Cybersecurity Roundup: DDoS Service Takedowns, Malware Campaigns and Major Arrests
Summary
A roundup covers FBI impersonation scams, DDoS-for-hire takedowns, malware campaigns, ransomware activity and international law-enforcement actions, including arrests and seizures.
Key points
- The FBI reported more than 100 reports of scammers impersonating IC3 employees to offer victims help recovering lost funds, from December 2023 through February 2025.
- Polish authorities arrested four suspects allegedly linked to six DDoS-for-hire platforms; the United States also seized nine domains associated with booster services.
- Researchers reported IronHusky targeting Russian and Mongolian government entities with an upgraded MysterySnail remote access trojan.
- Fake AI video-generator sites reportedly tricked users into downloading a ZIP archive that installs the Noodlophile infostealer.
- Europol-coordinated Operation RapTor resulted in 270 arrests of dark web vendors and buyers across ten countries.
- Sophos reported more than 55 attempted email-bombing and impersonated-IT-support attacks between November 2024 and January 2025; one tracked incident involved a 3AM ransomware affiliate.
- Authorities announced charges against a Yemeni national over alleged Black Kingdom ransomware attacks on roughly 1,500 computers, and Germany seized crypto and data in its eXch exchange takedown.
Article Details
- Event Type
- A roundup of cybersecurity news covering law-enforcement actions, fraud, ransomware, and malware campaigns.
- Impact
- Reported events include arrests and seizures targeting DDoS-for-hire services, dark-web marketplaces, and an alleged cryptocurrency-laundering platform; scams impersonating FBI IC3 employees; and malware and ransomware attacks affecting government entities and organizations. The article reports more than 100 IC3 impersonation scam reports, 270 arrests in Operation RapTor, and alleged Black Kingdom ransomware deployment on roughly 1,500 computers. It also describes distribution of the Noodlophile infostealer through fake AI video-generator sites and an upgraded MysterySnail RAT used in attacks targeting Russian and Mongolian government entities.
Threat Actors
Malware
3am6. 3AM ransomware uses spoofed IT calls, email bombing to breach networks – Bleeping ComputerBlack Kingdom7. U.S. Charges Yemeni Hacker Behind Black Kingdom Ransomware Targeting 1,500 Systems – The Hacker NewsMysterySnailthreat group that has been active since at least 2017, is using an upgraded version of MysterySnail remote access trojan (RAT) malware. Researchers identified the updated RAT “while investigating recentNoodlophile4. Fake AI video generators drop new Noodlophile infostealer malware – Bleeping Computer
Vendors
KasperskyResearchers at Kaspersky’s Global Research and Analysis Team have observed IronHusky hackers targeting Russian and Mongolian government entities. IronHusky, a Chinese-speaking threat group that has been active since atMorphisecResearchers at Morphisec have observed threat actors distributing malware via fake AI-powered video generators.SophosIn a May 20 report, Sophos researchers outlined two distinct threat clusters using “’email bombing’ to overload a targeted organization’s employee with unwanted emails, and then […] posing as a tech support team member
Products
Countries
Germany8. Germany Shuts Down eXch Over $1.9B Laundering, Seizes €34M in Crypto and 8TB of Data – The Hacker NewsUnited StatesFurthermore, as part of the operation the United States also seized nine domains associated with booster services.Yemencomputer.” According to the press release, the individual is currently believed to be residing in Yemen.