✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Law Enforcement
Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.
Explore Other Sectors
Law Enforcement Threat Reports
Interpol Uncovers Major Romance Scam and Sextortion Networks in Africa
In June 2024, Interpol coordinated "Operation Contender 3.0" across 14 African countries, arresting 260 individuals involved in cyber-enabled romance scams and sextortion schemes. The operation disrupted 81 cybercrime networks and resulted in the seizure of devices, forged documents, and other cybercrime infrastructure. Authorities uncovered nearly $2.8 million in losses affecting almost 1,500 victims, with Ghana and Senegal among the countries making substantial arrests and asset recoveries. Criminal networks exploited online platforms to deceive victims, using forged identities, stolen images, and blackmail tactics to extort payments or sensitive information. This operation highlights the escalating threat of social engineering attacks and cyber-enabled financial fraud in rapidly digitizing regions. As online interactions increase, so do identity-driven scams, making it critical for organizations and individuals alike to strengthen digital vigilance and invest in layered, resilient cybersecurity controls.
6 months ago
Kill Chain
Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv
In early 2024, cybercriminals conducted a sophisticated phishing campaign targeting organizations and individuals in Kyiv, Ukraine, by spoofing the National Police of Ukraine. The attackers distributed malicious emails containing Scalable Vector Graphics (SVG) files, which enabled fileless delivery of info-stealing malware such as Amatera Stealer and the cryptocurrency miner PureMiner. By leveraging social engineering and trusted police branding, they bypassed common security defenses, leading to the theft of sensitive credentials, system compromise, and potential financial losses. The breach highlights attackers’ growing reliance on fileless techniques and deceptive lures to infiltrate victims’ environments with minimal detection. This incident underlines a shift toward advanced, stealthy phishing tactics that weaponize graphics files and trusted institutional identities. The approach signifies an escalating trend in cybercrime, where threat actors continue to innovate to evade legacy controls and exploit user trust amid ongoing geopolitical unrest.
6 months ago
Kill Chain
Dutch Teens Arrested for Espionage Attempt Targeting Europol via WiFi Sniffer
In September 2025, Dutch authorities arrested two 17-year-old boys who attempted to spy on Europol and other international entities in The Hague using WiFi sniffer devices. The teenagers, allegedly recruited via Telegram to work for Russian interests, conducted reconnaissance outside the offices of Europol, Eurojust, and the Canadian embassy, aiming to intercept wireless traffic. A tip-off from the Dutch intelligence service (AIVD) led to their arrest before any confirmed data breach occurred. Europol reported no compromise of its systems but is maintaining heightened vigilance. This incident underscores the evolving threat landscape where state-sponsored actors increasingly recruit and exploit minors for espionage activities. With attacks targeting wireless infrastructures and leveraging easily accessible tools, organizations must strengthen controls, enhance insider threat awareness, and expand security measures to non-traditional attack vectors.
6 months ago
Kill Chain
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.
6 months ago
Kill Chain
Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly
In September 2025, the U.S. Secret Service disrupted a sophisticated illicit telecom infrastructure in the New York City area, uncovering more than 300 servers and over 100,000 SIM cards located near the United Nations General Assembly. The operation identified a network enabling encrypted, anonymous communications allegedly used by foreign actors, criminals, and potentially threat groups to coordinate activities and transmit assassination threats. Investigators warned that the scale of the system posed significant risk, including the theoretical ability to disable cellular networks and disrupt critical communications during high-security events. This incident highlights rising risks of criminal and nation-state actors leveraging physical telecom infrastructure to subvert detection, illustrating how sophisticated SIM farms and server farms can facilitate large-scale anonymity and attacks. The operation underscores heightened scrutiny on telecom supply chain security during high-profile events and the need for robust infrastructure monitoring.
6 months ago
Kill Chain
Canada Seizes $40 Million in Historic Crackdown on TradeOgre Crypto Exchange
In September 2025, the Royal Canadian Mounted Police (RCMP) dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million in digital assets linked to alleged financial crimes. The operation was initiated following intelligence from Europol, leading to an investigation by the Money Laundering Investigative Team (MLIT) that uncovered the exchange's lack of regulatory compliance, such as evading Know Your Customer (KYC) protocols and failing to register with Canada's FINTRAC. The lack of oversight facilitated the laundering of cybercrime proceeds, particularly via privacy-focused cryptocurrencies like Monero, culminating in the country's largest-ever asset seizure. This incident underscores the growing scrutiny and regulatory pressure on privacy-centric platforms facilitating anonymous digital transactions. The enforcement action highlights heightened law enforcement capabilities targeting underground exchanges and reflects broader trends in global efforts to curb illicit finance within the crypto sector.
6 months ago
Kill Chain
DOJ Resentences BreachForums Founder in 2025 Cybercrime Marketplace Crackdown
In September 2025, the U.S. Department of Justice resentenced Conor Brian Fitzpatrick—known online as Pompompurin and the former administrator of the notorious BreachForums cybercrime marketplace—to three years in prison. Fitzpatrick pleaded guilty after orchestrating access device fraud and facilitating the sale of stolen data, in addition to possessing child sexual abuse material (CSAM). BreachForums had become a major platform for trading compromised credentials, payment card information, and illicit content before law enforcement seized the site and apprehended its leader. The takedown disrupted a key meeting ground for cybercriminals involved in massive data breaches and identity theft operations. This incident underlines heightened law enforcement focus on cybercrime forums as hubs for illegal commerce, reflecting rising pressure on both administrators and users. The prosecution of BreachForums’ founder highlights regulatory and investigative trends aimed at deterring similar platforms and enforcing accountability for cyber-enabled offenses.
6 months ago
Kill Chain
Sextortion at Scale: Lessons from 1,900 Cryptocurrency Extortion Emails (2021–2025)
Between June 2021 and August 2025, researchers analyzed nearly 1,900 sextortion emails sent globally as part of orchestrated financial extortion campaigns. Threat actors leveraged email as the primary attack vector, issuing blackmail demands and requesting payments to over 200 unique cryptocurrency addresses (primarily Bitcoin). The attackers frequently rotated wallet addresses to hinder tracing, with most being active for only a few days. While 28% of the wallet addresses received no payments, the majority collected varied sums, with a median received amount of approximately $4,315 per address; a handful captured large sums exceeding $75,000. These campaigns underline the continuing prevalence and evolution of cryptocurrency-enabled extortion tactics. Sextortion remains a persistent cybercrime threat, with campaigns adapting to changes in cryptocurrency use and email security. Recent analysis suggests a downward trend in victim willingness to pay, potentially reflecting higher user awareness and stronger resilience to such scams, but attackers are refining techniques to maintain extortion income.
6 months ago
Kill Chain
European Crypto Fraud Ring Dismantled After €100 Million Theft
In September 2025, European law enforcement agencies coordinated by Eurojust and Europol dismantled a cryptocurrency investment fraud ring, arresting five suspects linked to more than €100 million ($118 million) in stolen funds. The operation, spanning several countries including Spain, Portugal, Bulgaria, Italy, Lithuania, and Romania, targeted a sophisticated group that lured victims with promises of high returns through professional online platforms. Funds from over 100 victims across 23 countries were diverted into controlled accounts, masked by additional recovery fees and subsequent website takedowns, resulting in substantial losses and significant reputational damage. This incident underscores the growing scale and sophistication of crypto-based financial fraud targeting both individuals and organizations globally. The case highlights the necessity for robust fraud prevention, regulatory vigilance, and proactive threat detection in the rapidly evolving crypto investment landscape.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports