ASOS customers received an unauthorized push notification on 6 October claiming the company’s Snowflake environment had been compromised and threatening a #dataleak. The message directed users to a #Telegram channel linked to a group calling itself Xuanye. Our read: #Xuanye is a newly surfaced extortion identity, but the operators behind it may not be new.

Group-IB uncovered a sophisticated Singapore-targeted scam campaign abusing verified Google Ads, 52 redirect domains, and 119 fake news sites to drive victims toward a Mauritius-registered trading platform. The operation blended malvertising, #deepfakes, and localized deception to mimic legitimate media and regulators. #ThreatIntel

Since early 2025, #MuddyWater (aka TA450/Seedworm) has shifted tactics. Once known for widespread RMM-based intrusions, the Iranian state-backed #APT has scaled down mass campaigns in favor of more targeted spearphishing and custom backdoors such as #Phoenix, and StealthCache.

Since 2023,#ShadowSilk has targeted government entities across Central Asia & #APAC. Our investigation uncovered direct infrastructure & toolset overlaps with the known group #YoroTrooper, linking these campaigns to a broader, ongoing operation focused on data exfiltration. #APT

#AI is the new bait. Group-IB uncovered a sophisticated scam network exploiting #deepfake videos, fake news sites, and AI-generated reviews to push fraudulent “AI trading” platforms. These campaigns use the likeness of public figures to falsely endorse platforms designed to siphon funds. #cybersecurity #fraud

Billions of leaked credentials flood #Telegram and #darkweb forums, but how many are actually new? Group-IB’s latest research shows most #combolists and ULP files are outdated, autogenerated, or fake, misleading defenders and inflating the true scale of compromise. #CredentialStuffing

Since 2020, over 620 drivers , 80+ certificates, and 60+ WHCP accounts have been associated with threat actor campaigns. From investigating the dataset, we identified overlaps in certificates and #WHCP accounts used to sign drivers used by unrelated threat actors and groups—the overlapped signed drivers which most of them are signed around the same time frame rely on the same WHCP accounts and signing certificates issued to the same entities. #MalwareAnalysis #ThreatIntel

Since April 2024, Android SMS stealer #Qwizzserial has targeted users in #Uzbekistan, impersonating government accounts providing financial aid. It steals banking credentials, intercepts 2FA codes, and exfiltrates data via Telegram bots — an evolution of the #Classiscam framework. #AndroidMalware

#Hacktivism surged 46% at the onset of #MiddleEast hostilities on June 13 but dropped approximately 70% by June 20. Group-IB analysis reveals 84% of content was original, showing decentralized participation. Future attacks will likely be reactive bursts tied to #geopolitical events.

In early 2025, Group-IB started tracking a #CryptoScam campaign primarily targeting Dutch taxpayers, with recent expansion across Europe. Attackers impersonate official entities like #Belastingdienst and #MijnOverheid, preying on victims' fear of tax non-compliance by demanding urgent declarations of their crypto assets only to drain their wallets once trust is gained. #ThreatIntel

New #Sidewinder activity: sample SHA-1 82ec4097d1cf35adccc97d6157083af2834815cb downloads a malicious RTF from hxxps://mod-gov-bd[.]net-src[.]org/9e1d9962-arrange/Accept_EULA.rtf. The decoy document contains a scanned image of Bengali (Bangla) text and was uploaded from Bangladesh. Block the #IOC & hunt for related traffic! #ThreatIntel #APT

Over the past several days, social media feeds have lit up with breathless warnings about a “new” cyberweapon called “Dance of the Hillary.” Posts urge users to delete files named tasksche.exe, Army_Job_Application_Form.pdf, or any clip titled Dance of the Hillary, claiming they will #hijack phones, drain bank accounts, and crash ATMs. Here’s what is really going on.

Not every “threat actor” is who they claim to be. Group-IB's #Threatlntelligence team exposes how #scammers fake data leaks, recycle public info & manipulate headlines, and why it still works. 🔍 Read the full breakdown of the main indicators of a dark web scam.

🚨Group-IB’s Threat Intelligence team has uncovered a sophisticated ransomware operation, #HuntersInternational, emerging in October 2023, with technical overlaps with the dismantled #Hive ransomware group. The group has implemented a dual extortion model, prioritizing data exfiltration while still maintaining file encryption across Windows, Linux, and ESXi systems. #CyberSecurity

Group-IB’s Threat Intelligence team has investigated the #ClickFix technique—a new #SocialEngineering technique leveraging fake reCAPTCHAs and bot verification prompts to auto-copy malicious PowerShell commands straight to victims’ clipboards and lead them to executing it.

Group-IB’s Threat Intelligence team has investigated the work of the #Lynx #Ransomware group, unveiling multi-architecture builds (Windows, Linux, ESXi). Their affiliate panel centralizes attack orchestration and data-leak scheduling. #RaaS #CyberSecurity