Related Threat Clusters
-
CISA Alerts on Critical Flaws in SimpleHelp, Samsung MagicINFO, and D-Link Devices
On April 24, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The affected products include SimpleHelp remote management software, Samsung MagicINFO 9 Server, and…
3 articles · Updated April 26, 2026 -
Teen Hacker Extradited for Role in Scattered Spider Cybercrime Group
Peter Stokes, a 19-year-old dual citizen of the U.S. and Estonia, was extradited from Finland to the U.S. to face charges related to his involvement in the Scattered Spider hacking group. The group has been linked to…
37 articles · Updated July 1, 2026 -
DragonForce Ransomware Exploits Microsoft Teams for Covert C2 Communications
The DragonForce ransomware group has been observed using a custom malware, Backdoor.Turn, to conceal command-and-control (C&C) traffic within Microsoft Teams' relay infrastructure. This sophisticated technique allows…
13 articles · Updated June 16, 2026 -
Scattered Spider Reclassified as Decentralized Cybercrime Collective
Scattered Spider, a cybercrime entity linked to various high-profile attacks since 2022, has been reclassified as a decentralized collective rather than a unified group. Group-IB's analysis indicates that it consists of…
2 articles · Updated July 7, 2026 -
Aflac Japan Data Breach Affects 4.38 Million Customers
Aflac Japan disclosed a data breach affecting 4.38 million customers after unauthorized access to its systems between June 15 and June 25, 2026. The breach was detected on June 25, prompting the suspension of certain…
18 articles · Updated June 30, 2026 -
Payroll Pirate Campaign Targets Payroll Systems Using AiTM Session Hijacking
The 'Payroll Pirate' campaign has emerged, utilizing advanced phishing and AiTM session hijacking to bypass MFA and reroute payroll disbursements. Targeting mid-market and enterprise organizations, attackers exploit…
2 articles · Updated June 15, 2026 -
Gelatissimo Faces Data Breach from Ransomware Group Dragonforce
Gelatissimo, an Australian gelato franchiser, is under threat from the ransomware group Dragonforce, which claims to have stolen 352.42 gigabytes of sensitive employee data. The hackers have provided sample screenshots…
2 articles · Updated April 28, 2026 -
Pay Tel Communications Exposes Sensitive Inmate Data in Major Security Breach
On May 4, 2026, UpGuard researchers found a publicly exposed Azure storage bucket belonging to Pay Tel Communications, revealing 3.4 million documents, including 300,000 driver’s licenses and sensitive inmate…
4 articles · Updated May 28, 2026 -
A.S.A.P. Restoration Corp. Faces DragonForce Ransomware Attack
A.S.A.P. Restoration Corp. has been targeted by a ransomware attack attributed to DragonForce. The attack has led to unauthorized access to sensitive information and potential data leaks affecting the company. This…
1 article · Updated December 11, 2025 -
Váhostav Hit by DragonForce Ransomware Attack
Váhostav has been targeted by a ransomware attack attributed to DragonForce, leading to unauthorized access to sensitive databases and email breaches. The attack is part of a broader trend of cyber incidents affecting…
1 article · Updated December 22, 2025
Recent Intelligence Reports
- TrendAI™ 2026 Cyber Risk Report - Security Roundup — Trendmicro · July 9, 2026
- TrendAI™ 2026 Cyber Risk Report | Trend Micro (GB) — Trendmicro · July 8, 2026
- Connecting Scattered Spider — www.group-ib.com · July 8, 2026
- TrendAI™ 2026 Cyber Risk Report - Security Roundup — Trendmicro · July 8, 2026
- TrendAI™ 2026 Cyber Risk Report| Trend Micro (ES) — Trendmicro · July 8, 2026
- TrendAI™ 2026 Cyber Risk Report | Trend Micro (IT) — Trendmicro · July 8, 2026
- Alleged Scattered Spider hacker extradited to the United States — Bleepingcomputer · July 2, 2026
- Alleged Scattered Spider Member Arrested in Finland, Extradited to U.S. — Thecyberexpress · July 2, 2026