs), this threat highlights that the SMS sender ID can be perfectly spoofed locally. Organisations should migrate to authenticator apps, hardware tokens, or application push notifications to avoid spoofing.
Proactive Takedown Programs: Since the attack relies on hosting malicious links to harvest credentials, defenders can perform proactive domain monitoring. Detecting and taking down lookalike domains immediately minimises the impact.
What HappenedOver the course of September 2025 to May 2026, Hargreaves Lansdown the UK-based investment platform has been the subject of IT glitches, hacker claims, and technical outages that have triggered rumours and customer concerns.On 11 September 2025, Hargreaves Lansdown customers reported discrepancies in the balances for their pension and ISA accounts, appearing as if huge sums had been mysteriously withdrawn. Customer began to fear they had been “hacked” after they logged onto their ac
Over the course of September 2025 to May 2026, Hargreaves Lansdown the UK-based investment platform has been the subject of IT glitches, hacker claims, and technical outages that have triggered rumours and customer concerns.
On 11 September 2025, Hargreaves Lansdown customers reported discrepancies in the balances for their pension and ISA accounts, appearing as if huge sums had been mysteriously withdrawn. Customer began to fear they had been “hacked” after they logged onto their account and saw their life savings reduced. In less than 24 hours, Hargreaves Lansdown, however, swiftly responded that it was a temporary technical issue that only lasted 45 minutes and all client balances were restored.
On 20 March 2026, Hargreaves Lansdown customers began experiencing technical issues that were affecting some parts of its website and app. The company apologised to customers over IT issues which left them unable to access their accounts during a period of heightened volatility in the financial markets. The company also assured people that there was no evidence of a cyber incident or a data breach and that all customers’ assets and data was secure.
On 27 April 2026, Hargreaves Lansdown (hl.co.uk) was listed as a victim on the Bashe Tor data leak site. The attacker claimed that they allegedly stole their customer database of 658,259 unique users. They then shared five links to their other servers where other Tor users can download the alleged data.
On 8 May 2026, the alleged Hargreaves Lansdown data appeared on DarkForums, a cybercrime forum. From the sample posted, the database offered contains addresses, names, emails, phone numbers, and date of birth. However, no Hargreaves Lansdown customer account numbers or transaction details were included in the sample.
Analyst Comment
Hargreaves Lansdown is the UK's largest direct-to-consumer investment platform, allowing customers to buy and sell investments such as shares, as well as providing financial advice and offering accounts like cash ISAs.
Activesince April 2024, Bashe (aka APT73 or Eraleign) is a cybercriminal group that focuses on data-theft-extortion and ransomware. Analysts at CloudSEK found that APT73 fabricates attacks by falsely claiming responsibility for high-profile breaches, aiming to attract affiliates and bolster its credibility. They are known for taking credit for attacks that either weren’t committed or wasn’t done by them.
Analysis of the sample data posted to DarkForums and the Bashe Tor data leak site revealed it to be purposely selected UK-based user records. Using HaveIBeenPwned to check the email addresses, the DarkForums sample email all appeared inside the Verifications[.]io breach as well as the People Data Labs (PDL) customer breach. This is unusual for recently leaked data and likely points to both the Bashe and DarkForums sharing fake data.
Further, data from a financial trading platform such as Hargreaves Lansdown would be considered highly valuable on the cybercrime underground and could be sold for a high large amount of cryptocurrency. Therefore, it is again unusual for it to be dumped for free on a forum or Tor site. Based on the technical analysis of the leaked data sample and the established behavioural patterns of the threat actor, it is assessed with high confidence that the alleged data breach of Hargreaves Lansdown is entirely fabricated.
It appears Bashe opportunistically weaponised Hargreaves Lansdown’s recent, IT outages and glitches (in September 2025 and March 2026) to construct a plausible, but false, narrative of a successful hack. By capitalising on pre-existing customer anxieties regarding platform stability, these cybercriminals attempted to reinforce their claims and extort their target for a quick ransom.
This incident highlights an evolving trend where threat actors substitute complex technical exploits with psychological manipulation.
Defensive Takeaways
Counter Adversary Threats: To counter this trend, UK firms must integrate their public relations (PR), incident response, and threat intelligence teams. Quick, transparent communication that explicitly decouples internal IT glitches from external cyber threats remains an effective defence against brand-damaging, clout-chasing extortion tactics.
Precautionary Threat Hunting: Even in a fake breach scenario, it is still important to threat hunt for malicious and suspicious activities involved potentially targeted systems to help prove that the alleged data exfiltration never happened. In this scenario, the attacker claimed to have stolen customer database. Therefore, it would be prudent to hunt for any signs of data theft involving systems hosting customer data specifically.
Precautionary Password Resets: In a scenario like this, companies may want to trigger a precautionary customer password reset “just to be on the safe side”. However, credential rotation must be calculated, automated, and decoupled from any fear, uncertainty, and doubt (FUD). If an incident response includes this action, it must be a measured approach. Triggering a mass password reset without tailored communications can unintentionally support the cybercriminals fake breach narrative and could trigger mass panic.
What Happened:On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec. On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project w
On 10 May 2026, the UK-based firm Arup Group was listed as a victim on the Tor data leak site of FulcrumSec.
On their Tor data leak site, FulcrumSec stated that they have exposed 700GB of GitHub repos and 2TB of Azure and AWS S3 cloud, plus database backups.
Other types of data the adversary claims to have stolen includes Neuron BMS client databases, Odoo ERP data, A66 landowner files, Apple code-signing certificates with plaintext passwords, a Google Cloud Platform (GCP) project with production payment gateway credentials, and the source code of ArupCompute and Oasys.
The FulcrumSec operators also claimed to have spent over half a year analysing the data and went through “email correspondence” with the company before publishing the stolen data.
On the victim post, FulcrumSec wrote a detailed incident breakdown. In it, they stated they gained initial access in September 2025 via a GitHub personal access token found hardcoded in a JavaScript file on a forgotten subdomain, which provided access to over 10,000 private GitHub repositories belonging to Arup Group.
From there, they scanned the repositories and found additional hardcoded tokens, API keys, and passwords for AWS, Azure, and databases.
The adversary stated that Arup detected the Github and Azure Storage intrusions approximately six weeks after they happened and rotated the credentials, but it was too late as the data had been exfiltrated.
FulcrumSec also stated they pivoted into the AWS infrastructure using keys they had found belonging to Arup’s subsidiary Neuron.
FulcrumSec allegedly waited until April 2026 to contact their victim, Arup Group, due to the time it took to analyse the vast amounts of stolen data.
Impacted client organisations of Arup Group were also mentioned in the post, such as Disney and several other Hong Kong companies. The adversary reportedly uncovered Amazon data center seismic fragility data, British Petroleum (BP) site selection coordinates, and Queensferry Crossing internal documents as well.
Critically for the UK, the breached data exposed up to 62 HS2 related GitHub repositories. This involved Euston Station pile design files, ground movement assessments, over 14,000 sensor monitoring records, 48 archaeological site GPS coordinates (including Jones Hill Wood, a sensitive site for environmentalists), as well as confidential documents.
Analyst Comment:
Arup Group is a large multinational architectural design and engineering firm based in London who has been involved in constructing the Wembley Football Stadium in London, the HS1 Channel Tunnel Rail Link network, and the Eden Project in Cornwall, among other significant international construction projects.
Active since September 2025, FulcrumSec is a financially motivated data-theft-extortion group that specialises in rapid exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions.
This attack was noteworthy due to its highly targeted nature. FulcrumSec claimed they had access to Arup Group’s data for seven months and they clearly invested significant time to analyse the documents and spent weeks negotiating over email. Plus, to find initial access they also would have had to spend time checking Arup’s domains and Internet-facing assets to eventually find a single leaked credential to exploit. These types of targeted intrusions often only happen to large companies. This is because for it to be worth the cybercriminal’s time, effort, and risk to their freedom they will want a large ransom payment that only rich companies can typically afford.
FulcrumSec is an adversary worth monitoring due to the effort they put into their intrusions compared to other smash-and-grab ransomware campaigns. In October 2025, in a case documented by VX-Underground, FulcrumSec emailed detailed information about the breach they conducted with the aim of those details getting published and exert additional pressure on the victim.
Interestingly, FulcrumSec said the ransom they demanded was less than 1% of Arup’s annual revenue and was less than how much Arup lost to the deepfake fraudsters. This is a reference to Arup reportedly lost over £20 million pounds in 2024 after one of their Hong Kong employees was duped into sending cash to cybercriminals using an AI-generated video call. The fact Arup became publicly known for falling victim to a large scam potentially contributed to the adversary’s decision to select and focus them for this attack.
Defensive Takeaways:
Asset Inventory and Shadow IT Audits: Identifying the outdated unused domains with hardcoded credentials is standard best practices. All organisations must have processes in place to catalog and retire systems to avoid incidents like this.
Hardcoded Credentials in Code: They way FulcrumSec gained access demonstrates the importance of using secret environment variables and features like GitHub Secret Scanning.
Implement Incident Response Procedures: Importantly, Arup detect the activity too late and it took them a staggering six weeks to rotate credentials (according to the adversary), which shows why having automated systems to check for unauthorised usage and reset tokens and all accounts is crucial to respond to such attacks.
GitHub Activity Monitoring: The adversary claimed they were able to clone thousands of GitHub repositories containing sensitive data without being detected. These types of activities are available to monitor and detect in GitHub Audit Logs. It’s also important to have a plan in place when suspicious activities are detected.
Third-Party Risk Management Programs: This incident also had some notable downstream impact. It shows why client organisations of another company’s services need to know what data and how much data is stored by third-parties for when such breaches occur. Knowing what’s potentially exposed will streamline the response to the incident.
Deception Tech: Arup could have implemented a boobytraps for the adversary such as the use of CanaryTokens inside sensitive documents. As the adversary spent time analysing the Arup’s documents before contacting them, if they open a boobytrapped document, then the incident could been detected much earlier and the damages could have been reduced.
What Happened:On 3 May 2026, ShinyHunters, the English-speaking adolescent cybercrime collective, claimed they breached Instructure by listing them on their Tor data leak site.Instructure is a US-based software provider behind the widely adopted Canvas Learning Management System (LMS). ShinyHunters reportedly exfiltrated 3.65 terabytes of data, spanning 275 million global records from up to 9,000 institutions, before posting extortion messages across university login portals demanding Bitcoin.T
On 3 May 2026, ShinyHunters, the English-speaking adolescent cybercrime collective, claimed they breached Instructure by listing them on their Tor data leak site.
Instructure is a US-based software provider behind the widely adopted Canvas Learning Management System (LMS).
ShinyHunters reportedly exfiltrated 3.65 terabytes of data, spanning 275 million global records from up to 9,000 institutions, before posting extortion messages across university login portals demanding Bitcoin.
The outage forced prominent UK higher education institutions, including the University of Liverpool, Queen’s University Belfast, and the University of Manchester, to take systems offline and hastily rewrite their end-of-year exam submission schedules.
Instructure confirmed the affected data includes names, student ID numbers, email addresses, and private student-instructor messages. Instructure also confirmed no passwords, financial data, or government IDs were pilfered.
When the initial negotiation deadline passed, ShinyHunters then escalated by defacing Canvas login portals at roughly 330 institutions and pivoting to direct school-by-school extortion.
Following the initial investigation into the breach, Instructure confirmed that ShinyHunters had exploited a vulnerability in its “Free-for-Teacher” account creation system.
To prevent the data from being leaked, Instructure announced it had “reached an agreement with the unauthorised actor” behind the data extortion attack.
According to an expert interviewed by ABC News, while a ransom amount hadn't yet been verified or publicly confirmed, people claiming to have knowledge of the situation estimated the amount was $10 million USD.
Analyst Comment:
Canvas is reportedly the UK’s primary digital learning platform, whose usage grew significantly during the pandemic. The timing of the attack also couldn’t come at a worse time for UK universities. In May, thousands of undergraduate students will be uploading their dissertations and trying to access their course content to prepare for their exams.
Active since 2019, ShinyHunters is a financially motivated data-theft-extortion collective that first emerged publicly in January 2020. Notably, ShinyHunters does not currently deploy ransomware as part of their intrusions. Instead, they exfiltrate data from cloud platforms, software environments, and third-party integrators, then demand a ransom to avoid its public release. SaaS Platforms such as Salesforce, Snowflake, GainSight, SalesLoft Drift and their customers have been targeted by ShinyHunters and adjacent groups in the last couple years.
Instructure is one of the few victims who have likely paid ShinyHunters. Most victims refuse due to not being able to trust that the cybercriminals will stick to their word and delete the stolen data. The consensus across the industry is paying the ransom is never the appropriate option for multiple reasons, such as fuelling future attacks, making your company look like an easy target, and possibly violating sanctions and local ransom payment ban laws. The most likely scenario is that Instructure felt they should pay the ransom to prevent further harm from the release of personal information of millions of students in their system.
Defensive Takeaways:
Enhance Platform Security: ShinyHunters reportedly exploited a vulnerability in Instructure’s Free-for-Teacher system, which highlights the importance of identity security audits alongside standard application penetration testing.
Enhance Logging and Round-the-Clock Monitoring: ShinyHunters reportedly exfiltrated 3.65 terabytes of data from Instructure. Enhanced activity logs and a certified 24/7 SOC monitoring service could have detected these actions by identifying anomalous login events and data exfiltration events to unknown IP addresses.
Create and Test Backup Processes: While Canvas was down, the universities shifted to alternative methods like email and printed paper. This case highlights the importance of business continuity plans (BCPs) along with making sure they are updated and tested.
Be Wary of Second-Order Effects: After a breach of this size, its key to warn users and SOC teams to be vigilant for new waves of phishing emails, brute forcing attacks, and other account takeover methods leveraging the stolen data.
Never Trust a Cybercriminal: In Instructure’s case, the company says it received “digital confirmation of data destruction (shred logs).” However, as Allison Nixon says, it’s completely unprovable because such shred logs or videos can be easily faked.
What HappenedOn 5 May 2026, new data revealed that British romance scam victims were defrauded of a staggering £102 million last year, representing a 29% surge in reported cases.The figures come from information gathered by Report Fraud (f.k.a ActionFraud), which is a City of London Police-run service that logged 10,784 romance scam reports in 2025.According to the data, cybercriminals are reportedly pocketing roughly £280,000 everyday by exploiting online relationships, with individual losses
On 5 May 2026, new data revealed that British romance scam victims were defrauded of a staggering £102 million last year, representing a 29% surge in reported cases.
The figures come from information gathered by Report Fraud (f.k.a ActionFraud), which is a City of London Police-run service that logged 10,784 romance scam reports in 2025.
According to the data, cybercriminals are reportedly pocketing roughly £280,000 everyday by exploiting online relationships, with individual losses averaging £9,500 and in extreme cases, reaching up to £1 million per victim.
This wave of scam victims is part of the growing trend where scammers blend emotional manipulation with fake cryptocurrency investment schemes, heavily weaponising AI-generated profiles, and focusing on lonely victims aged 55 to 74.
Analyst Comment
When analysing fraud statistics, it is important to remember that underreporting is very common, with many victims staying silent out of shame. Therefore, this is likely only a fraction of the real figures and the problem is likely much worse than we know. The data we do have, however, still reveals there is essentially an army of digital scammers routinely bleeding UK citizens dry, using not much more than a Midjourney AI subscription, a ChatGPT script, face-swapping services, and an entirely fictitious character with an emotional backstory.
Losing £102 million in a single year to fake internet characters is a truly wild national milestone. The fact that reports surged by nearly a third (29%) proves that in our society, emotional vulnerability is being monetised at industrial scale. We aren’t just looking at a clumsy email from a Nigerian prince anymore. This is industrial-grade social engineering. Scammers are playing the long game, spending months "love-bombing" victims before dropping the inevitable bombshell that they need a quick bank transfer to cover a “medical emergency” or an unmissable cryptocurrency investment opportunity.
In March 2026, the UK Government took some action against this threat and sanctioned Xinbi, a Chinese-language cryptocurrency marketplace accused of enabling large-scale online fraud and human exploitation. Xinbi reportedly processed more than $19.9 billion in transactions between 2021 and 2025, highlighting how much money the scam industry is generating globally.
Until we treat the underground scam economy with the same significance we treat ransomware or nation state attacks, the UK will continue to be one of the world's most lucrative money spinners for heartless cybercriminals.
Defensive Takeaways
Enforce the "Face-to-Face" Financial Boundary: If you are advising family members (especially those in vulnerable demographics), establish an unshakeable, non-negotiable rule: if you have not looked a person in their physical eyeballs, you do not send them money, gift cards, or cryptocurrency.
Teach Others Digital Sanity Checks: Teach your friends and family the art of basic digital literacy. Run profile images through reverse-image search tools (Google Lens or TinEye) and consciously flag the platform migration trap. Scammers desperately want to move targets off monitored apps like Tinder or Bumble and onto unmoderated WhatsApp or Telegram channels as fast as possible to avoid automated dating app ban filters.
Learn From the Mistakes of Others: To find examples of victims falling for these scams, the UK Financial Ombudsman Service’s database of decisions can act as a useful resource. The decision details can help you understand how these scams work, how much money individuals can lose, and the rate at which UK banks offer refunds or compensation. More examples can be found in my talk on this topic here.
Leverage Stripe’s FT3 Framework: If your organisation or team is tasked with combating fraud, then categorising these scammers TTPs is crucial. That’s why Stripe has developed the Fraud Tools, Tactics, and Techniques (FT3) framework. It’s designed to help security teams understand the landscape, spot gaps, develop detections, improve incident response, and foster collaboration.
What Happened:On 11 May 2026, the UK Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 after the Cl0p ransomware group lurked completely undetected in its network for nearly two years.Initial access reportedly occurred via a malicious phishing email in September 2020, which downloaded Cl0p’s Get2Loader malware and their SDBBOT backdoor to establish persistence.The breach itself, however, was only discovered two years later in July 2022 when staff began investigati
On 11 May 2026, the UK Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 after the Cl0p ransomware group lurked completely undetected in its network for nearly two years.
Initial access reportedly occurred via a malicious phishing email in September 2020, which downloaded Cl0p’s Get2Loader malware and their SDBBOT backdoor to establish persistence.
The breach itself, however, was only discovered two years later in July 2022 when staff began investigating IT performance slowdowns and ultimately found out that 4.1 terabytes of data was exfiltrated and the personal data of 633,887 customers and employees being published in August 2022 on Cl0p’s Tor data leak site.
The ICO’s investigation also revealed a staggering list of systemic failures, such as South Staff’s outsourced Security Operations Center (SOC) was blind to 95% of the network and that they conducted zero internal or external vulnerability scans over an 18-month window.
At the time of the attack they were still running Windows Server 2003 machines long after extended support ended. Further, two of their domain controllers were left completely unpatched against ZeroLogon (CVE-2020-1472), a critical, easily exploitable vulnerability published years before the intrusion.
Analyst Comment:
This case is a sobering look at the technical debt hiding inside the UK’s Critical National Infrastructure (CNI). A dwell time of nearly two years is practically unheard of in modern ransomware operations, and the TTPs used by the adversary points to a total breakdown of their defences. Cl0p didn’t need sophisticated, state-sponsored techniques or zero-days to pull this one off, they just walked back in through an infection that went undetected.
The ICO’s findings also reveal the reality that many UK organisations still treat cybersecurity as a set-and-forget compliance check rather than routine efforts to mature and upgrade systems or proactive measures to hunt and detect threats lurking inside the network.
Defensive Takeaways:
Audit Your Outsourced SOC: As we learned from this incident, never assume the third-party security provider sees everything or is doing everything right. Establish audits to verify that endpoint telemetry and logs from your entire estate are actively ingested, retained, and monitored in the right platform.
Harden Your Crown Jewels Against Old Flaws: Ensure that active directory and domain controllers are strictly monitored and prioritised for critical patches. Vulnerabilities like ZeroLogon remain a ransomware operator’s favourite tool for fast lateral movement and escalation to Domain Admin access. This is exactly what Cl0p and a dozen or so other groups use.
IntroductionThe Ransomware Tool Matrix continues to be a useful passion project that I am happy to continue maintaining. One piece of common feedback I've received for the Ransomware Tool Matrix was that individuals would like to contribute their observations to it, but do not have public links they can cite (such as a formal blog post on a company website). Therefore, I came up with a plan to make a reporting template to help with this.What are Community Reports?Individuals can now share what
The Ransomware Tool Matrix continues to be a useful passion project that I am happy to continue maintaining. One piece of common feedback I've received for the Ransomware Tool Matrix was that individuals would like to contribute their observations to it, but do not have public links they can cite (such as a formal blog post on a company website). Therefore, I came up with a plan to make a reporting template to help with this.
What are Community Reports?
Individuals can now share what tools they have seen various ransomware groups, affiliates, or initial access brokers (IABs) use via the new Community Report Template. The level of detail provided is the contributor's choice. The more verifiable information shared, the increased level of reliability and credibility.
You can view the current list of Community Reports on GitHub here.
Why the need for Community Reports?
Most of the sources of CTI about ransomware TTPs comes from open source reports by organisations such as the US Cybersecurity and Infrastructure Security Agency (CISA), The DFIR Report, and other cybersecurity vendors. From the beginning it was important to recognise the importance of the having public citations by reputable organisations to maintain the reliability and credibility of the resource overall. Consumers of the Ransomware Tool Matrix should feel confident that the information provided is of high standard and legitimate.
The problem was, however, that members of the cybersecurity community who may work with victims of ransomware attacks also have information about what tools which ransomware group uses.
The sources of this information could come from various sources, such as from Digital Forensics and Incident Response (DFIR) service providers, Managed Security Service Providers (MSSPs), Endpoint Detection and Response (EDR) vendors, or security researchers who manage to obtain threat intelligence about ransomware groups via various other means, such as infiltrating cybercrime forums or open directory hunting.
These sources of information did not currently have a way to contribute to the Ransomware Tool Matrix due to the missing factor of a publicly citable blog.
How do Community Reports work?
Members of the Community with information and tools used by ransomware groups can now share their observations via a structured report template shown below.
Whether to include all the details here is up to the contributor, but this type of reporting system is an option for community members to share their findings with the rest of the community who are interested in this information.
Anyone who wants to submit a Community Report can copy the code, edit in their findings, and submit a pull request to the GitHub repository. Alternatively, they can fork the project and then I can merge their commits to the main branch. More details about how to creating a pull request from a fork can be found in the GitHub's Docs here.
Conclusion
One of the problems of cybersecurity vendor blogs is that a lot of them are marketing material and therefore, details about every ransomware incident a company worked on is not great marketing. However, as CTI analysts, incident responders, threat hunters, and detection engineers, these details are crucial for our day-to-day lives. Hence why the Community Report system was one of the most common pieces of feedback I received and why I created it.
I look forward to the contributions from the community to this new reporting system and hope it helps many more who are keen to see and read about what the latest tools are that the ransomware cybercriminals are using.
IntroductionThis blog is a summary and analysis of recent additions to
the Ransomware
Tool Matrix (RTM) as well as the Ransomware
Vulnerability Matrix (RVM). Feedback from the infosec community about these projects has
been overwhelmingly positive and many researchers have contacted me to tell me
how helpful they have found these to be. It makes me happy to hear how doing something in my spare
time can help stop ransomware attacks and cybercriminals from exploiting our
society’s systems. And it
This blog is a summary and analysis of recent additions to
the Ransomware
Tool Matrix (RTM) as well as the Ransomware
Vulnerability Matrix (RVM). Feedback from the infosec community about these projects has
been overwhelmingly positive and many researchers have contacted me to tell me
how helpful they have found these to be. It makes me happy to hear how doing something in my spare
time can help stop ransomware attacks and cybercriminals from exploiting our
society’s systems. And it is for that reason, I shall continue to maintain
these projects as long as ransomware is still around. For anyone new to these projects, please read the
descriptions on GitHub or feel free to watch my talk explaining the project at BSides London.
Background on the current ransomware ecosystem as of May
2025
Following the impact of Operation Cronos against LockBit and
the exit scam by ALPHV/BlackCat, the ransomware ecosystem has been even more unstable
than usual. The exit scams and law enforcement infiltration operations
have created a zero trust environment for the cybercriminals participating in
the ransomware economy. The days of affiliates putting their faith in one RaaS
platform seem to be long gone and many are experimenting and going from one
RaaS to the next.
Sources of Threat Intelligence for the RTM
The RTM was updated with OSINT reports shared by
cybersecurity researchers at various private service providers or vendors. The
thing to remember about these reports is that the tool usage is going to be
slightly outdated due to the time it takes incident response teams to wrap up
an investigation, compile findings, and publish a report.
From the reports, threat groups such as Qilin, BlackSuit,
RansomEXX, Medusa, BianLian, Hunters International and PLAY have been active
for over one year or for multiple years. These are established groups. Since
RansomHub and LockBit have shut down, it is more likely than not that the
affiliates have already shifted to one of the other RaaS platforms, like Qilin,
among others.
There has also been a number of ransomware operations suspected
to be linked to Chinese cyber-espionage groups, such as RA World (for using PlugX),
NailaoLocker (for using ShadowPad and PlugX), and CrazyHunter (for its focus on
Taiwan).
Threat groups such as IMN Crew, QWCrypt (linked to RedCurl),
NightSpire, SuperBlack, and Helldown are all rising threat groups that have
more recently begun their ransomware campaigns.
These factors have led to seeing a large variety of tool
usage in ransomware operations being observed across the landscape. The
reliance on tools from sites like GitHub and other free software sites, however,
continues to remain a constant theme among all of these ransomware operations.
List of sources used for the May 2025 major update to the
RTM:
EDRSandBlast and WKTools are relatively new tools that are
being used by multiple groups to deactivate and overcome EDR tools that many victims
will have on their networks to prevent ransomware attacks.
Typical ransomware tools, such as PsExec, Mimikatz, and
Rclone remain effective and still used by multiple ransomware gangs for the
foreseeable future.
Tool
Type
Groups Using It
WinSCP
Exfiltration
NightSpire
Hunters International
Mimikatz
Credential Theft
RansomHub
Qilin
Helldown
Impacket
Offensive Security Tool
RansomHub
RA World
NailaoLocker
Rclone
Exfiltration
RansomHub
Hunters International Medusa
NetScan
Discovery
RansomHub
Medusa
WKTools
Discovery
RansomHub
BianLian
PLAY
Advanced IP Scanner
Discovery
Hunters International BianLian
Advanced Port Scanner
Discovery
Hunters International Helldown
AnyDesk
RMM Tool
Medusa
BianLian
EDRSandBlast
Defense Evasion
Medusa
Qilin
New Tools Added to the RTM
The most notable new tools added to RTM include several defense
evasion tools for deactivating EDRs, discovery for sensitive files, and tunnelling
tools to conceal adversary network connections.
Tool
Type
Groups Usage
Bublup
Exfiltration
BlackSuit
WKTools
Discovery
BianLian, PLAY
AmmyyAdmin
RMM Tool
BianLian
CQHashDump
Credential Theft
NailaoLocker
Throttle Stop Driver
Defense Evasion
Medusa
KillAV
Defense Evasion
Medusa
BadRentdrv2
Defense Evasion
RansomHub
Toshiba Power Driver (BYOVD)
Defense Evasion
Qilin
ZammoCide
Defense Evasion
CrazyHunter
FRP
Networking
Medusa
Stowaway
Networking
RansomHub
Navicat
Discovery
Medusa
Everything.exe
Discovery
NighSpire
RoboCopy
Discovery
Medusa
NPS
Networking
RA World
SharpGPOAbuse
Offensive Security Tool
CrazyHunter
Attrib
LOLBAS
BlackSuit
Curl
LOLBAS
QWCrypt (RedCurl)
PCA Utility (pcalua)
LOLBAS
QWCrypt (RedCurl)
Exploits used by Ransomware Gangs added to the RVM
As is now usual, multiple ransomware groups have been targeting
Fortinet networking devices for initial access into to victim environments.
Multiple ransomware groups continue to exploit the Windows Common
Log File System (CLFS) for local privilege escalation to run hacking tools and
steal credentials.
Other exploits involve targeting edge devices, such as Check
Point VPNs or PAN Firewalls, or exposed servers, such as Atlassian Confluence Data
Center Servers.
The targeting of Veeam backup software should come as no
surprise as preventing backups or stealing sensitive files, such as Active
Directory backups, are key objectives of ransomware gangs to complete their
mission.
My recommendation for defenders who continue the fight against ransomware is to take some of the findings from this report and begin threat hunting, detection rule writing, and start blocking some of these tools not present in the environments you are protecting.
Here are a few sites to help you get started with:
Introduction
This blog is
part of a cyber threat intelligence (CTI) blog series called Tracking
Adversaries that investigates prominent or new threat groups.
The focus of
this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known
for launching ransomware attacks, and RansomHub, a prominent ransomware as a
service (RaaS) operation run by Russian-speaking cybercriminals.These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs sha
This blog is
part of a cyber threat intelligence (CTI) blog series called Tracking
Adversaries that investigates prominent or new threat groups.
The focus of
this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known
for launching ransomware attacks, and RansomHub, a prominent ransomware as a
service (RaaS) operation run by Russian-speaking cybercriminals.
These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs shared by multiple CTI sources. The implication of this link is critical due to RansomHub being the most active ransomware gang and is working with a well-known sanctioned affiliate.
Who is RansomHub?
Active since
February 2024, RansomHub
is a RaaS operation formerly known as Cyclops and
Knight and is run by Russian-speaking adversaries. It is currently used by more and more cybercriminals that are ex-affiliates
of other RaaS operations. This includes the ALPHV/BlackCat RaaS and the LockBit
RaaS, which have since shutdown or disappeared. This has made the RansomHub RaaS one
of the most widespread ransomware families as of early 2025.
Due to
having a high number of affiliates, the tools and TTPs observed before the
final RansomHub payload is deployed can vary significantly.
Each affiliate may have their own set of tools and TTPs to achieve the final
objectives of data exfiltration and ransomware deployment.
Who is EvilCorp?
Evil Corp is
an international cybercrime network sanctioned for
orchestrating large-scale financial cyberattacks led by Maksim Yakubets. EvilCorp’s operations have evolved over time, expanding from Dridex
banking trojan campaigns into developing
ransomware like BitPaymer, WastedLocker, Hades, PhoenixLocker, and MacawLocker.
Notably,
Aleksandr Ryzhenkov, was identified
by the National Crime Agency (NCA) as a high-ranking member of EvilCorp and
also LockBit affiliate. Ryzhenkov became a LockBit affiliate around 2022, contributing to over 60
LockBit ransomware builds and attempting to extort more than $100 million from
victims. This discovery aligns with Mandiant’s previous reporting
on EvilCorp shifting to LockBit as well.
The NCA also
found that EvilCorp maintains close ties with Russian intelligence agencies
through Yakubets' father-in-law, Eduard Bendersky, a former FSB officer, who is
suspected of using his influence to shield the group from prosecution in Russia.
One of the
TTPs that makes EvilCorp standout from the rest of the RaaS affiliates is their
own affiliation
to the SocGholish
JavaScript malware (aka FAKEUPDATES). If ransomware deployment takes place
following a SocGholish infection, then the attackers responsible for the attack
will be affiliated with EvilCorp.
Reported Connections Between EvilCorp and RansomHub
On 15 July
2024, Microsoft shared a post on X stating that RansomHub was
observed being deployed in post-compromise activity by Manatee Tempest (which is Microsoft’s name for
EvilCorp) following initial access via SocGholish (aka FakeUpdates) infections
(which Microsoft tracks as Mustard Tempest).
On 15
January 2025, Guidepoint wrote a blog on a new Python backdoor used by an
affiliate of RansomHub. Notably, the new Python backdoor was delivered by
SocGholish. Therefore, this Python backdoor is another potential artifact worth
monitoring for its connection to known EvilCorp-related malware.
The next
day, on 16 January 2025, Google shared a report on EvilCorp (which Google tracks as
UNC2165) that disclosed numerous tools and malware families they have been using to deliver RansomHub, including a Python
backdoor dubbed VIPERTUNNEL (see the image below). The presence of a Python
backdoor following a SocGholish infection is notable TTP that overlaps with the
Guidepoint blog on RansomHub.
On 14 March
2025, Trend Micro disclosed further details that also confirmed the
SocGholish malware is leading to the deployment of RansomHub ransomware. The
operators of SocGholish are tracked as Water Scylla by Trend Micro. The
operators distribute SocGholish via the Keitaro Traffic Direction System (TDS), a legitimate service used for marketing campaigns. Trend Micro
also observed SocGholish dropping the same custom Python backdoor (aka
VIPERTUNNEL) as well.
So What?
EvilCorp has been under US sanctions since 2019, making it
illegal for affected organisations to pay ransoms to them without facing
potential fines from the US Treasury’s Office of Foreign Assets Control (OFAC).
Despite these sanctions, EvilCorp has continued its cybercriminal activities by
adapting its tactics to include rebranding their ransomware and becoming an affiliate of RaaS operations, such as LockBit and RansomHub.
The key indicator of EvilCorp's involvement in ransomware attacks continues to be the
use of the SocGholish malware, which employs drive-by downloads masquerading as web browser software updates to gain initial access to systems.
EvilCorp’s affiliation with RansomHub raises the
possibilities that RansomHub may soon face sanctions similar to those imposed
on EvilCorp. Consequently, any victim that pays a ransom to RansomHub could
become significantly riskier for cyber insurance organisations, incident
responders, and ransomware negotiators, as they may inadvertently violate
sanctions and face legal repercussions.
Given EvilCorp's prominence as a target for international
law enforcement, its association with RansomHub is likely to draw increased
scrutiny. This could result in RansomHub becoming the focus of future law
enforcement actions, including potential takedowns and additional sanctions,
further complicating the landscape for entities involved in ransomware response
and mitigation.
There is also the increased likelihood that RansomHub will
now rebrand. As we saw in the BlackBasta
Leaks, ransomware groups pay close attention to the news, CTI reports, and
even posts on X and even blogs by researchers. This association to EvilCorp and
threat of sanctions is an issue for ransomware groups as it impacts their
business model and makes earning harder. Therefore, by linking the two entities together CTI analysts can impose cost on these cybercriminals.
The BlackBasta ransomware group’s leaked chat logs have proven
to already be another unique and fascinating opportunity for researchers to
better understand the internal operations of a Russia-based organised
cybercrime enterprise. These leaks followed a major leak of Conti chat logs in
2022, which also proved to be a treasure trove of intelligence on the cybercrime
enterprise. The BlackBasta gang consists of former Conti ransomware members and
it should come as no surprise that their operations
The BlackBasta ransomware group’s leaked chat logs have proven
to already be another unique and fascinating opportunity for researchers to
better understand the internal operations of a Russia-based organised
cybercrime enterprise. These leaks followed a major leak of Conti chat logs in
2022, which also proved to be a treasure trove of intelligence on the cybercrime
enterprise. The BlackBasta gang consists of former Conti ransomware members and
it should come as no surprise that their operations are similar in nature and
structure.
Ransomware researchers have several valuable resources to
conduct investigations with nowadays. This includes ransomware.live, which contains several
resources including ransomch.at, a
collection of negotiation chats between ransomware gangs and their victims, as
well as the ransomware
tool matrix and ransomware
vulnerability matrix. These resources allow to deeply understand the
capabilities and motivations of these ransomware gangs. However, leaked chat logs
are the final missing piece of the puzzle and offer a deeper understanding from
the cybercriminal’s very own perspective and organisational structure.
Active since
April 2022, BlackBasta is one of the top-tier ransomware gangs and one of
the largest cybercrime enterprises in the world. According to the US
Cybersecurity Infrastructure and Security Agency (CISA), BlackBasta impacted
up to 500 different businesses and critical infrastructure in North America,
Europe, and Australia as of May 2024.
The importance of the Ascension Health incident
This blog shall dive deep into the Ascension Health attack
by BlackBasta. It is a step-by-step extraction of the conversation between the
BlackBasta members while they decide how to handle the attack.
The new insights around how BlackBasta and other ransomware
gangs perceive being involved with incidents at healthcare sector victim should
prove useful for incident responders, law enforcement, and governments that have
to resolve these types of attacks on the healthcare sector on an alarmingly
regularly basis.
Background
On 9 May 2024, mainstream news organisations in the US
reported about a cyberattack and significant disruption of services of
Ascension Health, one of the largest healthcare providers in the country. On 11
May 2024, BleepingComputer
reported that BlackBasta was to blame for the attack on Ascension Health and
that ambulances had been disrupted and patients were being redirected to other
hospitals.
How the Incident Began
The BlackBasta attack on Ascension Health began many months
before the ransomware was deployed on their network. Reconnaissance of
Ascension Health by members of BlackBasta began around 3 November 2023. They shared
14 email addresses of Ascension Health employees, which we can only assume were
used for phishing or password guessing. Ransomware gangs often used Zoominfo to
profile their targets to determine whether it is worth it for them to attack
and get a ransom from them.
The ransomware gang themselves wrote in their Matrix chat
that CBS
News had written about a cyberattack on Ascension Health on 9 May 2024 and
exclaimed that “it looks like one of the largest attacks of the year.”
Another BlackBasta member “gg” confirmed in the chat that it
was them and appeared to be surprised that the news was writing about it.
Later, “gg” appeared to feel bad about the attack and
concerned that cancer patients were suffering. However, at this stage it is
hard to tell if they are serious or being sarcastic.
One member of BlackBasta who used the moniker “tinker” then
stated that he wanted to be the negotiator for the BlackBasta team and began to
strategize how to extract a ransom payment.
“gg” says they encrypted Ascension Health’s network using
the Windows Safe Mode Boot
technique, which is a function that BlackBasta
is well-known to do.
The negotiator, “tinker” begins to weigh up their options.
He states he believes the FBI and CISA will be involved, as well as Mandiant
and begins to compare the incident to the Change
Healthcare attack by ALPHV/BlackCat (and later RansomHub) who received a 22
million USD ransom payment.
“gg” shares that all the stolen data was put on a server
named “ftp8” and tagged as “ALBIR_DS” and says to “tinker” that he should “look
at the folder name, everything we downloaded from them is there."
The operator, “gg” also shared a summary of the target
environment of Ascension Health. This includes number of servers being over
12,000, what security tools they use such as Cylance, Tanium, and McAfee. Plus,
“gg” said they downloaded over 1.4TB of data to "ftp8" and used
BlackBasta ransomware version 4.0 and attacked them on 8 May 2024.
Interestingly, “gg” appears to have also recommended to
bluff to the victim that they stole more than 1.5TB and say to the victim that
they stole 3TB instead.
Negotiation Strategizing
After having established the details of the incident, Tinker
(the negotiator) began to wonder about the likelihood of getting a ransom
payment as well as estimate how much Ascension Health is likely losing per day.
Tinker (negotiator) then explains to the rest of the BlackBasta members involved in the attack what course of action they should take to get the ransom from Ascension Health. Tinker says they would normally set a 3% of the annual revenue and negotiate from there. They note that there are clear problems with the victim being a hospital and that this attack followed the Change Health attack by ALPHV/BlackCat. They also noted that they are worried as they believe the US National Security Agency (NSA) attacked TrickBot's servers four years ago and that the FBI took down Qakbot more recently. Tinker is also worried that one of Ascension Health’s patients will die and they will be blamed and labelled as a terrorist attack.
Tinker also noted that when BlackSuit attacked Octapharma that it was labelled by the news as "hostile actions by Russia" and they warned that Conti was already under sanctions and that because they are tied to Conti they may not get paid.
Tinker, ransomware negotiator for BlackBasta, ultimately recommended giving the decryptor for free to Ascension Health and resorting to data theft extortion. This is notable, as it is a similar situation to the Irish HSE ransomware attack by Conti, who also provided the decryptor for free.
Healthcare Impact
The fact Ascension Health is a major medical organisation
with many patients appeared to take its toll on the BlackBasta members. Tinker
wrote in the BlackBasta chat they he found a post on Reddit by a doctor that
works for Ascension Health who described the damage of the attack.
Another member of BlackBasta, “nn” also found out that
Ascension Health is a group of hospitals. He immediately recommends giving them
a decryptor for free.
Interestingly, “gg” compares the attack on Change Health and
also recognises Mandiant and warns that the FBI and CISA will be involved.
Plus, “gg” noted that they did not encrypt via virtualization (such as vCenter,
ESXi or Hyper-V) and reconfirmed they used Safe Mode Boot. Further, “gg” was
also inclined to give Ascension the decryptor for free too.
Another BlackBasta member, “nickolas” comments about the
situation. He warned and was particularly concerned about law enforcement
retaliation, such as hacking back, sanctions, indictments. He recommended
auditing the entire infrastructure and having a rebrand of the BlackBasta name,
which means changing the ransomware, leak site, and other personas.
Tinker (negotiator) is aware however of the risk of someone
dying and how it will impact their chances of getting the ransom.
Tinker also discussed the politics of the scenario. He
compared the situation to the colonial pipeline incident of 2021. He mentioned
how Russia reacted and arrested ransomware operators. He also brought up the
war in Ukraine and how ransomware attacks on the US impact the politics with
Russia.
Tinker highlighted that the ransomware was used to encrypt
patient data and how it caused the hospital management system to crash. He was
particularly concerned about the ambulances being unable to operate but also
tries to minimize the severity of the incident. Nevertheless, he asked to see
the stolen data himself to get a better understanding of what data BlackBasta
operators have that they can leverage against Ascension Health.
By the end of deliberations, Tinker recommends giving a free
decryptor and then demand a ransom for the stolen data.
tinker edited his message to then clarify that he reckons
they should demand a ransom in the 10s of millions USD or over 100 million USD.
Ransomware Negotiations
The operator “gg” then shared the opening message to
Ascension Health shared via the Black Basta negotiation portal:
The negotiator for Ascension Health (who BlackBasta believes
is Mandiant) replied to the negotiation chat portal:
“gg” then clarified the terms of the ransom demand. A
payment will be needed to delete and share the stolen data He maintains the
offer to provide a free decryptor:
The negotiator for Ascension Health asked for the decryption
tool:
The decryptor was then provided to Ascension Health:
Later, “gg” then shares a file tree for
""DS"" (which is equal to Ascension Health). The file is
added to a ZIP and shared via a temp[.]sh link and is password protected:
The operator “gg” then uses Privat (a screenshot sharing
site) to show the proof that they have deleted the data of Ascension Health:
From these messages, it appears no ransom was paid and
BlackBasta returned the data and deleted it.
Change of Heart
The most interesting part of this engagement with Ascension
Health by BlackBasta was that the members deliberated back and forth about
whether to provide a free decryption tool but all appeared to be fine with demanding
a ransom for the victim data.
The operator “gg” appears to have a change of heart. He
exclaims that they (the members of the BlackBasta ransomware gang) are "pentesters"
and not "killers" and claims he “held a meeting in the office” which
is interesting as it further proves they are a cybercrime enterprise,
potentially with full-time employees.
The operator “gg” decided to help Ascension Health and requests
not to work on hospitals anymore.
He also said “the software will fly to the trash” which
likely means the group was thinking of ditching the brand of BlackBasta and
rebrand to another name. Finally, “gg” warns other BlackBasta members not to
target hospitals any more:
The Impact of the BlackBasta Attack on Ascension Health
According to the HIPAA Journal,
the personal data of up to 5.6 million patients was exposed and Ascension
confirmed that some patient data was stolen during the attack. Ascension said that
it found no evidence that the ransomware group gained access to electronic
health records or other clinical systems, so full medical histories have not
been stolen. During the attack, however, Ascension was forced to divert
ambulances, close pharmacies, take critical IT systems offline and resort to
pen and paper to record patient information. The attack affected a large
percentage of its 136 hospitals across the US and took Ascension around 6 weeks
to restore access to its electronic medical record system and resume normal
operations. The ransomware attack reportedly caused delays in revenue cycle
processes, claims submission, and payment processing, in addition to
significant remediation costs.
Lessons Learned
This chat log confirms that BlackBasta attacked Ascension Health
using version 4.0 of their ransomware and used the Safe Mode Boot technique on 12,000
endpoints of the healthcare system.
If reconnaissance began on 3 November 2023 and the attack happened on the 8 May 2024, that would make the amount of time they took to gain access and deploy the ransomware was up to 187 days long or around six months. Due to this, cybercriminal campaign appears to be comparable to a more focused state-sponsored level intrusion where months of planning and numerous attempts are made to infiltrate a target.
The BlackBasta negotiator, Tinker, believed that they were
going to get a very high ransom payment in the 10s of millions or up to 100
million USD and compared the attack to the Change Health incident by ALPHV/BlackCat
who got 22 million USD.
The high ransom payment by Change Health has appeared
to be like a dinner bell for ransomware gangs to go after other healthcare sector
victims. Paying the ransom as a healthcare organisation clearly has significant
downstream impact on the rest of the industry and it should be an absolute last
resort and default to be to never pay the ransom.
There was an interesting change of heart and moment where
the operator “gg” decided to give up on the Ascension Health attack, provide
them a decryptor, provide the data back to them, and share proof that they
deleted it. The members of BlackBasta were clearly concerned about hack-backs
from law enforcement or intelligence services, as well as sanctions and
deanonymization. The BlackBasta team also mentioned several times during this
incident that they were going to have to rebrand because of the attack.
Overall, this incident goes to show that even Russia-based cybercrime
enterprises with dozens of members remain paranoid about being attack by law
enforcement and intelligence services. It is really interesting that they themselves
admit that their actions warrant such a response.
One of the key lessons to learn from this engagement is that
if a healthcare organisation is attacked by a ransomware gang, then it would be
a valid strategy to tell the news about the incident. News about patients lives
being at risk and dying will get the attention of these ruthless cybercriminals
who will realise the mistakes they made and are potentially likely to at least provide a free decryptor and may give up entirely on their ransom payment pursuit and move on to the next target.
Lastly, these chat logs appear to prove that the West’s
policies aimed at increasing pressure on Russia-based ransomware gangs is evidently
working. These organised cybercrime enterprises are beginning to alter their
targeting behaviour as a result to avoid the wrath of law enforcement
retaliation.
One of the challenges with investigating cybercrime is the
infrastructure the adversaries leverage to conduct attacks. Cybercriminal
infrastructure has evolved drastically over the last 25 years, which now involves
hijacking web services, content distribution networks (CDNs), residential
proxies, fast flux DNS, domain generation algorithms (DGAs), botnets of IoT
devices, the Tor network, and all sorts of nested services.
This blog shall investigate a small UK-based hosting provider
known as Bit
One of the challenges with investigating cybercrime is the
infrastructure the adversaries leverage to conduct attacks. Cybercriminal
infrastructure has evolved drastically over the last 25 years, which now involves
hijacking web services, content distribution networks (CDNs), residential
proxies, fast flux DNS, domain generation algorithms (DGAs), botnets of IoT
devices, the Tor network, and all sorts of nested services.
This blog shall investigate a small UK-based hosting provider
known as BitLaunch as an example of how challenging it can be to tackle
cybercriminal infrastructure. Research into this hosting provider revealed that
they appear to have a multi-year history of cybercriminals using BitLaunch to
host command-and-control (C2) servers via their Anonymous
VPS service.
The year-on-year growing number of CobaltStrike C2 servers
hosted on BitLaunch’s services could be an indicator of tacit collusion with
cybercriminals through the facilitation of cheap and quick to procurement of
VPSs that end up being used to launch ransomware attacks on all sorts of
victims, including hospitals, schools, governments, companies, and charities.
The concept of aiding and abetting criminal activity in law is
essentially when an individual or an organisation intentionally assists,
facilitates, or encourages a crime. In this case, it would be aiding and
abetting the creation of cybercriminal infrastructure. If a hosting provider
ignores clear red flags (e.g., cryptocurrency payments from known illicit
sources or use of servers for illegal activities), they might still be held criminally
liable under wilful blindness under certain laws.
In the past, authorities have taken down bulletproof hosting
(BPH) providers that knowingly support cybercrime, such as CyberBunker and
LolekHost. In February 2025, the UK government also sanctioned
a Russia-based BPH known as ZSERVERS (aka XHOST) for facilitating LockBit
attacks.
Update: This blog was updated with a statement from BitLaunch (see the end of this blog).
Who is BitLaunch aka BL Networks aka BLNWX?
Active since at least 2017, BitLaunch (also known as BL
Networks or BLNWX) is a virtual private server (VPS) reseller whose autonomous
system number (ASN) is AS399629.
Up to 48 IPv4 networks belong to BitLaunch
which are used to "instantly launch a Linux or Windows VPS” where
customers can “pay hourly with Bitcoin, Litecoin, and Ethereum, with no firm
commitments." BitLaunch also supports their customers via a command-line (CLI)
tool and a Python
library. BitLaunch has another name, however, in their legal terms and conditions
they go by Liber Systems and have their own separate website.
Why focus on BitLaunch?
BitLaunch is quite interesting as they present themselves as
a UK-based company run by two local UK businessmen. Their “anonymous Bitcoin
VPS” service is regularly abused for all sorts of cybercriminal activities. What
triggered this research was the fact that their nickname “BLNWX” was regularly
reappearing in cyber threat intelligence (CTI) vendor reports on ransomware and
other cybercriminal campaigns. It is also worth highlighting that while BitLaunch own their
own IP networks, they are a VPS reseller as well who works with DigitalOcean,
Linode, and Vultr, as shown from their website below.
One website that reviews so-called “offshore services” (offshore[.]cat) has listed BitLaunch as being a “verified” offshore hoster that accepts cryptocurrency, only requires email request confirmation to open an account, and is described as allowing anyone to “create VPSs in seconds, using crypto” making them an attractive hoster for cybercriminals. Their service paired with their CLI tools and Python libraries makes it super easy to stand up C2 servers rapidly.
Command and Control (C2) infrastructure on BLNWX
Significant numbers of CobaltStrike C2s among other hacking
tools and malware families have been discovered on BitLaunch. I would like to
thank the owner of the C2IntelFeedsBot (@drb_ra)
account on X/Twitter who assisted with this research by providing their feed of
C2 servers discovered on BitLaunch.
The image below shows a sampling of the known C2 servers
hosted with BitLaunch between 2021 and 2025. The most notable part of this
diagram is the number of CobaltStrike C2 servers in particular. Cobalt Strike
is a well-known C2 framework used by organised cybercriminal groups to launch
ransomware attacks. It is also favoured by state-sponsored threat groups as
well.
Over the last few years, several dozen C2 servers have been
identified by the C2IntelFeedsBot and each
year, the number of C2s has continued to grow as more cybercriminals identify
BitLaunch as a preferable service to support their ransomware campaigns.
The image below displays the totals calculated between “2021-06-26
12:33:41" and "2025-02-05 18:46:10." It is not a complete
picture by any means, but this independently verifiable data gives a decent
idea of the rate at which BitLaunch is being used by cybercriminals, with each
year since 2022 has trended upwards.
One of the interesting things about CobaltStrike is that it
is a commercial offensive security tool (OST). It is issued to legitimate
customers through licenses, which have a unique watermark. While there have
been several cracked versions of CobaltStrike over the years, it is possible to
track certain groups through their usage of the same CobaltStrike versions.
The image below shows the distribution of the CobaltStrike
watermarks gathered from BitLaunch. Notably, “0” is the most common. This is
often the case when analysing CobaltStrike watermarks as this signifies it is
the cracked version.
OSINT collection and analysis of the CobaltStrike watermarks
revealed potential connections to several well-known cybercriminal groups using
BitLaunch who have a history of conducting ransomware attacks:
"426352781” – This watermark is used by ShadowSyndicate,
a ransomware affiliate group tracked by Group-IB which is connected to multiple
Ransomware-as-a-Serivce (Raas) platforms. This watermark is also historically associated
with CobaltStrike Beacons dropped
by the Qakbot malware botnet.
“1580103824” – This watermark was linked to ShadowSyndicate
as well, alongside the Cleo
exploitation campaign attributed CL0P ransomware. A threat group tracked by
CERT-UA as UAC-0056 has also been observed
using this watermark too.
”987654321” – This watermark has been associated
with the IcedID malware botnet and the Dagon Locker ransomware gang previously.
”1359593325” – This watermark has been used by CobaltStrike
Beacons in campaigns attributed
to the Russian Foreign Intelligence Service (SVR)
“391144938” and “305419896” – These watermarks have been
attributed to campaigns by multiple Chinese cyber-espionage campaigns tracked
by SentinelOne,
Recorded
Future, Zscaler,
and Cisco
Talos.
C2s on BLNWX attributed to Ransomware Gangs by CTI vendors
There are a number of CTI reports over the last couple years
that directly reference BitLaunch Networks (BLNWX) IP addresses as Indicators
of Compromise (IOCs) as part of high-profile ransomware campaigns.
This includes attribution
to the Yanluowang ransomware attack against Cisco, a C2 linked
to the JavaScript more_eggs backdoor used by FIN6 (who is connected to
ransomware campaigns), a dozen IPs attributed to Rhysida
ransomware attacks, and a Rhysida and Interlock ransomware precursor
campaign tracked as TAG-124,
as well as the PaperCut
exploitation campaign which involved
both LockBit and CL0P.
Additional notable CTI alerts that called out BLNWX include
a report on Latrodectus,
a ransomware precursor campaign, by Proofpoint; Okta-themed phishing campaigns
attributed to Scattered
Spider, who has carried out ALPHV/BlackCat and RansomHub attacks, by
Intel471; infrastructure used to enable
the BlackBasta ransomware gang by QuadrantSec, as well as C2 servers of the IcedID
malware botnet that has been used by ransomware gangs for initial access.
Assessment of BitLaunch
As of February 2025, BitLaunch's parent firm Liber Systems Limited is run by two UK-based directors according to UK Companies House. While they are profiting off this Anonymous VPS service they are not taking the appropriate steps to prevent their service from being used by
ransomware and malware gangs. Organised cybercrime groups have evidently found and recognised this about BitLaunch and are leveraging the cheap, crypto-accepting service
that doesn’t ask too many questions.
To be fair to BitLaunch, they appear to be responsive to
takedowns and are noted on Offshore[.]cat as enforcing DMCA requests. The crux
of the issue though is that the cybercriminals can use their service to rapidly
spin up instances for C2 for a few hours and chuck it away again. This means there often no need to submit a takedown as the cybercriminals has already abandoned the C2 and can spin up another one. Therefore,
the cybercriminals can continually leverage BitLaunch without interference.
As a security researcher, and not a police officer, I cannot comment on how cooperative BitLaunch have been with the police and it is probably not something BitLaunch would want to advertise to their customers anyway based on who some of their customers are.
For BitLaunch’s two directors, this works out nicely for them. They
can take the cybercriminals money via cryptocurrency and also appear to be
ethical and compliant by assisting with law enforcement takedown requests. Currently, they appear to be helping both the criminals and the police, and have been getting away with it for years.
On BitLaunch’s front page advertisement they highlight as
the main focus as being able to pay hourly for the use VPS and that customers
can pay in “anonymous cryptocurrency.” It is in my opinion, and that of other
cybersecurity researchers I have spoken to about this (including red teamers and penetration testers), that
this service is perfect for C2 servers and almost nothing else legitimate.
The Broader Issue with Anonymous VPSs
In BitLaunch’s blogs, they say they believe the internet should be "open, free, and devoid of interference by any single government or authority" adding that accept cryptocurrency because "citizens of some countries do not have bank accounts and can use Bitcoin
instead" because the local banks have control over who their citizens can send money to.
Their blogs also state that they believe internet users should be allowed to
run their own virtual private networks (VPNs) for anti-surveillance and privacy
reasons. They also provide lots of guides on how to configure private VPNs for this purpose. While this is a legitimate service that is useful for some people in specific situations, having it be abused by ransomware gangs is a situation that needs to be changed.
This issue of selling anonymous VPSs is not specific to this one company. BitLaunch is
obviously a small company and proactively combating cybercriminals from
registering VPSs on their service is an expensive and multi-pronged challenge
for any hoster, which includes preventing abuse while preserving the privacy of
their customers.
Hosters such as BitLaunch could use services such as Shodan, Abuse.ch,
GreyNoise, OTX Alienvault, and AbuseIPDB to check if their IP addresses are
being abused. One interesting example of a hoster trying to tackle this issue is how PQ Hosting (aka Stark Industries Solutions) announced publicly on their blog that they have partnered with Team Cymru, a netflow security intelligence firm. Alternatively, hosters could use a blockchain analytics platform like Chainalysis, TRM Labs, or Arkham Intelligence, to trace cryptocurrency payments from known illicit wallet clusters.
There will, however, always be some threats that slip through the net. It is undoubtedly a difficult challenge for small hosters
who do not have funds to sacrifice on network observability tools or CTI
platforms. Even some of the world’s largest hosters, such as Cloudflare
struggle with this as well and end up having their services abused for cybercrime operations.
The anonymous VPS problem could be
compared to issues in other industries such as stolen funds being used to buy gift cards or game keys that are then resold for money laundering. Another platform often
abused for a variety of scams and phishing campaigns is Gmail. Is Google being
wilfully negligent to cybercrime happening on their platform? That’s a question
I shall leave for readers to decide on their own.
Overall, this type of issue is analogous to a hotel offering rooms for the night and organized criminals renting them to commit various types of crimes inside them. Ultimately, the criminals are the ones breaking the law, not the hotel, but if the hotel is being constantly made aware of these activities by bystanders and law enforcement, it is their duty to shut that activity down, to the best of their abilities.
What the UK Could Do About It
In this scenario around BitLaunch, there are three potential ways the UK could help stop these small hosters being taken advantage of by
cybercriminal operations.
Firstly, the cybersecurity and hosting industry could launch an initiative through institutions, such as the British Computer Society (BCS) or something, that would work to convince hosting providers that the
hassle being investigated by law enforcement agencies, sanctions, or the chance
of being arrested is not worth the funds generated from selling C2 servers to cybercriminals.
Secondly, as BitLaunch (or Liber Systems) is registered here, the UK Government Department for Science, Innovation, and Technology (DSIT) could work with them and other small hosters to regulate the industry and
provide support to these businesses to warn them of the dangers of offering
unregulated VPS services and inform them how they contribute to the
damage that ransomware attacks are having on the UK and elsewhere.
Third, providing free network observability services to
hosters could also help them proactively shutdown C2 servers before they are
weaponised against victims. All UK hosters can sign-up to the free UK
government-provided service called MyNCSC, offered by the UK
NCSC, which is part of GCHQ. Hosters will then get alerts when MyNCSC detects
which IPs are flagged for hosting C2 servers (such as CobaltStrike).
As the UK government’s mandate
is to “make the UK the safest place in the world to live and work online” then
tackling the issue with these UK-based hosters supporting ransomware
should also be one of those priorities.
Indicators of Compromise
Historic Malicious BLNWX IP addresses are available below:
Statement from BitLaunch following the publication of this blog:
"BitLaunch appreciates the conversation surrounding the misuse of VPS hosting services. It is an important topic, and there is always room for improvement and reflection. That said, we believe the article contains several key inaccuracies and misleading implications. We take the prevention of abuse on our platform very seriously, and we would like to offer the following context:
We reject the notion that BitLaunch may be in "tacit collusion with cybercriminals" due to the year-on-year growth of IPs associated with CobaltStrike C2 servers. In fact, the number of abusive IPs has not increased relative to BitLaunch's rapid infrastructure growth – it is just that more IP blocks are available overall.
At the time of writing, BitLaunch has 50 /24 prefixes announced over BGP, totalling 12,800 IP addresses. As a result, 82 C2s in 2024 represents just 0.6% of our IPs over the entire year. Across all first and third party hosts, abuse per month is around 1% of active servers.
We strongly disagree that BitLaunch is "not taking the appropriate steps to prevent their service from being used by ransomware and malware gangs". BitLaunch takes regular and concrete action against abuse, including no longer serving the Russian market. We employ a full-time, dedicated abuse team that already uses various tools to proactively and passively identify malicious servers. These tools include abuse.ch, urlscan, spamhaus, and more. Servers are suspended as soon as malicious activity is suspected, per our Acceptable Use policy.
The report implies that BitLaunch may be ignoring key red flags, such as accepting cryptocurrency from known illicit sources, and mentions that hosters can use blockchain analysis services to prevent this. BitLaunch already uses Elliptic for this purpose. We also disagree with the opinion that our service is "perfect for C2 servers and almost nothing else". As previously stated, abuse per month accounts for 1% of active servers despite BitLaunch accepting payments exclusively in cryptocurrency. There are numerous reasons to pay privately with cryptocurrency that do not involve illegal activity.
We believe the report fails to disclose a potential conflict of interest. The researcher works for Carrier Hotel Equinix, which serves some of our direct competitors. One such customer, PQ Hosting, is linked in the blog as a positive example of dealing with malicious activity.
Finally, we would like to thank BushidoToken for giving us a chance to issue this addendum. We welcome constructive critique on this topic and appreciate the opportunity to reflect on our abuse-prevention strategies and their communication."
The scourge of ransomware continues primarily because of
three main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.Cryptocurrency enables cybercriminals to receive funds from victims around the world without the option to freeze or refund them due to the immutable nature of the virtual funds.Safe havens are
The scourge of ransomware continues primarily because of
three main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.
RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.
Cryptocurrency enables cybercriminals to receive funds from victims around the world without the option to freeze or refund them due to the immutable nature of the virtual funds.
Safe havens are countries that permit cybercriminals to launch attacks without immediate fear of arrest, enabling them to earn vast fortunes through ransomware campaigns.
With these three challenges in mind, law enforcement and
governments have a very difficult job to do when it comes to fighting ransomware
but fight it they must. In this blog we shall recall what counter-ransomware
activities took place in 2024, analyse their effectiveness, and assess how the
landscape shall evolve as a result.
A podcast version of this blog is also available here.
Ransomware Operator Arrests and Sanctions
During 2024, there were significant disruption operations by
law enforcement and financial authorities targeting individuals behind
ransomware campaigns (see the Table below). The main focus of 2024 for Western
law enforcement was squarely on the LockBit RaaS and its affiliates as it was
the largest and highest earning ransomware operation to date.
Several key players of the ransomware ecosystem were
arrested, including the main developer of LockBit ransomware. Interestingly,
Russian law enforcement also decided to arrest ransomware threat actors located
in Moscow and Kaliningrad as well.
European police took down malicious spam botnets that support ransomware campaigns. This resulted in 4 arrests (1 in Armenia and 3 in Ukraine), over 100 servers and 2,000 domains being seized. One of the main suspects earned €69 million by renting out infrastructure sites to deploy ransomware.
Deniss Zolotarjovs, a Latvian national was arrested and extradited to the US from Georgia for running the Karakurt data extortion gang linked to Conti.
Mikhail “Wazawaka” Matveev was arrested in Russia for violating domestic laws against the creation and use of malware. He was fined and had his cryptocurrency seized and is awaiting trial.
The ransomware ecosystem has fragmented due to the law enforcement disruptions of the largest players, such as
ALPHV/BlackCat and LockBit. In the case of ALPHV/BlackCat, the operators staged
a law enforcement takedown as they put up a fake seizure notice as part of
an exit scam in March 2024 after the attack on UnitedHealth.
Following these disruptions, some affiliates have migrated
to less effective strains or launched their own strains. This includes
Akira and RansomHub at the top of the list as well as Hunters International and
PLAY.
Cryptocurrency Exchanges Disrupted
During 2024, law enforcement seized funds from and
sanctioned a number of cryptocurrency exchanges and individuals running payment
processors using cryptocurrency (see the Table below).
One of the most interesting disclosures this year came from
the UK National Crime Agency (NCA) around Operation Destablise. The NCA linked
payments to ransomware gangs to money laundering networks used by Russian
oligarchs to covertly purchase property and Russia Today, the state-run media
organization, to covertly fund pro-Russia foreign entities.
Another notable investigation in 2024 was when the US
Treasury sanctioned more Russian cryptocurrency exchanges, such as PM2BTC and
Cryptex, that led to money launderers that facilitate the cashing out of ransom
payments being arrested by Russian law enforcement.
The US Justice Department indicted Russian national Roman Pikulev and Cryptonator, which processed a total of $1.4 billion in transactions, of which $8 million were ransom payments. Cryptonator also has ties to other sanctioned entities including Blender, Hydra Market, Bitzlato, and Garantex, among others.
FinCEN identified PM2BTC as being of “primary money laundering concern” in connection with Russian illicit finance. This was alongside Cryptex and Sergey Sergeevich Ivanov, a Russian national, who is associated with UAPS and PinPays, as well as Genesis Market. Cryptex also facilitated more than $115 million of proceeds from ransomware payments.
In Operation Final Exchange, German federal police (BKA) shut down 47 cryptocurrency exchange services that ransomware gangs use that operated without requiring registration or identity verification.
Russian authorities have arrested nearly 100 suspected cybercriminals linked to the anonymous payment system UAPS and the cryptocurrency exchange Cryptex.
The NCA uncovered a Russian money-laundering network operated by two companies called Smart and TGR Group as part of Operation Destabilise that involved UK-based cash-to-crypto networks that laundered Ryuk ransom payments as well as the money of Russian oligarchs and Russia Today.
Safe Havens Enabling Ransomware
While ransomware is a global problem, there are only a few
countries that are to blame for this rapid expansion of the ransomware
ecosystem. The state that is blamed the most for preventing many ransomware operators
from facing justice is Russia. There are explicit rules posted to
Russian-speaking cybercrime forums that state as long as members avoid
targeting Russia and the Commonwealth of Independent States (CIS), they are
free to operate.
The Russian ransomware safe haven theory was further proven
following sanctions levied against Evil Corp by the UK, US, and Australia. One
of the sanctioned men connected to Evil Corp was Eduard
Benderskiy, a former Russian federal security service (FSB) official.
Benderskiy is reportedly
the father-in-law of Maksim Yakubets, the leader of Evil Corp, an organized cybercrime
group responsible for multiple
ransomware strains including BitPaymer, WastedLocker, Hades, PhoenixLocker,
and MacawLocker. In total, Evil Corp has reportedly extorted at least $300
million from victims globally, according to the UK NCA. It is now clear that
Evil Corp has protection from a highly connected Russian FSB official who has
also been involved
in multiple overseas assassinations on behalf of the Kremlin, according to
Bellingcat investigators.
While a number of ransomware operators were arrested in 2024
and some were extradited to the US, the work done by law enforcement
specializing in cybercrime was put in the spotlight during the August
2024 prisoner swap. Multiple countries decided to release cybercriminals,
spies and an assassin as part of a historic
prisoner exchange with Russia at an airport in Ankara, Turkey. The US negotiated
the release of 16 people from Russia, including five Germans as well as seven
Russian citizens who were political prisoners in their own country.
Notably, from a cybercrime intelligence perspective, the Russian
nationals released from the West included the infamous cybercriminals Roman
Seleznev and Vladislav Klyushin. The latter, Klyushin, was sentenced
in 2023 to nine years in US prison after he was caught in a $93 million stock
market cheating scheme that involved hacking into US companies for insider
knowledge. The other cybercriminal, Seleznev, was sentenced
to 27 years in prison in 2017 for stealing and selling millions of credit card
numbers from 500 businesses using point-of-sale (POS) malware and causing more
than $169 million in damage to small businesses and financial institutions,
including those in the US.
In 2024, we saw several more Russian nationals get
extradited to the US after being arrested by law enforcement in the country
they were residing in. This includes the Phobos operator living in South Korea
and the LockBit developer living in Israel. This follows others arrested in
previous years such as a TrickBot developer arrested
in South Korea as well as the two LockBit affiliates extradited
to the US. There is a potential that these Russian nationals involved in
ransomware could be used in prisoner exchanges in the future.
Further, another curious trend in 2024 was that some Russians
inside Russia, which is firmly considered a safe haven for ransomware gang, did
get arrested. This includes the SugarLocker operators arrested in Moscow and
the LockBit affiliate Wazawaka who was arrested in Kaliningrad. This is
alongside the money launderers arrested around Russia linked to the Cryptex
exchange.
The arrests of Russian nationals in Russia for ransomware
activities appear to be more symbolic than a true crackdown on this type of
activity. This is because there are several dozen Russian-speaking ransomware
gangs that continue to operate, as well as a plethora of other types of cybercrime
in the Russian-speaking underground.
Outlook
In 2024, there was lots of significant action by law
enforcement to shake up the ransomware economy. One of the main successes of the
notable Operation Cronos action taken against LockBit was the sowing of
distrust and disharmony in the ransomware ecosystem. Despite the admins of
LockBit trying to recover, their reputation and army of affiliates have been
smashed.
Many of Russian law enforcement activities could all be
related to the costs of the Russian invasion of Ukraine. Russian authorities seizing funds of the illicit cryptocurrency exchanges could be to pay for
the war in Ukraine and they could be recruiting arresting cybercriminals for offensive
cyber operations related to the war in Ukraine. The true motivations of Russian law enforcement arresting these specific ransomware operators but allowing others to operate are unclear. The cybercriminals could also simply have not paid their protection money or lack connections in the FSB like Evil Corp has.
Due to the fall of LockBit and ALPHV/BlackCat
in 2024, there has been a rise of other ransomware groups like RansomHub and
Akira to fill the vacuum. However, the rate of attacks by these emerging groups
is still noticeably lower than when LockBit was operating at full force. This
should be perceived as a success for law enforcement operations in 2024 due to the overall
number of ransomware attacks lowering, which we should all be thankful
for.
Entrar
