A hacked computer has become a commodity whose value an algorithm determines by its banking software, corporate systems, and owner data. Group-IB specialists have discovered a malicious framework named BraZetsu, which supplies an underground...
The Iranian group Tortoiseshell continues to broaden both its toolset and the geography of its operations. Group-IB specialists have uncovered previously unknown malware samples and additional server infrastructure tied to the group. Among the...
A single phone call with a fraudster can now result, within the same session, in a loan taken out in the victim’s name and unauthorized purchases charged to their bank card. Researchers at Group-IB...
An Unprotected Directory Exposes Espionage Operations A single overlooked server misconfiguration inadvertently exposed the inner workings of an entire China-nexus cyber espionage infrastructure. Cybersecurity specialists at Group-IB gained access to an exposed directory, uncovering...
Unveiling the HollowGraph Threat A cloud calendar can conceal far more than mundane appointments; the HollowGraph malware exploits Microsoft 365 to clandestinely receive commands and transmit pilfered files. Cybersecurity experts at Group-IB have detected...
An international law enforcement crusade against cybercriminality has yielded monumental results. Constabularies spanning dozens of sovereign nations have eradicated tens of thousands of venomous network addresses inextricably tethered to phishing architectures, malicious software, and...
In Indonesia, a sophisticated fraudulent enterprise has been unmasked, masquerading as the official Coretax fiscal service. Adversaries orchestrated a clandestine infrastructure utilizing counterfeit mobile applications, facilitating offensives not only against taxpayers but also across...
The DeadLock syndicate, which emerged within the cyber threat landscape during the summer of 2025, persists as one of the most clandestine and technologically sophisticated entities. Analysts at Group-IB have documented a highly unconventional...
Group-IB researchers have identified a burgeoning proliferation of Android malware within subterranean marketplaces designed to exploit Near Field Communication (NFC) technology for fraudulent contactless payments. This criminal ecosystem is primarily attributed to Mandarin-speaking syndicates...
Fraudulent job advertisements promising easy income and remote work continue to flood social media platforms, particularly across the Middle East and North Africa. Disguised as no-experience side gigs, these schemes are designed to harvest...
The GoldFactory group has launched a new wave of attacks targeting mobile-banking users across Southeast Asia. Disguising themselves as government agencies and well-known corporations, the attackers distribute tampered banking applications. According to Group-IB, more...
The “Bloody Wolf” group is expanding its targeted campaign across Central Asia, deploying NetSupport RAT and impersonating government agencies. According to Group-IB specialists, the attacks that began in Kyrgyzstan in the summer of 2025...
