CyberCrime Blog- 2026 2025 2024 2023 2022 2021 2020 2019 2018
BigBrother blog BotNet blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blogDATE | NAME | Info | CATEG. | WEB |
|
24.10.26 |
Operation Serengeti III: Three Years of Collaboration Against Cybercrime | Participating authorities reportedly recovered an additional $105 million during Operation Serengeti III, targeting cybercrime networks across Africa. In earlier Serengeti operations, INTERPOL recognized Fortinet and the World Economic Forum’s Cybercrime Atlas as operational partners; Fortinet is a founding grantor of the initiative. This collaboration highlights the ongoing importance of public-private collaboration in supporting law enforcement operations that disrupt criminal infrastructure and impose consequences on cybercriminal networks. | CyberCrime blog | Fortinet Blog |
|
24.10.26 |
ConnectWise Cloud Backup application abused in cross-tenant token sweep | On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a single virtual private server (VPS) and continued for about 96 minutes | CyberCrime blog | SOPHOS |
|
24.10.26 |
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers | Legitimate infrastructure has become a powerful delivery mechanism for attackers, carrying the inherent trust they once had to build. As Cisco Talos explored in our previous research on weaponizing software-as-a-service (SaaS) notification pipelines, these platforms are increasingly repurposed as proxies for malicious intent. | CyberCrime blog | CISCO TALOS |
|
24.10.26 |
Dark Web Roast - September 2026 Edition | September delivered another bumper crop of underground incompetence, proving once again that the cybercrime economy runs less on sophistication and more on vibes, typos, and secondhand embarrassment. | CyberCrime blog | TRELLIX |
|
13.10.26 |
Angi, Tour Guy, Healthcare, KPN and CafeMom Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer database sale, an alleged The Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China. | CyberCrime blog | SOCRADAR |
|
10.10.26 |
Healthcare: Cybercrime's Highest-Value Target | Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. | CyberCrime blog | FLARE.IO |
|
7.10.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. | CyberCrime blog | RAPID7 |
|
3.10.26 |
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem | The Spetsvuzavtomatika leak found on the darknet exposes a broad Russian cyber research and development program, with seven named projects defining its work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing. Another project, Putnik, supports internal-network access and credential theft. | CyberCrime blog | DomainTools Investigations |
|
3.10.26 |
Spanish Carding Tutorial: How Fraudsters Think | A 2,200-word tutorial titled “Complete Guide to Carding in Spain (2026)” appeared on the Carder Market forum in April 2026. It is exactly what it sounds like: a beginner’s playbook for credit card fraud targeting the Spanish market, complete with entry fees, expected returns, and step-by-step operational workflows (we are holding back specific names and techniques to execute attacks to prevent these from falling into those with malicious intentions). | CyberCrime blog | FLARE.IO |
|
3.10.26 |
TerminalFix and Lorem Ipsum Loader enable covert tunneling | The activity is linked to a broader campaign that previously used a different delivery mechanism | CyberCrime blog | SOPHOS |
|
29.9.26 |
Metree, WuBook, SonicWall Access and Data Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Metree e-commerce database leak, an alleged WuBook customer data leak, and an alleged SonicWall-based access auction for a U.S. automotive engineering firm. Other posts advertised alleged student records from campus.gov.il and an alleged Kenyan vehicle valuation database containing more than 1.2 million records. | CyberCrime blog | SOCRADAR |
|
26.9.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. Security teams today face evolving challenges, requiring them to continuously refine monitoring channels, adjust operational strategies, and foster cross-functional internal collaboration to capture actionable intelligence. | CyberCrime blog | RAPID7 |
|
26.9.26 |
The roqueue-tools DevFlow campaign: 2 fake project-flow extensions that fetch JavaScript from a DuckDNS host and run it | Two project-flow extensions sit quietly for five minutes after you open your editor. The Kanban board renders, the webview loads, everything looks like a normal project-management tool. Then, once the IDE has settled and the developer has moved on to something else, a setTimeout fires. The extension reaches out to a free DuckDNS subdomain over plain HTTP, grabs a JavaScript file, and runs it with new Function. | CyberCrime blog | Yeeth Security |
|
26.9.26 |
The SadiqShuaibu campaign: 6 fake npm dependency checkers that embed a GitHub token and run remote code | Checking npm package versions is one of the most common things a developer extension does. On August 18, 2026, six of them showed up from one publisher — SadiqShuaibu — in under 100 minutes: sadiq-dep-checker, sadiq-dep-lens, sadiq-dep-helper, sadiq-dep-tool, sadiq-npm-updater, and pkg-outdated-check. They all work. The commands fire, the npm registry responds, the versions render in the panel. | CyberCrime blog | Yeeth Security |
|
23.9.26 |
August 2026: GTA VI Leak, Keyv & Carhartt Breaches | August 2026 brought a wide mix of cyber incidents, from large-scale data breaches affecting millions of people to software supply chain attacks targeting developers and enterprise environments. | CyberCrime blog | SOCRADAR |
|
16.9.26 |
Mythic C2 Activity at Internet Scale | Mythic is an open-source collaborative C2 framework which is actively maintained on GitHub. It provides a plugin-based architecture supporting multiple agent types, transport profiles, and an operator-facing web UI. | CyberCrime blog | CENSYS |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and Microsoft Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
UCQ Leak, Israeli GlobalProtect Access, Digital Nirvana Dump, 32baar, and Ghorer Bazar | SOCRadar Dark Web Team identified several new underground posts, including an alleged Universidad Cuauhtémoc database leak, an alleged GlobalProtect-based access auction for an Israeli manufacturing firm, and an alleged 900GB Digital Nirvana data dump. | CyberCrime blog | SOCRADAR |
|
15.9.26 |
Simplify Threat Intelligence Procurement with SOCRadar and AWS Marketplace | Your security team has already made the case for external threat intelligence. The budget owner agrees. Then the deal stalls on procurement rather than technology: a new vendor onboarding form, a separate legal review, another invoice outside the cloud commitment you have already negotiated. | CyberCrime blog | SOCRADAR |
|
12.9.26 |
Finding and Notifying a ShinyHunters Claims Impersonation Campaign Before It Activated: 61 Domains, 48 Brands | ReliaQuest Threat Research published a short public advisory about a ShinyHunters campaign on August 17, 2026. This campaign was built on domains following a company[.]claims pattern, and reported that the group had added legal team impersonation to its established help desk and IT pretexts. The advisory had no domains, and described a shape that left the reader to find the instances. | CyberCrime blog | FLARE.IO |
|
12.9.26 |
Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure | A recent Unit 42 investigation into seemingly low-priority enterprise infections demonstrates how the most effective camouflage in cybercrime is not necessarily in the use of sophisticated techniques, but in how unremarkable the threat appears. The activities that we investigated would typically not require escalation or further inquiry. But upon closer inspection, we discovered a massive cybercrime campaign largely targeting young gamers. | CyberCrime blog | Palo Alto |
|
11.9.26 |
How a Fraudulent Hire Clears Your Verification Process | The controls most companies trust to vet a candidate were built to catch mistakes and embellishments. They were not built for a well-funded adversary using a real person's identity, and sometimes a real person. | CyberCrime blog | ABNORMAL |
|
10.9.26 |
FBI Investigates Nexus Claim of 153M+ ID Records | A Dark Web service called Nexus has claimed to offer access to more than 153 million driver’s license records from the United States and Canada, along with millions of other identity documents. The FBI has reportedly opened an investigation into the exposure. | CyberCrime blog | SOCRADAR |
|
10.9.26 |
Dark Web Market: Anubis Market | Anubis Market is a multi-category Dark Web marketplace operating as a Tor hidden service, with escrow-backed trading in Bitcoin (BTC) and Monero (XMR). Its visible category strip displays more than 11,000 listings, and while narcotics account for the largest share of physical goods, its Digital section is the single biggest category on the market. | CyberCrime blog | SOCRADAR |
|
5.9.26 |
The NDA Was the Payload: Inside Phantom Deal, a Fake Acquisition Fraud Campaign | Attackers posed as executives, moved conversations to WhatsApp and personal email, and forged acquisition documents to set up international wire transfers. When they targeted Gen, researchers played along, exposing a wider M&A scam. | CyberCrime blog | GENDIGITAL |
|
31.8.26 |
Finnish Kennel Club, Shell Access, UK Iframe, Salt Mobile, and Brazil SERPRO Claims | SOCRadar Dark Web Team identified several new underground posts, including an alleged Finnish Kennel Club and Showlink dog-show database leak, and a separate initial access listing offering shell and WordPress access to websites in Indonesia and Romania. | CyberCrime blog | |
|
29.8.26 |
Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs |
Despite modern verification controls, identity theft remains one of the most pervasive threats to both individuals and enterprise organizations. U.S. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year. |
||
|
29.8.26 |
On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cybercrime syndicate that inserted malicious code into open-source software used by thousands of organizations worldwide. Both men appeared in Perth Magistrates Court the following day. |
|||
|
29.8.26 |
On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cybercrime syndicate that inserted malicious code into open-source software used by thousands of organizations worldwide. Both men appeared in Perth Magistrates Court the following day. |
|||
|
29.8.26 |
Imobiliare.ro, Klark.ai, Fortinet VPN, E-Commerce Skimming, and Solimut SQLi |
SOCRadar Dark Web Team identified several new underground posts involving alleged database leaks, exposed remote access, and access-for-sale activity. The findings include an alleged Imobiliare.ro user database sale, administrative Fortinet SSL-VPN access tied to a UAE hotel reservation firm, an alleged Klark.ai data leak, a U.S. e-commerce iframe skimming operation, and alleged SQL injection access affecting Solimut Mutuelle de France. |
||
|
29.8.26 |
A ShinyHunters-associated leak site listed ReliaQuest on August 23, 2026, raising questions about a potential data extortion attempt against the cybersecurity provider. |
|||
|
29.8.26 |
A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. |
|||
| 22.8.26 | Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor | Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 | CyberCrime blog | Seqrite |
|
7.8.26 |
Snowflake Hacker Pleads Guilty, Faces 32 Years | Snowflake hacker Connor Riley Moucka pleaded guilty on August 5, 2026, in the U.S. District Court for the Western District of Washington, admitting to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy count tied to the 2024 breaches of Snowflake customer accounts. | CyberCrime blog | SOCRADAR |
|
6.8.26 |
Dark Web Market: Vortex Market | Vortex Market describes itself as a “classic wallet escrow market,” and that self-description is accurate. It is a general-purpose Dark Web marketplace built around anonymous trade, vendor reputation levels, and cryptocurrency payments held in market-controlled wallets. Reporting on mirror directories places the launch of the Vortex darknet market in October 2023 with full public access during 2024. | CyberCrime blog | SOCRADAR |
|
8.8.26 |
From Stolen Credentials to Full Breach: The 72-Hour Timeline | The 72-hour Timeline reveals how stolen credentials can escalate into a cyberattack, showing key attack stages and detection opportunities. | CyberCrime blog | Cyble |
|
1.8.26 |
Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape | Cyble breaks down how dark web ecosystems are evolving in 2026 with ransomware, initial access brokers, AI-driven attacks, and underground threat activity. | CyberCrime blog | Cyble |