🚨Balonx Sistema shows how Phishing-as-a-Service (PhaaS) is evolving into a multi-vector financial fraud operation targeting Mexican banking customers.

In our latest technical investigation, Group-IB uncovers how the operation combines:
🔹 Weekly PhaaS subscriptions targeting 20+ financial institutions (3,000–6,000 MXN/week)
🔹 1,100+ harvested credentials and financial records since October 2025
🔹 WebSocket-based real-time session hijacking with 14 screen types for MFA interception
🔹 Spyroid-based Android RAT (BankProtect) for persistent device control
🔹 AI-powered vishing using GPT-4o-mini, ElevenLabs, and OpenAI Whisper
🔹 350+ domains linked to the Balonx and Aclaraciones Bancarias campaigns

The investigation reveals how phishing, malware, and AI-driven social engineering are being integrated into a single criminal ecosystem with active domain rotation and centralized PostgreSQL infrastructure.

Read the full technical analysis.

#Phishing #FinancialFraud #CyberSecurity #MalwareThreats

The hardest fraud to stop is the one the customer approves. By the time the money moves, there is nothing left to refuse.

Investment scams and fake platforms cost billions annually. If you try to fight these operations at the transaction layer, you lose, because the payment is the criminals' most defensible point.

But Group-IB’s latest analysis reveals their fatal flaw: fraud at this scale cannot afford to be artisanal. What makes these operations industrial also makes them profoundly networked through shared hosting, reused templates, and connected mule accounts.

Article three, in Dmitry Volkov's One Adversary series, shifts the focus from the payment to the network. It challenges you to ask the exact question every CRO should be putting on the agenda: how do we see what peer institutions have flagged without customer data ever leaving the bank?

Read it here.

#CyberFraudFusion #FraudPrevention #CyberSecurity

🚨Tortoiseshell is evolving its infrastructure and expanding its operational footprint across Europe and the Middle East.

In our latest technical analysis, Group-IB Threat Intelligence uncovered new infrastructure and malware associated with the Iranian-nexus APT, including a reverse SSH tunneling tool disguised as wtsapi32.dll and TWOSTROKE C++ backdoor capable of command execution, file exfiltration, in-memory DLL execution, and host reconnaissance.

Our research also identified additional C2 infrastructure and geographically named subdomains that may indicate a broader targeting profile.

Read the full technical analysis to explore Tortoiseshell's evolving toolset, infrastructure, C2 architecture, and defensive recommendations.

#ThreatIntelligence #APT #CyberSecurity #Tortoiseshell

🚨 By the time a bank detects fraud, legacy systems are simply watching the end of a story they missed.

When an industrial malware campaign hit 11,000 devices, unfused banks drowned in isolated alerts while losses compounded.

But institutions with cyber-fraud fused defense held fraud success to just 0.027%, a 9x reduction compared to the market.

Global regulators are taking note, rapidly shifting mandates to require cyber and fraud to operate as a single architecture.

Article three in Dmitry Volkov's One Adversary series turns strategy debates into hard proof. It delivers the exact two questions your Risk Committee needs to answer before the next campaign hits. Read it here.

#FinancialSecurity #RiskManagement #CyberSecurity #Compliance

🚨 Cybercrime is evolving, and so is the underground economy behind it.

Group-IB has uncovered BraZetsu, a sophisticated malware framework attributed to Brazilian threat actor Exilware, revealing how cybercriminals are using AI-enhanced reconnaissance to identify high-value targets across banking, ERP, government, and industrial environments.

BraZetsu powers the Infected Marketplace, where initial access to compromised systems is sold as a tradable commodity, allowing buyers to deploy their own malicious payloads without ever establishing the initial foothold themselves.

Read the full technical analysis.

#Cybersecurity #ThreatIntelligence #BraZetsu #AI

🚨 Outsider Phishing Kit: a resilient PhaaS threat

Group-IB researchers uncovered the Outsider Phishing Kit, operated by threat actor ChenLun, which has enabled large-scale smishing campaigns targeting 54+ countries.

From December 2025 to May 2026, researchers identified 100,000+ phishing pages and 267+ ready-made templates targeting financial services, telecom, government, logistics and other sectors.

The kit includes AiTM capabilities, real-time credential and payment card interception, MFA manipulation, WebSocket-based C2 communication and anti-analysis techniques.

Even after law enforcement action, Group-IB identified 700+ new phishing pages and domains, highlighting the resilience of the ecosystem.

Read the full technical analysis.

#CyberSecurity #Phishing #Smishing #PhaaS

🚨 Group-IB uncovers Vwork, a weaponized fork of the open-source Android app cloner Shelter, used alongside the Gigabud banking trojan.

Vwork abuses Android Work Profiles to clone banking apps into an isolated environment, helping attackers evade detection and bypass fraud controls.

Vwork-compatible Gigabud samples were identified across LATAM, MENA, and APAC, targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a GCC member state.

In Indonesia, Group-IB observed 1,469 compromised devices and 1,281 potentially compromised logins between February and July 2026, with estimated losses of $960,939.

Read the full technical analysis.

#ThreatIntelligence #AndroidMalware #Vwork #Gigabud

🚨 Inside the Smishing Triad’s Phishing Cockpit

Group-IB’s latest research dives into JWR, a phishing kit used by the Outsider cluster, revealing how attackers turn phishing pages into real-time fraud operations.

Key findings:
🔹32 operator commands for real-time victim manipulation
🔹Keystroke-level credential and payment-data capture
🔹~70 data fields for PII, cards, OTPs, credentials and device data
🔹WebSocket C2 with AES-256-CTR encrypted communications
🔹Distinctive fingerprints, IOCs, YARA and Suricata detection rules

Read the full technical analysis.

#Phishing #Smishing #CyberCrime

🚨Group-IB Threat Intelligence has uncovered 29 new samples linked to the HEAVYGRAM and CRUDEEXCLUDE malware families, expanding our understanding of activity attributed with moderate confidence to Handala Hack.

The investigation reveals a multi-stage Windows infection chain combining social engineering, legitimate application masquerading, PowerShell execution, Defender exclusions and persistent access.

At the centre of the operation is HEAVYGRAM, a Python-based Windows backdoor that uses Telegram’s Bot API for C2 and data exfiltration. Operators can remotely execute commands, capture screenshots, collect system and process information, steal Telegram session data and deploy additional payloads.

The research also shows how CRUDEEXCLUDE is used to prepare compromised systems by adding paths to Microsoft Defender exclusions before deploying subsequent stages.

Read the full technical analysis.

#ThreatIntelligence #HandalaHack #HEAVYGRAM

🚨Group-IB researchers have uncovered RemControl, a previously undocumented Android banking trojan operating as Malware-as-a-Service (MaaS). First observed in July 2026, RemControl abuses Android’s Accessibility Service to inject phishing overlays over legitimate banking applications, capture sensitive credentials, stream the victim’s screen, log interactions, and remotely control the device.

The threat goes beyond credential theft. Its infrastructure includes an exposed operator panel for managing bots, overlay templates, stolen credentials, remote sessions, and affiliate-specific APK builds. The malware also uses a local VPN to interfere with Google Play Protect during installation and retrieves its command-and-control address through an encrypted Telegram dead-drop mechanism.

Researchers also identified evidence of AI-assisted development, including an AI-generated response accidentally left inside a live phishing page.

Read the full blog.

#CyberSecurity #AndroidMalware #BankingTrojan

🏦 There's a stage in every major fraud that belongs to no one in your bank.

Not the cyber team. Not the fraud team. Not AML. And the criminals know exactly where it is.

We're constantly reinforcing this because the gap is still open, unowned, and being worked while the industry nods along. Fraud and cybercrime aren't two problems. They're one operation.

This is the convergence our CEO Dmitry Volkov has been strongly making the case for, and we've brought it together in one whitepaper: One Adversary, One Workflow.

So that's what the paper does. Make the defence the same shape as the attack: one picture of the adversary, one chain defended end to end, one loop where every blocked session sharpens the next detection. On a live malware campaign, institutions running that fused model held fraud success to 0.027% of infected devices, roughly 9× below the market.

Download report.

#FraudPrevention #FinancialSecurity

🛍️That “too good to be true” deal could be the lure.

Milk Dragon, also known as NaiLong, has targeted over 6,159 victims across 66 countries since October 2025. With 258 identified phishing pages, the operation impersonates major brands like LEGO, Calvin Klein, and Aeon Malaysia.

Instead of suspicious emails or urgent messages, this phishing operation uses heavily discounted products promoted through Facebook & TikTok marketplaces to lead victims to fake WordPress and WooCommerce e-commerce sites.

Behind the scenes, its custom BytePress plugin can capture payment data in real time, intercept OTPs through Adversary-in-the-Middle techniques, and give operators centralized control over multiple phishing campaigns via a WebSocket connection.

Sold as Phishing-as-a-Service through Telegram starting at 300 USDT per month, Milk Dragon shows how cybercriminals are turning trusted social platforms & familiar shopping experiences into attack infrastructure.

Read more.

#Phishing #CyberSecurity #ThreatIntelligence

🚨Operation KillSwitch, led by German authorities, with support from Europol and Eurojust, has taken action against KillSec, a ransomware-as-a-service group linked to around 1,000 suspected attacks worldwide.

Key Highlights:
🔹 274 organizations were publicly claimed as victims on KillSec’s leak site.
🔹 Around 35% of identified victims were in North America, 30% in Asia-Pacific, and 14% in Europe
🔹 Financial services, healthcare, and government were among the most affected sectors
🔹 The group operated a fully functional affiliate platform with ransom negotiation and payment handling capabilities, payload configuration for Windows and VMware ESXi environments, a Tor-based DLS, and more

Group-IB supported the international Operation KillSwitch with investigative intelligence on KillSec’s operations, infrastructure, and key enablers.

Read the full press release to learn more.

#CyberSecurity #Ransomware #OperationKillSwitch

🚨What if a fully authenticated 3DS payment was still fraudulent?

That is what Group-IB uncovered in a card fraud scheme targeting the GCC. Fraudsters used phishing, eSIM swaps, and account takeover to gain control of victims’ identities and banking access, then used that access to settle genuine government bills and fines using stolen cards.

The payments satisfied valid 3DS authentication.

Group-IB identified approximately 300 related incidents. Of these, 80 compromised cards were linked to around $2.01 million in confirmed fraudulent payments across three government institutions.

How does a fraudster turn a stolen card into a legitimate-looking government payment?

Our new report follows the scheme from the first phishing ad to the final cash-out, covering the infrastructure, actors, Telegram marketplace, and signals that can expose the fraud.

Read the full report.

#CardFraud #FinancialFraud #PaymentSecurity #FraudPrevention

⚠️ KGB RAT: behind the capabilities of a Windows Remote Access Trojan

KGB RAT is sold as Malware-as-a-Service, combining credential theft, keylogging, hidden desktop access, cryptocurrency, clipboard hijacking, and ransomware functionality in a configurable tool.

In its technical analysis, Group-IB researchers examined how KGB RAT establishes persistence, conducts system reconnaissance, communicates with its command-and-control infrastructure, and uses evasion techniques to complicate detection.

The investigation also identified multiple operators using a common builder, highlighting why shared code alone is not enough to establish that activity comes from the same threat actor.
The findings show why defenders need to look beyond individual indicators and investigate behavioral evidence, including suspicious process chains, scheduled task creation, registry changes, and unexpected outbound connections.

Read the full technical analysis.

#CyberSecurity #MalwareAnalysis #KGBRAT

🚨Group-IB has been named a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026.

The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared.

One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on.

It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut:
→ Native attack surface management, cyber threat intelligence and digital risk protection
→ Native remediation
→ Outside-in and inside-out visibility

Frost singles out two reasons: intelligence Group-IB originates rather than resells, and Cyber-Fraud Fusion, defending cyber and fraud as the single operation attackers actually run. Learn More

#CyberSecurity #VisionaryLeader

🚨The Checker You Pay For: How Spend-Management Onboarding Became Fraud Infrastructure

How can cybercriminals turn a legitimate financial platform into a tool for fraud?

In a new investigation, Group-IB researchers examined a suspected Classiscam operation that abused a spend-management platform’s notification systems to distribute Poshmark-impersonation phishing and its open-banking account-linking flow to validate stolen bank and card credentials.

🔹 Trusted payment notifications used to deliver phishing.
🔹 Open-banking abused to check stolen credentials.
🔹 Device and graph analysis linked phishing and card-testing accounts.
🔹 Group-IB reduced fraudulent account blocking time from several hours to under a minute, stopping more than 230 accounts assessed as fraudulent in May 2026 alone.

Read the full investigation.

#FraudPrevention #ThreatIntelligence #FinTechSecurity

🚨Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified.

The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA.

Overlaps with organizations later listed by ransomware groups including Qilin and The Gentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed.

Read the full technical analysis.

#ThreatIntelligence #CyberSecurity #CyberThreats #k0t

🔎 Inside SiriusQT: A seriously skilled RAT

SiriusQT has been circulating on underground forums since April 2026, combining HVNC, credential theft, browser automation, keylogging, persistence, process injection and custom encrypted C2 communication.

The analysis identified more than 280 SiriusQT client samples linked to different campaigns and 146 unique licenses, including 110 leaked licenses. The malware supports techniques such as Process Hollowing, QueueUserAPC/Early-Bird Injection and Remote Thread Injection, while its credential recovery functionality can target more than 100 different data sources.

The latest technical analysis examines SiriusQT’s server and client components, licensing ecosystem, dark web distribution, HVNC implementation, infrastructure and encrypted C2 protocol.

Read the full research.

#ThreatIntelligence #MalwareAnalysis #CyberCrime #SiriusQT

🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered.

Group-IB supported INTERPOL’s Operation Serengeti III, a multinational law-enforcement operation targeting cybercriminal networks across Africa.

Coordinated by INTERPOL and involving 21 countries, the operation tackled cyber-enabled fraud, ransomware, business email compromise, online scams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million.

As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa or used to target the region. The company also shared intelligence on threat actors involved in fraudulent activities, including social media accounts linked to suspected fraudsters.

Read the full press release to learn more.

#INTERPOL #OperationSerengetiIII #Cybercrime