Cybersecurity Roundup: KidFlix Takedown, Phishing Campaigns and 4chan Hack Claims
Summary
A cybersecurity news roundup covers the KidFlix takedown, phishing and malware campaigns, a claimed hack of 4chan, FBI warnings about impersonation scams, and arrests tied to a cryptocurrency investment scam.
Key points
- German and Dutch authorities took down the KidFlix child sexual abuse material platform in an international operation announced by Europol.
- Cisco Talos reported that Gamaredon used troop-related phishing lures and malicious LNK files to deploy Remcos RAT against entities in Ukraine.
- The PoisonSeed campaign reportedly compromised corporate email marketing accounts to send messages containing crypto wallet seed phrases.
- 4chan went offline after a suspected hack; users of Soyjak.party claimed responsibility and leaked screenshots and alleged staff email addresses.
- Check Point identified an APT29 phishing campaign using diplomatic-event invitations to target European diplomatic entities with GRAPELOADER and a WINELOADER variant.
- The FBI warned that scammers were impersonating IC3 employees to offer help recovering lost funds, citing more than 100 reports from December 2023 to February 2025.
- Spanish authorities arrested six people in a cryptocurrency investment scam case involving 208 victims and €19 million in reported losses.
Article Details
- Event Type
- A roundup of reported cybersecurity incidents and threat campaigns, including law-enforcement takedowns, phishing and fraud schemes, a platform breach, and malware campaigns.
- Impact
- Reported impacts include child sexual abuse material platform disruption; phishing and malware targeting Ukrainian entities, European diplomats, and Linux systems; compromised email marketing accounts used to distribute cryptocurrency seed phrases; a hack of 4chan with alleged exposure of administrator information and potential access to user locations and IP addresses; impersonation and investment fraud; and cryptocurrency losses affecting victims.
Threat Actors
Cozy BearName the source gives for APT29.GamaredonRussian hacking group believed to be behind a phishing campaign targeting entities in Ukraine.ICE RELICRussian state-sponsored threat actor reported to be carrying out a phishing campaign targeting diplomatic entities across Europe; also identified by the source as Midnight Blizzard and Cozy Bear.Midnight BlizzardName the source gives for APT29.UNC5174Chinese state-sponsored threat actor reported to have used VShell and C2 infrastructure to infect Linux systems; also identified by the source as Uteus.
Malware
GRAPELOADER5. APT29 Deploys GRAPELOADER Malware Targeting European Diplomats Through Wine-Tasting Lures – The Hacker NewsRemcos RAT2. Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine – The Hacker NewsSNOWLIGHT8. Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool – The Hacker NewsWINELOADERThe newly identified campaign utilizes a new variant of WINELOADER and a new malware loader codenamed GRAPELOADER.
Products
4chan4. Infamous message board 4chan taken down following major hack – Bleeping ComputerHubSpothave included Coinbase and Ledger, while the targeted bulk email providers include Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho.Linux8. Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool – The Hacker NewsMailChimpcrypto companies have included Coinbase and Ledger, while the targeted bulk email providers include Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho.MailgunCoinbase and Ledger, while the targeted bulk email providers include Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho.SendGridcompanies have included Coinbase and Ledger, while the targeted bulk email providers include Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho.Zohoand Ledger, while the targeted bulk email providers include Mailchimp, SendGrid, Hubspot, Mailgun, and Zoho.
Tools
Countries
GermanyAs noted in the report, “The PowerShell downloader contacts geo-fenced servers located in Russia and Germany to download the second stage Zip file containing the Remcos backdoor.” Article here.Russia2. Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine – The Hacker NewsSpainIn an April 7 press release, Spain’s Policía Nacional announced the arrest of six individuals affiliated with a criminal organization behind a large-scale cryptocurrency investment scam that defrauded 19 million EurosUkraine2. Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine – The Hacker News