Latest Cyber Threat Trends

Technologies · September 24, 2026

No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click

One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time.

Ilya Pomerantsev

Maria Viderman

213

Malware Analysis · September 23, 2026

RemControl: AI Built the Overlays. Victims Lose their PINs

Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI.

Bruno Bijelić

1,245

Malware Analysis · September 17, 2026

HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control.

Karam Chatra

Batuhan Karakoç

Mahmoud Zohdy

4,305

Technologies · September 16, 2026

The Adversary We Are Fighting Is Now a Full-Force Industry: Inside cybercrime’s new economy

Attacks now are cheap, fast, and outsourced. The recent research shows what it changes and how organizations should strategy defense.

Jasmine Kharbanda

922

Technologies · September 14, 2026

Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit

A deep technical analysis of the Smishing Triad’s JWR phishing kit and Outsider operator cluster, revealing its real-time victim control, encrypted WebSocket communications, multi-stage credential theft, AES-256-CTR implementation, infrastructure, and actionable indicators for defenders.

Mohammad Gamal Younis

2,592

Fraud Protection · September 9, 2026

Vwork: Weaponized Open-source Software as an Addon for Gigabud

How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders.

Pavel Naumov

Bryan Karunachandra

3,970

Technologies · September 8, 2026

Ransomware in 2026: What the Data Demands From You

Group-IB's 2026 data shows ransomware accelerating across APAC. See where response plans fail, and the 5-pillar framework built to hold under pressure.

Meeba Gracy

1,073

Technologies · September 4, 2026

One Adversary: The 90-Day Fusion Playbook

Fusion is a capability you mature into, not a team you hire. Here is the honest maturity path, the metrics that fund it, and the on-ramp that costs no headcount, startable this quarter.

Dmitry Volkov

24,950

Scam & Phishing · September 3, 2026

The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action

This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide.

Viacheslav Shevchenko

Brandon Tan

2,825

Threat Intelligence · August 31, 2026

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets.

Julio Guapo Menezes

Miguel Salazar

4,954

Technologies · August 27, 2026

One Adversary, Two Outcomes: The 0.027% Proof

One malware campaign, 11,000 compromised devices, two banks with very different outcomes. At the bank with fused defence, fraud succeeded on just 0.027% of compromised devices; nine times less than the market average. Regulators are taking notice too.

Dmitry Volkov

1,652

Advanced Persistent Threats · August 26, 2026

Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure.

Mansour Alhmoud

Mohamed Emam

6,385

Technologies · August 20, 2026

One Adversary: Fraud Is a Network, Not a Payment

Payment was authorised. The transaction was, technically, legitimate. It was also part of a $187 million criminal network, and the payment was the worst place to fight it.

Dmitry Volkov

2,029

Technologies · August 19, 2026

Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities.

Luis Lamus

7,101

Technologies · August 13, 2026

One Adversary: The Fifteen-Minute Problem

More than a quarter of stolen funds are gone within fifteen minutes of the fraudulent transfer. That number ends the case-file era — and points to where the time can be won back.

Dmitry Volkov

1,929

Malware Analysis · August 12, 2026

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme

A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out.

Alexander Grabko

Konstantinos Angelopoulos

Pavlos Gaitanis

Bruno Bijelić

6,472

Technologies · August 7, 2026

Building Scalable Bridges Between Systems Using The Latest Release of Our Ciaops Library

ciaops is Group-IB's open-source Python library for integrating Threat Intelligence, Digital Risk Protection, and Attack Surface Management APIs. Zero event loss, guaranteed.

Pavel Shepetina

Maria Antonova

Kirill Chekhlatov

1,902

Technologies · August 5, 2026

One Adversary: The Moment Nobody Sees

Map any fraud campaign against your org chart and one stage of the attack has no owner. The adversary knows exactly which one — and the most expensive fraud cases live there.

Dmitry Volkov

2,032

Technologies · July 30, 2026

MSSPs: Your SOC Already Detects Fraud. Missed Opportunity Is Selling It As a Service.

Managed cyber-fraud protection is the most overlooked growth line in the MSSP playbook, and most of the capability is already sitting in your SOC.

Vladimir Goliashev

1,869

Digital Forensics & Incident Response · July 30, 2026

XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens

Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads.

Nam Le Phuong

Yeo Zi Wei

3,087

Email Protection Spotlight · July 27, 2026

No Room For Compromise: How Business Email Protection Predicts BEC Before It Starts

Most business email compromise (BEC) attacks start with stolen credentials, not a malicious email. Group-IB uses threat intelligence to detect compromised accounts before attackers log in — predicting BEC before it starts.

Ilya Pomerantsev

Maria Viderman

1,882

Ransomware · July 23, 2026

Ransomware in 2026: Same Business, New Rules

The ransomware economy has been rewired. Meet the eight ransomware groups driving the shift, from affiliate breakaways to AI-assisted attacks based on Group-IB Threat Intelligence.

Nikolay Kichatov

Maria Viderman

11,999

Threat Intelligence · July 23, 2026

JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake

An open directory and a SEA of victims reaching as far as LATAM all lead to TriBack Loader.

Sathwik Ram Prakki

9,019

Technologies · July 20, 2026

Risks, Vulnerabilities And Response: Threat Intelligence is Quietly Becoming The Connected Layer in Security

Cyberthreat Intelligence is not a feed bolted on the side, it is the operational impetus behind strengthened security. And that change in role has earned the market its first dedicated industry evaluation.

Jasmine Kharbanda

2,269

Advanced Persistent Threats · July 20, 2026

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels

Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.

Javier Castillo

10,004

Threat Intelligence · July 16, 2026

ClickLock Stealer: Paste Once, Lose Everything

Analyzing a new threat targeting macOS users in Europe, North America and MEA

Boris Martynyuk

11,251

Scam & Phishing · July 14, 2026

The Scam Will Go On: Beware of Fake Offers for Celine Dion Concert Tickets

Group-IB discovers a sophisticated multi-layered scam scheme targeting fans with fake ticket sales on two fronts: social network platforms and fraudulent websites impersonating official distributors.

Carla Lippolis

Anthony Gerlach

3,843

Fraud Protection · July 13, 2026

Inside the Matching Engine: How Distributed Tokenization Identifies Compromised Cards Without Exposing Them

Discover how Distributed Tokenization identifies compromised cards at pre-authorization without exposing raw card data — a technical deep-dive for fraud operations and risk teams.

Julien Laurent

2,312

Threat Intelligence · July 9, 2026

RedHook Returns with a Dangerous Upgrade

Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack.

Sharmine Low

Ha Thi Thu Nguyen

11,041

Threat Intelligence · July 7, 2026

Connecting Scattered Spider: Defining A Cybercrime Collective Through Shared TTPs

This blog covers Group-IB’s overview of Scattered Spider, backed by Group-IB’s proprietary intelligence, providing additional information to what has already been reported publicly, with added clarification on 0ktapus and how it is related to Scattered Spider.

Igor Gudarov

8,037

Scam & Phishing · July 1, 2026

Phishing in the Balkans: Fake Traffic Fines, Real Losses

This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe.

Azizbek Khakimov

3,089

Threat Intelligence · June 25, 2026

Millenium: A RAT Rewritten, A Threat Multiplied

Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone an architectural shift from .NET to native C++, while continuing to leverage the Telegram Bot API for command and control, requiring no dedicated server infrastructure. This blog also profiles the developer “ShinyEnigma”, and threat actor cluster “Y2K Operators” responsible for active Millenium RAT exploitation campaigns. Over 62,000 compromised endpoints across more than 160 countries have been identified, with infections accelerating sharply in Q1 2026.

Bakhtiyor Yokubov

Volen Kayo

10,944

Technologies · June 23, 2026

Brace Before The Impact: 7 Signals Your Organization Needs A Cybersecurity Services Retainer

Incident response plans aren't enough if the response can't activate when it matters. Discover seven signs your organization may need a cybersecurity services retainer to strengthen readiness, resilience, and incident response capabilities.

Jasmine Kharbanda

28,453

Technologies · June 23, 2026

10 Cybersecurity Priorities for E-Commerce Teams This Year

E-commerce is the second most targeted sector for cyberattacks in 2026. Get the 10 priorities every security team must act on, with Group-IB intelligence behind each.

Meeba Gracy

2,719

Technologies · June 22, 2026

8 Questions to Ask Before Choosing an Incident Response Retainer

Before you sign an incident response retainer, ask about SLA definitions, scope, hidden costs, threat profile fit, and post-incident support. Here is what to look for.

Meeba Gracy

2,279

Scam & Phishing · June 17, 2026

GitBait: Phishing the Mexican Financial Sector

A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a centralized credential exfiltration via SheetBest API, indicating a scalable and persistent multi-brand phishing operation.

Cristián Espinoza Sinsay

3,828

Cyber Investigations · June 11, 2026

Sniper’s Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud

This blog provides a deep-dive into SniperDz, a centralised PhaaS platform with more than 80 ready-made phishing templates impersonating over 30 global brands, and uncovers the hidden infrastructure behind this sophisticated and highly-organized fraud ecosystem.

Anna Yurtaeva

Viacheslav Shevchenko

4,028

Threat Intelligence · June 10, 2026

SilabRAT, What’s Your Power?

SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by the threat actor "o1oo1," SilabRAT is heavily focused on financial gain through credential theft. It offers stability and is capable of bypassing existing security measures.

Sharmine Low

Vladimir Timofeev

9,267

Scam & Phishing · June 3, 2026

Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

Group-IB researchers expose a large-scale smishing and phishing operation impersonating 260+ brands across 72 countries, using fake Cloudflare error pages, geofencing, and encrypted WebSocket channels for real-time credit card theft.

Hans Figueroa

7,732

Technologies · June 1, 2026

Cryptocurrency Scams: The 10 Most Common Types and How They Work

Learn the most common crypto scam types and how they work in practice. Understand how financial institutions can detect fraud earlier and prevent losses at the fiat-to-crypto boundary.

Meeba Gracy

6,381

Fraud Protection · June 1, 2026

The $48 Billion Blind Spot: Why Merchants Pay for Card Breaches They Can’t See

Merchants face $53B in card fraud losses but lack access to compromised card data. Discover the three barriers keeping merchants in the dark — and the solution.

Julien Laurent

2,235

Scam & Phishing · May 27, 2026

The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

With the 2026 FIFA World Cup just weeks away, Group-IB researchers have uncovered six distinct fraud schemes, four independent threat actors, and over 4,300 fraudulent domains impersonating FIFA's official web presence — including a sophisticated phishing operation run by the Chinese-speaking threat actor GHOST STADIUM, whose campaign could cause losses reaching billions of dollars.

Yuan Huang

Kuvonchbek Yorkulov

Alyaa Selim

Mahmoud Gamal Rashied

17,923

Fraud Protection · May 22, 2026

Online Payment Fraud Prevention: Best Practices for Organizations

Learn what payment fraud is, how it unfolds, and the practical controls that organizations can use at every step of the payment process to reduce losses without harming customer trust.

Julien Laurent

2,779

Threat Intelligence · May 20, 2026

Volume Obfuscation Game: The Lead Data Brokers Out To Waste Your Time

An increasing number of data brokers active in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of purportedly stolen data from organizations worldwide. But are they credible?

Karam Chatra

8,871

Fraud Protection · May 19, 2026

Is Fraud Distorting Your iGaming Growth Numbers?

A candid conversation on fraud disguised as iGaming growth with Sarah Psaila, Head of Gaming at Group-IB.

2,395

Technologies · May 18, 2026

Introducing Group-IB Prevyn AI

How Group-IB is building a cognitive core that anticipates threats before they happen

Boris Zverkov

Maria Viderman

2,453

Digital Forensics & Incident Response · May 15, 2026

What Is an Incident Response Retainer? (And Why Waiting Until a Breach Is Too Late)

An incident response retainer gives organizations immediate access to cybersecurity experts when a breach occurs, without losing critical time to legal, procurement, or onboarding delays. This article explains how IR retainers work, the different retainer models available, and why they can significantly reduce downtime, damage, and uncertainty during a cyber incident.

Meeba Gracy

2,796

Technologies · May 15, 2026

Digital Brand Protection in Cybersecurity: Why It Matters in 2026

Digital brand protection helps organizations detect and disrupt external threats, such as phishing sites, fake social profiles, counterfeit listings, and leaked credentials, before they become customer-facing fraud or reputational damage.

Meeba Gracy

2,315

Scam & Phishing · May 13, 2026

The French 2-Step: Exposing a Multi-stage Scam Targeting the National Railway Company in France

This highly targeted scam scheme uses advanced phishing and social engineering cues, rely on brand recognition, event-based campaigns and emotional manipulation to defraud victims twice.

Anthony Gerlach

Anton Fomin

3,136

Technologies · May 8, 2026

Group-IB Digital Risk Protection Integrates with Google SecOps: Brand Threat Intelligence, Now In Your SOC

Pavel Shepetina

Maria Antonova

Alejandro Antonio Moreno Sancho

2,715

Scam & Phishing · May 6, 2026

The Architecture of Deception: How a $187 Million Fraud Ecosystem Exploits Trust Across Australia and the United States

This blog examines how threat actors use deepfake impersonation and social media to manipulate real stocks, how a network of 208 connected fake investment platforms steals millions in cryptocurrency, and what a new approach to defence can do about it.

Yuan Huang

Afiq Sasman

Alexander Sychev

3,609

Threat Intelligence · April 29, 2026

Phoenix Rising: Exposing the PhaaS Kit Behind Global Mass Phishing Campaigns

While analyzing global smishing operations spanning APAC, LATAM, Europe, and MEA, Group-IB researchers uncovered the 'Phoenix System' administrative panel, a centralized Phishing-as-a-Service (PhaaS) platform with real-time victim monitoring, geofencing, and live-phishing interventions to bypass multi-factor authentication.

Ha Thi Thu Nguyen

Sia Fei

9,145

Fraud Protection · April 22, 2026

Anatomy of a Fraud Operation: Mule Account Creation on B2B Fintech Platforms in France

How corporate/retail accounts are exploited for financial fraud through sophisticated device fingerprinting and mule networks.

Alexander Grabko

Konstantinos Angelopoulos

3,559

Cyber Investigations · April 16, 2026

W3LL Unmasked: Inside the Takedown of a Global BEC Phishing-as-a-Service Ecosystem

The takedown of a global phishing-as-a-service ecosystem

Anton Ushakov

3,682

Technologies · April 9, 2026

Seven Signals Cyber Experts Agreed on at FIRST Paris 2026

Group-IB hosted the FIRST Technical Colloquium in Paris, where cybersecurity experts challenged assumptions around modern cyber defense. FIRST Chair Olivier Caleff opened and moderated the event.

Jasmine Kharbanda

2,498

Fraud Protection · April 9, 2026

Are Risks Revealed in Actions or Activity? Understanding Behavioral Analytics in Cybersecurity

Attackers count on static defenses. Switch to advanced behavioral analytics to spot abnormal behavior while its still unfolding and protect your environment.

Jasmine Kharbanda

2,539

Threat Intelligence · April 8, 2026

Cyber Saga: In the Footsteps of the DPRK IT Workers

Discover how North Korean threat actors use synthetic identities, AI-assisted workflows, and overlapping infrastructure to infiltrate companies, and learn actionable strategies to mitigate this insider threat.

Anastasia Tikhonova

11,379

Scam & Phishing · April 1, 2026

Hooking the Archipelago: Dissecting a Phishing Campaign Targeting Philippine Banking Users

Group-IB researchers uncover an ongoing phishing campaign targeting major banks in the Philippines. This blog details how threat actors abuse trusted and legitimate platforms to deceive users and evade detection. It highlights a significant threat escalation with the successful hijacking of a legitimate domain to host malicious infrastructure, enabling threat actors to operate with even greater credibility and reduced detection.

Ha Thi Thu Nguyen

3,686

Email Protection Spotlight · March 31, 2026

Phantom Stealer: Credential Theft as a Service

Group-IB shows how Business Email Protection blocked Phantom Stealer phishing emails across different campaign waves.

Anton Shumakov

Alpomish Asadov

3,389

Technologies · March 30, 2026

Beyond Compliance: How Financial Institutions Can Meet New Fraud-Sharing Mandates While Respecting Privacy

Global regulators are mandating fraud intelligence sharing. Learn how financial institutions can collaborate in real-time while maintaining privacy compliance through Distributed Tokenization.

Julien Laurent

1,894

Technologies · March 30, 2026

Cybersecurity Strategy Planning: The Essential Reset for Security Teams and Leaders in 2026

Is your cybersecurity truly built to withstand today’s nuanced threats or is it just living on paper? Find out more.

Jasmine Kharbanda

1,769

Fraud Protection · March 25, 2026

Cloud Phones: The Invisible Threat

Tracing the evolution of cloud phone technology from harmless social media engagement automation to industrial-scale financial fraud that’s invisible to modern detection systems.

Anvar Anarkulov

Khumoyun Turakhujaev

4,156

Ransomware · March 19, 2026

How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods

The report provides an overview on tactics, techniques, and procedures (TTPs) of The Gentlemen observed by Group-IB in intrusions conducted by its affiliates, as well as relevant information about the group's capabilities collected from underground private sources.

Nikolay Kichatov

Pietro Albuquerque

Michael Perugia

8,028

Scam & Phishing · March 13, 2026

The Rise of Fake Shipment Tracking Scams in MEA

Did you really lose your shipment on the way?

Fouad Elsergany

3,424

Threat Landscape Overview · March 13, 2026

Six Supply Chain Attack Groups to Watch Out for in 2026

Who's attacking your vendors? Read about the six main supply chain attack groups who are driving SaaS, open-source, and MSP compromise in 2026. Learn how npm supply chain attacks threaten your security today, based on threat intelligence collected by Group-IB.

Maria Viderman

Anastasia Tikhonova

17,276

Scam & Phishing · February 26, 2026

GTFire Phishing Scheme: Avoiding Detection Using Google Services

How GTFire abuses Google Firebase and Google Translate to scale global phishing campaigns

Vlada Govorova

Hans Figueroa

145,097

Technologies · February 19, 2026

Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia

It’s tax season in Indonesia and fraudsters are observed to be ramping up the fraud campaign involving fake Coretax apps, but behind it lies an industrialized MaaS infrastructure ready to strike anywhere.

Yuan Huang

2,732

Threat Intelligence · February 4, 2026

Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure

ShadowSyndicate levels up by developing new tactics, establishing additional SSH fingerprints and involving more servers.

Boris Martynyuk

154,491

Technologies · February 3, 2026

AI, Explain Yourself: Why Is Explainable AI (XAI) Becoming Critical for Cybersecurity?

AI knows everything, but should we trust it blindly? Here’s where XAI becomes important, by helping to keep AI in check and maintaining transparency, trust, and a true risk picture in cybersecurity.

Jasmine Kharbanda

69,602

Technologies · January 27, 2026

Your Cloud(s). Adversaries’ Chance At Control

Reconfigure multi-cloud security with the newly launched Group-IB Cloud Security Posture Management (CSPM)

Dmitry Shestakov

70,629

Technologies · January 21, 2026

Peruvian Peaks: The Digital Loan Illusion

A deep dive into loan phishing scams in Peru and Latin America. Discover how scammers lure victims with fake loan offers, harvest sensitive banking credentials, and leverage advanced scripts to maximize fraud at scale.

Vlada Govorova

Hans Figueroa

30,019

Threat Intelligence · January 15, 2026

DeadLock Ransomware: Smart Contracts for Malicious Purposes

This blog uncovers DeadLock’s stealthy usage of Polygon smart contracts for proxy address storage, a poorly-documented and under-reported technique that Group-IB analysts have observed increased usage in the wild. Variants of this technique are very wide and offer great alternatives to threat actors for bypassing traditional defenses by abusing decentralized blockchains available worldwide.

Xabier Eizaguirre

49,647

Threat Intelligence · January 7, 2026

Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware

Group-IB researchers detail the inner workings of Chinese tap-to-pay schemes on Telegram and examine the NFC-enabled Android apps fraudsters are using to steal money from victim’s bank cards and mobile wallets remotely.

Batuhan Karakoç

Karam Chatra

Anvar Anarkulov

9,589

Email Protection Spotlight · January 5, 2026

The DocuSign Impersonation Wave with Real-Time Customizable LogoKit

Learn how Group-IB’s Business Email Protection stops the growing wave of DocuSign impersonation before users are exposed, and protects them from credential-capturing websites built with real-time customizable LogoKit.

Anton Shumakov

Anastasia Tikhonova

5,516

Scam & Phishing · December 24, 2025

Empty Promises in MENA: How Online Quick Cash Schemes Exploit the Gig Economy

Fake online job ads continue to circulate across social media, especially in Arab countries, offering easy remote work and quick income. The sinister goal: to harvest sensitive information, from ID documents to banking details. This blog explains how the scheme operates, who the scammers target, and how to prevent falling victim to it.

Mahmoud Mosaad

Fouad Elsergany

2,171

Malware Analysis · December 19, 2025

Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan

Group-IB analyzes the evolution of Android malware in Uzbekistan, revealing advanced droppers, encrypted payload delivery, anti-analysis techniques, and Wonderland’s bidirectional SMS-stealing capabilities driving large-scale financial fraud.

Anvar Anarkulov

Bakhtiyor Yokubov

Amirbek Kurbanov

Pavel Naumov

3,762

Technologies · December 12, 2025

Your Updated Guide to AI in Cybersecurity: Adoption, Trends, Challenges, and The Future

AI in cybersecurity is changing the threat landscape faster than ever. Stay current and prepared with Group-IB.

Jasmine Kharbanda

4,556

Fraud Protection · December 11, 2025

Fighting Credit Fraud in Uzbekistan: An Uphill Battle Against Social Engineering

Comprehensive insights into Uzbekistan’s credit fraud trends, the methods used by fraudsters, and the practical security controls financial institutions are fighting back with.

Anvar Anarkulov

Viktor Kosenko

Khumoyun Turakhujaev

2,184

Technologies · December 10, 2025

Stranger Threats Are Coming: Group-IB Cyber Predictions for 2026 and Beyond

Stranger things are happening in the upside-down world of cybercrime. Group-IB’s CEO, Dmitry Volkov, shares his cyber predictions for 2026 — what’s coming next, and what we must collectively fight against.

Dmitry Volkov

48,308

Malware Analysis · December 3, 2025

Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines

A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as Gigaflower, shared criminal infrastructure, and insights from the Group-IB Fraud Matrix, with recommendations for organizations and end users.

Andrey Polovinkin

Sharmine Low

Ha Thi Thu Nguyen

Pavel Naumov

9,603

Fraud Protection · December 2, 2025

Can You Actually Stop APP Fraud Before It Happens? Inside The Secure, Real-Time Fraud Intelligence Network Proving It’s Possible

Discover how real-time fraud intelligence sharing prevents APP fraud before losses. Stop mule accounts already during warm-up with GDPR-compliant technology.

Julien Laurent

Maria Viderman

1,598

Threat Intelligence · November 26, 2025

Bloody Wolf: A Blunt Crowbar Threat To Justice

Since late June 2025, Group-IB analysts observed a surge in spear-phishing emails across Central Asia. The attackers impersonate government agencies to gain the trust of their victims. This blog describes the techniques, tools and ongoing activity of the threat group known as Bloody Wolf.

Amirbek Kurbanov

Volen Kayo

43,834

Ransomware · November 13, 2025

Uncovering a Multi-Stage Phishing Kit Targeting Italy’s Infrastructure

Group-IB researchers uncovered a professional phishing framework that mimics trusted brands with remarkable precision. Using layered evasion, CAPTCHA filtering, and Telegram-based data exfiltration, attackers harvest credentials and bypass automated detection. The findings highlight how phishing-as-a-service operations are scaling through automation, lowering technical barriers for cybercriminals, and industrializing one of the oldest yet most effective forms of digital fraud.

Ivan Salipur

Federico Marazzi

22,424

Technologies · November 5, 2025

Ghosts in /proc: Manipulation and Timeline Corruption

Discover how attackers could manipulate the Linux /proc filesystem to hide malicious processes and distort forensic timelines. This technical deep dive highlights examples of command-line substitution and start time corruption, and offers detection and defense strategies for incident responders and security analysts.

Nam Le Phuong

1,846

Email Protection Spotlight · October 31, 2025

Detecting the NPM Supply Chain Compromise Before It Spread

Discover how Group-IB’s Business Email Protection (BEP) could prevent an NPM supply chain compromise by detecting the initial phishing email that led to the developer’s infection.

Anastasia Tikhonova

Anton Shumakov

72,853

Cyber Investigations · October 28, 2025

The Illusion of Wealth: Inside the Engineered Reality of Investment Scam Platforms

This blog details online investment scam campaigns, including fraudulent cryptocurrency, forex, and trading platforms, while offering a technical investigation guide for investigators, based on Group-IB’s technical investigation methodology. It outlines the social engineering tactics and victim manipulation models employed, describes the fraud actor structures behind these schemes, and highlights key infrastructure artifacts identified by Group-IB High-Tech Investigations analysts that can be leveraged by cybersecurity professionals for detection and disruption.

Hai Ha Phan

2,978

Advanced Persistent Threats · October 22, 2025

Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage

Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign, attributed with high confidence to the Advanced Persistent Threat (APT) MuddyWater. The attack used a compromised mailbox to distribute Phoenix backdoor malware to international organizations and across the whole Middle East and North Africa region, targeting more than 100 government entities.

Mahmoud Zohdy

Mansour Alhmoud

64,563

Scam & Phishing · October 21, 2025

Exposing the Immediate Era Fraud in Singapore

Group-IB’s Threat Intelligence Report on a Singapore-Targeted Scam Operation

Vladimir Kalugin

5,250

Technologies · October 17, 2025

East-west tension: Are NDR vendors monitoring the wrong traffic?

Most NDR deployments focus on perimeter traffic. Meanwhile, attackers move laterally inside networks. Here’s why east-west visibility is the blind spot that defines today’s biggest breaches.

Ilya Pomerantsev

1,504

Threat Intelligence · October 15, 2025

A new weapon against payment fraud: Unique threat intelligence for anti-fraud teams

Group-IB’s Suspicious Payment Details module for Threat Intelligence delivers payment identifiers tied to ransomware, illegal casinos, and laundering schemes. Fraud, AML, and compliance teams can now stop money from reaching criminal infrastructure.

Dmitry Shestakov

84,282

Technologies · October 8, 2025

Top 7 Cybersecurity Newsletters Worth Your Inbox

Your inbox deserves better than spam. Here are 7 cybersecurity newsletters that actually inform and make you a little smarter each week.

Meeba Gracy

3,863

Advanced Persistent Threats · September 17, 2025

Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025

The blog provides an in-depth look at MuddyWater’s evolution in tooling, targeting, and infrastructure management, suggesting a more mature and capable advanced persistent threat within the META region.

Mansour Alhmoud

Mahmoud Zohdy

182,725

Technologies · September 5, 2025

10 Cybersecurity Podcasts to Add to Your Queue Now

Meeba Gracy

1,937

Scam & Phishing · September 3, 2025

From Deepfakes to Dark LLMs: 5 use-cases of how AI is Powering Cybercrime

AI in cybercrime is evolving fast, fueling AI phishing attacks, AI scam calls, AI voice cloning scams, and even AI deepfake scams. From Dark LLMs to next-gen AI phishing tactics, we break down how criminals exploit AI today and what you can do to stay protected.

Anton Ushakov

6,401

Threat Intelligence · August 27, 2025

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration

This blog describes attacks on victims in Central Asia and APAC. Research into the attack has identified a group also called YoroTrooper. We also identified profiles of attackers on hacker forums, their malicious web-panels, test infections of attackers' own machines, and screenshots of attackers' desktops.

Nikita Rostovcev

Sergei Turner

36,939

Technologies · August 25, 2025

Trust issues: How email threats hide behind your partners

The most widely used email security tools still focus on yesterday’s threats. Meanwhile, attackers have moved on. By hijacking legitimate business relationships and embedding infostealers in familiar-sounding, well-written emails, cybercriminals bypass conventional defenses. The only way to keep up is by using a behavioral approach.

Ilya Pomerantsev

21,212

Fraud Protection · August 20, 2025

Evolving Mule Tactics in the META Region Banking Sector

Discover how mule operators evolved in META-region banks—from IP masking to Starlink tactics with advanced GPS spoofing, SIM abuse, and device muling—and how layered fraud detection strategies fought back.

Andrei Loshchev

Norah Altriri

Nurbolat Nygmetov

2,364

Fraud Protection · August 13, 2025

Exposing Investment Scams: AI Trading, Deepfake & Online Fraud

AI trading scams use deepfake videos, fake reviews, and fraudulent platforms to steal investor money, and learn the signals that expose these online investment scams before you deposit.

Azizbek Khakimov

Anton Fomin

7,970

Fraud Protection · August 6, 2025

The Anatomy of a Deepfake Voice Phishing Attack: How AI-Generated Voices Are Powering the Next Wave of Scams

Discover how AI voice deepfake vishing exploits trust, drains millions, and learn practical steps to detect and stop voice‑based scams.

Yuan Huang

7,375

Digital Forensics & Incident Response · July 30, 2025

UNC2891 Bank Heist: Physical ATM Backdoor & Linux Forensic Evasion

Deep dive into UNC2891’s multi‑stage bank intrusion: Raspberry Pi ATM implant, bind mount evasion, Dynamic DNS C2, and a CAKETAP move toward HSM manipulation.

Nam Le Phuong

10,657

Technologies · July 25, 2025

Predictive AI: The “Quiet Catalyst” Behind The Future of Cybersecurity

Think threat actors are unpredictable? The rise of intelligence-driven defense and the push for incident predictions might just give us the edge to know their next moves…long before they make it.

Jasmine Kharbanda

84,947

Digital Forensics & Incident Response · July 23, 2025

Signed, Sealed, Altered? Deepdive into PDF Tampering

Uncovering the validity of a PDF by utilizing some of the tools and methods to detect changes made to a PDF, and understand the limitations in proving PDF integrity.

Yeo Zi Wei

4,759

Technologies · July 22, 2025

Fraud-Proof Your Security: How BioConfirm Protects iGaming Platforms and Players

Enable real-time, token-based account security that stops withdrawal fraud before your brand, players, and their revenue are compromised.

Julien Laurent

Jasmine Kharbanda

1,287

Fraud Protection · July 17, 2025

Fake Receipts Generators: the rising threat to major retail brands

Scammers are using tools like MaisonReceipts to create fake receipts and exploit brands. Uncover how this growing fraud ecosystem works behind the scenes.

Anthony Gerlach

Aydos Kurbanaev

Sorint.Sec

3,648

Threat Intelligence · July 8, 2025

What Is a Combolist? How It Works, Risks, and Prevention

Combolists and ULP files circulate on the dark web as new leaks, but most of what they contain was stolen years earlier and recycled many times over.

Semyon Botalov

27,893

Fraud Protection · July 7, 2025

Authenticate Users, Secure Transactions: How BioConfirm Secures High-Stakes Banking Operations

Introducing BioConfirm - Enable real-time, token-based user account security that stops withdrawal fraud before your brand, customers’ trust, and revenue are compromised.

Julien Laurent

Jasmine Kharbanda

53,530

Technologies · July 4, 2025

Exploiting Trust: How Signed Drivers Fuel Modern Kernel Level Attacks on Windows

Discover how attackers leverage Windows Kernel loaders and abuse digitally signed drivers to gain privileged access, disable security tools, and stealthily maintain control — bypassing traditional defenses and enabling advanced threat operations.

Mahmoud Zohdy

3,545

Technologies · July 4, 2025

One attack, one alert: From thousands of signals to one clear story

Discover how Smart Alert in Group-IB Managed XDR consolidates thousands of alerts into one, cuts alert volume by 80%, and automates SOC detection and triage with AI.

Ilya Pomerantsev

54,555

Figure 1. A screenshot of a deceptive message via Telegram requesting users to download a malicious app to receive financial assistance from the government in Uzbek (top) and translation in English (bottom).

Malware Analysis · July 2, 2025

June’s Dark Gift: The Rise of Qwizzserial

Discovered by Group-IB in mid-2024, the Qwizzserial, which was initially not very active, began to spread strongly in Uzbekistan, masquerading as legitimate applications. The malware steals banking information and intercepts 2FA sms, transmitting it to fraudsters via Telegram bots.

Pavel Naumov

Amirbek Kurbanov

Anvar Anarkulov

2,956

Cyber Investigations · June 23, 2025

Middle East Cyber Escalation: From Hacktivism to Sophisticated Threat Operations

Regional Conflict Monitoring (June 13 - 20, 2025)

Batuhan Karakoç

Kuvonchbek Yorkulov

Karam Chatra

Amirbek Kurbanov

3,314

Scam & Phishing · June 19, 2025

Declaration trap: Crypto Drainers masquerading as European Tax Authorities

Scammers are using fake tax authority emails to deploy crypto drainers. Discover how the declaration trap works and how to protect your digital assets.

Nika Nepomniashchikh

2,764

Threat Landscape Overview · May 15, 2025

Disguised Cyber Risks On The Colombian Shore: The Insurance Trap

Uncover how cybercriminals in Colombia impersonate financial brands and exploit public data to craft convincing vehicle insurance scams.

Vlada Govorova

Hans Figueroa

13,498

Digital Forensics & Incident Response · May 8, 2025

Understanding Credential Harvesting via PAM: A Real-World Threat

Learn how attackers exploit Pluggable Authentication Modules (PAM) for credential harvesting—and discover defenses to harden Linux authentication.

Nam Le Phuong

Vito Alfano

30,680

Technologies · May 5, 2025

How To Avoid Critical Integration Mistakes In Your Cybersecurity Stack

Pavel Shepetina

41,777

Ransomware · April 30, 2025

Ransomware debris: an analysis of the RansomHub operation

This blog on RansomHub provides an overview into how this Ransomware-as-a-Service (RaaS) group operates, including its extortion tactics, affiliate recruitment strategies, and the features of its affiliate panel.

Pietro Albuquerque

Mahmoud Zohdy

Vito Alfano

10,281

Scam & Phishing · April 23, 2025

Toll of Deception: Where Evasion Drives Phishing Forward

Discover the latest phishing campaign targeting a major toll road service provider, where cybercriminals use sophisticated evasion techniques to bypass security detections. This in-depth blog reveals how threat actors exploit legitimate platforms and deploy cloaking methods to disguise malicious links, allowing them to evade detection by security solutions. Discover how these sophisticated tactics create highly convincing phishing pages designed to steal victims’ card information, and how to safeguard yourself against these evolving cyber threats.

Ha Thi Thu Nguyen

Hai Ha Phan

Bui Tuan Vu

2,056

Technologies · April 18, 2025

Fast, smart, and private: Group-IB introduces AI Assistant

Our new LLM-powered chatbot is designed for efficiency and security. Discover how Group-IB AI Assistant enhances threat intelligence workflows and provides security teams with instant insights — without compromising privacy.

Boris Zverkov

4,556

Cyber Investigations · April 16, 2025

Typical Dark Web Fraud: Where Scammers Operate and What They Look Like

Semyon Botalov

5,994

Technologies · April 11, 2025

CISOs Top Order Of Business: Cyber Risk Reduction & Management

For modern CISOs, cyber risk management and reduction are nonstop challenges. But this blog offers exactly what you need to build a strategy that empowers you to manage and mitigate threats—cutting through the noise of an otherwise demanding role.

Jasmine Kharbanda

1,551

Fraud Protection · April 9, 2025

SMS Pumping: How Criminals Turn Your Messaging Service into Their Cash Machine

Alexander Grabko

6,259

Threat Landscape Overview · April 3, 2025

Fraud Underbelly: Australia’s Digital Boom—A Fraudster’s Goldmine?

Know exactly how cybercriminals are orchestrating attacks on Australia’s citizens and digital assets, and why are they a lucrative target?

Vaibhav Khandelwal

1,517

Ransomware · April 2, 2025

The beginning of the end: the story of Hunters International

Learn about technical details on the ransomware and Storage Software tool, how the criminals use the affiliate panel as well as information on the Hunters International ransomware group from its emergence to the end of the operation.

Mahmoud Zohdy

Pietro Albuquerque

Abzal Aitoriyev

9,786

Technologies · March 27, 2025

Navigating Cybercrime Currents in Latin America: Strengthening the Region’s Defenses

Stripping down barriers of distance, language, and the unknown, Group-IB’s mission to fight cybercrime brings us to our latest frontier –Latin America. Join us as we uncover the region’s deceptive criminals and tactics.

Vlada Govorova

Hans Figueroa

1,684

Scam & Phishing · March 26, 2025

Unmasking the Classiscam in Central Asia

Scams like Classiscam automate fake websites to steal financial data, exploiting digitalization’s rise in developing countries, making fraud both effective and hard to detect. In this blog, we dissect the inner working of the scam and its prevalence in Central Asia.

Azizbek Khakimov

Sammy Pao

2,353

Hunting Rituals · March 24, 2025

Hunting Rituals #5: Why hypothesis-based threat hunting is essential in cybersecurity

Discover how hypothesis-driven threat hunting uncovered stealthy malware. Learn why having a dedicated in-house team or leveraging expert threat hunting services is crucial for modern cybersecurity.

Yiu Wai Leong

Yeo Zi Wei

2,160

Cyber Investigations · March 20, 2025

The Cybercriminal with Four Faces: Revealing Group-IB’s Investigation into ALTDOS, DESORDEN, GHOSTR and 0mid16B

Following the arrest of the cybercriminal behind the aliases ALTDOS, DESORDEN, GHOSTR, and 0mid16B, Group-IB provides a deep dive into his activities, uncovering striking similarities and unmasking the cybercriminal that breached more than 90 instances of data leaks worldwide over the span of four years in operation.

Jessica Tedja

Vesta Matveeva

7,939

Threat Intelligence · March 13, 2025

ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims

Discover how the ClickFix social engineering attack exploits human psychology to bypass security. Learn how hackers use this tactic and how to protect against it.

Mansour Alhmoud

Sattam AlMohsen

Abdullah Alzeid

23,026

Technologies · March 10, 2025

The Evolution of SIM Swapping Fraud: How Fraudsters Bypass Security Layers

Discover how SIM swapping fraud has evolved, how cybercriminals bypass security layers, and the best ways to protect yourself from SIM swap attacks. Learn key prevention tips now.

Norah Altriri

3,660

Technologies · March 7, 2025

Building Zero Trust Security: Selectively Trust To Rightfully Secure

Build resilience with a zero trust cybersecurity model. Leverage your existing infrastructure for stronger security. Get all essential insights to start now.

Jasmine Kharbanda

1,296

Technologies · March 4, 2025

Technology Alone Isn’t the Answer to Cyber Threats: Time to Rethink Security Culture

Get the (ABCs) Awareness, Behavior, and Culture of cybersecurity right - an organization's silent drivers of cyber protection.

Jasmine Kharbanda

1,273

Fraud Protection · February 20, 2025

Fingerprint Heists: How your browser fingerprint can be stolen and used by fraudsters

Discover how cybercriminals steal browser fingerprints to mimic users, bypass security measures, and commit online fraud. Learn how to protect your digital identity.

Giovanni Barbieri

Dmitrii Yankelevich

Pavel Naumov

Dmitry Pisarev

4,067

Ransomware · February 12, 2025

RansomHub Never Sleeps Episode 1: The evolution of modern ransomware

Discover how ransomware has evolved into a sophisticated cyber threat, with groups like RansomHub leading the charge. Learn more about their adaptability, TTPs, and the rise of Ransomware-as-a-service in this first-of-three-part trilogy.

Vito Alfano

Nam Le Phuong

Mahmoud Zohdy

Pietro Albuquerque

6,546

Technologies · February 6, 2025

5 ways to leverage our Malware Reports for malware analysis

Discover 5 ways to leverage Malware Reports for daily analysis and improve detection. Perfect for SOC analysts, threat hunters, and reverse engineers.

Ilya Pomerantsev

Maria Viderman

17,076

Fraud Protection · February 5, 2025

The Dark Side of Automation and Rise of AI Agents: Emerging Risks of Card Testing Attacks

Card testing attacks exploit stolen credit card details through small, unnoticed purchases to verify active cards for larger fraud. Cybercriminals use bots, proxies, and automation to evade detection, making real-time fraud prevention challenging. Learn how these attacks work and how to protect against them.

Alisher Abdullaev

Andrei Loshchev

Maxim Baldakov

12,820

Ransomware · January 28, 2025

Cat’s out of the bag: Lynx Ransomware-as-a-Service

In this blog, we observed how the Lynx Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the panel, their cross-platform ransomware arsenal, customizable encryption modes, and advanced technical capabilities.

Nikolay Kichatov

Sharmine Low

Pietro Albuquerque

21,149

Cyber Investigations · January 22, 2025

Odds & Ends: Unraveling the Surebet Playbook

Discover the world of surebets, a strategy that guarantees profits by leveraging differing odds from multiple bookmakers. Explore how this approach impacts the betting market, challenging traditional profit models and increasing operational costs for bookmakers.

Julien Laurent

Alexander Grabko

2,541

Technologies · January 21, 2025

Group-IB’s GLOCAL Vision Leading The Fight Against Global Cybercrime

How is Group-IB evolving into a leading cybersecurity force that the community relies on?

Jasmine Kharbanda

1,323

Scam & Phishing · January 16, 2025

The Realty of Deception: Real Estate Frauds Uncovered in the Middle East

Real estate scams are on the rise as fraudsters exploit online platforms to deceive victims into paying for fake properties. This blog dives into how these scams operate in the Middle East, explains the tools and techniques used to detect and disrupt money-mule networks, and provides practical tips for staying safe.

Aya Ibrahim

Yusuf Gülcan

Stepan Kechko

6,271

Fraud Protection · January 13, 2025

Beyond AI: Group-IB’s Local Expertise in Fraud Protection

Minimize false positives, proactively prevent threats, and gain customized fraud protection with Group-IB. Our AI-powered solutions are fine-tuned by local experts and real-time threat intelligence in key regions, ensuring optimal security performance and minimal disruption to your business.

Julien Laurent

1,218

Fraud Protection · January 8, 2025

Social Engineering in Action: How Fraudsters Exploit Trust with Fake Refund Schemes in the Middle East

Fraudsters have devised a sophisticated scheme targeting banking customers in the Middle East, impersonating government officials and using remote access software to steal credit card information and OTP codes. This scam specifically targets individuals who have lodged complaints online via a government portal, taking advantage of their trust and willingness to cooperate in hopes of refunds, leading to significant financial losses through fraudulent transactions.

Stepan Kechko

2,141

Threat Landscape Overview · January 7, 2025

Cyber Predictions For 2025 (and Beyond): Group-IB’s Expert Take On What’s Coming

Don’t fall weak in the face of change and disruption. Review the upcoming cybersecurity changes and become equipped while there’s time!

Dmitry Volkov

17,699

Cyber Investigations · December 18, 2024

Patch Me If You Can: The Truth About Smartphone Vulnerabilities

Discover how smartphone manufacturers conceal security flaws, the risks these vulnerabilities pose to users and businesses, and actionable steps to protect devices from data breaches, identity theft, and exploitative attacks.

Sergey Nikitin

4,464

Scam & Phishing · December 11, 2024

Trust Hijacked: The Subtle Art of Phishing Through Familiar Facades

Explore the advanced tactics employed in recent email phishing campaigns targeting employees from over 30 companies across 12 industries and 15 jurisdictions. This blog unveils sophisticated techniques used to outsmart Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials.

Ha Thi Thu Nguyen

Hai Ha Phan

3,165

Fraud Protection · December 4, 2024

Deepfake Fraud: How AI is Deceiving Biometric Security in Financial Institutions

Group-IB’s Fraud Protection team examines how fraudsters use deepfake technology to bypass biometric security in financial institutions, including facial recognition and liveness detection. This blog highlights the use of emulators, app cloning, and virtual cameras to exploit vulnerabilities, and highlights the financial and societal impacts of deepfake fraud.

Yuan Huang

8,566

Scam & Phishing · November 28, 2024

Shady Bets: How to Protect Yourself from Gambling Fraud Online

Scammers are using fake betting game advertisements on social media to target users, with over 500 deceptive advertisements and 1,377 malicious websites identified by Group-IB CERT. These scams promise quick money but are designed to steal personal data and funds, and this blog aims to educate users on how to recognize and protect themselves from such threats.

Mahmoud Mosaad

2,862

Cyber Investigations · November 25, 2024

Rethinking investigation: Group-IB’s Graph takes a leap forward

Daria Shcherbatyuk

2,011

Cyber Investigations · November 21, 2024

Tracing the Path of VietCredCare and DuckTail: Vietnamese dark market of infostealers’ data

Following the arrest in May 2024 of more than 20 individuals behind Facebook infostealers campaigns in Vietnam, we have compared the tactics of operators behind VietCredCare and DuckTail stealers. These 2 malware families have been active before the arrest in Vietnam and are believed to be controlled by Vietnamese threat actors. Based on the research, we decided that the groups operate in a different way and the arrest probably affected the VietCredCare operators.

Hai Ha Phan

Vesta Matveeva

3,507

Scam & Phishing · November 15, 2024

Strengthening AML Defenses: Detect Money Mules During Their ‘Warm-Up’ Phase

Know the need to catch mules early in their operations to protect you from severe risks, including large-scale money laundering, compliance breaches, and business and customer disruptions.

Julien Laurent

1,293

Advanced Persistent Threats · November 13, 2024

Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes

In this blog, we examine a fresh take on techniques regarding concealing codes in Extended Attributes in order to evade detection in macOS systems. This is a new technique that has yet to be included in the MITRE ATT&CK framework.

Sharmine Low

50,737

Hunting Rituals · November 7, 2024

~~Run from~~ Chase Cyber Threats

Waiting for risks to be presented to you rather than actively hunting them down? After reading this, you might consider a shift in approach to improve detection and proactively counter sophisticated attacks.

Jasmine Kharbanda

1,307

Scam & Phishing · October 30, 2024

Delivery Deception: Escalating cybercriminal tactics in the Balkan region

Explore our latest findings on the surge of cyberattacks in the Balkan region, focusing on threats to financial institutions and critical infrastructure. Discover how phishing scams impersonating postal services are targeting citizens in Croatia, Romania, Serbia, and Slovenia, and learn about the implications for public safety and security. Stay informed and protected against the rising tide of cybercrime.

Ivan Salipur

1,722

Fraud Protection · October 29, 2024

Group-IB Fraud Protection: Know your real users, catch the fraudsters

Stop fraud, RATs, and malware with Group-IB's Fraud Protection AI. Our advanced behavioral analysis uses AI to detect and prevent threats in real-time, safeguarding your business and users.

Julien Laurent

4,849

Fraud Protection · October 25, 2024

Global iGaming? Tailor Your Security with Group-IB Fraud Protection

With Group-IB Fraud Protection, you can navigate the complexities of global iGaming regulations and risk. Tailor security measures for each market, optimize costs, and maximize growth. Learn how our advanced fraud detection and prevention tools can protect your players and profits.

Julien Laurent

1,857

Scam & Phishing · October 22, 2024

Woodn’t You Believe It? The Rise of Fake Wood Scams

In this blog we uncover a long-running scheme by scammers selling wood to the people in France during the winter season, and how consumers and businesses can protect themselves from financial and reputation damages.

Anthony Gerlach

1,732

Threat Intelligence · October 17, 2024

Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group

In this blog, we observed how the Cicada3301 Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the panel and examining the Windows, Linux, ESXi, and PowerPC variants of the ransomware.

Nikolay Kichatov

Sharmine Low

13,561

Fraud Protection · October 16, 2024

The firming grip of cyber fraud in Asia: What effective actions must banks take today?

Banks' current measures against cyber fraud are falling short – and the numbers don’t lie. That said, with a hyperactive threat landscape, what steps should you take to maximize cybersecurity?

Vaibhav Khandelwal

1,477

Digital Forensics & Incident Response · October 10, 2024

Unveiling USB Artifacts: A Comparative Analysis

Discover how USB artifacts enhance tracking user activities on files, examining the influence of operating systems, file systems, and applications on these crucial data traces.

Yeo Zi Wei

Alexey Kashtanov

2,610

Scam & Phishing · October 2, 2024

Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users

In this article, Group-IB specialists uncovered a large-scale fraud campaign involving fake trading apps targeting Apple iOS and Android users across multiple regions through the UniApp framework, and distributed through official app stores and phishing sites.

Andrey Polovinkin

11,601

Ransomware · September 25, 2024

Inside the Dragon: DragonForce Ransomware Group

In this blog, we look at the DragonForce ransomware group, which poses a severe threat with two variants—a LockBit fork and a customized Conti fork with advanced features and SystemBC malware.

Nikolay Kichatov

Sharmine Low

Alexey Kashtanov

44,576

Cyber Investigations · September 18, 2024

Storm clouds on the horizon: Resurgence of TeamTNT?

Investigations into recent campaigns may suggest the reemergence of TeamTNT in 2023 to present day, since evaporating in 2022.

Vito Alfano

Nam Le Phuong

8,868

Group-IB dark web investigations blog cover

Cyber Investigations · September 16, 2024

Concealed networks: Are dark web syndicates turning to social media for cybercrime?

Group-IB dark web investigations: To avoid prying eyes, find out how adversaries increasingly shift from the dark web to social media to execute attacks, leak credentials, share exploitable vulnerabilities, and more.

Cyril Boussiron

Jennifer Soh

2,034

Malware Analysis · September 12, 2024

Ajina attacks Central Asia: Story of an Uzbek Android Pandemic

Discovered by Group-IB in May 2024, the Ajina.Banker malware is a major cyber threat in the Central Asia region, disguising itself as legitimate apps to steal banking information and intercept 2FA messages.

Boris Martynyuk

Pavel Naumov

Anvar Anarkulov

5,536

Digital Forensics & Incident Response · September 6, 2024

The Duality of the Pluggable Authentication Module (PAM)

The Group-IB DFIR Team has identified a new technique not yet included in the MITRE ATT&CK framework, which could lead to use the module pam_exec to obtain a privileged shell on a host and grant a full persistence to a threat actor.

Vito Alfano

Nam Le Phuong

2,544

Advanced Persistent Threats · September 4, 2024

APT Lazarus: Eager Crypto Beavers, Video calls and Games

Explore the growing threats posed by the Lazarus Group's financially-driven campaign against developers. We will examine their recent Python scripts, including the CivetQ and BeaverTail malware variants, along with their updated versions in Windows and Python releases. Additionally, we will analyze their tactics, techniques, and indicators of compromise.

Sharmine Low

26,552

Ransomware · August 28, 2024

RansomHub ransomware-as-a-service

Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and exfiltrating large data volumes—are critical for staying ahead of modern cyber threats.

Abzal Aitoriyev

Anatoly Tykushin

5,986

Digital Forensics & Incident Response · August 26, 2024

Hiding in plain sight: Techniques and defenses against `/proc` filesystem manipulation in Linux

Group-IB explores methods of process visibility evasion through /proc filesystem manipulation in Linux, along with effective defenses to counteract these tactics.

Nam Le Phuong

3,716

Ransomware · August 14, 2024

Deciphering the Brain Cipher Ransomware

Deep dive into Brain Cipher ransomware group's activities and techniques, and how they are seemingly linked to other ransomware groups such as EstateRansomware and SenSayQ

Jennifer Soh

Vesta Matveeva

23,700

Threat Landscape Overview · August 7, 2024

Under Siege: The threat of compromised Mobile Device Management credentials and its implications for organizational security

The leakage of credentials for Mobile Device Management (MDM) services could pose significant risks to organizations and their data security.

Nikita Rostovcev

18,942

Threat Landscape Overview · August 2, 2024

NIS 2 compliance for EU businesses: Meet cybersecurity requirements before the deadline (October 17)

With NIS 2 non-compliance proving detrimental — resulting in millions in fines, business activity suspension, and more, become compliant while there’s still time!

Leonardo Cappabianca

1,301

Beware the RAT: Android Remote Access malware strikes in Malaysia

Malware Analysis · July 31, 2024

Beware CraxsRAT: Android Remote Access malware strikes in Malaysia

CraxsRAT is a notorious Android malware family known for its Remote Administration Tools (RAT), which include remote device control and advanced spyware functions like keylogging, gesture manipulation, and recording of cameras, screens, and calls.

Pavel Naumov

Yuan Huang

74,955

Cyber Investigations · July 25, 2024

GXC Team Unmasked: The cybercriminal group targeting Spanish bank users with AI-powered phishing tools and Android malware

Specializing in AI-powered phishing-as-a-service and Android malware capable of intercepting OTP codes, the GXC Team targets Spanish bank users and 30 institutions worldwide

Anton Ushakov

Martijn van den Berk

3,367

Ransomware · July 17, 2024

Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks

Discover the insidious tactics of the Qilin ransomware group, notorious for their $50 million attack on the healthcare sector, impacting key NHS hospitals.

Dmitry Volkov

6,085

Technologies · July 15, 2024

Group-IB Digital Risk Protection: How does it enable the fastest violation detection and takedown?

The digital space is riddled with risks to your brand. Ensure it stays defended with Group-IB Digital Risk Protection’s automated violation detection and takedown.

Afiq Sasman

1,804

Ransomware · July 10, 2024

Patch or Peril: A Veeam vulnerability incident

Delaying security updates and neglecting regular reviews created vulnerabilities that were exploited by attackers, resulting in severe ransomware consequences.

Yeo Zi Wei

6,627

Fraud Protection · July 8, 2024

Breaking silos: The convergence of cybersecurity and fraud prevention

Where adversaries do not hesitate to initiate blended attacks combining multiple tactics, why are security teams still operating in silos?

Jasmine Kharbanda

1,790

Ransomware · July 3, 2024

Eldorado Ransomware: The New Golden Empire of Cybercrime?

All about Eldorado Ransomware and how its affiliates make their own samples for distribution.

Nikolay Kichatov

Sharmine Low

8,833

Threat Intelligence · July 1, 2024

Boost your MSSP’s competitive edge: New strategies for leveraging Threat Intelligence

How to best empower your business clients’ cybersecurity with critical cyber threat intelligence

Vladimir Goliashev

Zlata Greenberg

6,279

Malware Analysis · June 26, 2024

Craxs Rat, the master tool behind fake app scams and banking fraud

The scam schemes enabled by Craxs Rat malware provide complete remote control of the victims’ devices. Defend yourself from being next.

42,135

Malware Analysis · June 21, 2024

Boolka Unveiled: From web attacks to modular malware

Uncovering the operations of threat actor Boolka, driven by the creation of malicious scripts, malware trojans, sophisticated malware delivery platforms, and more.

Rustam Mirkasymov

Martijn van den Berk

6,068

Malware Analysis · June 5, 2024

GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself

Learn how to protect your devices against evolving iOS threats

Sergey Nikitin

9,329

Threat Landscape Overview · May 27, 2024

Reorienting Cybersecurity: To GenAI or not to GenAI?

Amidst the GenAI revolution, how can you harness its potential to boost cybersecurity?

Jasmine Kharbanda

9,509

Fraud Protection · May 20, 2024

GDPR: A shield for consumers, a shackle for fraud fighters?

Does the GDPR, designed to protect customer data, unintentionally create opportunities for cybercriminals to exploit it?

Julien Laurent

5,821

Fraud Protection · May 6, 2024

Generative AI: Raising the stakes for fraud in iGaming

Fraudsters see potential in generative AI to defraud the gambling industry. Here’s how.

Julien Laurent

4,467

Threat Intelligence · April 18, 2024

Phishy Business: Unraveling LabHost’s scam ecosystem

Group-IB takes part in a global operation to cripple Canadian Phishing-as-a-Service provider LabHost

Alexander Sychev

18,348

Hunting Rituals · March 29, 2024

Hunting Rituals #4: Threat hunting for execution via Windows Management Instrumentation

Actionable insights on hunting for Windows Management Instrumentation (WMI) execution abuse

Roman Rezvukhin

3,921

Malware Analysis · March 15, 2024

In-Depth Analysis of Pegasus Spyware and How To Detect It on Your Mobile Devices

Pegasus infects mobile devices through zero-click exploits and silently harvests messages, calls, location, and microphone access. Learn how the spyware operates and the steps security teams can take to detect it on iOS and Android.

Sergey Nikitin

35,980

Cyber Investigations · February 21, 2024

Extra credit: VietCredCare information stealer takes aim at Vietnamese businesses

Group-IB discovers new information stealer targeting Vietnam with rare functionality to filter out Facebook accounts with advertising credits

Hai Ha Phan

Vesta Matveeva

4,793

Malware Analysis · February 15, 2024

Face Off: Group-IB identifies first iOS trojan stealing facial recognition data

Group-IB uncovers the first iOS Trojan harvesting facial recognition data used for unauthorized access to bank accounts. The GoldDigger family grows

Andrey Polovinkin

Sharmine Low

35,015

Threat Intelligence · February 6, 2024

Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks

ResumeLooters gang infects websites with XSS scripts and SQL injections to vacuum up job seekers' personal data and CVs

Nikita Rostovcev

38,125

Cyber Investigations · January 16, 2024

Inferno Drainer: A Deep Dive into Crypto Wallet-Draining Malware

Inferno Drainer may have shut down in November 2023, but users of the devastating scam-as-a-service platform still pose a risk as they look for other avenues.

Viacheslav Shevchenko

14,031

Hunting Rituals · December 29, 2023

Hunting Rituals #3: Threat hunting for scheduled tasks

Actionable guide to hunting for the scheduled tasks by using Group-IB MXDR

Roman Rezvukhin

15,276

Technologies · December 27, 2023

The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 2)

Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by it.

Dmitry Volkov

10,626

Technologies · December 20, 2023

The future is now: Watch out for these 20 trends that will change the course of cybersecurity (Part 1)

Cybersecurity is changing, and changing fast. Learn how Group-IB can help you lead the change instead of being carried by it.

Dmitry Volkov

14,835

Technologies · December 15, 2023

You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 2)

Cybersecurity essentials that ensure your business stays undisrupted in the upcoming year.

5,792

Threat Intelligence · December 14, 2023

Ace in the Hole: exposing GambleForce, an SQL injection gang

Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region

Nikita Rostovcev

10,295

Technologies · December 8, 2023

You versus adversaries: How to become unbeatable in 20 cybersecurity moves (Part 1)

Cybersecurity essentials that will ensure your business stays undisrupted in the upcoming year.

8,533

Malware Analysis · December 7, 2023

Curse of the Krasue: New Linux Remote Access Trojan targets Thailand

This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used in attacks against Thai companies.

Sharmine Low

8,469

Hunting Rituals · November 22, 2023

Hunting Rituals #2.2: Threat hunting for abuse of Windows Services

Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Part 2: Execution of Windows Services

Roman Rezvukhin

9,255

Threat Intelligence · November 8, 2023

Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware

Take a deep dive into the operations of one of the most active players in the Ransomware-as-a-Service market.

Nikolay Kichatov

15,726

Digital Forensics & Incident Response · October 24, 2023

The untold story of incident response: Insider’s Gambit

Get a close look at details of the most notable cases faced by Group-IB’s Digital Forensics and Incident Response (DFIR) team

Zlata Greenberg

3,250

Threat Intelligence · October 17, 2023

Analyzing cyber activity surrounding the conflict in the Middle East

Hacktivists take center stage with DDoS, defacement attacks – summary of Week 1 and 2 of the conflict.
The blog was updated on Oct. 24, 2023.

7,749

Digital Forensics & Incident Response · October 16, 2023

The untold story of incident response: A Christmas Miracle

Twas the night before Christmas, when out came the cry, a cyberattack is happening, so stop them, won’t you try?

Artem Artemov

Zlata Greenberg

14,335

Fraud Protection · October 5, 2023

Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix

Delve into the tactics of the GoldDigger Trojan and discover ways to safeguard your customers

7,106

Threat Intelligence · September 26, 2023

Dusting for fingerprints: ShadowSyndicate, a new RaaS player?

No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.

Eline Switzer

Joshua Penny

Michael Koczwara

16,434

Threat Landscape Overview · September 22, 2023

It’s a trap: Detecting a cryptominer on a popular website using Group-IB MXDR

Group-IB analysts discovered and analyzed a cryptojacking campaign on a popular educational resource using Group-IB Managed XDR.

3,502

Hunting Rituals · September 20, 2023

Hunting Rituals #2: Threat hunting for abuse of Windows Services

Actionable guide to hunting for the Windows Services abuse by using Group-IB MXDR.
Part 1: Creation/modification of Windows Services

Roman Rezvukhin

5,706

Digital Forensics & Incident Response · September 18, 2023

Incident Response through an opportunity lens: In conversation with Dmitry Volkov (CEO, Group-IB)

Gather valuable insights on how incident response can be a make-or-break factor in securing your business.

Dmitry Volkov

4,477

Scam & Phishing · September 7, 2023

From Rags to Riches: The illusion of quick wealth in investment scams

Group-IB Digital Risk Protection uncovers malicious campaign leveraging almost 900 scam pages with potential financial damage estimated at $280,000 over four-month span

Olga Ulchenko

Anton Varygin

3,410

Fraud Protection · September 5, 2023

Stealing the extra mile: How fraudsters target global airlines in air miles and customer service scams

Uncover the vulnerabilities crippling the airline industry and learn how to implement appropriate countermeasures

Dmitry Pisarev

Gleb Malkov

Julien Laurent

6,042

Scam & Phishing · August 31, 2023

New hierarchy, heightened threat: Classiscam’s sustained global campaign

The automated scam-as-a-service program designed to steal your money and data is still going strong four years after launch

5,395

Threat Intelligence · August 23, 2023

Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders

Spoof extensions help cybercriminals target users on trading forums as 130 devices still infected at time of writing

Andrey Polovinkin

49,177

Hunting Rituals · August 17, 2023

Hunting Rituals #1: Threat hunting for DLL side-loading

Actionable guide to hunting for the DLL side-loading threat by using Group-IB MXDR.

Roman Rezvukhin

6,113

Fraud Protection · August 14, 2023

Breaking down Gigabud banking malware with Group-IB Fraud Matrix

Uncover the disruptive nature of Gigabud malware and take proactive measures to mitigate the associated risks

Pavel Naumov

Artem Grischenko

7,509

Threat Landscape Overview · August 4, 2023

JOIN THE CYBERCRIME FIGHTERS CLUB

Fighting cybercrime is more effective when we work together. Find out more about how you can work with Group-IB to document emerging threats.

2,606

Threat Intelligence · August 3, 2023

Demystifying Mysterious Team Bangladesh

Analysis of a highly active hacktivist group with global reach

12,659

Threat Landscape Overview · July 10, 2023

Clouded Judgment: how mismanaged cloud infrastructure can expose users to cyber risks

Discover how organizations unwittingly create vulnerabilities by misconfiguring their cloud infrastructure

Zakhar Kornyakov

3,207

Cyber Investigations · June 15, 2023

Busting CryptosLabs: a scam ring targeting French speakers for millions

Get all the undisclosed details that our investigators uncovered on CryptosLabs' full scope of fraudulent schemes

Anton Ushakov

4,805

Threat Landscape Overview · June 2, 2023

Operation Triangulation: Mapping the threat

What we know about APT campaign to date and how to detect it

3,728

Advanced Persistent Threats · May 31, 2023

Dark Pink. Episode 2

APT Dark Pink is back with 5 victims in new countries.

Andrey Polovinkin

9,619

Threat Landscape Overview · May 30, 2023

Bridging the gap: How to leverage API security best practices to combat top 3 vulnerability types

Security misconfiguration, excessive data exposure, and injections top three API vulnerability types for financial and tech firms

Konstantin Damotsev

2,278

Advanced Persistent Threats · May 17, 2023

The distinctive rattle of APT SideWinder

Bridewell and Group-IB expose the APT’s unknown infrastructure

Nikita Rostovcev

Joshua Penny

Yashraj Solanki

12,069

Ransomware · May 15, 2023

The Qilin Ransomware: Analysis and Protection Strategies

All you need to know about Qilin ransomware and its operations targeting critical sectors.

Nikolay Kichatov

20,033

Technologies · May 2, 2023

Managed upgrades. Enhance malware analysis efficiency with Group-IB Malware Detonation Platform updates

New and modified malware detonation capabilities in Group-IB’s Managed XDR and Business Email Protection solutions for precise threat detection and analysis

2,265

Scam & Phishing · April 25, 2023

Tech (non)support: Scammers pose as Meta in Facebook account grab ploy

Group-IB Digital Risk Protection discovers more than 3,200 fake Facebook profiles in ongoing phishing campaign that sees scammers impersonate Meta support staff

Sharef Hlal

Karam Chatra

19,832

Cyber Investigations · April 21, 2023

Investigation into PostalFurious: a Chinese-speaking phishing gang targeting Singapore and Australia

How to investigate phishing campaigns

Jennifer Soh

Kristina Ivanova

5,913

Threat Intelligence · April 18, 2023

SimpleHarm: Tracking MuddyWater’s infrastructure

Group-IB analysts discovered the new MuddyWater infrastructure while researching the pro-state group’s use of the legitimate SimpleHelp tool.

Nikita Rostovcev

14,133

Ransomware · April 4, 2023

The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia

Group-IB uncovers a new stealthy ransomware strain

Andrey Zhdanov

Vladislav Azersky

11,298

Threat Landscape Overview · March 31, 2023

36gate: supply chain attack

What is known about the 3CX supply chain incident and how to defend against it?

Ivan Pisarev

Victor Belov

4,712

Scam & Phishing · March 21, 2023

Venomous vacancies: Job seekers across MEA hit by sting in scammers’ tail

Group-IB uncovers more than 2,400 scam job pages in ongoing campaign targeting users in Egypt, KSA, Algeria, and 10 other MEA countries.

Sharef Hlal

Olga Ulchenko

3,906

Threat Landscape Overview · March 17, 2023

Bleak outlook: Mitigating CVE-2023-23397

Microsoft Outlook Elevation of Privilege Vulnerability

3,325

Fraud Protection · February 20, 2023

Bad Behaviour: How to detect banking trojans

Mobile banking users are being manipulated by attackers to authorize fraudulent transactions. Learn what financial service providers can do to render these organized crimes powerless.

Julien Laurent

6,014

Ransomware · February 17, 2023

Package deal: Malware bundles causing disruption and damage across EMEA

What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?

Svetlana Ostrovskaya

Andrey Zhdanov

4,535

Advanced Persistent Threats · February 13, 2023

Nice Try Tonto Team

How a nation-state APT attempted to attack Group-IB

Anastasia Tikhonova

11,377

Threat Landscape Overview · February 10, 2023

Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report

Which cybercrimes will dominate the threat landscape for 2023 and beyond? Find out!

Jasmine Kharbanda

3,059

Advanced Persistent Threats · January 11, 2023

Dark Pink

New APT hitting Asia-Pacific, Europe that goes deeper and darker

Andrey Polovinkin

24,592

Malware Analysis · December 21, 2022

Godfather Trojan – mobile banking malware that is impossible to refuse

Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries

Artem Grischenko

15,237

Scam & Phishing · December 16, 2022

Scam-free Christmas

8 online scams to protect your customers from

2,566

Fraud Protection · November 28, 2022

Understanding Money Mules: The Hidden Link in Cybercrime

A money mule is someone who moves stolen funds across bank accounts on behalf of cybercriminals. Learn how money mules operate and how you can proactively counteract mule accounts.

Dmitry Pisarev

Julien Laurent

5,306

Scam & Phishing · November 9, 2022

Hired hand: Scammers mimic Saudi manpower provider

Group-IB uncovers one thousand (and one) fake domains part of a scam campaign targeting users in KSA

Mark Alpatsky

Sharef Hlal

3,568

Threat Intelligence · November 3, 2022

Armés et dangereux : une soif d’argent inextinguible L’APT OPERA1ER en Afrique

En 2019, l'équipe Threat Intelligence de Group-IB a détecté une série d'attaques ciblant des organisations financières en Afrique.

Rustam Mirkasymov

5,428

Threat Intelligence · November 3, 2022

Financially motivated, dangerously activated: OPERA1ER APT in Africa

The French-speaking gang managed to carry out over 30 successful attacks on banks, financial services and telecommunications companies, mainly located in Africa.

Rustam Mirkasymov

10,829

Threat Intelligence · October 24, 2022

Treasure trove. Alive and well point-of-sale malware

Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals

Said Khamchiev

Nikolay Shelekhov

10,474

Ransomware · October 19, 2022

Deadbolt ransomware decryption: unlock your data

The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample

Andrey Zhdanov

Vladislav Azersky

10,019

Scam & Phishing · October 17, 2022

Scam is rising

With well-set digital marketing campaigns and professional call-centres

2,555

Technologies · September 28, 2022

Take control of your shadow IT

How Group-IB Attack Surface Management ensures full mastery of your external attack surface

3,461

Scam & Phishing · September 13, 2022

Letting off steam

Hackers use the browser-in-the-browser technique to steal Steam accounts

Dmitry Eroshev

Ivan Lebedev

7,915

Threat Intelligence · August 25, 2022

Roasting 0ktapus: The phishing campaign going after Okta identity credentials

Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits

Rustam Mirkasymov

Roberto Martinez

48,871

Advanced Persistent Threats · August 18, 2022

APT41 World Tour 2021 on a tight schedule

4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections

Nikita Rostovcev

18,499

Threat Intelligence · August 17, 2022

Switching side jobs

Links between ATMZOW JS-sniffer and Hancitor

Victor Okorokov

7,882

Fraud Protection · August 11, 2022

Challenge accepted

Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution

2,720

Scam & Phishing · July 29, 2022

Fake investment scams in Europe

How we almost got rich

17,348

Technologies · July 25, 2022

Under the Hood. Group-IB Managed XDR

What Group-IB’s new all-in-one solution offers: cybersecurity management, network event analysis, and lightning-fast stops to attacks

4,709

Technologies · June 30, 2022

Group-IB introduces the Unified Risk Platform

Group-IB’s platform allows organizations to overcome cyber risks

4,679

Malware Analysis · June 24, 2022

We see you, Gozi

Hunting the latest TTPs used for delivering the Trojan

Albert Priego

2,717

Threat Intelligence · June 16, 2022

“We find many things that others do not even see”

Nikita Rostovtsev on current cyber threats and his profession

Nikita Rostovcev

6,792

Threat Intelligence · June 16, 2022

Thousands of IDs exposed in yet another data breach in Brazil

Unsecured public-facing database allowed anyone to access ID selfies for months

Anastasia Tikhonova

8,710

Scam & Phishing · June 9, 2022

Swiss Army Knife Phishing

Group-IB identifies massive campaign capable of targeting clients of major Vietnamese banks

Ivan Lebedev

3,000

Advanced Persistent Threats · June 1, 2022

SideWinder.AntiBot.Script

APT SideWinder’s new tool that narrows their reach to Pakistan

Nikita Rostovcev

Alexander Badaev

8,445

Ransomware · April 14, 2022

Old Gremlins, new methods

Russian-speaking ransomware gang OldGremlin resumes attacks in Russia

Ivan Pisarev

5,659

Scam & Phishing · April 8, 2022

Scammers make off with $1.6 million in crypto

Fake giveaways hit bitcoiners again. Now on YouTube

Daniil Glukhov

4,254

Threat Landscape Overview · March 31, 2022

Mitigating Spring4Shell with Group-IB

What we know about Spring4Shell so far

3,577

Scam & Phishing · March 28, 2022

Empty Box

Group-IB unveils three groups of fraudsters behind delivery scams in Singapore

Ilia Rozhnov

2,520

Technologies · March 15, 2022

Lost & Found: Group-IB Unveils Attack Surface Management (ex. AssetZero)

Intelligence-Driven Attack Surface Management

2,955

Ransomware · February 18, 2022

Top 5 recommendations for preventing ransomware for 2022

With ransomware attacks on the rise, companies need to take a proactive approach to security. Group-IB has put together a list of actionable tips to help you protect your organization from the ransomware threats in 2022.

1,779

Technologies · February 7, 2022

Cleaning the atmosphere

Weak points in modern-day corporate email security

Ilya Pomerantsev

2,845

Cyber Investigations · January 28, 2022

Shedding light on the dark web

Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors

Vesta Matveeva

Yaroslav Polyanskiy

4,945

Threat Landscape Overview · December 23, 2021

Mitigating Log4Shell in Log4j with Group-IB

Group-IB's recommendations to mitigate this vulnerability and protect your organization.

2,127

Technologies · December 23, 2021

How MITRE ATT&CK® helps users of Threat Intelligence

The MITRE ATT&CK® framework became the industry standard to describe attack tactics and techniques.

Dmitry Volkov

3,618

Scam & Phishing · December 21, 2021

Ready-made fraud

Behind the scenes of targeted scams

Yakov Kravtsov

Yvgeny Egorov

3,241

Ransomware · December 9, 2021

Inside the Hive

Deep dive into Hive RaaS, analysis of latest samples

Dmitry Shestakov

Andrey Zhdanov

Nikolay Stepanov

12,157

Ransomware · November 3, 2021

The Darker Things

BlackMatter and their victims

Andrey Zhdanov

4,813

Threat Landscape Overview · October 28, 2021

Cannibal Carders

Group-IB uncovers largest networks of fake shops – phishing websites disguised as card shops

Ruslan Chebesov

Sergey Kokurin

7,091

Scam & Phishing · September 17, 2021

Scamdemic outbreak

Scammers attack users in Middle Eastern countries

Yvgeny Egorov

Yakov Kravtsov

2,487

Scam & Phishing · September 16, 2021

RUNLIR – phishing campaign targeting Netherlands

Phishers take an approach to bypass security controls never seen in the country

Ivan Lebedev

Reza Rafati

3,380

Technologies · August 13, 2021

Under the hood. Group-IB Threat Intelligence. Part 2

How we make Tailored Threat Intelligence

Dmitry Volkov

4,367

Threat Intelligence · August 6, 2021

Bold ad campaign

AWC joins illicit carding business by offering 1 Mln compromised cards for free

Sergey Kokurin

8,075

Ransomware · August 6, 2021

It’s alive!

The story behind the BlackMatter ransomware strain

Andrey Zhdanov

6,720

Threat Intelligence · August 5, 2021

Prometheus TDS

The key to success for Campo Loader, Hancitor, IcedID, and QBot

Victor Okorokov

Nikita Rostovcev

16,150

Advanced Persistent Threats · August 3, 2021

The Art of Cyberwarfare

Chinese APTs attack Russia

Anastasia Tikhonova

8,305

Technologies · July 29, 2021

Under the hood. Group-IB Threat Intelligence. Part 1

Dive into Breached DB section

Dmitry Volkov

4,435

Cyber Investigations · July 22, 2021

The Fraud Family

Fraud-as-a-Service operation targeting Dutch residents

Roberto Martinez

Anton Ushakov

4,891

Malware Analysis · July 2, 2021

The Brothers Grim

The reversing tale of GrimAgent malware used by Ryuk

5,319

Ransomware · June 30, 2021

REvil Twins: Ransomware-as-a-Service program

Deep Dive into Prolific RaaS Affiliates' TTPs

6,828

Advanced Persistent Threats · June 10, 2021

Big airline heist

APT41 likely behind a third-party attack on Air India

Nikita Rostovcev

19,669

Threat Intelligence · June 3, 2021

FontPack: A dangerous update

Attribution secrets: Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or font updates?

Nikita Rostovcev

6,476

Ransomware · May 14, 2021

BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies

An analysis of the BlackCat ransomware affiliate program

Andrey Zhdanov

8,086

Ransomware · May 7, 2021

Connecting the Bots

Hancitor fuels Cuba Ransomware Operations

Semyon Rogachev

3,562

Threat Intelligence · May 6, 2021

GrelosGTM group abuses Google Tag Manager to attack e-commerce websites

Group-IB specialists detected GrelosGTM group started to abuse Google Tag Manager legitimate functionality for their own purposes in infections of online shops.

Victor Okorokov

7,019

Threat Intelligence · April 14, 2021

Lazarus BTC Changer

Back in action with JS sniffers redesigned to steal crypto

Victor Okorokov

8,516

Scam & Phishing · April 12, 2021

Deep water: exploring phishing kits

Group-IB's Computer Emergency Response Team built a solid phishing kit database, which helps Group-IB fight phishing that targets specific brands.

Ivan Lebedev

3,548

Threat Intelligence · April 8, 2021

When Karma Comes Back

The rise and fall of illicit cardshop breached twice in two years

Sergey Kokurin

6,684

Threat Intelligence · April 5, 2021

Kremlin RATs from Nigeria

The analysis of phishing campaigns carried out by a new threat actor

4,614

Digital Forensics & Incident Response · March 17, 2021

Masters of disguise

Let's hunt some bootkits

Semyon Rogachev

3,339

Threat Intelligence · March 15, 2021

JavaScript sniffers’ new tricks

Analysis of the E1RB JS sniffer family

Victor Okorokov

5,108

Scam & Phishing · March 1, 2021

Inside Classiscam

A deep dive into Classiscam: automated scam as a service designed to steal money and payment data

Evgeny Ivanov

Yakov Kravtsov

5,708

Digital Forensics & Incident Response · January 26, 2021

The source of everything

Forensic examination of incidents involving source code leaks

Anatoly Tykushin

3,882

Threat Intelligence · December 23, 2020

New attacks by UltraRank group

As part of UltraRank's new campaign, Group-IB Threat Intelligence team discovered 12 eCommerce websites infected with their JavaScript-sniffer.

Victor Okorokov

7,155

Threat Intelligence · December 7, 2020

The footprints of Raccoon

A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer

Nikita Rostovcev

7,671

Ransomware · November 20, 2020

The Locking Egregor

Analysis of TTPs employed by Egregor operators

Semyon Rogachev

2,980

Ransomware · November 1, 2020

Big Game Hunting: Now in Russia

Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware

Rustam Mirkasymov

5,856

Fraud Protection · October 10, 2020

Group-IB Fraud Protection (ex. Fraud Hunting Platform)

Keeping user digital identity safe

Dmitry Volkov

5,003

Ransomware · September 10, 2020

Lock Like a Pro

Dive in Recent ProLock's Big Game Hunting

Semyon Rogachev

2,189

Digital Forensics & Incident Response · July 5, 2020

Digital forensics specialist’s bookshelf

Top 11 books on digital forensics, incident response, and malware analysis

Igor Mikhailov

4,600

Threat Intelligence · May 29, 2020

IcedID: new malware version

When ice burns through bank accounts

Ivan Pisarev

10,149

Ransomware · May 14, 2020

ATT&CKing ProLock Ransomware

The success of enterprise ransomware attacks has motivated more and more threat actors to join the game.

3,455

Threat Intelligence · April 30, 2020

PerSwaysion Campaign

Playbook of Microsoft Document Sharing-Based Phishing Attack

Feixiang He

6,676

Digital Forensics & Incident Response · April 28, 2020

Reconstructing User Activity for Forensics with FeatureUsage

Useful feature that can help forensic analysts and incident responders to reconstruct user activities.

4,280

Digital Forensics & Incident Response · February 20, 2020

Chromium-based Microsoft Edge from a Forensic Point of View

Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and more.

Svetlana Ostrovskaya

18,653

Digital Forensics & Incident Response · January 17, 2020

Hunting for Nextcloud Cloud Storage Forensic Artifacts on Endpoints

Forensic artifacts, which can be found during forensic examination of a Windows endpoint.

2,372

Digital Forensics & Incident Response · December 20, 2019

A Shortcut to Compromise: Cobalt Gang phishing campaign

Cobalt Gang is alive and well, and continued to attack financial institutions around the globe in 2019.

2,150

Digital Forensics & Incident Response · December 11, 2019

Hunting for Attacker’s Tactics and Techniques With Prefetch Files

Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.

4,170

Technologies · November 18, 2019

Group-IB unveils its Graph

The story about Group-IB searching for graph analysis solution and creating its own unique instrument

Dmitry Volkov

2,812

Threat Intelligence · November 8, 2019

Massive malicious campaign by FakeSecurity JS-sniffer

Group-IB specialists detected a new JS-sniffer family called FakeSecurity.

Victor Okorokov

4,765

Digital Forensics & Incident Response · November 7, 2019

WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts

All about WhatsApp forensics and the wealth of data extracted from a device through forensic analysis.

Igor Mikhailov

83,558

Threat Intelligence · November 5, 2019

RDoS attacks by fake Fancy Bear hit banks in multiple locations

Group-IB experts have detected a massive email campaign spreading similar ransom demands sent to banks and financial organizations across the word.

Anastasia Tikhonova

4,848

Digital Forensics & Incident Response · October 4, 2019

No Time to Waste

How Windows 10 Timeline Can Help Forensic Experts

Igor Mikhailov

8,642

Ransomware · September 30, 2019

50 Shades of Ransomware

The following article examines forensic artifacts left by the Shade cryptolocker and maps used tactics and techniques to MITRE ATT&CK.

2,607

Digital Forensics & Incident Response · September 26, 2019

Tools up: the best software and hardware tools for computer forensics

Igor Mikhailov gave his review of the best software and hardware solutions for computer forensics.

Igor Mikhailov

18,130

Cyber Investigations · June 11, 2019

Voting results of “The Voice Kids Russia Season 6”

2,028

Threat Intelligence · May 29, 2019

Catching fish in muddy waters

How the hacker group MuddyWater attacked a Turkish manufacturer of military electronics

Anastasia Tikhonova

Nikita Rostovcev

6,344

Digital Forensics & Incident Response · May 8, 2019

Following the RTM

Forensic examination of a computer infected with a banking trojan

2,684

Threat Intelligence · April 26, 2019

Meet the JS-Sniffers 4: CoffeMokko Family

Group-IB researchers have discovered 38 families of JS-sniffers, whereas only 12 were known previously.

Victor Okorokov

4,448

Threat Intelligence · April 25, 2019

Meet the JS-Sniffers 3: Illum Family

Group-IB researchers discovered Illum JS-sniffers family designed to steal payment data of customers of online stores.

Victor Okorokov

3,676

Threat Intelligence · April 19, 2019

Meet the JS-Sniffers 2: G-Analytics Family

Group-IB discovered that the stolen payment cards data is sold through an underground store specially created for this purpose.

Victor Okorokov

3,830

Threat Intelligence · April 9, 2019

Meet the JS-Sniffers: ReactGet Family

ReactGet is one of the most interesting families of JS-sniffers, designed to steal banking cards data from online stores.

Victor Okorokov

4,329

Threat Intelligence · April 4, 2019

Gustuff: Weapon of Mass Infection

Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, a number of cryptocurrency and marketplace applications

Ivan Pisarev

4,523

Scam & Phishing · February 5, 2019

The end of torrents era in Russia

Currently, a total of 80% of pirated films and almost 90% of TV series are being watched online

2,590

Threat Intelligence · September 5, 2018

Silence: Moving into the Darkside

Group-IB has exposed the attacks committed by Silence cybercriminal group.

7,054

Threat Intelligence · May 29, 2018

Cobalt Renaissance

New attacks and joint operations

Rustam Mirkasymov

6,681

Threat Intelligence · December 11, 2017

MoneyTaker: in pursuit of the invisible

Group-IB has uncovered a hacker group attacking banks in the USA and Russia

6,475

Cyber Investigations · November 27, 2017

When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection

Andrey Zosimov

1,523

Scam & Phishing · November 2, 2017

In a Queue for a Scam

How faudsters cash in on hype around new iPhones

1,894

Threat Intelligence · October 26, 2017

NotPetya pulls BadRabbit out of the hat

Research revealed that the BadRabbit code was compiled from NotPetya sources.

Rustam Mirkasymov

6,445

Threat Intelligence · October 24, 2017

BadRabbit: spread of new cryptolocker

There is a connection between BadRabbit and Not Petya

6,767

Scam & Phishing · October 19, 2017

‘Black spot’ for pirates

Russia has developed a strong legal framework to combat online piracy. All that is needed is for it to be used effectively (especially for Forbes.ru)

Ilya Sachkov

2,988

Scam & Phishing · September 26, 2017

Airline companies «landing» on fake pages

Top global airline companies have been compromised by fraudsters for the second time during the last six months.

2,917

Threat Intelligence · August 15, 2017

Secrets of Cobalt

How Cobalt hackers bypass your defenses

Vesta Matveeva

9,966

Threat Landscape Overview · August 10, 2017

Insecure venture

On the price of hacker attacks and the toxic cyber environment

2,429

Threat Intelligence · August 4, 2017

Kronos devouring its children

The man who "saved the world" from the WannaCry outbreak has been arrested on suspicion of being the author of Kronos banking Trojan

6,471

Threat Intelligence · August 2, 2017

Hacktivists unmasked

Group-IB reveals the identity of alleged members of the Islamic hacker group United Islamic Cyber Force

8,445

Threat Landscape Overview · July 24, 2017

Targeted attacks on banks

Russia as a testing ground

Ilya Sachkov

3,031

Ransomware · June 27, 2017

Petya starts with Ukraine and then goes global

Group-IB has identified the ransomware that has infected energy, telecommunications and financial companies

2,120

Scam & Phishing · June 5, 2017

Ghost flights

Top global airline companies have been compromised through fake links distributed by "friends" on Facebook

2,923

Advanced Persistent Threats · May 30, 2017

LAZARUS ARISEN

Group-IB reveals the unknown details of attacks from one of the most notorious APT groups: sophisticated espionage and APT techniques of the North Korean state-sponsored hackers

4,929