Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for the Eastern District of New York announced it in a press release, and it also says an $11 million reward remains for a co-conspirator who’s still at large. “Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.” reads the DoJ’s press release. “The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers. “ In December, Artem Aleksandrovych Stryzhak pleaded guilty in the U.S. for Nefilim ransomware attacks. The Ukrainian citizen was arrested in Spain in 2024 and extradited to the US in April 2025. He pleaded guilty to conspiracy to commit computer fraud, extortion, and related activity Nefilim ransomware was used to encrypt networks worldwide, including in the Eastern District of New York, causing millions in losses from ransom payments and system damage. Attackers employed a customized ransomware executable in each attack, generating unique decryption keys and tailored ransom notes for victims. In June 2021, Nefilim administrators granted Artem Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds, which he deployed via his account on the administrators’ online platform. Stryzhak and co-conspirators researched victims using online databases to collect information on their net worth, size, and contacts. After gaining network access, they stole data to pressure companies into ransom payments. Nefilim notes warned that stolen data would be posted on publicly accessible “Corporate Leaks” sites maintained by the administrators if victims did not comply. Volodymyr Tymoshchuk, Stryzhak’s co-defendant and Nefilim admin, is a serial ransomware cybercriminal who is still at large. According to court documents, his first role was with Nefilim. Starting around June 2021, he joined the ongoing Nefilim conspiracy as an affiliate and got access to the ransomware. In exchange, he agreed with one of the group’s administrators, Volodymyr Tymoshchuk, to pay the administrators 20 percent of the ransom proceeds. Even crime has licensing fees. One of those attacks came in June 2021, when Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that went into a ransom note sent to the victim. He kept deploying Nefilim ransomware through at least October 2021. Separately, he also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive’s conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. The attacks caused major disruption to daily operations around the world and affected responses to the COVID-19 pandemic. One hospital had to give up digital technology to treat its patients and couldn’t take in new ones right after the attack. As a Hive affiliate, Stryzhak and his co-conspirators hit seven victims, including law firms, a dentist’s office and a healthcare provider, during the pandemic. Those victims couldn’t get to their encrypted data. The FBI, as part of a months-long effort to disrupt Hive, gave a decryption key to one of Stryzhak’s victims, so that victim recovered its data without paying a ransom. U.S. Attorney Joseph Nocella, Jr. thanked the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and its Computer Crime and Intellectual Property Section, and Spanish law enforcement for helping to capture him. “Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.” The State Department’s Transnational Organized Crime Rewards Program is offering up to $11 million for information that leads to the arrest, conviction or location of Tymoshchuk. Anyone with information can call the FBI at +1-917-242-1407 or email TymoTips@fbi.gov, contact a local field office if in the United States, or reach the nearest U.S. Embassy if overseas. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. The goal is to surface useful information to the wider internet community instead of keeping it buried in Discord conversations. “Discussions in Discoverable Servers will soon be easier to find when you search the web, so you can find the answer you’re looking for and step straight into the conversation on Discord,” the messaging platform explains. The changes apply only to Discoverable Servers, publicly listed communities with at least 1,000 members. The platform says it hosts approximately 63,000 such servers. This decision excludes private servers, direct messages between users, and group announcements on servers that don’t meet the requirements.
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information. A Sony Group Corporation subsidiary, the company provides telecommunications and technology services, acting as an internet service provider (ISP) in Japan. The breach occurred on October 19 and was detected four days later, when the company shut down the compromised servers and blocked external communication. In an announcement yesterday, the company said that its So-net member database, supporting its internet access service, was accessed by an unauthorized party. The investigation confirmed that a total of 2,585,481 customer records had been exposed, including the following types of information: No banking, payment card, or other account details were exposed.
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously. Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts. Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods. "Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter, speaking to Reuters. Raphael Satter reported it on October 27 in a Reuters story, and the claims rest on sources, not on a published attribution. “Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.” Reuters states. TrendAI concluded that the company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink. They believe the ads were likely used to geolocate users or otherwise surveil them. “TrendAI Research observed large-scale use of advertising infrastructure for geolocation tracking, advertising technology surveillance, and intelligence gathering. Data from these activities is valuable for precise targeting of key individuals in sensitive locations, including active conflict zones.” reads the report published TrendAI. “SHADOW-EARTH-79 is also the number one bidder in 105 individual countries in Starlink traffic that we observed. It accounts for approximately 13% of all winning bid events in Starlink traffic, five times higher than average (approximately 3%) bids for other bidders, and the highest of any high-volume buyer. Starlink is widely used in conflict zones where terrestrial networks are degraded.” SpaceX didn’t respond to requests for comment, and Discover-Tech and its chief executive didn’t respond over the past two weeks. Starlink users make attractive targets. Governments around the world are trying to get a grip on satellite internet terminals, which route data through SpaceX satellites and not through nationally regulated telecom firms. That lets them sidestep local internet restrictions, work in hostile areas or coordinate action across battlefields. Ukraine’s military relies on Starlink for frontline communications and for directing drone strikes. The findings come from advertising data collected by TrendAI. The data shows that Discover-Tech became one of the biggest bidders for ads shown to Starlink users worldwide. It was the top bidder in more than 100 countries, including several where Starlink is banned or restricted. Advertisers bid in online auctions to buy space for ads in browsers and apps. “In Starlink IP space traffic that we observed, SHADOW-EARTH-79 is the second-largest winning bidder by raw volume. However, examining the statistics and saturation of the group’s ad impression buying strategy reveals an obvious skew towards buying ad impressions on Starlink addresses, compared with its overall footprint.” continues the report. TrendAI published its report on October 15 but didn’t name Discover-Tech. Instead, it identified “an ad tech entity” called Shadow-Earth-79. Six sources say that’s TrendAI’s codename for Discover-Tech. TrendAI didn’t directly explain why it left out the company’s name. It said its naming policy helps prevent mistakes and avoids labels that could confuse security teams, lead them to focus on the wrong risks or prompt the wrong response. Starlink users are valuable targets for surveillance. Governments want more control over satellite internet services, which send data through SpaceX satellites rather than local telecom networks. Starlink lets users get around local internet restrictions, stay connected in dangerous areas and communicate on the battlefield. Ukraine’s military uses Starlink for frontline communications and to help direct drone strikes. Finding ways to track Starlink users has turned into a cottage industry. In May, the Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track them. Haaretz said exploiting ad data appeared to play a key role. On the same day as TrendAI’s report, the Canadian cyber watchdog Citizen Lab and the New York ad tech firm Confiant named Discover-Tech. Both said it abused the ad bidding process, which can leak data about internet users back to the bidder. Over time, a bidder can collect that data, collate it and merge it with other information to de-anonymize users and follow them around the web. In some cases it can also set them up for targeting with surveillance software. Citizen Lab and Confiant said the ads appeared inside dozens of sensitive networks belonging to media organizations, governments and tech firms. Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. At least one big US tech company and one international organization recently started internal inquiries into whether Discover-Tech’s ads targeted their employees, according to one of the six people and a seventh person familiar with the matter. TrendAI’s report pointed to suspicious bidding patterns that suggested “targeting and tracking infrastructure” and not a commercial advertising operation. “Overall, the design of this “customer-facing” front-end makes us believe that the system is more likely designed as a “surveillance” and “intelligence gathering” platform, rather than simply a platform for advertisement management.” the report concludes. “The collected evidence indicates with moderate-to-high confidence that SHADOW-EARTH-79’s advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation. The anomalous bidding behavior, heavy dominance in sanctioned and conflict states, and pronounced over-bidding for Starlink address space establish intent to reach specific audiences in sensitive geographies.” It noted an obvious skew toward Starlink-aimed ads. It also found that Shadow-Earth-79 was the top ad buyer in Syria, Libya, Yemen and South Sudan, and the second biggest in Afghanistan. Few Western brands are chasing shoppers in Libya at the moment, and the report says demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. The entity also won an implausibly dominant share of bids in several other countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela. The researchers were convinced Discover-Tech was behind it and discussed naming it in the report, according to the six sources. They dropped the idea after TrendAI executives raised legal concerns, five of those sources said. It wouldn’t be the first time. Earlier this year, Reuters reported that Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident Beijing was behind the hacking. Reuters said the report was watered down over fears that naming China would cause problems for Palo Alto’s operations there, which were already under scrutiny after a Beijing directive told domestic companies not to use its products. Palo Alto said the lack of attribution had nothing to do with China’s procurement rules and called any suggestion otherwise speculative and false. Executives fear that exposing surveillance operations could draw retribution, and industry experts tell Reuters the sector has a habit of staying quiet. “Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.” Reuters concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Starlink)
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. Discovered in a core component of EBS's Application Object Library and tracked as CVE-2026-101767, this flaw lets unauthenticated threat actors with HTTP network access take over vulnerable systems in low-complexity attacks. Oracle released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20 and urged customers to patch their systems immediately. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches," it said. "Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the firmware that boots most of the world’s servers is now public, and the patch details came out months early. The bug affects TianoCore EDK II, an open-source project used by hardware manufacturers and cloud providers to build UEFI firmware. UEFI is the software that starts a computer before the operating system loads. EDK II is widely used across the industry, including by major UEFI vendors such as AMI, Insyde and Phoenix. Even Microsoft’s more secure version, Project Mu, used the vulnerable component. “EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.” reads the advisory. The flaw can corrupt memory in a component that handles ICMP messages, which devices use to report network errors. Attackers could exploit it to run code before the operating system starts and before security protections such as Secure Boot are fully active. Secure Boot checks that the software loaded during startup can be trusted, while the Trusted Platform Module (TPM) supports security functions such as hardware-based trust. Although the attacker’s code does not remain active after execution, it could help attackers install other malicious components that run early in the boot process. The flaw is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe). That driver lets servers, storage gear and other devices boot from code downloaded over a local network. While it does that, it listens for ICMP errors, and it never enforces the 504-byte limit on how much it copies. “While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component.” states the advisory. A malicious insider, or a hacker with low-level access to the local network, can send an error message that spills code past the limit and corrupts the UEFI module running on the CPU. The advisory is more precise. The driver keeps a receive request open for ICMP errors and copies each message into a fixed 504-byte field called Mode.IcmpError. In both the IPv4 and IPv6 handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle) the bounds handling is wrong: a longer message still gets copied, and the destination pointer moves by the cumulative length and not the per-fragment length. So an oversized message writes attacker-controlled bytes past the field, and nothing earlier on the receive path limits its size. The attack is simple. The attacker sends a direct message to the target’s IP address during the PXE boot process, even from a remote network. Sending invalid data can stop the boot process and cause a denial of service. If the attacker knows the target’s firmware version, they can create a fake event to run their own code at ring 0, the CPU’s highest privilege level. This also bypasses attestation, which uses cryptographic checks to prove that the hardware is trustworthy. As a result, the attack can help an attacker turn limited access into full control. The attacker needs some control over the local network. This could be an insider or an external attacker who already has a foothold in the target network and is seeking to gain higher privileges. So far, there’s no evidence that this flaw can be exploited to gain initial access to a network from the outside. The flaw affects some systems that start up over a network using EDK2-based firmware with PXE enabled. Home and small-office users, and anyone who boots only from a disk drive, aren’t affected. Researchers planned to disclose the bug in January, but AMI published a fix last month, revealing details of the flaw. TianoCore then issued a public warning. Attackers can now study the fix to develop exploits, while updating firmware across many devices could take a long time. It’s still unclear which devices are affected. Intel and Arm say their own products aren’t directly affected, but manufacturers may add vulnerable code. Several other companies hadn’t answered questions when the article was published. Organizations should contact their system or firmware supplier and disable network boot where possible. They should also monitor logs for suspicious activity. TPM and Secure Boot remain useful protections, but they don’t stop this attack. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-97631)
Confirm this action.
Leaving now will discard your changes.