The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Law Enforcement
Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.
Explore Other Sectors
Law Enforcement Threat Reports
Arrest of Pro-Russian Hacktivist in Spain Highlights Ongoing Cyber Threats
In July 2026, Spanish authorities, in collaboration with the FBI, arrested a suspected core member of pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest in Palencia, Spain. The individual is accused of providing logistical support to a Ukrainian hacker affiliated with CARR and attempting to facilitate their escape to Russia. The suspect is also linked to coordinating cyber operations for the NoName057(16) group using encrypted messaging platforms. Seized items include multiple computers and frozen cryptocurrency wallets allegedly used to launder proceeds from stolen data sales. The suspect faces ongoing investigations for collaboration with a recognized terrorist organization and severe computer damage. ([es.euronews.com](https://es.euronews.com/my-europe/2026/07/06/la-policia-y-el-fbi-detienen-en-palencia-a-un-presunto-colaborador-de-hackers-prorrusos?utm_source=openai)) This arrest underscores the persistent threat posed by hacktivist groups targeting critical infrastructure across the United States and Europe. The incident highlights the importance of international cooperation in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against such multifaceted threats.
2 months ago
Kill Chain
INTERPOL's Operation First Light 2026: A Major Blow to Global Fraud Networks
Between January 15 and April 30, 2026, INTERPOL coordinated 'Operation First Light 2026,' a global initiative targeting social engineering fraud and money laundering across 97 countries. The operation resulted in the arrest of 5,811 suspects, the seizure of $293 million in illicit assets, and the identification of over 142,000 victims. Authorities also blocked 31,014 bank accounts and analyzed 152,808 cases, highlighting the extensive reach of these fraudulent activities. This operation underscores the escalating threat of transnational social engineering scams, which have become increasingly sophisticated and widespread. The significant number of victims and the substantial financial impact emphasize the urgent need for enhanced international cooperation and proactive measures to combat such fraud.
2 months ago
Kill Chain
Expansion of Deepfake CSAM Lawsuit Targets xAI and Stability AI
In July 2026, a class-action lawsuit against xAI, the developer of the AI tool Grok, was expanded to include two additional plaintiffs. These individuals allege that Grok was used by acquaintances to generate nonconsensual deepfake child sexual abuse material (CSAM) based on their real photos. The lawsuit also names Stability AI as a defendant, claiming that its Stable Diffusion model facilitated the creation of such illicit content. The plaintiffs report significant emotional distress and a loss of control over the dissemination of these images. This incident underscores the urgent need for robust safeguards in AI technologies to prevent misuse, particularly in generating harmful content. It highlights the growing legal and ethical challenges companies face in ensuring their AI models are not exploited for creating nonconsensual and illegal material.
2 months ago
Kill Chain
European Parliament Member Targeted with Pegasus Spyware During Investigation
In October 2022 and March 2023, former Member of the European Parliament (MEP) Stelios Kouloglou's mobile device was infiltrated with Pegasus spyware while he was serving on the PEGA committee, which was investigating the misuse of such surveillance tools within the European Union. The Citizen Lab's forensic analysis confirmed these infections, indicating that attackers potentially accessed confidential committee documents and deliberations. The specific government or entity responsible for these attacks remains unidentified. ([citizenlab.ca](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/?utm_source=openai)) This incident underscores the escalating threat of sophisticated spyware targeting high-profile individuals, including those involved in oversight and investigative roles. It highlights the urgent need for robust cybersecurity measures and regulatory frameworks to protect sensitive information and uphold democratic processes. ([theguardian.com](https://www.theguardian.com/world/2026/jul/03/spyware-used-against-mep-investigating-pegasus-abuses-report-finds?utm_source=openai))
2 months ago
Kill Chain
DHS HSIN Breach 2026: Cyberattack on Information-Sharing Platform
In late May to early June 2026, the Department of Homeland Security (DHS) experienced a cyberattack on the Homeland Security Information Network (HSIN), a platform for sharing sensitive but unclassified information among federal, state, local, and private-sector partners. An unknown threat actor accessed HSIN servers and a SharePoint system used for collaboration. DHS is investigating the breach to determine the extent of the intrusion and whether any documents were stolen. The department has not attributed the attack to any specific threat actor or foreign government. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/dhs-confirms-hackers-breached-hsin-info-sharing-platform/amp/?utm_source=openai)) This incident underscores the persistent threats to government information-sharing platforms and highlights the need for robust cybersecurity measures. As the United States oversees security for major events like the World Cup, ensuring the integrity of such systems is paramount to national security. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/dhs-confirms-hackers-breached-hsin-info-sharing-platform/amp/?utm_source=openai))
2 months ago
Kill Chain
FBI Issues Alert on Russian Hackers Targeting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued a warning about a sophisticated phishing campaign by Russian intelligence services targeting Signal users. The attackers impersonated Signal support teams, sending messages that prompted users to enable backups and share their 64-character recovery keys. With these keys, the attackers could decrypt victims' entire message histories, compromising sensitive communications. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and key officials in Ukraine. This incident underscores the evolving tactics of state-sponsored cyber actors and highlights the critical importance of user vigilance against social engineering attacks. The exploitation of backup recovery keys represents a significant escalation in phishing techniques, emphasizing the need for robust security practices and user education to prevent unauthorized access to encrypted communications.
3 months ago
Kill Chain
Persistent Cyber Scam Centers in Asia Despite Crackdowns
In June 2026, reports from INTERPOL and Amnesty International highlighted the persistent and escalating issue of cyber scam centers across Asia, particularly in Cambodia, Myanmar, Laos, and the Philippines. Despite high-profile crackdowns and arrests, these operations continue to thrive, generating an estimated $40 billion annually through schemes like romance fraud and investment scams. The resilience of these criminal enterprises is largely attributed to local corruption and collusion with law enforcement, which undermine efforts to dismantle them. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific?utm_source=openai)) This situation underscores the urgent need for enhanced international cooperation and robust anti-corruption measures. The continued operation of these scam centers not only results in significant financial losses globally but also involves severe human rights abuses, including human trafficking and forced labor. Addressing this issue is critical to protecting vulnerable populations and maintaining global cybersecurity. ([amnesty.org](https://www.amnesty.org/en/latest/news/2026/06/cambodia-evidence-suggests-scamming-compounds-bypassed-despite-high-profile-crackdown/?utm_source=openai))
3 months ago
Kill Chain
Russia's Unauthorized Use of Cellebrite Tools on Activist's iPhone
In June 2021, Russian authorities utilized Cellebrite's Universal Forensic Extraction Device (UFED) to access the iPhone of detained opposition activist Andrey Pivovarov. This occurred three months after Cellebrite announced the cessation of sales and services to Russian government clients in March 2021. Forensic evidence and Russian court documents confirm that investigators extracted data, including WhatsApp and Telegram messages, and searched for political terms and opposition figures. This incident underscores the challenges technology vendors face in controlling the use of their tools post-sale, especially when used by authoritarian regimes. The continued operation of Cellebrite's tools in Russia, despite the termination of official support, highlights the need for more robust mechanisms to prevent misuse of surveillance technologies.
3 months ago
Kill Chain
Russia's Continued Use of Cellebrite Tools Raises Concerns
In June 2021, Russian authorities utilized Cellebrite's Universal Forensic Extraction Device (UFED) to access the iPhone of detained human rights activist Andrey Pivovarov. This occurred despite Cellebrite's public announcement in March 2021 that it had ceased all sales and services to Russian government agencies. The extracted data reportedly included communications from encrypted messaging apps, which were subsequently used to surveil other dissidents. This incident underscores the challenges technology companies face in controlling the use of their tools post-sale, especially when they are employed for political repression. The case highlights the need for robust mechanisms to prevent the misuse of surveillance technologies by authoritarian regimes, even after contractual relationships have been terminated.
3 months ago
Kill Chain
FBI Issues Warning on New Cryptocurrency Scam Involving In-Person Couriers
In June 2026, the FBI issued a warning about a new tactic in cryptocurrency investment scams, commonly referred to as 'pig butchering' or 'romance baiting.' Fraudsters initiate contact through social media, dating sites, and messaging apps, building trust with victims before introducing them to fake investment schemes. When traditional financial institutions block suspicious transactions, these scammers dispatch couriers to collect cash directly from victims, often using agreed-upon passwords or specific dollar bill serial numbers for identification. Victims are led to believe their investments are growing, but when they attempt to withdraw funds, they are prompted to provide additional cash for fraudulent taxes and penalties, perpetuating the cycle. This incident underscores the evolving nature of cryptocurrency scams, highlighting the shift towards in-person interactions to circumvent financial safeguards. The FBI's alert serves as a critical reminder for individuals to exercise caution when approached with unsolicited investment opportunities, especially those involving direct cash transactions facilitated by couriers.
3 months ago
Kill Chain
Unveiling App.MenuItem: A New Forensic Artifact in macOS Tahoe 26
In June 2026, researchers identified a new artifact in macOS Tahoe 26, named App.MenuItem, which logs specific menu selections made by users across the operating system. This artifact provides a detailed record of user actions, such as compressing files or emptying the trash, offering critical context for forensic investigations. Located at ~/Library/Biome/streams/restricted/App.MenuItem/local, the artifact contains SEGB-encapsulated protobuf entries that require specific tools to parse. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/?_wpnonce=c8aaaf1bea&lg=en&pdf=download&utm_source=openai)) The discovery of App.MenuItem is significant for digital forensics, as it allows examiners to reconstruct user workflows with greater precision. By capturing exact menu choices and timestamps, investigators can gain insights into user intent and actions, enhancing the accuracy of forensic analyses. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/new-macos-artifact-discovered/?_wpnonce=c8aaaf1bea&lg=en&pdf=download&utm_source=openai))
3 months ago
Kill Chain
Russian Hackers Exploit WinRAR Vulnerability CVE-2025-8088
In mid-2025, Russian state-sponsored threat groups, including RomCom (also known as Storm-0978), exploited a critical vulnerability in WinRAR (CVE-2025-8088) to target Ukrainian military and government organizations. The flaw, a path traversal vulnerability, allowed attackers to execute arbitrary code by delivering specially crafted RAR archives via spear-phishing emails. These campaigns led to unauthorized access, data theft, and potential disruption of critical operations within the targeted entities. Despite the release of WinRAR version 7.13 in July 2025, which addressed this vulnerability, many systems remained unpatched due to the software's lack of an automatic update mechanism. This oversight has enabled continued exploitation by various threat actors, underscoring the importance of timely software updates and robust cybersecurity practices to mitigate such risks.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports