June Cybersecurity Roundup: Arrests, Threat Campaigns and a Ukraine Wiper Attack
Summary
A June roundup covers international arrests and marketplace seizures, campaigns attributed to FIN6 and a suspected Russian actor, PathWiper’s attack on Ukrainian critical infrastructure, and a U.S. ransomware case.
Key points
- INTERPOL announced 20 arrests in an international investigation into the production and distribution of child sexual abuse material.
- Europol announced the disruption of darknet marketplace Archetyp Market and the arrest of its suspected administrator; authorities also seized domains and cryptocurrency associated with the BidenCash marketplace.
- Researchers reported FIN6 social engineering recruiters to deliver the JavaScript backdoor more_eggs, which can enable credential theft and follow-on attacks.
- Google Threat Intelligence Group observed a suspected Russian state-sponsored actor using rapport-building and tailored lures to obtain victims’ application-specific password passcodes and access their email.
- Cisco Talos researchers reported PathWiper targeting a Ukrainian critical infrastructure entity, with deployment through a legitimate endpoint administration framework; they assessed with high confidence that a Russia-nexus APT actor was responsible.
- Google Threat Intelligence Group said it was aware of multiple breaches affecting U.S. insurance companies that bore hallmarks of Scattered Spider activity.
- An Iranian national pleaded guilty to participating in ransomware attacks; the U.S. DOJ said an attack on Baltimore caused more than $19 million in damage and service disruption.
Article Details
- Event Type
- June threat-intelligence roundup covering law-enforcement actions against illicit marketplaces and CSAM distribution, plus reported cybercrime, espionage, and destructive malware activity.
- Impact
- Reported incidents included PathWiper disrupting a critical-infrastructure entity in Ukraine; a Robinhood ransomware attack that caused Baltimore more than $19 million in damage and service disruption; and campaigns involving credential theft, backdoors, and breaches targeting recruiters, academics, and U.S. insurance companies. Law-enforcement operations resulted in arrests and the seizure or disruption of Archetyp Market and BidenCash.
People
Threat Actors
FIN6Hacking group reported to target recruiters with social-engineering campaigns and deliver the more eggs backdoor; the source says it is also known as Skeleton Spider.Scattered SpiderThreat activity was associated with breaches of U.S. insurance companies; the group was also reported to have targeted retail organizations in the U.K. and U.S.
Malware
more eggsIts most recent campaigns have been used to deliver the JavaScript-based backdoor “more eggs,” which “facilitates credential theft, system access, and follow-on attacks, including ransomware deployment.” Read more here.PathWiper5. New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack – The Hacker NewsRobinhoodAn Iranian national pled guilty to participating in a ransomware attack using the Robinhood variant between 2019 and 2024.
Countries
UkraineResearchers at Cisco Talos have observed a newly identified data wiper malware dubbed “PathWiper” targeting a critical infrastructure entity in Ukraine.United Kingdominsurance industry breaches, Scattered Spider was observed targeting retail organizations in both the U.K.United StatesResearchers at Google Threat Intelligence Group (GTIG) have observed a suspected Russian state-sponsored threat actor impersonating U.S.