The UNC2891 campaign against Indonesian banks used a Raspberry Pi and the CAKETAP rootkit to bypass ATM verification protocols, orchestrating cash-outs via a mule network.

The “Bloody Wolf” group is expanding its targeted campaign across Central Asia, deploying NetSupport RAT and impersonating government

The GoldFactory group has launched a new wave of attacks targeting mobile-banking users across Southeast Asia. Disguising themselves

A sophisticated wave of mobile malware is sweeping through Central Asia, marking a dangerous evolution in how cybercriminals target Android users. A new in-depth analysis by Group-IB reveals that …

Fraudulent job advertisements promising easy income and remote work continue to flood social media platforms, particularly across the

Your smartphone might be the only accomplice a thief needs to drain your bank account, even if your card never leaves your wallet. A new report from Group-IB reveals a surging underground market f…

Group-IB researchers have identified a burgeoning proliferation of Android malware within subterranean marketplaces designed to exploit Near Field Communication (NFC) technology for fraudulent con…

The DeadLock syndicate, which emerged within the cyber threat landscape during the summer of 2025, persists as one

A new ransomware family is turning the decentralized dream of blockchain into a cybersecurity nightmare. Analysts at Group-IB have uncovered DeadLock, a ransomware strain discovered in July 2025 t…

Group-IB reveals ShadowSyndicate is evolving. The cybercrime cluster now rotates SSH keys to hide its infrastructure. Is it a BPH or IAB?