The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Law Enforcement
Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.
Explore Other Sectors
Law Enforcement Threat Reports
Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia
In August 2025, U.S. federal prosecutors charged Peter Williams, a former executive at L3Harris Technologies’ cyber division, with stealing and selling sensitive trade secrets to an undisclosed Russian buyer. Williams, the former general manager of specialized hacking group Trenchant, allegedly misappropriated eight proprietary technologies from two companies between April 2022 and August 2025, totaling $1.3 million in illicit gains. The Department of Justice seeks forfeiture of assets derived from the scheme. Neither L3Harris nor Trenchant is accused of direct wrongdoing. This incident underscores the growing threat posed by insiders with privileged access to highly sensitive cyber capabilities. As governments and critical industries bolster defenses, advanced techniques to detect, monitor, and mitigate insider risk are essential to prevent breaches that could have national security consequences.
8 months ago
Kill Chain
Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge
In 2024, security researchers tracked a surge in activity from a sophisticated smishing (SMS phishing) group known as Smishing Triad, a decentralized operation managed in Chinese, leveraging a network of over 195,000 malicious domains to steal sensitive information globally. Domains impersonated critical sectors—including U.S. postal services, financial firms, healthcare, e-commerce, and government agencies—with the majority hosted in the U.S., China, and Singapore. Cross-functional threat actors orchestrated attacks via mobile messaging and Telegram forums, evolving tactics to avoid detection; most domains were short-lived, amplifying evasion and operational scale. This incident stands out for its scale, rapid infrastructure cycling, and global targeting, highlighting rising threats from organized smishing groups. The continued proliferation of phishing-as-a-service operations, increasing attacker collaboration, and adoption of short-lived domain infrastructures demonstrate the urgent need for improved east-west security controls, rapid detection, and stronger identity-based segmentation.
8 months ago
Kill Chain
WhatsApp Bans NSO Group: Landmark Legal Win Over Spyware Surveillance (2024)
In June 2024, WhatsApp achieved a legal victory against NSO Group following a six-year battle over the use of commercial spyware targeting WhatsApp users. NSO Group had exploited zero-day vulnerabilities to deploy its Pegasus spyware, surreptitiously compromising user devices for surveillance. As a result of the court decision, NSO Group is permanently banned from accessing or reverse-engineering WhatsApp and must pay $4 million in damages. The court's judgement underscores the broader risks posed by commercial surveillance tools, impacting end-user privacy and digital trust on a global scale. This incident comes amidst intensifying global scrutiny over spyware vendors and increasing pressure for technology companies to safeguard user data. The legal ruling sets a precedent for software platforms defending against targeted surveillance campaigns, emphasizing the role of legal strategy alongside technical security countermeasures.
8 months ago
Kill Chain
International SIM Box Fraud Network Dismantled in Major 2024 Sting Operation
In June 2024, law enforcement agencies from multiple countries executed a coordinated operation that dismantled a large-scale SIM box fraud network. This criminal enterprise facilitated the use of SIM boxes—devices housing dozens or hundreds of SIM cards—to provide fake phone numbers from over 80 countries to criminals. The network enabled anonymous communications for threat actors, facilitating various cybercrimes such as phishing, scams, and the circumvention of telecommunication safeguards. The takedown targeted both the technical infrastructure and the operators, disrupting ongoing fraudulent operations and preventing further abuse. This operation underscores an increased focus among law enforcement on telecom fraud infrastructure, which has proliferated alongside the rise in organized cybercrime and financial scams leveraging global communications. Recent trends show cybercriminals rapidly adopting new tools like SIM farms for voice spoofing, making such police action both timely and necessary.
8 months ago
Kill Chain
US Court Bars NSO Group from Targeting WhatsApp Users with Spyware
In June 2024, a U.S. federal judge issued a permanent injunction against NSO Group, prohibiting the Israeli spyware developer from targeting WhatsApp users with its surveillance products. The case originated from a 2019 incident in which NSO Group exploited flaws in WhatsApp's messaging platform to compromise user privacy, prompting Meta (WhatsApp's parent company) to launch a protracted legal battle. The court recognized the significant risk posed to Meta's business and user trust, as WhatsApp's core value proposition is secure, end-to-end encrypted communications. The injunction was coupled with a major reduction in damages, from $167.3 million to $4 million, marking a significant legal precedent in the spyware industry. This decision highlights mounting regulatory and legal scrutiny on commercial spyware vendors and underscores the increasing stakes for companies offering encrypted services. The ruling signals judicial awareness of privacy threats from advanced surveillance tools and may embolden similar litigation or policy action worldwide.
8 months ago
Kill Chain
Dutch Teens Arrested for Wi-Fi Sniffer Recon in 2024 Russian Espionage Case
In June 2024, Dutch law enforcement arrested two 17-year-olds suspected of conducting cyber-espionage for Russian-backed threat actors. The teens reportedly canvassed high-profile locations in The Hague, including several embassies and European law enforcement headquarters, using a Wi-Fi sniffer to gather network intelligence. Authorities allege they were recruited via Telegram and that state-sponsored Russian actors utilized the pair for reconnaissance, leveraging youth engagement to mask attribution. The operation came to light after a tip-off from Dutch intelligence, resulting in swift arrests and raising significant policy concerns. This incident underscores a rising trend of nation-states outsourcing early reconnaissance to foreign youth via social media, reducing their risk of direct detection. The use of simple yet effective tools for physical/digital hybrid espionage highlights growing operational sophistication—and creates new urgency for organizations to shore up network perimeter and monitoring controls.
8 months ago
Kill Chain
Android Spyware Attack Impersonates UAE Government App in 2024
In early June 2024, security analysts uncovered a sophisticated campaign in which attackers distributed Android spyware posing as a well-known UAE government surveillance app. By leveraging convincing social engineering and impersonation tactics, the threat actors tricked users into installing malicious software capable of exfiltrating sensitive data, monitoring communications, and maintaining persistent control over compromised devices. The spyware utilized encrypted and covert exfiltration methods, giving attackers broad access to user data while evading standard detection. The incident quickly raised concerns among organizations and citizens in the region about mobile device security and privacy. This attack is part of a growing trend using brand impersonation and sophisticated spyware packaging, targeting both individuals and potentially organizations. The resurgence of mobile surveillance threats underscores the evolving risks facing users in high-risk regions and highlights the need for robust mobile device security and compliance with privacy frameworks.
8 months ago
Kill Chain
Interpol Uncovers Major Romance Scam and Sextortion Networks in Africa
In June 2024, Interpol coordinated "Operation Contender 3.0" across 14 African countries, arresting 260 individuals involved in cyber-enabled romance scams and sextortion schemes. The operation disrupted 81 cybercrime networks and resulted in the seizure of devices, forged documents, and other cybercrime infrastructure. Authorities uncovered nearly $2.8 million in losses affecting almost 1,500 victims, with Ghana and Senegal among the countries making substantial arrests and asset recoveries. Criminal networks exploited online platforms to deceive victims, using forged identities, stolen images, and blackmail tactics to extort payments or sensitive information. This operation highlights the escalating threat of social engineering attacks and cyber-enabled financial fraud in rapidly digitizing regions. As online interactions increase, so do identity-driven scams, making it critical for organizations and individuals alike to strengthen digital vigilance and invest in layered, resilient cybersecurity controls.
8 months ago
Kill Chain
Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv
In early 2024, cybercriminals conducted a sophisticated phishing campaign targeting organizations and individuals in Kyiv, Ukraine, by spoofing the National Police of Ukraine. The attackers distributed malicious emails containing Scalable Vector Graphics (SVG) files, which enabled fileless delivery of info-stealing malware such as Amatera Stealer and the cryptocurrency miner PureMiner. By leveraging social engineering and trusted police branding, they bypassed common security defenses, leading to the theft of sensitive credentials, system compromise, and potential financial losses. The breach highlights attackers’ growing reliance on fileless techniques and deceptive lures to infiltrate victims’ environments with minimal detection. This incident underlines a shift toward advanced, stealthy phishing tactics that weaponize graphics files and trusted institutional identities. The approach signifies an escalating trend in cybercrime, where threat actors continue to innovate to evade legacy controls and exploit user trust amid ongoing geopolitical unrest.
8 months ago
Kill Chain
Dutch Teens Arrested for Espionage Attempt Targeting Europol via WiFi Sniffer
In September 2025, Dutch authorities arrested two 17-year-old boys who attempted to spy on Europol and other international entities in The Hague using WiFi sniffer devices. The teenagers, allegedly recruited via Telegram to work for Russian interests, conducted reconnaissance outside the offices of Europol, Eurojust, and the Canadian embassy, aiming to intercept wireless traffic. A tip-off from the Dutch intelligence service (AIVD) led to their arrest before any confirmed data breach occurred. Europol reported no compromise of its systems but is maintaining heightened vigilance. This incident underscores the evolving threat landscape where state-sponsored actors increasingly recruit and exploit minors for espionage activities. With attacks targeting wireless infrastructures and leveraging easily accessible tools, organizations must strengthen controls, enhance insider threat awareness, and expand security measures to non-traditional attack vectors.
8 months ago
Kill Chain
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.
8 months ago
Kill Chain
Secret Service Disrupts Extensive NYC Telecom Threat Targeting UN Assembly
In September 2025, the U.S. Secret Service disrupted a sophisticated illicit telecom infrastructure in the New York City area, uncovering more than 300 servers and over 100,000 SIM cards located near the United Nations General Assembly. The operation identified a network enabling encrypted, anonymous communications allegedly used by foreign actors, criminals, and potentially threat groups to coordinate activities and transmit assassination threats. Investigators warned that the scale of the system posed significant risk, including the theoretical ability to disable cellular networks and disrupt critical communications during high-security events. This incident highlights rising risks of criminal and nation-state actors leveraging physical telecom infrastructure to subvert detection, illustrating how sophisticated SIM farms and server farms can facilitate large-scale anonymity and attacks. The operation underscores heightened scrutiny on telecom supply chain security during high-profile events and the need for robust infrastructure monitoring.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports