December Cybersecurity Roundup: Major Arrests, Seizures and Threat Campaigns
Summary
A roundup of December cybersecurity news covers international cybercrime operations, the seizure of the Rydox marketplace, cryptocurrency theft attributed to North Korean hackers, attacks on Romanian election systems, and HiatusRAT activity.
Key points
- INTERPOL-led Operation Serengeti resulted in 1,006 arrests and the takedown of 134,089 malicious infrastructures and networks across 19 African countries.
- The DOJ announced the seizure of the Rydox marketplace and the arrest of three administrators; authorities also seized cryptocurrency worth $225,000.
- INTERPOL said Operation HAECHI V led to more than 5,500 arrests and the seizure of over $400 million in assets across 40 countries.
- Microsoft analysts reported that North Korean actor Sapphire Sleet stole more than $10 million in cryptocurrency over six months.
- The U.S. Treasury sanctioned Sichuan Silence over its alleged role in firewall attacks linked to ransomware incidents, including attacks on U.S. critical infrastructure.
- Romanian intelligence agencies reported more than 85,000 cyberattacks targeting election infrastructure and an influence operation involving TikTok accounts.
- The FBI warned that HiatusRAT actors targeted Chinese-branded web cameras and DVRs, including devices awaiting security patches.
Article Details
- Event Type
- Cybersecurity news roundup covering law-enforcement operations, marketplace seizures, cyberattacks, ransomware targeting, and influence campaigns.
- Impact
- Reported actions included 1,006 arrests and 134,089 malicious infrastructures and networks taken down in Operation Serengeti; more than 5,500 arrests and over $400 million seized in Operation HAECHI V; the seizure of the Rydox marketplace; and over $10 million in cryptocurrency stolen by Sapphire Sleet. Other reports described ransomware attacks against firewall-targeting victims, more than 85,000 attacks on Romania’s election infrastructure, and HiatusRAT activity targeting web cameras and DVRs.
People
Threat Actors
APT38Name explicitly identified in the article as another tracking name for Sapphire Sleet, which it reports engaged in cryptocurrency theft and computer network exploitation.BlueNoroffName explicitly identified in the article as another tracking name for Sapphire Sleet, which it reports engaged in cryptocurrency theft and computer network exploitation.CageyChameleonName explicitly identified in the article as another tracking name for Sapphire Sleet, which it reports engaged in cryptocurrency theft and computer network exploitation.Sapphire SleetNorth Korean threat actor reported to have stolen over $10 million in cryptocurrency; the article says it is also tracked as APT38, BlueNoroff, CageyChameleon, and CryptoCore.
Malware
Products
Countries
AlbaniaTwo of the administrators were arrested in Kosovo while the third was arrested in Albania.Kosovoother tools for carrying out cybercrime and fraud.” The press release also revealed the arrest of three Kosovo nations for serving as Rydox’s administrators.Romania6. Romania’s election systems targeted in over 85,000 cyberattacks – Bleeping ComputerRussiaOn December 4, Romania’s top security council declassified reports from its intelligence agencies which revealed an extensive influence operation carried out by Russia against the Romanian presidential election.Ukrainesupporting Călin Georgescu, a far-right candidate who has “vowed to end all Romanian aid to neighboring Ukraine.” Read full article.United StatesThe campaign—dubbed “Operation Undercut”—was executed by the Social Design Agency (SDA), which the United States sanctioned in March, 2024, for “providing services to the government of Russia in connection with a