This media is not supported in your browser
VIEW IN TELEGRAM
🚨201 arrests. 3,867 victims identified. 53 servers seized.
Group-IB supported INTERPOL’s Operation Ramz, the first large-scale cybercrime operation across the MENA region, spanning 13 countries and targeting phishing, malware, and cyber fraud infrastructure.
Key contributions from Group-IB:
🔹Intelligence on 5,000+ compromised accounts, including government-linked accounts
🔹Identification of active phishing infrastructure across MENA
🔹 Mapping of threat actor clusters involved in phishing distribution and leaked data trafficking
This operation reflects what public-private collaboration can achieve when intelligence is regionally grounded and globally coordinated. Our Digital Crime Resistance Centers in Egypt and the UAE were central to delivering that visibility.
We remain committed to supporting international efforts to dismantle cybercriminal ecosystems and protect individuals and organisations across the MENA region and beyond.
Read More.
#ThreatIntelligence #INTERPOL #DCRC #Phishing
Group-IB supported INTERPOL’s Operation Ramz, the first large-scale cybercrime operation across the MENA region, spanning 13 countries and targeting phishing, malware, and cyber fraud infrastructure.
Key contributions from Group-IB:
🔹Intelligence on 5,000+ compromised accounts, including government-linked accounts
🔹Identification of active phishing infrastructure across MENA
🔹 Mapping of threat actor clusters involved in phishing distribution and leaked data trafficking
This operation reflects what public-private collaboration can achieve when intelligence is regionally grounded and globally coordinated. Our Digital Crime Resistance Centers in Egypt and the UAE were central to delivering that visibility.
We remain committed to supporting international efforts to dismantle cybercriminal ecosystems and protect individuals and organisations across the MENA region and beyond.
Read More.
#ThreatIntelligence #INTERPOL #DCRC #Phishing
🔥9❤3👍2🤯1
🚨Chinese-language dark web forums and Telegram channels are flooding cybercrime ecosystems with claims of stolen data from financial institutions worldwide. Group-IB researchers dug in, and the datasets don't hold up.
After analyzing 17,000+ messages across five active sources, names and phone numbers trace back to the 2021 Facebook leak, password hashes to the 2020 Eatigo breach, assigned to entirely different individuals. These are not fresh breaches. They are repackaged old data sold as new.
The research includes sample validation walkthroughs, upstream source mapping, and identification markers organizations can use to assess similar claims.
Read the full analysis.
#CyberSecurity #DarkWeb #InfoSec #ThreatIntelligence
After analyzing 17,000+ messages across five active sources, names and phone numbers trace back to the 2021 Facebook leak, password hashes to the 2020 Eatigo breach, assigned to entirely different individuals. These are not fresh breaches. They are repackaged old data sold as new.
The research includes sample validation walkthroughs, upstream source mapping, and identification markers organizations can use to assess similar claims.
Read the full analysis.
#CyberSecurity #DarkWeb #InfoSec #ThreatIntelligence
❤9🔥5👍1🖕1
🚨Group-IB researchers uncovered a large-scale fraud ecosystem operating ahead of kickoff, with more than 4,300 fraudulent domains impersonating the tournament’s official web presence and over 300 active phishing domains targeting fans globally.
At the center of the operation is GHOST STADIUM, a sophisticated phishing campaign leveraging cloned SSO authentication flows, fake hospitality portals, coordinated social media distribution, and multi-rail payment fraud infrastructure.
Key Highlights:
🔹4,300+ fraudulent tournament-themed domains identified.
🔹300+ active phishing domains linked to one coordinated operator.
🔹2,513 compromised credential pairs circulating on dark web markets.
🔹Estimated premium ticket fraud losses ranging from $71M to $474M USD.
🔹130,000+ infostealer logs containing tournament-related data.
🔹Underground Fraud-as-a-Service vendors selling phishing kits and ticket scam infrastructure.
Read the full technical analysis.
#ThreatIntelligence #FraudProtection
At the center of the operation is GHOST STADIUM, a sophisticated phishing campaign leveraging cloned SSO authentication flows, fake hospitality portals, coordinated social media distribution, and multi-rail payment fraud infrastructure.
Key Highlights:
🔹4,300+ fraudulent tournament-themed domains identified.
🔹300+ active phishing domains linked to one coordinated operator.
🔹2,513 compromised credential pairs circulating on dark web markets.
🔹Estimated premium ticket fraud losses ranging from $71M to $474M USD.
🔹130,000+ infostealer logs containing tournament-related data.
🔹Underground Fraud-as-a-Service vendors selling phishing kits and ticket scam infrastructure.
Read the full technical analysis.
#ThreatIntelligence #FraudProtection
🔥8👍3🖕2
🚨Group-IB researchers uncovered a sophisticated global smishing operation that has impersonated more than 267 brands across 72 countries and generated over 4,389 phishing domains since the second half of 2025.
The campaign combines SMS phishing, geofencing, device fingerprinting, fake Cloudflare error pages, and encrypted WebSocket communications to evade detection and harvest personal and payment card data in real time.
Key findings:
🔹 Telecommunications emerged as the most targeted sector with 1,754 domains, followed by financial services with 696 domains and consumer rewards programs with 488 domains.
🔹 Malicious content is revealed only to victims matching specific geographic and mobile device criteria.
🔹 Stolen data is exfiltrated through encrypted WebSocket channels using binary encoded payloads.
🔹 Approximately 30 percent of the infrastructure is hosted on Tencent Cloud and Alibaba origin servers while being fronted by Cloudflare.
Read the full technical analysis.
#DRP #Smishing
The campaign combines SMS phishing, geofencing, device fingerprinting, fake Cloudflare error pages, and encrypted WebSocket communications to evade detection and harvest personal and payment card data in real time.
Key findings:
🔹 Telecommunications emerged as the most targeted sector with 1,754 domains, followed by financial services with 696 domains and consumer rewards programs with 488 domains.
🔹 Malicious content is revealed only to victims matching specific geographic and mobile device criteria.
🔹 Stolen data is exfiltrated through encrypted WebSocket channels using binary encoded payloads.
🔹 Approximately 30 percent of the infrastructure is hosted on Tencent Cloud and Alibaba origin servers while being fronted by Cloudflare.
Read the full technical analysis.
#DRP #Smishing
🔥9❤5👍3🖕2
💳 The $48 Billion Blind Spot: Why Merchants Pay for Card Breaches They Can’t See
The scale of the problem:
🔹200M+ compromised payment cards actively circulating in underground markets
🔹E-commerce fraud projected to reach $53 billion in 2025
🔹Every $1 of fraud costs merchants $4.61 once chargebacks, fees, and operational costs are factored in
Why merchants can’t access the intelligence:
1️⃣ PCI DSS prohibits storing raw card data
2️⃣ Card network notification systems (Visa CAMS, Mastercard SAFE) operate issuer-to-issuer only
3️⃣ GDPR and data protection laws block cross-border sharing of personal identifiers
The result: Merchants absorb losses from cards that were already confirmed compromised. They just had no way to know.
What’s changing: Privacy-preserving Distributed Tokenization enables real-time compromised card checks at authorization, without raw card data or PCI DSS scope expansion.
Read the full analysis.
#FraudPrevention #EcommerceSecurity #Cybersecurity
The scale of the problem:
🔹200M+ compromised payment cards actively circulating in underground markets
🔹E-commerce fraud projected to reach $53 billion in 2025
🔹Every $1 of fraud costs merchants $4.61 once chargebacks, fees, and operational costs are factored in
Why merchants can’t access the intelligence:
1️⃣ PCI DSS prohibits storing raw card data
2️⃣ Card network notification systems (Visa CAMS, Mastercard SAFE) operate issuer-to-issuer only
3️⃣ GDPR and data protection laws block cross-border sharing of personal identifiers
The result: Merchants absorb losses from cards that were already confirmed compromised. They just had no way to know.
What’s changing: Privacy-preserving Distributed Tokenization enables real-time compromised card checks at authorization, without raw card data or PCI DSS scope expansion.
Read the full analysis.
#FraudPrevention #EcommerceSecurity #Cybersecurity
👍5🔥2🖕2👎1
Our latest research examines SilabRAT, a Malware-as-a-Service platform sold on underground forums that combines credential theft, browser profile cloning, HVNC, Chrome App-Bound Encryption bypass techniques, and cryptocurrency-focused capabilities into a single offering.
Key findings:
🔹 SilabRAT has been marketed on underground forums since late 2025 for $5,000/month
🔹 Leverages HVNC for invisible interaction with victim systems; other session access options include browser profile cloning, cookie theft
🔹 Includes functionality to bypass Chrome App-Bound Encryption (ABE) and extract protected browser data
🔹 Features automated cryptocurrency wallet targeting and password recovery capabilities
🔹 Observed in real-world campaigns leveraging ClickFix social engineering techniques
As cybercriminals move beyond simple credential theft toward full session compromise, understanding emerging RAT capabilities is critical for defenders.
🔗 Read the full analysis.
#ThreatIntel #MalwareAnalysis #CyberSecurity
Key findings:
🔹 SilabRAT has been marketed on underground forums since late 2025 for $5,000/month
🔹 Leverages HVNC for invisible interaction with victim systems; other session access options include browser profile cloning, cookie theft
🔹 Includes functionality to bypass Chrome App-Bound Encryption (ABE) and extract protected browser data
🔹 Features automated cryptocurrency wallet targeting and password recovery capabilities
🔹 Observed in real-world campaigns leveraging ClickFix social engineering techniques
As cybercriminals move beyond simple credential theft toward full session compromise, understanding emerging RAT capabilities is critical for defenders.
🔗 Read the full analysis.
#ThreatIntel #MalwareAnalysis #CyberSecurity
🔥6👍5🖕2
Group-IB supported INTERPOL and the Algerian National Police in dismantling SniperDz, a phishing-as-a-service (PhaaS) platform that operated for nearly a decade and enabled cybercriminals to launch phishing campaigns at scale.
Key findings:
🔹 20,000+ domains linked to the ecosystem
🔹 30+ global brands impersonated
🔹 80 phishing templates across five languages
🔹 45,000+ victim records reported by the platform in 2016 alone
Following a multi-month investigation, the operation led to the disruption of SniperDz infrastructure and the arrest of its primary developer and administrator.
The takedown of a platform operating at this scale is a major blow to the phishing ecosystem and helps better protect users of financial, telecom, entertainment, and other online services.
🔗 Read the full story.
#CyberSecurity #Phishing #ThreatIntelligence #INTERPOL
Key findings:
🔹 20,000+ domains linked to the ecosystem
🔹 30+ global brands impersonated
🔹 80 phishing templates across five languages
🔹 45,000+ victim records reported by the platform in 2016 alone
Following a multi-month investigation, the operation led to the disruption of SniperDz infrastructure and the arrest of its primary developer and administrator.
The takedown of a platform operating at this scale is a major blow to the phishing ecosystem and helps better protect users of financial, telecom, entertainment, and other online services.
🔗 Read the full story.
#CyberSecurity #Phishing #ThreatIntelligence #INTERPOL
❤7🔥7👍2🖕2
🚨Smishing campaigns continue to evolve beyond convincing lures. Modern phishing operations are increasingly engineered to evade detection.
In our latest technical analysis, Group-IB researchers dissect a campaign targeting drivers in Serbia through fake traffic fine SMS notifications. The investigation links the operation to two Phishing-as-a-Service ecosystems, Darcula and Phoenix, and reveals a phishing framework built for scale, resilience, and evasion.
The report explores how attackers:
🔹Deploy disposable lookalike domains and cloned government portals
🔹Use JavaScript-based runtime decoding and client-side obfuscation to hide phishing content from automated scanners
🔹Leverage browser APIs such as requestIdleCallback and IntersectionObserver to selectively render malicious content
🔹Rotate infrastructure rapidly to stay ahead of detection and takedowns
Read the full technical analysis.
#Phishing #Smishing #CyberSecurity
In our latest technical analysis, Group-IB researchers dissect a campaign targeting drivers in Serbia through fake traffic fine SMS notifications. The investigation links the operation to two Phishing-as-a-Service ecosystems, Darcula and Phoenix, and reveals a phishing framework built for scale, resilience, and evasion.
The report explores how attackers:
🔹Deploy disposable lookalike domains and cloned government portals
🔹Use JavaScript-based runtime decoding and client-side obfuscation to hide phishing content from automated scanners
🔹Leverage browser APIs such as requestIdleCallback and IntersectionObserver to selectively render malicious content
🔹Rotate infrastructure rapidly to stay ahead of detection and takedowns
Read the full technical analysis.
#Phishing #Smishing #CyberSecurity
👏8👍1🔥1
Scattered Spider has been linked to major cyberattacks in recent years, but our latest research suggests the threat is often misunderstood.
Group-IB's investigation shows Scattered Spider is not a single threat group but a decentralized cybercrime collective of independent subclusters connected by shared TTPs.
Key findings:
🔹 Scattered Spider is better understood as a network of autonomous subclusters rather than a centralized organization.
🔹 Oktapus represents one subcluster within the Scattered Spider ecosystem, not the collective itself.
🔹 The same subclusters have been linked to SIM swapping, crypto theft, enterprise intrusions, ransomware, and access brokerage.
🔹 Social engineering remains the primary access vector, with phishing, vishing, & smishing campaigns leveraging short-lived identity provider impersonation sites.
🔹 Its decentralized structure allows operations to continue despite arrests & law enforcement action.
Read the full technical analysis here.
#ThreatIntelligence #ScatteredSpider
Group-IB's investigation shows Scattered Spider is not a single threat group but a decentralized cybercrime collective of independent subclusters connected by shared TTPs.
Key findings:
🔹 Scattered Spider is better understood as a network of autonomous subclusters rather than a centralized organization.
🔹 Oktapus represents one subcluster within the Scattered Spider ecosystem, not the collective itself.
🔹 The same subclusters have been linked to SIM swapping, crypto theft, enterprise intrusions, ransomware, and access brokerage.
🔹 Social engineering remains the primary access vector, with phishing, vishing, & smishing campaigns leveraging short-lived identity provider impersonation sites.
🔹 Its decentralized structure allows operations to continue despite arrests & law enforcement action.
Read the full technical analysis here.
#ThreatIntelligence #ScatteredSpider
🔥7❤3
Android malware continues to evolve, and RedHook is a prime example of how legitimate developer features can be repurposed for malicious gain.
Our latest research analyzes the newest version of the RedHook Android RAT, which introduces a sophisticated privilege abuse chain by leveraging ADB Wireless Debugging to obtain shell-level access..
Key Highlights:
🔹 Autonomous abuse of ADB Wireless Debugging to gain shell-level privileges (uid 2000)
🔹 Integration of the Shizuku framework to execute protected Android system APIs
🔹 An expanded command-and-control framework supporting 53 remote commands
🔹 A robust persistence stack designed to survive reboots and evade process termination
🔹 Distribution through spoofed government and financial websites, with malicious APKs hosted on trusted platforms such as GitHub and AWS S3
🔹 Recent activity indicating an expansion of targeting from Vietnam to Indonesia
Read the full technical analysis.
#ThreatIntelligence #ThreatResearch #AndroidMalware
Our latest research analyzes the newest version of the RedHook Android RAT, which introduces a sophisticated privilege abuse chain by leveraging ADB Wireless Debugging to obtain shell-level access..
Key Highlights:
🔹 Autonomous abuse of ADB Wireless Debugging to gain shell-level privileges (uid 2000)
🔹 Integration of the Shizuku framework to execute protected Android system APIs
🔹 An expanded command-and-control framework supporting 53 remote commands
🔹 A robust persistence stack designed to survive reboots and evade process termination
🔹 Distribution through spoofed government and financial websites, with malicious APKs hosted on trusted platforms such as GitHub and AWS S3
🔹 Recent activity indicating an expansion of targeting from Vietnam to Indonesia
Read the full technical analysis.
#ThreatIntelligence #ThreatResearch #AndroidMalware
🔥9
🚨Group-IB researchers have uncovered ClickLock Stealer, a previously undocumented macOS malware that combines ClickFix social engineering, credential theft, crypto wallet harvesting, Keychain extraction, and persistent remote access into a single attack chain.
Key findings:
🔹At least 100 victims identified across 33 countries, with more than 50% located in Europe
🔹Targets 8 browsers, 31 crypto wallet extensions, 7 password manager extensions, and 8 desktop wallet applications
🔹Uses coercive "locker" techniques that repeatedly kill user applications until victims enter passwords or approve Keychain access
🔹Leverages Telegram bots for exfiltration and a modified GSocket backdoor for persistent access
🔹Relies entirely on social engineering, requiring no exploits or elevated privileges to compromise systems
🔹Had zero detections at the time of discovery
Read the full technical analysis.
#ThreatIntelligence #MalwareAnalysis #CyberSecurity #ClickLockStealer
Key findings:
🔹At least 100 victims identified across 33 countries, with more than 50% located in Europe
🔹Targets 8 browsers, 31 crypto wallet extensions, 7 password manager extensions, and 8 desktop wallet applications
🔹Uses coercive "locker" techniques that repeatedly kill user applications until victims enter passwords or approve Keychain access
🔹Leverages Telegram bots for exfiltration and a modified GSocket backdoor for persistent access
🔹Relies entirely on social engineering, requiring no exploits or elevated privileges to compromise systems
🔹Had zero detections at the time of discovery
Read the full technical analysis.
#ThreatIntelligence #MalwareAnalysis #CyberSecurity #ClickLockStealer
🔥9❤5👍4🏆1
🚨 Group-IB Threat Intelligence researchers have uncovered HOLLOWGRAPH, a Windows malware linked with high confidence to the Cavern framework that abuses Microsoft Graph API and compromised Microsoft 365 accounts to establish a covert command-and-control channel.
Key findings from our research:
🔹 Microsoft 365 calendars repurposed as two-way dead drops for command execution and data exfiltration
🔹 Commands and stolen files hidden inside encrypted calendar event attachments scheduled for the year 2050
🔹 DNS tunneling over IPv6 AAAA records used to refresh Microsoft Entra ID credentials required for cloud-based C2 communications
🔹 At least 12 identified victims, with telemetry suggesting a highly targeted operation focused on Israeli entities
🔹 Technical overlaps linking HOLLOWGRAPH to the broader Cavern framework
Read the full technical analysis.
#ThreatIntelligence #CyberSecurity #MalwareAnalysis
Key findings from our research:
🔹 Microsoft 365 calendars repurposed as two-way dead drops for command execution and data exfiltration
🔹 Commands and stolen files hidden inside encrypted calendar event attachments scheduled for the year 2050
🔹 DNS tunneling over IPv6 AAAA records used to refresh Microsoft Entra ID credentials required for cloud-based C2 communications
🔹 At least 12 identified victims, with telemetry suggesting a highly targeted operation focused on Israeli entities
🔹 Technical overlaps linking HOLLOWGRAPH to the broader Cavern framework
Read the full technical analysis.
#ThreatIntelligence #CyberSecurity #MalwareAnalysis
🔥8❤2
🚨A single OPSEC mistake exposed an entire China-nexus operation.
An exposed Alibaba Cloud staging server provided a rare view into an active threat operation. The infrastructure revealed attacker tooling, bash history, victim paths, and post-exploitation activity, leading to the discovery of a previously undocumented threat cluster we track as JadeProx.
Key Highlights:
🔹Discovery of TriBack Loader, a previously undocumented malware family observed across four infection chains.
🔹Targeting of government, healthcare, and education organizations across Southeast Asia, alongside phishing campaigns in Latin America.
🔹Abuse of signed Microsoft and G DATA binaries for DLL sideloading and payload execution.
🔹Use of InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread for evasion.
🔹Deployment of AdaptixC2 and the Beagle backdoor through a shared loader architecture.
🔹Large-scale vulnerability scanning, credential harvesting, and tunneling activity.
🔗 Read the full blog
#ThreatIntelligence
An exposed Alibaba Cloud staging server provided a rare view into an active threat operation. The infrastructure revealed attacker tooling, bash history, victim paths, and post-exploitation activity, leading to the discovery of a previously undocumented threat cluster we track as JadeProx.
Key Highlights:
🔹Discovery of TriBack Loader, a previously undocumented malware family observed across four infection chains.
🔹Targeting of government, healthcare, and education organizations across Southeast Asia, alongside phishing campaigns in Latin America.
🔹Abuse of signed Microsoft and G DATA binaries for DLL sideloading and payload execution.
🔹Use of InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread for evasion.
🔹Deployment of AdaptixC2 and the Beagle backdoor through a shared loader architecture.
🔹Large-scale vulnerability scanning, credential harvesting, and tunneling activity.
🔗 Read the full blog
#ThreatIntelligence
🔥8👍2
🚨 Fraud teams at banks and payment providers are under more pressure than ever. ATO, APP fraud, scams, and mule activity are accelerating, and regulators are watching.
KuppingerCole has published its Buyer’s Compass for Fraud Reduction Intelligence Platforms (FRIP) – Finance 2026, an independent framework for evaluating FRIP solutions, mapping capabilities to use cases, and providing structured RFP guidance.
Group-IB Fraud Protection is featured in the independent Vendor Spotlight, covering ATO prevention, APP fraud and scam detection, device intelligence, behavioural biometrics, and BioConfirm for PSD2 compliance.
Download the full report.
#FraudProtection #Cybersecurity #Fintech #GroupIB
KuppingerCole has published its Buyer’s Compass for Fraud Reduction Intelligence Platforms (FRIP) – Finance 2026, an independent framework for evaluating FRIP solutions, mapping capabilities to use cases, and providing structured RFP guidance.
Group-IB Fraud Protection is featured in the independent Vendor Spotlight, covering ATO prevention, APP fraud and scam detection, device intelligence, behavioural biometrics, and BioConfirm for PSD2 compliance.
Download the full report.
#FraudProtection #Cybersecurity #Fintech #GroupIB
🔥6👍5❤1
🚨Cryptomining campaigns continue to evolve beyond simple resource theft.
In our latest research, Group-IB analysts uncovered a covert Linux-based XMRig operation that leveraged trusted third-party access to infiltrate victim environments before deploying a heavily modified cryptomining implant engineered for stealth, persistence, and defence evasion.
Key Highlights:
🔹 Abuse of Linux PAM (pam_rootok) to impersonate multiple low-privileged users and create a forensic smokescreen.
🔹 Active log suppression and the use of a /tmp/.lock mutex to ensure single-instance execution without crashing the host.
🔹 A self-unlinking XMRig implant that deletes itself from disk and continues running entirely from memory.
🔹 Process masquerading, hidden artifacts (T1564.013), and network User-Agent spoofing as Java/Agent to blend Stratum traffic with legitimate web flows.
🔹 Campaign tracking identifiers (My-V25-GEN-26) linking infections to the V25-GEN-26 operation.
Read the full technical analysis.
#DFIR #XMRig
In our latest research, Group-IB analysts uncovered a covert Linux-based XMRig operation that leveraged trusted third-party access to infiltrate victim environments before deploying a heavily modified cryptomining implant engineered for stealth, persistence, and defence evasion.
Key Highlights:
🔹 Abuse of Linux PAM (pam_rootok) to impersonate multiple low-privileged users and create a forensic smokescreen.
🔹 Active log suppression and the use of a /tmp/.lock mutex to ensure single-instance execution without crashing the host.
🔹 A self-unlinking XMRig implant that deletes itself from disk and continues running entirely from memory.
🔹 Process masquerading, hidden artifacts (T1564.013), and network User-Agent spoofing as Java/Agent to blend Stratum traffic with legitimate web flows.
🔹 Campaign tracking identifiers (My-V25-GEN-26) linking infections to the V25-GEN-26 operation.
Read the full technical analysis.
#DFIR #XMRig
🔥6❤2👍1
🎉 Group-IB's Threat Intelligence solution is now available in AWS Marketplace.
Designed to provide adversary-centric intelligence, Group-IB's Threat Intelligence helps organizations identify and assess cyber threats at their earliest stages: from compromised credentials and dark web activity to emerging cybercrime groups, APT campaigns, fraud schemes, and large-scale attack indicators.
Powered by Group-IB's global Digital Crime Resistance Centers, adversary-centric research, and one of the industry's largest cybersecurity data lakes, the solution delivers verified, actionable intelligence. Proven through contributions to more than 1,600 global law enforcement investigations worldwide, it helps security teams shift from reactive response to proactive defense.
Now available on AWS Marketplace, customers can simplify procurement, consolidate billing, and gain faster access to threat intelligence.
Get started with Group-IB Threat Intelligence on AWS Marketplace today.
#GroupIB #ThreatIntelligence #AWS
Designed to provide adversary-centric intelligence, Group-IB's Threat Intelligence helps organizations identify and assess cyber threats at their earliest stages: from compromised credentials and dark web activity to emerging cybercrime groups, APT campaigns, fraud schemes, and large-scale attack indicators.
Powered by Group-IB's global Digital Crime Resistance Centers, adversary-centric research, and one of the industry's largest cybersecurity data lakes, the solution delivers verified, actionable intelligence. Proven through contributions to more than 1,600 global law enforcement investigations worldwide, it helps security teams shift from reactive response to proactive defense.
Now available on AWS Marketplace, customers can simplify procurement, consolidate billing, and gain faster access to threat intelligence.
Get started with Group-IB Threat Intelligence on AWS Marketplace today.
#GroupIB #ThreatIntelligence #AWS
🔥10👍2
🚨The most expensive fraud sits at the one stage nobody in the bank owns. Cyber sees the fake domain. Fraud sees the money leaving.
The moment a customer is compromised falls into the gap between teams, where no telemetry tells the full story.
Group-IB CEO Dmitry Volkov calls this positional, not technological: no transaction-layer tool removes it, only an observer placed earlier on the chain.
Article one in his new series, One Adversary, opens with an exercise: map your last serious fraud case stage by stage, and name the team that could have caught each one. The stage with no name beside it is where your losses live.
Read it here.
#CyberFraudFusion #FraudPrevention #CyberSecurity
The moment a customer is compromised falls into the gap between teams, where no telemetry tells the full story.
Group-IB CEO Dmitry Volkov calls this positional, not technological: no transaction-layer tool removes it, only an observer placed earlier on the chain.
Article one in his new series, One Adversary, opens with an exercise: map your last serious fraud case stage by stage, and name the team that could have caught each one. The stage with no name beside it is where your losses live.
Read it here.
#CyberFraudFusion #FraudPrevention #CyberSecurity
👍6🔥4❤3👏3
🚨Right person. Right device. Right password. Wrong everything else.
Kyrgyz Investment and Credit Bank (KICB) set out to protect its 500,000+ customers from the attacks that traditional security struggles to stop: social engineering, account takeover, and unauthorized remote access. Fraud that looks legitimate because the customer is the one being manipulated.
Together with its implementation partner, Noventiq Kyrgyzstan, KICB deployed Group-IB Fraud Protection to detect these attacks in real time and give investigators the context they need to act quickly.
"The most significant result we have seen so far is in combating social engineering attacks. Fraud Protection helps us identify events that were previously difficult to detect through manual review and provides significantly more context for investigating suspicious activity." — Aida Isakova, Head of Anti-Fraud, KICB
Read the full story.
#CyberSecurity #SocialEngineering #FinancialSecurity
Kyrgyz Investment and Credit Bank (KICB) set out to protect its 500,000+ customers from the attacks that traditional security struggles to stop: social engineering, account takeover, and unauthorized remote access. Fraud that looks legitimate because the customer is the one being manipulated.
Together with its implementation partner, Noventiq Kyrgyzstan, KICB deployed Group-IB Fraud Protection to detect these attacks in real time and give investigators the context they need to act quickly.
"The most significant result we have seen so far is in combating social engineering attacks. Fraud Protection helps us identify events that were previously difficult to detect through manual review and provides significantly more context for investigating suspicious activity." — Aida Isakova, Head of Anti-Fraud, KICB
Read the full story.
#CyberSecurity #SocialEngineering #FinancialSecurity
👍6🔥3
☎️ A live phone call. A remote access trojan. An NFC relay malware.
Group-IB researchers uncovered WindRelay, a previously unseen Android NFC relay malware deployed alongside SpyNote RAT in a live-call fraud scheme.
The investigation reveals how threat actors are combining:
🔹 Social engineering calls with personalized RAT delivery
🔹 Remote sideloading of NFC relay malware
🔹 Real-time interception and relay of EMV card transactions
🔹 23 related samples and four C2 IPs linked to WindRelay activity
The findings also highlight why defenders should look beyond screen-sharing detection and monitor Accessibility Service abuse, sideloaded apps, suspicious permissions, and NFC activity.
👉 Read the full technical analysis.
#AndroidMalware #SpyNoteRAT #WindRelay #FraudPrevention
Group-IB researchers uncovered WindRelay, a previously unseen Android NFC relay malware deployed alongside SpyNote RAT in a live-call fraud scheme.
The investigation reveals how threat actors are combining:
🔹 Social engineering calls with personalized RAT delivery
🔹 Remote sideloading of NFC relay malware
🔹 Real-time interception and relay of EMV card transactions
🔹 23 related samples and four C2 IPs linked to WindRelay activity
The findings also highlight why defenders should look beyond screen-sharing detection and monitor Accessibility Service abuse, sideloaded apps, suspicious permissions, and NFC activity.
👉 Read the full technical analysis.
#AndroidMalware #SpyNoteRAT #WindRelay #FraudPrevention
🔥5👍4
🕰️ Every fraud operating model contains an assumption nobody wrote down: the money will wait while the case file travels.
Confirm the case. Assemble the file. Cross the team boundary: email, ticket, weekly sync. Each step is reasonable. The sum assumes the money waits.
It does not. RUSI research on UK banking data: 28% of stolen funds gone within fifteen minutes of the fraudulent transfer. Over 85% within a day.
Dmitry Volkov's second article, One Adversary: The Fifteen-Minute Problem, argues this number ends the case file era, and shows where the time is won back: not by hurrying investigators, but in the weeks of preparation every fifteen minute execution is bought with.
He gives that interval a name, Defensive Lead Time, and a metric to manage it by.
Learn more about it in the most useful six minutes read you’ll indulge in this week.
#FraudPrevention #FinancialCrime #CyberSecurity
Confirm the case. Assemble the file. Cross the team boundary: email, ticket, weekly sync. Each step is reasonable. The sum assumes the money waits.
It does not. RUSI research on UK banking data: 28% of stolen funds gone within fifteen minutes of the fraudulent transfer. Over 85% within a day.
Dmitry Volkov's second article, One Adversary: The Fifteen-Minute Problem, argues this number ends the case file era, and shows where the time is won back: not by hurrying investigators, but in the weeks of preparation every fifteen minute execution is bought with.
He gives that interval a name, Defensive Lead Time, and a metric to manage it by.
Learn more about it in the most useful six minutes read you’ll indulge in this week.
#FraudPrevention #FinancialCrime #CyberSecurity
🔥4❤2👍2
🚨Balonx Sistema shows how Phishing-as-a-Service (PhaaS) is evolving into a multi-vector financial fraud operation targeting Mexican banking customers.
In our latest technical investigation, Group-IB uncovers how the operation combines:
🔹 Weekly PhaaS subscriptions targeting 20+ financial institutions (3,000–6,000 MXN/week)
🔹 1,100+ harvested credentials and financial records since October 2025
🔹 WebSocket-based real-time session hijacking with 14 screen types for MFA interception
🔹 Spyroid-based Android RAT (BankProtect) for persistent device control
🔹 AI-powered vishing using GPT-4o-mini, ElevenLabs, and OpenAI Whisper
🔹 350+ domains linked to the Balonx and Aclaraciones Bancarias campaigns
The investigation reveals how phishing, malware, and AI-driven social engineering are being integrated into a single criminal ecosystem with active domain rotation and centralized PostgreSQL infrastructure.
Read the full technical analysis.
#Phishing #FinancialFraud #CyberSecurity #MalwareThreats
In our latest technical investigation, Group-IB uncovers how the operation combines:
🔹 Weekly PhaaS subscriptions targeting 20+ financial institutions (3,000–6,000 MXN/week)
🔹 1,100+ harvested credentials and financial records since October 2025
🔹 WebSocket-based real-time session hijacking with 14 screen types for MFA interception
🔹 Spyroid-based Android RAT (BankProtect) for persistent device control
🔹 AI-powered vishing using GPT-4o-mini, ElevenLabs, and OpenAI Whisper
🔹 350+ domains linked to the Balonx and Aclaraciones Bancarias campaigns
The investigation reveals how phishing, malware, and AI-driven social engineering are being integrated into a single criminal ecosystem with active domain rotation and centralized PostgreSQL infrastructure.
Read the full technical analysis.
#Phishing #FinancialFraud #CyberSecurity #MalwareThreats
🔥4👍1