March Cybersecurity Roundup: LockBit’s FBI Claim, DDoS Outages and Botnet Growth
Summary
A March roundup covers LockBit’s unverified FBI data claim, cybercrime arrests, DDoS outages at X, phishing targeting Ukraine, a railway service disruption, and large Android botnets.
Key points
- LockBit claimed on its leak site to have stolen classified FBI information; the article provides no confirmation of the claim.
- INTERPOL reported 306 arrests and 1,842 devices seized in Operation Red Card, targeting scams across seven African countries.
- Dark Storm claimed DDoS attacks on X during worldwide outages that affected tens of thousands of users.
- CERT-UA warned that attackers used compromised Signal accounts to target Ukrainian defense-industry employees and military members with malware.
- Europol announced 25 arrests in an international operation targeting distribution of AI-generated child sexual abuse material.
- A cyberattack disrupted Ukraine’s railway ticketing services, but railway operations were not affected.
- Researchers reported Vo1d infecting nearly 1.6 million Android TV devices and BADBOX 2.0 affecting more than 1 million devices.
Article Details
- Event Type
- March 2025 cybersecurity and law-enforcement roundup covering ransomware claims, arrests, DDoS attacks, phishing and malware activity, service disruption, and botnet infections.
- Impact
- Reported effects included outages affecting tens of thousands of X users; disrupted online ticket sales and passenger delays at Ukrzaliznytsia, without reported impact on railway operations; malware targeting Ukrainian defense personnel; and large-scale Vo1d and BADBOX 2.0 infections. Law-enforcement operations reported arrests, device seizures, and investigations involving cybercrime and AI-generated CSAM distribution. LockBit's claim that it stole classified FBI data is an allegation in the article, not a confirmed breach.
MITRE ATT&CK
People
Threat Actors
Dark StormHacktivist group that claimed responsibility for DDoS attacks associated with X outages.Lemon GroupIdentified as one of four threat actor groups associated with the BADBOX 2.0 operation.LockBitRansomware gang that claimed it had stolen data from the FBI; the article reports this as a claim.MoYu GroupIdentified as one of four threat actor groups associated with the BADBOX 2.0 operation.SalesTracker GroupIdentified as one of four threat actor groups associated with the BADBOX 2.0 operation.
Malware
Badbox 2.08. BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse – The Hacker NewsDark Crystal RATThe phishing messages contained a PDF and an executable file classified as the DarkTortilla cryptor, “which, when launched, decrypts and executes the remote access trojan Dark Crystal RAT (DCRAT).DarkTortillaThe phishing messages contained a PDF and an executable file classified as the DarkTortilla cryptor, “which, when launched, decrypts and executes the remote access trojan Dark Crystal RAT (DCRAT).Vo1d7. Vo1d Botnet’s Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries – The Hacker News
Products
Android TVAccording to researchers at Xlab, nearly 1.6 million Android TV devices have been infected with a new and improved variant of the Vo1d malware botnet.Signal4. Ukrainian military targeted in new Signal spear-phishing attacksX3. X hit by ‘massive cyberattack’ amid Dark Storm’s DDoS claims – Bleeping Computer
Countries
Beninwhich aims to “disrupt and dismantle cross-border criminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.Brazil226 countries have been targeted in the campaign, with Brazil, South Africa, and Indonesia accounting for the largest number of infections (24.97%, 13.6%, and 10.54% respectively).Côte d’Ivoireto “disrupt and dismantle cross-border criminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.Indonesia226 countries have been targeted in the campaign, with Brazil, South Africa, and Indonesia accounting for the largest number of infections (24.97%, 13.6%, and 10.54% respectively).Nigeriaand dismantle cross-border criminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.Rwandadismantle cross-border criminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.South Africacriminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.Togocriminal networks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.UkraineIn a March 18 bulletin, Ukraine’s Computer Emergency Response Team (CERT-UA) warned of numerous cases of targeted cyberattacks against employees within Ukraine’s defense industry and members of the Armed Forces ofZambianetworks.” The arrests were carried out in Benin, Côte d’Ivoire, Nigeria, Rwanda, South Africa, Togo, and Zambia.
Industries
DefenseTeam (CERT-UA) warned of numerous cases of targeted cyberattacks against employees within Ukraine’s defense industry and members of the Armed Forces of Ukraine (AFU).Law enforcementby artificial intelligence.” The global operation—dubbed “Operation Cumberland”—was led by Danish law enforcement and involved authorities from 19 countries.