FlagThis — Daily Cybersecurity Intelligence Briefing

A coordinated multinational operation disrupted the Sality peer-to-peer botnet, active for over 23 years, by mapping its P2P overlay, identifying bootstrap nodes, and deploying sinkhole servers that injected benign peer responses into the protocol. The sinkholes redirected infected peers away from criminal C2, blocking >2 million malware download attempts and reducing active peers from ~1.5 M to <100 k. Law enforcement seized 12 C2 servers, arrested three operators, and coordinated >30 jurisdictions via Europol EC3 and the U.S. DOJ.

In October 2026, the FBI arrested Edward Dubrovsky, co-founder of the cybersecurity firm Cypfer, for allegedly facilitating extortion activities on behalf of the ShinyHunters hacking collective. Following a breach of FBI IT systems—achieved via custom phishing kits and credential-stealing malware—the attackers utilized Cobalt Strike beacons for lateral movement to exfiltrate 3,000 to 5,000 FBI employee records. Investigators allege Dubrovsky leveraged Cypfer’s specialized negotiation portal to process ransom payments, which were subsequently traced through blockchain transactions to wallets linked to his firm. This case underscores the critical risk of professional cybersecurity services being subverted to assist ransomware-driven extortion efforts.

In March 2024, the FBI added Aníbal Canelon Aguirre, alleged lead developer of the Ploutus ATM malware family (variants Ploutus.D and Ploutus.E), to its Top 10 Most Wanted Fugitives list; he was apprehended in Nebraska and charged with facilitating a transnational jackpotting campaign linked to the Venezuelan Tren de Aragua gang. Ploutus malware forces ATMs to dispense cash via USB or network‑based delivery, interacting with XFS/CEN/XFS middleware to issue cash‑dispense commands, employing obfuscation, packing, encryption, and a C2 infrastructure for remote activation. The arrest disrupted a key node of the Tren de Aragua cybercrime network and halted ongoing Ploutus‑based jackpotting operations targeting ATMs across the United States and Latin America.

The 2026 Microsoft Digital Defense Report details a fundamental shift in the cyber threat landscape as generative AI and Large Language Models (LLMs) accelerate offensive operations. Threat actors are leveraging LLM-driven static analysis for automated zero-day discovery, utilizing automated mutation engines for polymorphic malware generation, and deploying AI-orchestrated credential stuffing bots capable of bypassing adaptive MFA. This weaponization has compressed the average exploit window from 4.2 days to just 8.3 hours. The report emphasizes that the compression of attack timelines necessitates an immediate transition toward AI-driven detection, automated response via SOAR, and identity-centric Zero Trust architectures to mitigate the increasing volume of automated, high-velocity intrusions.

The Lunex Malware-as-a-Service (MaaS) platform is deploying the Psychedelic Stealer by exploiting CVE-2025-54517 in the legitimate AMD driver amdhdl64.sys. This campaign utilizes a Bring Your Own Vulnerable Driver (BYOVD) technique to achieve unsigned kernel-mode code execution, allowing attackers to disable EDR sensors within approximately two minutes of infection. Following defense neutralization, the stealer harvests browser credentials, session cookies, and autofill data from Chrome, Edge, and Firefox. Targeting Ukrainian-speaking users via fake CAPTCHA/ClickFix social engineering prompts, the campaign has impacted approximately 12,000 endpoints, resulting in significant credential theft and an estimated $3.2M in financial losses.

Operation Jackal IV, a coordinated international law enforcement initiative led by INTERPOL, successfully disrupted the globalized criminal infrastructure of West African organized crime syndicates, specifically targeting the Black Axe group. Spanning 22 countries across six continents, the eight-month operation (November 2025 – June 2026) focused on dismantling sophisticated "Crime-as-a-Service" (CaaS) models. These models facilitate large-scale fraud, sextortion, and money laundering via complex digital and physical financial networks. The operation resulted in 58 arrests, identification of 263 suspects, and the seizure of millions in illicit assets, effectively degrading the high-tech, infrastructure-heavy capabilities used to exploit global financial systems.