The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Law Enforcement
Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.
Explore Other Sectors
Law Enforcement Threat Reports
Europol's Project Compass: A Milestone in Combating The Com Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international effort involving 28 countries, including all Five Eyes nations, to dismantle 'The Com,' a decentralized network of minors and young adults engaged in cybercrime, extortion, and physical violence. Over the past year, this operation has led to the arrest of 30 individuals, the identification of 179 perpetrators, and the safeguarding of 62 victims. The Com operates across various online platforms, making it challenging to disrupt due to its fragmented structure. ([cyberscoop.com](https://cyberscoop.com/project-compass-the-com-europol/?utm_source=openai)) The significance of this operation lies in its demonstration of effective international collaboration in combating complex cybercriminal networks. The Com's activities, including high-profile ransomware attacks and exploitation of vulnerable individuals, underscore the evolving nature of cyber threats. Project Compass highlights the necessity for continuous global cooperation and adaptive strategies to address such multifaceted cybercrime challenges. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai))
6 months ago
Kill Chain
Operation Red Card 2.0: A Landmark Cybercrime Crackdown in Africa
Between December 8, 2025, and January 30, 2026, Operation Red Card 2.0, coordinated by INTERPOL, led to the arrest of 651 individuals across 16 African countries, including Nigeria and Kenya. The operation targeted high-yield investment scams, mobile money fraud, and fraudulent mobile loan applications, resulting in the recovery of over $4.3 million and the dismantling of 1,442 malicious infrastructures. Investigations revealed financial losses exceeding $45 million, affecting 1,247 victims globally. Notable actions included the dismantling of a high-yield investment fraud ring in Nigeria and the arrest of 27 individuals in Kenya linked to scams exploiting messaging apps and social media platforms. ([nairametrics.com](https://nairametrics.com/2026/02/19/interpol-backed-operation-recovers-4-3m-from-cybercrime-in-nigeria-kenya-others/?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, driven by rapid digitalization and the proliferation of online financial services. The success of Operation Red Card 2.0 highlights the critical importance of international collaboration and intelligence sharing in combating transnational cyber threats. Organizations are urged to enhance their cybersecurity measures and remain vigilant against evolving cybercriminal tactics.
7 months ago
Kill Chain
Predator Spyware's Stealthy Bypass of iOS Recording Indicators
In February 2026, security researchers uncovered that Intellexa's Predator spyware can suppress iOS's camera and microphone recording indicators, allowing covert surveillance without user awareness. By injecting code into SpringBoard, the spyware intercepts sensor activity updates, preventing the green and orange dots from appearing when the camera or microphone is active. This technique requires prior full device compromise, including kernel-level access, and does not exploit new iOS vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/?utm_source=openai)) This discovery highlights the evolving sophistication of commercial spyware and underscores the importance of maintaining up-to-date device security measures. Users should be aware that visual indicators alone may not reliably signal unauthorized access to device sensors, emphasizing the need for comprehensive security practices.
7 months ago
Kill Chain
FBI Reports Surge in ATM Jackpotting Attacks in 2025
In 2025, the FBI reported a significant surge in ATM jackpotting incidents across the United States, with over 700 attacks resulting in more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs, often deploying malware like Ploutus to force machines to dispense cash without legitimate transactions. Criminals typically gain access by using generic keys to open ATM fronts and then install malware to control the machines remotely. This alarming trend underscores the evolving tactics of cybercriminals and highlights the urgent need for financial institutions to bolster their ATM security measures. The rise in such sophisticated attacks calls for enhanced vigilance and the implementation of robust security protocols to protect against these threats.
7 months ago
Kill Chain
INTERPOL's Operation Red Card 2.0: A Major Blow to African Cybercrime Networks
Between December 8, 2025, and January 30, 2026, INTERPOL coordinated Operation Red Card 2.0, a collaborative effort involving law enforcement agencies from 16 African countries. This operation targeted transnational cybercriminal networks engaged in high-yield investment scams, mobile money fraud, and fraudulent mobile loan applications. The concerted efforts led to the arrest of 651 individuals, the recovery of over $4.3 million, and the dismantling of 1,442 malicious infrastructures, including IPs, domains, and servers. Investigations revealed that these scams were responsible for financial losses exceeding $45 million, affecting 1,247 victims across Africa and beyond. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/Major-operation-in-Africa-targeting-online-scams-nets-651-arrests-recovers-USD-4.3-million?utm_source=openai)) The success of Operation Red Card 2.0 underscores the escalating threat posed by organized cybercrime syndicates and highlights the critical importance of international collaboration in combating these pervasive threats. The operation also emphasizes the need for continuous vigilance and proactive measures to protect individuals and businesses from evolving cyber fraud schemes.
7 months ago
Kill Chain
Unveiling the 2026 Tax Preparation Firm Phishing Scheme by Matthew Akande
Between June 2016 and June 2021, Matthew A. Akande, a Nigerian national residing in Mexico, orchestrated a cyber intrusion targeting Massachusetts tax preparation firms. Utilizing phishing emails embedded with Warzone RAT malware, Akande and his co-conspirators gained unauthorized access to sensitive client data, including personally identifiable information (PII) and prior tax records. This stolen information was then used to file over 1,000 fraudulent tax returns, seeking more than $8.1 million in refunds. The illicit proceeds, totaling over $1.3 million, were funneled through U.S. bank accounts and partially transferred to associates in Mexico. ([justice.gov](https://www.justice.gov/usao-ma/pr/nigerian-man-sentenced-eight-years-prison-computer-intrusion-and-theft?utm_source=openai)) This case underscores the persistent threat posed by sophisticated phishing attacks and the exploitation of remote access tools in financial fraud schemes. The incident highlights the critical need for robust cybersecurity measures within tax preparation firms to safeguard client data against such intrusions.
7 months ago
Kill Chain
Fulton County 2026: FBI's Controversial Election Document Seizure
In January 2026, the FBI conducted a raid on Fulton County's election offices in Georgia, seizing ballots and election-related documents from the 2020 presidential election. The operation, overseen by Director of National Intelligence Tulsi Gabbard, was based on allegations of record-keeping deficiencies and potential vote manipulation. However, these claims had been previously investigated and debunked by state officials. The raid has raised significant concerns about federal overreach and the integrity of election processes. ([apnews.com](https://apnews.com/article/9dfecd778c09134e9aa0bba2848718f5?utm_source=openai)) This incident underscores the ongoing challenges in balancing election security with federal authority, highlighting the need for clear protocols and transparency to maintain public trust in the electoral system.
7 months ago
Kill Chain
Kenyan Activist's Phone Compromised by Cellebrite Extraction
In July 2025, Kenyan pro-democracy activist Boniface Mwangi was arrested, and his personal devices were confiscated by authorities. Upon their return in September 2025, Mwangi discovered that his Samsung phone's password protection had been removed. Forensic analysis by Citizen Lab revealed with high confidence that Kenyan authorities utilized Cellebrite's forensic extraction tools on his device during its custody, enabling full access to sensitive information including messages, personal files, financial data, and passwords. This incident underscores the potential misuse of advanced surveillance technologies by government entities to target civil society members. The case highlights the growing concerns over digital privacy and the ethical implications of deploying such tools without proper oversight, emphasizing the need for stringent regulations to prevent abuse and protect individual rights.
7 months ago
Kill Chain
Serbian Authorities' Misuse of Cellebrite Tools in 2024: A Wake-Up Call for Digital Privacy
In December 2024, Amnesty International reported that Serbian police and intelligence agencies misused Cellebrite's digital forensic tools to unlawfully extract data from mobile devices belonging to journalists and activists. The authorities employed these tools to unlock devices without consent, facilitating the installation of spyware like NoviSpy during detentions and interrogations. This surveillance campaign targeted individuals critical of government policies, leading to significant privacy violations and suppression of civil society. ([amnesty.org](https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/?utm_source=openai)) The incident underscores the potential for abuse of digital forensic technologies when deployed without stringent oversight. It highlights the urgent need for robust legal frameworks and ethical guidelines to prevent the misuse of such tools against civil society and to protect fundamental human rights.
7 months ago
Kill Chain
ZeroDayRAT: The New Mobile Spyware Threatening Device Security
In early February 2026, cybersecurity researchers identified ZeroDayRAT, a sophisticated mobile spyware platform being sold openly on Telegram. This malware grants attackers full remote control over Android (versions 5 through 16) and iOS devices (up to iOS 26, including the iPhone 17 Pro). Once installed via smishing, phishing emails, or malicious app stores, ZeroDayRAT enables comprehensive surveillance, including GPS tracking, message interception, live camera and microphone access, keylogging, and financial theft targeting banking and cryptocurrency applications. The spyware's user-friendly control panel allows even non-technical operators to exploit compromised devices effectively. ([securityweek.com](https://www.securityweek.com/new-zerodayrat-spyware-kit-enables-total-compromise-of-ios-android-devices/?utm_source=openai)) The emergence of ZeroDayRAT signifies a concerning trend where advanced surveillance tools, previously accessible only to nation-state actors, are now available to a broader range of cybercriminals. This development underscores the urgent need for enhanced mobile security measures and user vigilance to prevent unauthorized access and data breaches. ([securityweek.com](https://www.securityweek.com/new-zerodayrat-spyware-kit-enables-total-compromise-of-ios-android-devices/?utm_source=openai))
7 months ago
Kill Chain
Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities
Between January 2024 and February 2026, the cyber espionage group TGR-STA-1030, assessed to be state-aligned and operating out of Asia, compromised at least 70 government and critical infrastructure organizations across 37 countries. The group employed phishing emails and exploited known software vulnerabilities to gain initial access, subsequently deploying tools like the Diaoyu Loader and the ShadowGuard rootkit to maintain persistence and exfiltrate sensitive data. Notable targets included national law enforcement agencies, ministries of finance, and departments focusing on trade and diplomacy. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/shadow-campaigns-uncovering-global-espionage/?utm_source=openai)) This incident underscores the escalating sophistication and reach of state-sponsored cyber espionage activities, highlighting the urgent need for enhanced cybersecurity measures and international cooperation to protect critical infrastructure and sensitive governmental data.
7 months ago
Kill Chain
Dark Web Drug Kingpin Sentenced: The Fall of Incognito Market
In February 2026, Rui-Siang Lin, a 24-year-old Taiwanese national, was sentenced to 30 years in U.S. federal prison for operating 'Incognito Market,' a dark web platform that facilitated over $105 million in illegal drug transactions from October 2020 to March 2024. Lin, known online as 'Pharoah,' managed the marketplace's operations, overseeing more than 1,800 vendors and 400,000 customer accounts. The platform processed over 640,000 transactions involving substantial quantities of narcotics, including cocaine, methamphetamine, and fentanyl-laced pills, which were linked to at least one fatal overdose. ([yahoo.com](https://www.yahoo.com/news/articles/incognito-market-founder-rui-siang-150954026.html?utm_source=openai)) This case underscores the persistent threat posed by dark web marketplaces in the global drug trade. Despite law enforcement's efforts to dismantle such platforms, their sophisticated use of anonymizing technologies and cryptocurrencies continues to challenge regulatory and enforcement agencies worldwide. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/04/incognito-dark-web-drug-market-operator-prison-sentence/?utm_source=openai))
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports