The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Law Enforcement
Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.
Explore Other Sectors
Law Enforcement Threat Reports
Europol Arrests 34 Black Axe Members in Massive 2026 Organized Cyber-Fraud Takedown
In January 2026, Europol and Spanish authorities arrested 34 suspected members of the Black Axe organized crime syndicate in Spain, dismantling a major transnational cyber-fraud operation. The group, originating from Nigeria but operating internationally, orchestrated a series of sophisticated cyber-enabled crimes, including business email compromise, romance and inheritance scams, credit card and tax fraud, and extensive money laundering. Law enforcement seized over €185,000 ($216,000) in assets and disrupted fraud estimated at more than €5.9 million ($6.9M), highlighting Black Axe's role in global financial crime and cyber-enabled offenses. This incident underscores the growing intersection of traditional organized crime with advanced cyber-fraud tactics, as law enforcement faces increasingly complex, multi-jurisdictional threats. The reliance on cyber-enabled fraud techniques by such syndicates reflects an urgent need for organizations to adapt their security posture to address sophisticated, persistent, and highly organized threats.
8 months ago
Kill Chain
Illinois Man Phishes 570 Snapchat Accounts in Major 2026 Breach
In early 2026, U.S. authorities charged Illinois resident Kyle Svara for orchestrating a large-scale phishing and account takeover operation targeting Snapchat users. Between May 2020 and February 2021, Svara used social engineering tactics, including impersonating Snap representatives, to solicit access codes from over 4,500 individuals. He successfully compromised credentials for approximately 570 victims and accessed at least 59 accounts without permission, stealing private images and selling his hacking services online via forums like Reddit and encrypted channels such as Kik. Affected organizations included Northeastern University and Colby College, with the breach exposing significant privacy and security risks for hundreds of women. This breach highlights the escalating threat of identity-driven attacks leveraging social engineering and phishing to gain unauthorized access to sensitive accounts. The incident underscores increased regulatory and public scrutiny of platforms' ability to safeguard user credentials, as well as the evolving risks posed by credential harvesting and account takeover methods.
8 months ago
Kill Chain
Bitfinex 2016 Hack: Anatomy of a Record Crypto Heist and Its Aftermath
In 2016, cryptocurrency exchange Bitfinex suffered one of the largest crypto thefts to date when hackers, including Ilya Lichtenstein, exploited security weaknesses to steal nearly 120,000 Bitcoins, worth billions of dollars at the time. Lichtenstein laundered the stolen funds through a sophisticated network of wallets and exchanges to obscure the assets' origin. Following a lengthy investigation, U.S. authorities arrested Lichtenstein in 2022, later convicting and sentencing him for money laundering tied to this high-profile breach. The Bitfinex hack has become a landmark case in cryptocurrency security and digital money laundering tactics. Its legacy persists as the industry faces increased regulatory scrutiny and ongoing threats targeting exchanges via increasingly sophisticated cyber methods.
8 months ago
Kill Chain
US Treasury Lifts Sanctions on Key Intellexa Predator Spyware Figures
In December 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) removed three individuals previously sanctioned for their involvement with Intellexa and its Predator commercial spyware from the Specially Designated Nationals (SDN) list. The individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—were linked to leadership and distribution roles within the Intellexa Consortium. Their removal followed a petition and OFAC’s evaluation that they had separated themselves from the Intellexa ecosystem, but no underlying details or independent confirmation were disclosed. The original sanctions stemmed from their roles in developing, distributing, and enabling Predator software, a tool implicated in high-profile surveillance of civil society figures, including journalists and activists, through stealth zero-day and social engineering attacks. This case underscores the continued risks posed by commercial spyware vendors and associated compliance exposures. Ongoing public reporting highlights Predator’s persistent activity despite regulatory efforts, as well as geopolitical pressures that drive international balkanization and new attack trends targeting sensitive sectors. With regulatory frameworks evolving and threat actors shifting tactics, the risk of spyware misuse for human rights abuses and espionage remains acute.
8 months ago
Kill Chain
INTERPOL’s Landmark Crackdown: 574 Cybercrime Arrests across Africa in Operation Sentinel
In November 2025, INTERPOL coordinated Operation Sentinel across 19 African nations, resulting in the arrest of 574 suspected cybercriminals and recovery of $3 million. The operation targeted major cybercrime networks involved in business email compromise (BEC), digital extortion, and related ransomware campaigns. Notably, a Ukrainian national associated with ransomware operations pled guilty, highlighting the global breadth of these criminal networks. The operation uncovered sophisticated use of encrypted communication and lateral movement tactics to evade detection, impacting financial institutions and businesses across the continent. The crackdown underscores the evolving nature of cybercrime, with attackers leveraging advanced techniques and international collaboration among law enforcement agencies rising in response. Increased BEC and ransomware threats have pressed organizations in Africa and globally to evaluate existing cybersecurity and compliance controls.
8 months ago
Kill Chain
CISA Flags Active Exploitation of Digiever Authorization Vulnerability (CVE-2023-52163)
In December 2023, CISA added CVE-2023-52163 to its Known Exploited Vulnerabilities Catalog after identifying active exploitation of a missing authorization vulnerability in Digiever DS-2105 Pro network video recorders. Malicious actors leveraged this flaw to gain unauthorized access to sensitive functions and video data, bypassing authentication controls. The exploitation exposed affected organizations to privacy breaches, potential lateral movement within networks, and possible compromise of video surveillance infrastructure. The vulnerability is particularly concerning for agencies required to comply with Binding Operational Directive 22-01, raising enterprise risks related to data integrity, operational continuity, and regulatory responsibility. This incident underscores a broader trend of attackers exploiting well-known yet unpatched vulnerabilities in internet-connected devices. Recent months have seen an increase in targeting of IoT and NVR platforms, highlighting the urgency for prioritized vulnerability management as threat actors continue to shift focus towards overlooked or legacy systems.
8 months ago
Kill Chain
US DOJ Indicts 54 for Ploutus Malware ATM Jackpotting: Tren de Aragua’s US Crime Wave, 2025
In December 2025, the U.S. Department of Justice charged 54 individuals associated with the Tren de Aragua criminal gang in a far-reaching ATM jackpotting operation across the United States. By deploying Ploutus malware onto automated teller machines, the group manipulated hardware to force cash withdrawals—ultimately stealing millions of dollars. The multi-state scheme involved coordinated physical access to ATMs, installation of malicious software, and cash-out teams, highlighting significant vulnerabilities in banking infrastructure and ATM security controls. This incident underscores an escalating wave of financially motivated attacks leveraging sophisticated malware and organized criminal networks. With jackpotting attacks resurging globally and law enforcement intensifying their response, organizations must prioritize layered defenses, real-time anomaly detection, and compliance with evolving regulatory requirements.
8 months ago
Kill Chain
Latvian Crew Arrested After Malware Attack on Italian Ferry: 2024 Maritime Cybersecurity Wake-Up Call
In June 2024, French law enforcement arrested two Latvian crew members aboard an Italian passenger ferry, the 'Cruise Bonaria,' after discovering they had installed malware on the ship’s critical systems. The suspects, employed as technicians, reportedly leveraged their privileged access to compromise the vessel’s automation and navigation controls. Investigators believe the malware was capable of allowing remote control over ship operations, raising concerns about the safety of passengers and the secure operation of maritime infrastructure. The incident temporarily disrupted the ferry's operations as authorities worked to contain the threat, analyze the infected systems, and restore normalcy while ensuring no lingering backdoors remained. This incident is a stark reminder of growing cyber risks targeting OT (operational technology) environments in critical transport sectors. The arrest coincides with heightened industry and regulatory attention on supply chain integrity, insider threats, and the urgent need for advanced monitoring and segmentation to protect safety-critical infrastructure.
8 months ago
Kill Chain
France's Ministry of the Interior Breached in Nation-State Attack: 2024 Suspect Arrested
In June 2024, French authorities arrested a 22-year-old suspect in connection with a cyberattack targeting the Ministry of the Interior. The attack took place earlier in the month and was orchestrated using sophisticated nation-state level tactics, resulting in unauthorized access to sensitive government infrastructure. Although the Ministry quickly identified the incursion and initiated prompt containment measures, the breach underscored significant vulnerabilities in the security perimeter of key government agencies. Investigators believe the attacker leveraged advanced persistence techniques and attempted to exfiltrate confidential information before being apprehended. This incident underscores the growing sophistication of cyber operations targeting European governmental institutions. As nation-state and advanced persistent threats (APTs) escalate in frequency and impact, public sector organizations must reinforce zero trust segmentation, threat detection, and traffic encryption controls to stay ahead of evolving risks.
8 months ago
Kill Chain
French Interior Ministry 2024 Email Server Breach: What Happened & Key Lessons
In June 2024, the French Interior Ministry confirmed a significant cyberattack that targeted its internal email servers. Threat actors conducted a sophisticated intrusion into the ministry's IT infrastructure, accessing and potentially exfiltrating sensitive email communications. The breach was detected after suspicious activity was found on the email systems. While no citizen data has reportedly been compromised, the attack forced authorities to rapidly isolate affected servers and implement remedial security protocols, causing temporary disruption to some official communications and raising concerns about government data confidentiality and resilience. This incident is emblematic of an increasing trend of targeted attacks on government email and communication systems. With attackers becoming more adept at breaching core administrative platforms, nations are under heightened pressure to bolster segmentation, encryption in transit, and detection capabilities to safeguard critical infrastructure.
8 months ago
Kill Chain
Intellexa Exposed: Predator Spyware Vendor’s Secret Remote Access Unveiled (2024)
In 2024, investigative reporting revealed that Intellexa, a vendor of the Predator spyware, retained the ability to remotely access systems belonging to its own customers. Leaked training videos and multiple research publications uncovered that Intellexa could view customer surveillance logs, potentially monitoring surveillance operations and data on targeted individuals. Additional findings exposed that Intellexa exploited malicious mobile advertisements (notably the 'Aladdin' vector) to infect targets, and utilized domains imitating legitimate news sites, implicating Predator in surveillance of high-profile activists, journalists, and lawyers across Kazakhstan, Egypt, Greece, Iraq, and Pakistan. This raised serious concerns regarding human rights oversight and corporate accountability. This incident is particularly alarming due to the vendor’s persistent development of new zero-day exploits and its direct operational involvement in customer deployments. Such practices highlight significant shifts in spyware vendor behavior and raise urgent questions about regulatory readiness, digital rights, and the security of organizations relying on third-party surveillance tools.
8 months ago
Kill Chain
Predator Spyware 2024: Zero-Click Ad Delivery Redefines Stealth Attacks
Between late 2023 and early 2024, the Predator spyware—developed by surveillance tech company Intellexa—was deployed via a novel zero-click attack vector known as "Aladdin." This technique exploited malicious ads to automatically compromise targeted devices as soon as they displayed the booby-trapped advertisement, without requiring any user interaction. Elite threat actors leveraged this method to implant sophisticated spyware capable of exfiltrating sensitive data and monitoring victim activity. The campaign’s covert nature enabled infections to go undetected, raising the risk for organizations and individuals exposed to this advanced surveillance toolset. This incident highlights the rapid evolution of zero-click infection strategies, especially those exploiting web advertising ecosystems. Security teams must double down on threat detection, anomaly response, and zero trust frameworks to counter increasingly stealthy surveillance tools used by both commercial operators and nation-state clients.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports