Latest Intelligence
Your Ransomware Negotiator Might Be Working Both Sides
The ransomware negotiator exists to be the one neutral party in a crisis. Now the FBI has charged one, a second has pleaded guilty to feeding attackers his clients’ secrets, and a third is accused of quietly paying ransoms he billed as recovery. The industry sells trust it was never built to prove.
Fear of a Breach Is How The Gentlemen Get Paid
The Gentlemen added ten names to its dedicated leak site this month, including Deloitte, KFC, and MoneyGram. None has confirmed a breach and no files have appeared. The ransomware-as-a-service operation does not need the claims proven. It only needs the accusation to travel faster than the evidence.
Threat Actor Asked AI Where to Sell Stolen Data Then to Write His Résumé
A lone threat actor pointed an open-source Chinese AI agent at South Korean banks and let cheap language models do the scaling. Then he asked one of those models to write his résumé. CrowdStrike recovered all of it, and the same memory that powered the attack documented the operator behind it.
ShinyHunters Survived Every Arrest but Now Someone Is Talking
Jordanian authorities detained Rey, an admin who seized the ShinyHunters brand, and he is reportedly helping the FBI. Jailing a member never killed the brand. The leak sites are already back. But a cooperating insider attacks the one thing the collective cannot do without. Trust between its members.
You Can Seize the Servers, Not the Business Model
Spanish police arrested a 16-year-old and named him the administrator of KillSec, tied to 500 ransomware attacks. The age is not the story. A productized platform and AI now do the work a skilled crew once did. Police can seize the servers and kill the brand, not the business model.
Arresting One Hacker Does Not Kill a Collective
Dutch police arrested a 24-year-old in the ShinyHunters investigation, and the case looks less like a clean win the closer you read it. The evidence tying him to the breaches is a reused alias and a disputed voice, against a collective that has no membership and publicly laughed off the arrest.
Cyber Crime Put AI on the Payroll
Gambit Security cracked the staging server behind a card-theft campaign and found the AI crime story that actually arrived. One operator rented open-source AI agents to break into 119 online retailers and steal more than 600,000 credit cards, for roughly $25 a target.
Cyber Crime Does Not End at the Intrusion
Everyone treats the attack as the event. The phishing email, the ransomware, the stolen keys. But financially motivated cyber crime does not end at access. The money still has to move, and the blockchain keeps a permanent record of where it went.
Revolut Says No One Demanded a Ransom, the Internet Disagrees
A group claiming the Revolut breach demanded US$3 million in Monero, with a 24-hour countdown clock, and never once contacted Revolut directly. The demand was public from the start. That is the inversion worth noticing. The pressure was not a private negotiation. It was everyone else watching.
Nobody Broke Into Revolut, They Just Asked
Revolut handed a stranger its customers passports, selfies, and full transaction histories. Nobody broke in. A fraudster asked, using a legitimate government email domain, and Revolut said yes. No hack, no exploit, just an email and a lie, and the trust a bank extends to anything official.