⚠️Cybercrime isn’t just growing—it’s adapting.

Ransomware fuels data breaches. Stolen data powers Initial Access Brokers. AI-driven phishing makes social engineering even more deceptive. And as geopolitical tensions rise, cyber warfare is becoming a tool of state power.

Our 2025 High-Tech Crime Trends Report uncovers how these threats are interconnected—and what it takes to break the cycle.
Cybercriminals are evolving. Are you? Read the full report

#HTCT2025 #cybersecurity #FightAgainstCybercrime

In a joint operation by Royal Thai Police & Singapore Police Force, with crucial intelligence from Group-IB, authorities have arrested a cybercriminal behind 90+ data breaches worldwide, including 65 across APAC. Since 2020, he targeted companies using SQL injections and vulnerable RDP servers, exfiltrating data to blackmail victims.

Group-IB has been tracking this threat actor since 2020, uncovering his multiple aliases: ALTDOS, DESORDEN, GHOSTR, and 0mid16B. His tactics evolved over time, leaking stolen data across dark web forums.

This landmark arrest is a victory for cybersecurity! Read the full story here

#Cybersecurity #LawEnforcement #FightAgainstCybercrime

Cost of building and maintaining a top-notch cybersecurity stack and team? At least a few thousand. Cost of NOT having one? Millions—lost to cyberattacks, and a constant threat of your customers, data, and operations being jeopardized.

Not having robust security isn’t an option. But even with the best tech, are you truly secure? No—unless you address your biggest hidden cybersecurity cost: your employees.

Insider threats—whether intentional or accidental—are a top concern for organizations today.

The real solution is building a strong security culture. With cybersecurity being a top-cited challenge for leaders today, building a strong security culture is just as essential as technological defenses.

But how should you best approach it? Our cybersecurity experts break it down for you.

#CyberSecurity #InsiderThreats #SecurityCulture

Trust No One – Is It The Right Approach to Network Security?

As organizations have gone perimeter-less, serverless and (consequently security-less), Zero Trust approach is gaining momentum.

No, it’s not cynicism—it’s a proven strategy. With 60%+ of companies already adopting Zero Trust, it is highly effective in protecting business-critical assets and people.

But..

Zero Trust isn’t a one-size-fits-all solution or a plug-and-play framework. It requires continuous monitoring, real-time anomaly detection, and proactive security enforcement.

Implementing it might make businesses question if:

✅ It is the right fit for your organization?
✅ What are the integration challenges?
✅ It will lead to endless false positives?
✅ It can work with existing infrastructure and be scaled over time?

Get your questions answered in our latest blog, where Group-IB experts share insights to begin your Zero Trust journey

#ZeroTrust #Cybersecurity #NetworkSecurity #FightAgainstCybercrime

🚨SIM Swapping Fraud: How Fraudsters Bypass Security Measures🚨

Despite advanced telecom and government safeguards, SIM swapping fraud continues to evolve. Fraudsters exploit human vulnerabilities through phishing and social engineering, deceiving individuals to bypass security layers and take control of phone numbers.
With access to a compromised SIM, they can intercept 2FA codes, hijack accounts, and commit identity theft.

🔗 Our latest analysis at Group-IB explores how these attacks happen and what can be done to prevent them.

#SIMSwapping #FraudDetection #CyberSecurity #SocialEngineering #Phishing

Cybercriminals have come up with a clever idea to trick users into running malware on their own systems—no exploits, just deception. The ClickFix technique disguises fake reCAPTCHA pages and "Fix It" pop-ups to auto-copy malicious PowerShell noscripts straight to your clipboard. One wrong move, and infostealers like Lumma, Vidar, CStealer, AMOS, and DarkGate are on your system.

What’s happening?
🔹Fake bot verifications copy malicious commands without your knowledge
🔹Victims unknowingly paste and execute malware in their Run dialog
🔹Cybercriminals & APT groups are using ClickFix for large-scale hacking campaigns

Group-IB’s latest research uncovers real-world attack chains, technical breakdowns, and must-know defense strategies.

🔗Read the full blog here

#ClickFix #ThreatIntelligence #APT #InfoStealer

Group-IB is proud to be recognized by the Singapore Police Force for our contributions in combating cyber threats across the Asia-Pacific (APAC) region. This accolade highlights our pivotal role in providing critical investigation data that led to the arrest of DESORDEN in February 2025, responsible for over 90 global data leaks.

The award also recognized the Group-IB Investigation team’s knowledge-sharing efforts by delivering key insights at the ASEAN Cybercrime Conference 2024, reinforcing collective cybersecurity defenses in the region. Read More

#CyberSecurity #GroupIB #APAC #CyberThreats #SingaporePolice #FightAgainstCybercrime

The Cybercriminal with Four Faces: How Group-IB Tracked ALTDOS, DESORDEN, GHOSTR & 0mid16B

For over four years, a cybercriminal hid behind multiple aliases, orchestrating more than 90 data breaches and extorting victims across Asia and beyond. From ALTDOS to DESORDEN, GHOSTR, and finally 0mid16B, he adapted his tactics, evaded detection, and exploited stolen data. Group-IB’s investigators uncovered the patterns linking his identities.

These findings, along with further investigative intelligence from Group-IB, helped the Royal Thai Police and the Singapore Police Force to track, identify, and ultimately arrest the cybercriminal. 🔗Read the full report.

#Cybersecurity #ThreatIntelligence #CyberInvestigation #FightAgainstCybercrime

Group-IB contributed to INTERPOL-led Operation Red Card, a major international effort to dismantle cybercriminal networks across Africa.

Key Outcomes:
✔️306 suspects arrested for banking fraud, mobile malware attacks, investment fraud and other social engineering scams
✔️5,000+ victims targeted by cybercriminals
✔️ 1,842 devices seized, used to defraud individuals & businesses
✔️$305,000 stolen through social engineering scams uncovered in Rwanda
✔️26 vehicles, 16 houses & 39 plots of land seized from fraudsters in Nigeria

This operation demonstrates the impact of cooperation between law enforcement and the private sector in tackling cybercrime. 🔗Read the full story

#CyberSecurity #LawEnforcement #OperationRedCard #FightAgainstCybercrime

Scam-as-a-service (SaaS) is reshaping cyber fraud in Central Asia. Classiscam operations leverage Telegram bots, phishing panels, and automated credential harvesting to scale attacks with minimal effort.

Our latest research reveals:
✔️How Telegram bots automate phishing site creation
✔️Classiscam’s role-based fraud hierarchy (Fake Support, Data Input, Operators)
✔️Targeting patterns against online marketplaces & financial institutions
✔️Key IoCs & proactive defense strategies

🔗 Read the full report here

#Phishing #FraudIntelligence #CyberSecurity #FightAgainstCybercrime

Cyber threats across Latin America (LATAM) show a concerning rise!

Cybercriminals have deceived countless victims—using elaborate scams to impersonate well-established brands and exploit users' trust.

In 2024 alone, Group-IB identified at least 97 fraudulent domains targeting four major brands. The level of sophistication among scammers even surprised our own experts.

Want to see these operations in action? Group-IB experts reveal trade secrets from the dark side in the latest blog

#CyberSecurity #LATAM #CyberThreats #FightAgainstCybercrime

🚨 Hunters International: The Next Evolution of Cyber Extortion?

Emerging in October 2023, Hunters International took over Hive ransomware's legacy, operating across Windows, Linux, FreeBSD, SunOS, and ESXi. But their game is changing—Group-IB’s latest research reveals their planned rebrand as World Leaks, adopting an extortion-only model featuring OSINT-driven coercion, their proprietary "Storage Software," and silent encryption (no ransom notes since v6.0).

Key Findings:
• Transitioning from ransomware to pure data extortion
• Infrastructure overlaps with Lynx/INC Ransom
• Evolving tactics to bypass payment bans and law enforcement

Their stealthy approach and affiliate structure make them a growing threat, particularly for healthcare and real estate sectors. Read the full analysis here

#Cybersecurity #Ransomware #FightAgainstCybercrime

📢 Breaking news: Group-IB Wins Frost & Sullivan’s 2025 Global Technology Innovation Leadership Award

In today’s fast-pacing cybersecurity landscape, staying ahead of threats requires continuous innovation and real-world expertise.

Frost & Sullivan has recognized Group-IB for pioneering advancements in custom threat intelligence, holistic cyber fusion approach, and integrated AI-technology — all aimed at helping businesses stay resilient against emerging cyber threats.

Key highlights from the report:
✔ Custom threat intelligence
✔ Unified Risk Platform that includes fraud protection, business email protection, and managed extended detection and response (XDR) solutions
✔ Integration of AI-technologies for better detection, response, and risk mitigation
✔ Decentralized cybersecurity model

Read the full report to see how innovations are shaping the future of cybersecurity

#Cybersecurity #ThreatIntelligence #RiskManagement #AI #FightAgainstCybercrime

As Australia’s digital economy booms, so do fraud losses, surging past $2 billion AUD annually—and traditional defenses are failing.

The (relatively) new disruptor? AI-powered fraud techniques.
From deepfake-driven scams to automated bot attacks, cybercriminals are evolving fast:

🔹 Mobile banking trojans steal facial recognition data for KYC fraud
🔹 Synthetic identities fuel account takeovers & mule account creation
🔹 AI-driven tactics enable seamless money laundering & loan fraud

📖 Read our latest blog to uncover Australia’s full fraud landscape

What is the key to defense? Data-driven fraud detection.
The catch for AI-driven tactics lies in monitoring transaction and behavioral biometrics data to spot deviations from “usual” activity and detect fraud.

#CyberSecurity #FraudPrevention #DeepfakeFraud #AIThreats #FightAgainstCybercrime

We’re proud to partner with Mahidol University to launch the Cybersecurity Center of Excellence, a pioneering initiative to strengthen the nation’s digital resilience.

By integrating Group-IB’s industry-leading technologies, including Managed XDR, Threat Intelligence, and Business Email Protection, into hands-on academic programs, we’re empowering students and professionals with the real-world skills needed to combat today’s and tomorrow’s cyber threats.

This collaboration merges Mahidol’s academic excellence with Group-IB’s global cybersecurity expertise to create a transformative hub for training, research, and workforce development.

Together, we’re empowering our next generation in building a safer digital future. Read More.

#ThreatIntelligence #ManagedXDR #BusinessEmailProtection #FightAgainstCybercrime

Group-IB launches its strategic Partner Program to fortify Europe’s cybersecurity ecosystem.

Designed for MSSPs, resellers, and tech partners, the program delivers cutting-edge solutions including threat intelligence, fraud protection, managed XDR, and more, alongside elite training, dedicated support, and tiered rewards (standard to platinum).

🤝 Partner with Group-IB to combat evolving threats with global intelligence and local expertise. Be part of the mission. Read More

#Cybersecurity #MSSP #FraudProtection #ThreatIntelligence #FightAgainstCybercrime

🚨 SMS Pumping Fraud: How Criminals Exploit SMS Verification for Profit 🚨

Our cyber fraud analysts have uncovered a sophisticated SMS Pumping scheme where fraudsters manipulate SMS verification systems to generate artificial traffic, costing businesses millions. By exploiting OTP requests, fake account sign-ups, and corrupt telecom partnerships, attackers inflate SMS volumes, leaving companies with soaring costs and operational disruptions.

Key Insights from the Blog:
✔️ Fraudsters use bots, telecom providers, and fake identities to trigger massive SMS traffic, often bypassing security measures.
✔️ Twitter lost $60M/year to this fraud before implementing stricter telecom provider controls.
✔️ Attacks can lead to system overloads, reputational damage, and penalties from telecom providers.

Businesses relying on SMS for 2FA or onboarding must act now to prevent exploitation. Read the full analysis here

#SMSPumping #ThreatIntelligence #CyberSecurity #FightAgainstCybercrime

Hyper-evolving threats. Expanding risk portfolios. And the board wants answers.

Today's CISOs are expected to lead through chaos, speak the business language, and prove the value of every decision.

Risk management isn’t just a checkbox — It demands foresight, strategy, and accountability.
Done right, it puts CISOs where they belong: in the boardroom, driving strategic decisions.

To step into every challenge with clarity and control, this blog puts things in perspective for CISOs and their team

Get real-world direction, critical communication cues, risk concepts, and decision-making clarity to navigate enterprise risk effectively.

#CISO #RiskManagement #FightAgainstCybercrime

Group-IB analysts shed light on the growing trend of fraudsters impersonating real threat actors to sell fake data leaks across dark web forums.

Many of these scammers never conducted any actual attacks and rely on recycled stealer logs (e.g., Raccoon, RedLine), repurposed public breaches, and hybrid datasets mixing real/fake entries. In one case, a fake VIP Telegram channel run by the group R00TK1T earned $10,000 by charging $500 per subscriber for access to freely available public leaks.

Key Insights:
✔️ Chinese-speaking darknet markets and Telegram channels offer nearly 100% fake data.
Impersonators mimic names like LockBit, Bjorka, and IntelBroker to deceive researchers and buyers.
✔️ Fraudsters use auto-generated IDs and rebranded aliases to bypass scrutiny.
✔️ Attackers offering "High-quality private data" in private telegram channels are, in most cases, scammers who present old reassembled data leaks as the result of their attacks.

👉 Read the full blog here

AI won’t replace your security team… but it will make your team faster, sharper, and happier.

That’s the idea behind Group-IB’s new AI Assistant — now available in beta for all Threat Intelligence customers.

This LLM-powered chatbot is a new way to interact with one of the industry’s largest threat intelligence datasets — with instant answers, deep context, and zero privacy compromises.

🔗 See it in action and learn how it works in our latest blog post.

#CyberSecurity #ThreatIntelligence #AIAssistant #FightAgainstCybercrime

🚨Sophisticated Toll Phishing Campaign Uncovered 🚨

Recently, our analysts uncovered an ongoing phishing campaign targeting toll road service users, where scammers impersonate legitimate providers via SMS to lure victims to fraudulent websites. These sites use third-party tools like FingerprintJS to fingerprint and filter visitors—blocking unwanted traffic such as researchers or automated scanners and Cleave.js for real-time input validation to ensure that the harvested payment data is in the correct format.

Key Highlights:
✅ Google AMP Abuse: Malicious links masked via trusted platforms to evade detection.
✅ Localized Lures: Messages tailored in French to target Canadian victims.
✅ Fingerprint Blocking: Filters out researchers/VPNs, ensuring only victims access phishing pages.
✅ Automated Data Theft: Heartbeat intervals exfiltrate input data every 3 seconds.

🔗 Read the full analysis here

#CyberSecurity #DataProtection #Phishing #FightAgainstCybercrime