A new variant of spyware called Stealerium automates sextortion by detecting when users browse pornography, capturing screenshots and webcam images to blackmail victims. Researchers at Proofpoint revealed that this malware, available as open-source on GitHub, enhances traditional infostealer functions by adding a layer of privacy invasion and humiliation. The malware has been linked to multiple cybercriminal campaigns since May.

EvilCorp, a sanctioned Russian cybercriminal group, has been linked to RansomHub, a rapidly growing ransomware-as-a-service operation. The collaboration between these entities raises concerns about potential sanctions for RansomHub, as their combined tactics involve using malware like SocGholish to infiltrate systems and execute ransomware attacks. This connection could complicate the landscape for organizations responding to ransomware incidents and increase scrutiny from law enforcement.

Microsoft has dismantled the Lumma Stealer operation, a malware distribution network involved in stealing user credentials and sensitive information. The company's actions included seizing domains associated with the malware, significantly disrupting its functionality and targeting cybercriminal activities.

Authorities in Pakistan have arrested 21 individuals linked to the “Heartsender” malware service, which facilitated spam and cybercrime for over a decade, resulting in extensive financial losses. The operation, which targeted various internet companies, was identified by KrebsOnSecurity in 2021, and included notorious figures like Rameez Shahzad, the alleged ringleader. The arrests follow a series of raids conducted by the National Cyber Crime Investigation Agency amid ongoing investigations into transnational organized crime.

Cybercriminals are utilizing malicious traffic distribution systems (TDS), such as TAG-124, to deliver targeted malware and conduct ransomware attacks on high-value targets, particularly in the healthcare sector. This infrastructure enhances the efficiency of cybercriminal operations, enabling them to exploit vulnerabilities and maximize extortion payouts. Understanding and mitigating the risks associated with TAG-124 is crucial for organizations to defend against these sophisticated attacks.

North Korea is reportedly targeting cryptocurrency job seekers to distribute malware designed to steal passwords. These cyber operations aim to exploit the growing interest in crypto jobs, leveraging social engineering tactics to infect potential candidates' devices. The initiative reflects North Korea's ongoing efforts to fund its regime through cybercrime activities.

Cybercriminals are increasingly exploiting the Lovable AI website builder to create phishing pages and fraudulent sites that impersonate well-known brands. Despite Lovable's efforts to detect and eliminate malicious content, the rising number of AI site generators is lowering the barriers for cybercrime. Recent campaigns have targeted organizations and individuals through sophisticated phishing schemes, resulting in significant data theft and malware distribution.

Hackers have exploited a leaked copy of Shellter Elite, a commercial AV/EDR evasion tool, to deploy infostealer malware, marking the first misuse incident since the vendor's strict licensing model was introduced. Despite ongoing malicious activity since April, Shellter was not notified by security researchers at Elastic Security Labs, who later confirmed the misuse and developed detections for the affected version. Shellter has since released an updated version for vetted customers, excluding the one responsible for the leak.

Interpol has successfully dismantled a network of over 20,000 malicious IP addresses that were used for various cybercrimes, including hacking and distributing malware. This operation aimed to enhance global cybersecurity and reduce the impact of cyber threats on individuals and organizations. The initiative highlights the ongoing efforts of law enforcement agencies to combat online criminal activities.

The U.S. government has unsealed charges against 16 individuals linked to DanaBot, a malware-as-a-service platform responsible for stealing information and causing over $50 million in losses. The FBI revealed that the malware infected more than 300,000 systems worldwide, and some defendants inadvertently exposed their identities by infecting their own computers. The operation included the seizure of servers used to control the malware and store stolen data.

An international law enforcement operation has successfully taken down AVCheck, a counter antivirus service used by cybercriminals to test malware evasion against commercial antivirus software. The takedown is part of Operation Endgame, which aims to disrupt organized cybercrime by targeting services that help criminals refine their malware for maximum effectiveness. Evidence links AVCheck's administrators to other crypting services that further support cybercriminal activities.