Group-IB’s Threat Intelligence team has uncovered a surge in sophisticated attacks exploiting #WindowsKernel loaders and weaponizing signed drivers. Here’s why it matters:
🔻 Key Findings
✅ 620+ malicious drivers linked to campaigns since 2020
✅ 80+ certificates and 60+ WHCP accounts abused by threat actors
✅ 32% of drivers act as loaders, enabling stealthy second-stage payloads
✅ Overlaps in Certificates and WHCP accounts used to sign drivers for unrelated TA
✅ underground certificate providers markets slash attacker signing costs
Learn how to detect anomalies, mitigate risks, and disrupt this shadow economy. 📈 Read the full report.
#CyberSecurity #ThreatIntelligence #WindowsSecurity #MaliciousDrivers #FightAgainstCybercrime
🔻 Key Findings
✅ 620+ malicious drivers linked to campaigns since 2020
✅ 80+ certificates and 60+ WHCP accounts abused by threat actors
✅ 32% of drivers act as loaders, enabling stealthy second-stage payloads
✅ Overlaps in Certificates and WHCP accounts used to sign drivers for unrelated TA
✅ underground certificate providers markets slash attacker signing costs
Learn how to detect anomalies, mitigate risks, and disrupt this shadow economy. 📈 Read the full report.
#CyberSecurity #ThreatIntelligence #WindowsSecurity #MaliciousDrivers #FightAgainstCybercrime
🔥3👍1
A high-value transaction request? Seems routine — even when it’s not.
What if it’s triggered from a fraudster’s desktop emulator using stolen credentials, a SIM-swap, or a deepfake scam?
Just like that, your OTPs and MFA validate the attacker. Funds lost. Trust broken.
Introducing BioConfirm by Group-IB: Real-time, device-bound biometric authentication only visible and usable by the true account holder.
Today’s fraudsters use automation, deepfakes, and Fraud-as-a-Service kits. Traditional security can’t keep up — but BioConfirm can:
✅ One-tap Face/Fingerprint user consent on their trusted device
✅ Cryptographic tokens that no fraudster can see, spoof, or intercept
✅ Highest-level security for real users, with zero extra effort
✅ Blocks emulators, phishing, and SIM-swaps
✅ Malware-resistant protection for mobile banking apps
✅ Easily integrates with your risk engine + PSD2 / RBI compliance
Learn how BioConfirm reduces risk and builds trust for high-risk transactions.
#FraudPrevention #BiometricSecurity
What if it’s triggered from a fraudster’s desktop emulator using stolen credentials, a SIM-swap, or a deepfake scam?
Just like that, your OTPs and MFA validate the attacker. Funds lost. Trust broken.
Introducing BioConfirm by Group-IB: Real-time, device-bound biometric authentication only visible and usable by the true account holder.
Today’s fraudsters use automation, deepfakes, and Fraud-as-a-Service kits. Traditional security can’t keep up — but BioConfirm can:
✅ One-tap Face/Fingerprint user consent on their trusted device
✅ Cryptographic tokens that no fraudster can see, spoof, or intercept
✅ Highest-level security for real users, with zero extra effort
✅ Blocks emulators, phishing, and SIM-swaps
✅ Malware-resistant protection for mobile banking apps
✅ Easily integrates with your risk engine + PSD2 / RBI compliance
Learn how BioConfirm reduces risk and builds trust for high-risk transactions.
#FraudPrevention #BiometricSecurity
❤5🔥2
🚨Not all data leaks are what they seem.
Group-IB’s latest blog peels back the layers on combolists and ULP files credential dumps flooding the dark web and Telegram, often mislabeled as fresh infostealer logs. But behind the buzzwords and file names like “PRIVATE_LEAK_2025” lies a cycle of recycled, fake, or autogenerated data that misleads defenders and fuels alert fatigue.
Threat actors like AlienTXT have built reputations on this deception—repackaging old data as new and selling it under the guise of exclusivity.
Learn how to tell real stealer logs from marketing noise, and why defenders must focus on the original source of compromise, not just what’s trending in cthreat actor channels. Read the full analysis.
#CyberSecurity #ThreatIntelligence #Infostealer #ULP #DarkWeb #DataLeaks #GroupIB
Group-IB’s latest blog peels back the layers on combolists and ULP files credential dumps flooding the dark web and Telegram, often mislabeled as fresh infostealer logs. But behind the buzzwords and file names like “PRIVATE_LEAK_2025” lies a cycle of recycled, fake, or autogenerated data that misleads defenders and fuels alert fatigue.
Threat actors like AlienTXT have built reputations on this deception—repackaging old data as new and selling it under the guise of exclusivity.
Learn how to tell real stealer logs from marketing noise, and why defenders must focus on the original source of compromise, not just what’s trending in cthreat actor channels. Read the full analysis.
#CyberSecurity #ThreatIntelligence #Infostealer #ULP #DarkWeb #DataLeaks #GroupIB
🔥8
Cybersecurity doesn’t break at the point of attack — it breaks at the planning table.
If your roadmap isn’t tied to real-world business context — it’s already irrelevant.
Gartner® latest Cybersecurity Strategy Planning Report breaks it down:
● Cybersecurity is now considered a board-level business risk
● Cyber strategy must be tied to business, tech, and environmental context to intercept and mitigate real risks.
● Most cyber plans fail because they’re rigid, one-size-fits-all, lacking modularity.
● Lack of executive oversight and cyber literacy brings inconsistencies that weaken resilience.
Build cybersecurity that defends. Access the complete report exclusively through Group-IB.
#RiskMitigation #CTI #Cybersecurity #FightAgainstCybercrime
If your roadmap isn’t tied to real-world business context — it’s already irrelevant.
Gartner® latest Cybersecurity Strategy Planning Report breaks it down:
● Cybersecurity is now considered a board-level business risk
● Cyber strategy must be tied to business, tech, and environmental context to intercept and mitigate real risks.
● Most cyber plans fail because they’re rigid, one-size-fits-all, lacking modularity.
● Lack of executive oversight and cyber literacy brings inconsistencies that weaken resilience.
Build cybersecurity that defends. Access the complete report exclusively through Group-IB.
#RiskMitigation #CTI #Cybersecurity #FightAgainstCybercrime
❤6👍1🔥1
This media is not supported in your browser
VIEW IN TELEGRAM
🌍 Our Inaugural Sustainability Report is here!
Cybersecurity is now a sustainability imperative, with Group-IB pioneering solutions that protect both digital ecosystems and our planet's future through ethical innovation and ESG leadership.
Key Insights:
🔹 10,000 tCO₂e prevented – equivalent to 48,000 trees grown for 10 years
🔹 65M potential victims shielded from cybercrime
🔹 $2.7B in fraud losses blocked globally
🔹 100% renewable energy powering our Netherland office
🔹 Zero data breaches, corruption, or compliance incidents
🔹 1,291 next-gen cyber defenders trained through partnerships
All these achievements, plus our commitment to gender equity, law enforcement capacity building, and governance excellence in the full report. Download it now and Read the press release.
#SustainabilityReport #Cybersecurity #ESG #GreenTech #RenewableEnergy #SustainableFuture #DigitalEcosystems #FightAgainstCybercrime
Cybersecurity is now a sustainability imperative, with Group-IB pioneering solutions that protect both digital ecosystems and our planet's future through ethical innovation and ESG leadership.
Key Insights:
🔹 10,000 tCO₂e prevented – equivalent to 48,000 trees grown for 10 years
🔹 65M potential victims shielded from cybercrime
🔹 $2.7B in fraud losses blocked globally
🔹 100% renewable energy powering our Netherland office
🔹 Zero data breaches, corruption, or compliance incidents
🔹 1,291 next-gen cyber defenders trained through partnerships
All these achievements, plus our commitment to gender equity, law enforcement capacity building, and governance excellence in the full report. Download it now and Read the press release.
#SustainabilityReport #Cybersecurity #ESG #GreenTech #RenewableEnergy #SustainableFuture #DigitalEcosystems #FightAgainstCybercrime
❤8
Fake receipt generators are powering a new wave of industrialized fraud.
Scammers use services like #MaisonReceipts to create localized receipts for 21+ brands—arming resellers of counterfeits with “proof” that deceives platforms, consumers, and retailers.
Our investigation with Sorint.SEC exposes:
🔹 30,000+ Discord members leveraged for real-time scam "support"
🔹 21+ global brands impersonated via polished counterfeit receipts
🔹 Fraud-as-a-service subnoscriptions (€16.99/month) funding TikTok/Telegram promotions
🔹 New platforms like Receiptified emerging to scale the threat
The ecosystem is professionalizing. The receipts? Nearly flawless.
👉 Discover how fraudsters exploit this tech, who’s at risk, and how brands and marketplaces can fight back.
#Cybercrime #FraudDetection #EcommerceSecurity #ThreatIntel #FraudProtection #FightAgainstCybercrime
Scammers use services like #MaisonReceipts to create localized receipts for 21+ brands—arming resellers of counterfeits with “proof” that deceives platforms, consumers, and retailers.
Our investigation with Sorint.SEC exposes:
🔹 30,000+ Discord members leveraged for real-time scam "support"
🔹 21+ global brands impersonated via polished counterfeit receipts
🔹 Fraud-as-a-service subnoscriptions (€16.99/month) funding TikTok/Telegram promotions
🔹 New platforms like Receiptified emerging to scale the threat
The ecosystem is professionalizing. The receipts? Nearly flawless.
👉 Discover how fraudsters exploit this tech, who’s at risk, and how brands and marketplaces can fight back.
#Cybercrime #FraudDetection #EcommerceSecurity #ThreatIntel #FraudProtection #FightAgainstCybercrime
🔥7❤3
iGaming witnesses some of the highest fraud rates across industries—ATO, multi-accounting, bonus abuse, other identity-driven, sophisticated tactics.
In this landscape, fool-proof protection is essential for your business and your players.
But can a single solution bring the chance of fraud down to zero?
After a highly anticipated launch in financial services this month—met with immediate success—we’re now bringing BioConfirm to iGaming.
🎮 Introducing BioConfirm for iGaming
An advanced authentication capability that links real users to their real devices, ensuring consent comes only from the genuine ones.
❌ No disguises. No imposters.
Learn how BioConfirm strengthens your defense against fraud.
#iGaming #BioConfirm #OnlineGaming #FraudDetection #CyberSecurity #FightAgainstCybercrime
In this landscape, fool-proof protection is essential for your business and your players.
But can a single solution bring the chance of fraud down to zero?
After a highly anticipated launch in financial services this month—met with immediate success—we’re now bringing BioConfirm to iGaming.
🎮 Introducing BioConfirm for iGaming
An advanced authentication capability that links real users to their real devices, ensuring consent comes only from the genuine ones.
❌ No disguises. No imposters.
Learn how BioConfirm strengthens your defense against fraud.
#iGaming #BioConfirm #OnlineGaming #FraudDetection #CyberSecurity #FightAgainstCybercrime
❤2👍2
🚨 Game-changing news in fraud prevention!
Group-IB just launched Fraud Matrix 2.0—a revolutionary analytics framework built using a similar approach to the widely recognized MITRE ATT&CK® framework, transforming how organizations detect, prevent, and respond to fraud.
Early adopters report results that speak for themselves:
✅ Detection coverage: 55% → 91%
✅ Response times improved by 85.6%.
✅ 80+ organizations across 30+ countries already onboard
This next-gen solution offers threat actor profiles, real-time campaign intelligence, and cross-industry fraud taxonomy to help businesses stay ahead of evolving threats.
Are you prepared to enhance your fraud defense strategy? Read more.
#CyberSecurity #FraudPrevention #FinTech #RiskManagement #Innovation #GroupIB
Group-IB just launched Fraud Matrix 2.0—a revolutionary analytics framework built using a similar approach to the widely recognized MITRE ATT&CK® framework, transforming how organizations detect, prevent, and respond to fraud.
Early adopters report results that speak for themselves:
✅ Detection coverage: 55% → 91%
✅ Response times improved by 85.6%.
✅ 80+ organizations across 30+ countries already onboard
This next-gen solution offers threat actor profiles, real-time campaign intelligence, and cross-industry fraud taxonomy to help businesses stay ahead of evolving threats.
Are you prepared to enhance your fraud defense strategy? Read more.
#CyberSecurity #FraudPrevention #FinTech #RiskManagement #Innovation #GroupIB
👍7🔥3
🔍 Think your PDFs are secure? Think again.
Our latest blog reveals how "official" documents can be forged or tampered with leaving zero traces if unsigned. From hidden overlays to broken signatures, learn why visual checks fail and how to detect fraud.
Key insights:
🔹 Subtle PDF edits can void digital signatures and break document integrity.
🔹 Tools like Adobe Acrobat and PDF-Processing can reveal hidden annotations and previous versions.
🔹 Metadata can be misleading; only digital signatures reliably prove authenticity.
🔹 Unsigned or PDFs with no password protection offer ZERO assurance.
Dive into the full analysis to learn how to spot tampering before it causes damage.
#Cybersecurity #PDFsecurity #DigitalForensics #InfoSec #DocumentIntegrity #ZeroTrust
Our latest blog reveals how "official" documents can be forged or tampered with leaving zero traces if unsigned. From hidden overlays to broken signatures, learn why visual checks fail and how to detect fraud.
Key insights:
🔹 Subtle PDF edits can void digital signatures and break document integrity.
🔹 Tools like Adobe Acrobat and PDF-Processing can reveal hidden annotations and previous versions.
🔹 Metadata can be misleading; only digital signatures reliably prove authenticity.
🔹 Unsigned or PDFs with no password protection offer ZERO assurance.
Dive into the full analysis to learn how to spot tampering before it causes damage.
#Cybersecurity #PDFsecurity #DigitalForensics #InfoSec #DocumentIntegrity #ZeroTrust
👍3🔥3
Unpredictability is an adversary’s greatest leverage – Break the illusion. Predict their every move.
While the world rides the hype wave of GenAI, Predictive AI is quietly building your real advantage in cybersecurity.
How?
The fusion of AI & ML, behavioral modeling, and correlational intelligence helps you unlock the enemy’s mind, along with:
✅ Early detection of attacker infrastructure;
✅ Vulnerability prioritization based on exploitation likelihood;
✅Risk scoring tied to business-impact mapping;
✅ Pre-emptive actions or faster-time-to-response, and more.
But let’s be clear — predictive analytics isn’t a silver bullet. Without high-quality data, human-in-the-loop validation, and contextual feedback, it will only be a vanity tool.
Read all about it and witness how this quiet catalyst is reshaping cyber defenses.
Start early and get the predictive advantage with Group-IB.
#PredictiveAI #Cybersecurity #AI #RiskManagement #ThreatIntelligence #DataProtection #FightAgainstCybercrime
While the world rides the hype wave of GenAI, Predictive AI is quietly building your real advantage in cybersecurity.
How?
The fusion of AI & ML, behavioral modeling, and correlational intelligence helps you unlock the enemy’s mind, along with:
✅ Early detection of attacker infrastructure;
✅ Vulnerability prioritization based on exploitation likelihood;
✅Risk scoring tied to business-impact mapping;
✅ Pre-emptive actions or faster-time-to-response, and more.
But let’s be clear — predictive analytics isn’t a silver bullet. Without high-quality data, human-in-the-loop validation, and contextual feedback, it will only be a vanity tool.
Read all about it and witness how this quiet catalyst is reshaping cyber defenses.
Start early and get the predictive advantage with Group-IB.
#PredictiveAI #Cybersecurity #AI #RiskManagement #ThreatIntelligence #DataProtection #FightAgainstCybercrime
👍4❤1
Empty shelves, lost customers, and hundreds of millions of pounds in lost profit are just some of the outcomes that retailers have faced in the wake of recent ransomware attacks.
From the Co-operative to M&S, the recent cyber attacks on UK retail giants have dominated headlines and wreaked havoc that’s been felt by customers, staff, and government officials alike.
The culprits behind it? A highly organised group of ransomware specialists, codename: DragonForce.
In this episode, we unpack how DragonForce evolved into a ransomware cartel, franchising their malware to affiliates like Scattered Spider, whose sophisticated social engineering tactics have significantly disrupted UK retail. We explore the wide-ranging impact on both businesses and consumers, offering insights into how each can better protect themselves. Finally, they examine the role of policy and regulation in preventing future attacks and strengthening cyber resilience.
Available now on Spotify and Apple Podcasts.
From the Co-operative to M&S, the recent cyber attacks on UK retail giants have dominated headlines and wreaked havoc that’s been felt by customers, staff, and government officials alike.
The culprits behind it? A highly organised group of ransomware specialists, codename: DragonForce.
In this episode, we unpack how DragonForce evolved into a ransomware cartel, franchising their malware to affiliates like Scattered Spider, whose sophisticated social engineering tactics have significantly disrupted UK retail. We explore the wide-ranging impact on both businesses and consumers, offering insights into how each can better protect themselves. Finally, they examine the role of policy and regulation in preventing future attacks and strengthening cyber resilience.
Available now on Spotify and Apple Podcasts.
❤5👍3🔥3
This media is not supported in your browser
VIEW IN TELEGRAM
🚨 ATM switch attack involving a Raspberry Pi, CAKETAP rootkit, and new TTPs uncovered.
Following a complex Incident Response operation, Group-IB attributed this sophisticated intrusion to threat actor UNC2891.
Key findings:
🔹 Attackers physically accessed the bank’s infrastructure to plant a Raspberry Pi, connecting it to the same switch as the ATM.
🔹 Their objective? Target the ATM switch server and deploy CAKETAP—a rootkit designed to spoof HSM authorization responses and enable fraudulent cash withdrawals.
🔹 Even after removing the device, attackers maintained persistence via a backdoor on the mail server, using TINYSHELL and Dynamic DNS for C2.
🔹 They leveraged an unpublished anti-forensics technique, now recognized as MITRE ATT&CK T1564.013, allowing them to remain hidden from standard detection tools.
👏 Kudos to the Mandiant team for their work on UNC2891.
Learn how it was uncovered and how to defend against it.
#CyberSecurity #LinuxSecurity #ATMSecurity
Following a complex Incident Response operation, Group-IB attributed this sophisticated intrusion to threat actor UNC2891.
Key findings:
🔹 Attackers physically accessed the bank’s infrastructure to plant a Raspberry Pi, connecting it to the same switch as the ATM.
🔹 Their objective? Target the ATM switch server and deploy CAKETAP—a rootkit designed to spoof HSM authorization responses and enable fraudulent cash withdrawals.
🔹 Even after removing the device, attackers maintained persistence via a backdoor on the mail server, using TINYSHELL and Dynamic DNS for C2.
🔹 They leveraged an unpublished anti-forensics technique, now recognized as MITRE ATT&CK T1564.013, allowing them to remain hidden from standard detection tools.
👏 Kudos to the Mandiant team for their work on UNC2891.
Learn how it was uncovered and how to defend against it.
#CyberSecurity #LinuxSecurity #ATMSecurity
❤12
Media is too big
VIEW IN TELEGRAM
Your defenses depend on more than technology.
They depend on how your people act under pressure.
Our Human-Centric Cybersecurity Assessments guide shows you how to test and improve readiness at every level — from end users to SOC and IR teams.
Written by Group-IB experts with proven use cases and role-by-role guidance. Download Now!
#Cybersecurity #IncidentResponse #HumanFactor #SOC #Training
They depend on how your people act under pressure.
Our Human-Centric Cybersecurity Assessments guide shows you how to test and improve readiness at every level — from end users to SOC and IR teams.
Written by Group-IB experts with proven use cases and role-by-role guidance. Download Now!
#Cybersecurity #IncidentResponse #HumanFactor #SOC #Training
👍9❤7
Curious how to actually plan, enrich, automate, and defend using CTI—beyond the theory?
Following the launch of our eBook, this webinar has been highly requested—and now it’s here.
Join our experts as they cut through the fluff and show you how to make cyber threat intelligence work for your business.
📅 Mark your calendars:
September 4 | ⏰ 10:00 AM CEST (GMT+2)
We’ll discuss:
1️⃣ The CTI signals, concepts, and frameworks that power real defense
2️⃣ Why most CTI programs fail to deliver impact—and how to fix that
3️⃣ How to understand attackers and collect evidence-based intelligence for smarter defenses
4️⃣ Real-world examples and advanced use cases of CTI
5️⃣ Expert guidance on building a CTI function that drives action, proves ROI, and creates measurable impact
Register Now!!
#CyberSecurity #InfoSec #ThreatIntelligence #DataProtection #CTIWebinar
Following the launch of our eBook, this webinar has been highly requested—and now it’s here.
Join our experts as they cut through the fluff and show you how to make cyber threat intelligence work for your business.
📅 Mark your calendars:
September 4 | ⏰ 10:00 AM CEST (GMT+2)
We’ll discuss:
1️⃣ The CTI signals, concepts, and frameworks that power real defense
2️⃣ Why most CTI programs fail to deliver impact—and how to fix that
3️⃣ How to understand attackers and collect evidence-based intelligence for smarter defenses
4️⃣ Real-world examples and advanced use cases of CTI
5️⃣ Expert guidance on building a CTI function that drives action, proves ROI, and creates measurable impact
Register Now!!
#CyberSecurity #InfoSec #ThreatIntelligence #DataProtection #CTIWebinar
🔥8👍7
Cybercriminals are no longer experimenting—they’re executing. Deepfake vishing is now a fully operational threat, using AI to clone voices and manipulate victims with unprecedented precision. Our latest blog breaks down how these attacks work and how to defend against them.
Key highlights:
🔹 Deepfake‑related fraud attempts in Asia-Pacific surged 194% in 2024 compared to 2023, with voice‑based scams leading the rise.
🔹 Voice clones crafted from just a few seconds of public audio
🔹 AI voice cloning platforms used to mimic tone, accent & emotion.
🔹 Caller ID spoofing via VoIP increases perceived credibility of scam calls.
🔹 Financial institutions report average losses of US$600,000 per attack.
🔹 Less than 5% of stolen funds are ever recovered.
The blog explores the full attack chain, real-world cases, and practical countermeasures to help organizations stay ahead. Read the full analysis here.
#CyberSecurity #Deepfake #ThreatIntelligence #InfoSec #FightAgainstCybercrime
Key highlights:
🔹 Deepfake‑related fraud attempts in Asia-Pacific surged 194% in 2024 compared to 2023, with voice‑based scams leading the rise.
🔹 Voice clones crafted from just a few seconds of public audio
🔹 AI voice cloning platforms used to mimic tone, accent & emotion.
🔹 Caller ID spoofing via VoIP increases perceived credibility of scam calls.
🔹 Financial institutions report average losses of US$600,000 per attack.
🔹 Less than 5% of stolen funds are ever recovered.
The blog explores the full attack chain, real-world cases, and practical countermeasures to help organizations stay ahead. Read the full analysis here.
#CyberSecurity #Deepfake #ThreatIntelligence #InfoSec #FightAgainstCybercrime
🔥3❤2👍2
🚨 Our latest investigation into AI trading scams is out now!
Fraudsters are evolving fast using deepfakes, AI-generated content, and localized scam infrastructure to target unsuspecting investors around the world.
The key findings:
🔹 Deepfake videos of public figures used to promote fake AI trading platforms
🔹 Entire networks of YouTube channels, fake blogs, and social media accounts engineered to build credibility
🔹 Scam websites dynamically adapt to users' IP address and language to appear region-specific and trustworthy
🔹 Dozens of malicious domains tied to just a few registrants revealing a coordinated global fraud operation
🔹 Sensitive personal data including IDs and credit cards harvested under the guise of “KYC verification”
All this, plus expert analysis, real-world case studies, and technical insights in our full report. Read the full investigation now.
#AI #CyberSecurity #Deepfake #InvestmentScams #ThreatIntel #FightAgainstCybercrime
Fraudsters are evolving fast using deepfakes, AI-generated content, and localized scam infrastructure to target unsuspecting investors around the world.
The key findings:
🔹 Deepfake videos of public figures used to promote fake AI trading platforms
🔹 Entire networks of YouTube channels, fake blogs, and social media accounts engineered to build credibility
🔹 Scam websites dynamically adapt to users' IP address and language to appear region-specific and trustworthy
🔹 Dozens of malicious domains tied to just a few registrants revealing a coordinated global fraud operation
🔹 Sensitive personal data including IDs and credit cards harvested under the guise of “KYC verification”
All this, plus expert analysis, real-world case studies, and technical insights in our full report. Read the full investigation now.
#AI #CyberSecurity #Deepfake #InvestmentScams #ThreatIntel #FightAgainstCybercrime
❤6
Fraud mule operators in the META region are evolving rapidly, shifting from basic VPN obfuscation to physical device muling and layered credential handoffs.
Group-IB’s analysis of 200M+ mobile sessions maps six adaptive fraud stages and the countermeasures that disrupted each: IP reputation blocking, GPS/SIM correlation, behavioral biometrics, and cross-channel intelligence fusion through graph-based linkage analysis.
These findings reveal how fraud supply chains now blend digital evasion with real-world logistics, demanding unified defenses combining device, network, and behavioral signals. Read the complete analysis.
#CyberSecurity #MobileSecurity #BankingSecurity #FraudMule #FightAgainstCybercrime
Group-IB’s analysis of 200M+ mobile sessions maps six adaptive fraud stages and the countermeasures that disrupted each: IP reputation blocking, GPS/SIM correlation, behavioral biometrics, and cross-channel intelligence fusion through graph-based linkage analysis.
These findings reveal how fraud supply chains now blend digital evasion with real-world logistics, demanding unified defenses combining device, network, and behavioral signals. Read the complete analysis.
#CyberSecurity #MobileSecurity #BankingSecurity #FraudMule #FightAgainstCybercrime
👍5🔥5
Group-IB is proud to have supported INTERPOL in “Operation Serengeti 2.0”, a landmark operation that has significantly disrupted cybercrime across Africa. Between June and August 2025, the operation led to:
✅ 1,209 cybercriminals arrested
✅ $97.4 MILLION recovered
✅ 11,432 malicious infrastructures dismantled
✅ Nearly 88,000 victims identified globally
Group-IB contributed circumstantial intelligence on cryptocurrency investment scams, business email compromise networks, and malicious infrastructure active in the African region. Leading up to the operation, our team also conducted a series of practical workshops for investigators on open-source intelligence techniques and techniques, as well as knowledge sharing on dark web investigations, enhancing investigative capabilities and directly contributing to the success of the operation. This operation highlights the powerful results achievable through global public-private partnership.
Read the full press release here.
#CyberSecurity #OperationSerengeti
✅ 1,209 cybercriminals arrested
✅ $97.4 MILLION recovered
✅ 11,432 malicious infrastructures dismantled
✅ Nearly 88,000 victims identified globally
Group-IB contributed circumstantial intelligence on cryptocurrency investment scams, business email compromise networks, and malicious infrastructure active in the African region. Leading up to the operation, our team also conducted a series of practical workshops for investigators on open-source intelligence techniques and techniques, as well as knowledge sharing on dark web investigations, enhancing investigative capabilities and directly contributing to the success of the operation. This operation highlights the powerful results achievable through global public-private partnership.
Read the full press release here.
#CyberSecurity #OperationSerengeti
❤7🔥3🏆3👍2🍾1
🚨 New Research Alert: ShadowSilk, a cross-border threat cluster with roots in YoroTrooper.
Since 2023, ShadowSilk has targeted government organizations across Central Asia and APAC, with operations continuing into July 2025. Group-IB’s joint investigation with CERT-KG uncovered:
🔹 Evidence of collaboration between two subgroups, one Russian and another Chinese-speaking
🔹 Use of Telegram bots, Cobalt Strike, Metasploit, and dark web–purchased panels (JRAT, MORF)
🔹 Campaigns focused on spear-phishing, persistence via registry keys, and stealthy data exfiltration
🔹 Infrastructure reuse linking ShadowSilk back to YoroTrooper, but with a distinct toolset and operational style
This research reveals ShadowSilk’s tactics, techniques, and procedures (TTPs), their underground ecosystem ties, and why we assess them as an evolving APT cluster rather than a mere extension of YoroTrooper. Read the full technical analysis here.
#ThreatIntelligence #CyberSecurity #ShadowSilk #YoroTrooper #FightAgainstCybercrime
Since 2023, ShadowSilk has targeted government organizations across Central Asia and APAC, with operations continuing into July 2025. Group-IB’s joint investigation with CERT-KG uncovered:
🔹 Evidence of collaboration between two subgroups, one Russian and another Chinese-speaking
🔹 Use of Telegram bots, Cobalt Strike, Metasploit, and dark web–purchased panels (JRAT, MORF)
🔹 Campaigns focused on spear-phishing, persistence via registry keys, and stealthy data exfiltration
🔹 Infrastructure reuse linking ShadowSilk back to YoroTrooper, but with a distinct toolset and operational style
This research reveals ShadowSilk’s tactics, techniques, and procedures (TTPs), their underground ecosystem ties, and why we assess them as an evolving APT cluster rather than a mere extension of YoroTrooper. Read the full technical analysis here.
#ThreatIntelligence #CyberSecurity #ShadowSilk #YoroTrooper #FightAgainstCybercrime
❤9👍4
🚨The most damaging APT attacks today begin with an ordinary email from a trusted partner.
Group-IB has analyzed infostealers delivered in emails that:
✅ Come from real accounts using trusted domains
✅ Include clean, reputation-safe links
✅ Pass all major vendor security checks
✅ Are written by AI with flawless grammar
Read the blog to see how attackers exploit your trust.
#CyberSecurity #EmailSecurity #ThreatIntelligence #CyberThreats #FightAgainstCybercrime
Group-IB has analyzed infostealers delivered in emails that:
✅ Come from real accounts using trusted domains
✅ Include clean, reputation-safe links
✅ Pass all major vendor security checks
✅ Are written by AI with flawless grammar
Read the blog to see how attackers exploit your trust.
#CyberSecurity #EmailSecurity #ThreatIntelligence #CyberThreats #FightAgainstCybercrime
👍7❤5
🚨From deepfakes to DarkLLMs, AI is no longer hype – it’s reshaping cybercrime in real time.
Our latest research uncovers how threat actors are:
🔹 Running live deepfake scams that have already cost victims $350M in Q2 2025 alone, according to a report by Resemble AI.
🔹 Equipping scam call centers with synthetic voices and LLM “coaches” for more persuasive fraud.
🔹 Deploying uncensored DarkLLMs to generate phishing kits, malware code, and scam noscripts.
🔹 Leveraging AI-powered spam tools to launch hyper-personalized phishing campaigns at scale.
🔹 Embedding AI into toolkits for reconnaissance, code obfuscation, and social engineering.
⚠️ The result? Faster, more scalable, and harder-to-detect cybercrime operations. Fully autonomous AI-driven attacks aren’t here yet, but hybrid human-AI campaigns already are.
Dive into Group-IB’s latest blog for a technical breakdown of 5 AI-driven use cases powering cybercrime and what defenders must prepare for next.
#Cybersecurity #FightAgainstCybercrime
Our latest research uncovers how threat actors are:
🔹 Running live deepfake scams that have already cost victims $350M in Q2 2025 alone, according to a report by Resemble AI.
🔹 Equipping scam call centers with synthetic voices and LLM “coaches” for more persuasive fraud.
🔹 Deploying uncensored DarkLLMs to generate phishing kits, malware code, and scam noscripts.
🔹 Leveraging AI-powered spam tools to launch hyper-personalized phishing campaigns at scale.
🔹 Embedding AI into toolkits for reconnaissance, code obfuscation, and social engineering.
⚠️ The result? Faster, more scalable, and harder-to-detect cybercrime operations. Fully autonomous AI-driven attacks aren’t here yet, but hybrid human-AI campaigns already are.
Dive into Group-IB’s latest blog for a technical breakdown of 5 AI-driven use cases powering cybercrime and what defenders must prepare for next.
#Cybersecurity #FightAgainstCybercrime
👍5🔥2