December Threat Intelligence Roundup Covers Ransomware Disruption, Kyivstar Attack and Arrests
Summary
A December roundup highlights Russia-linked disinformation, the FBI’s disruption of ALPHV, the Kyivstar outage, law-enforcement arrests and marketplace seizures, and an unverified release of 1.9 million credit cards.
Key points
- The FBI seized ALPHV’s leak site and reportedly accessed servers and decryption keys; the group later claimed the site had been unseized, and it was showing as seized again at publication.
- A December 12 cyberattack took most Kyivstar phone and internet services offline, affecting millions of users and some air-raid alerts and financial operations. The company linked the incident to the Ukraine-Russia war but provided no evidence for that claim.
- The roundup describes a new wave of Russia-linked Operation Doppelganger disinformation targeting Ukraine, the United States, and Germany.
- Vladimir Dunaev pleaded guilty to developing Trickbot; the roundup says he was due to be sentenced in 2024.
- German authorities seized the Kingdom Market dark-web marketplace, while Spanish police arrested a Venezuelan national described as a possible Kelvin Security leader.
- Austal USA confirmed a cyberattack after Hunters International claimed responsibility. Separately, BidenCash reportedly released 1.9 million credit cards, whose validity was unconfirmed.
Article Details
- Event Type
- December threat-intelligence roundup covering cybercrime marketplace and ransomware disruptions, a telecom cyberattack, data exposure, and disinformation activity.
- Impact
- Kyivstar’s December 12 cyberattack disrupted phone and internet services for users in Ukraine and also affected the air-raid alert system and some financial-sector operations. Initial reports cited 25 million mobile users and more than 1 million home internet users as affected; Kyivstar said it would compensate users. The FBI disrupted the ALPHV ransomware operation and obtained decryption keys, though the group later claimed the seizure had been reversed; the site was reported seized again. German law enforcement seized Kingdom Market, and Spanish law enforcement arrested a Venezuelan national described as a possible Kelvin Security leader. Austal USA confirmed a cyberattack after a data leak, which Hunters International claimed. BidenCash reportedly released 1.9 million credit cards, whose validity was not confirmed. The roundup also describes Russia-linked disinformation targeting Ukraine, Germany, and the United States.
People
Threat Actors
ALPHVNamed as a ransomware group whose operation the FBI breached; the source also refers to the group as Blackcat.BidenCashDark web marketplace reported to have released 1.9 million credit cards; the source says the cards’ validity was not confirmed.BlackCatNamed as a ransomware group whose operation the FBI breached; the source also refers to the group as ALPHV.Hunters InternationalRansomware group that claimed responsibility for the cyberattack on Austal USA.Kelvin SecurityDescribed as a hacking group that sells stolen data; Spanish law enforcement arrested a Venezuelan national described as a possible group leader.
Malware
Vendors
Countries
Germany1. Russia’s AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany – The Hacker NewsRussia1. Russia’s AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany – The Hacker NewsUkraine1. Russia’s AI-Powered Disinformation Operation Targeting Ukraine, U.S., and Germany – The Hacker NewsUnited StatesUkraine, Germany, and the United States are heavily targeted in Russia’s “Operation Doppelganger” – a new wave of fake news stories distributing falsehoods via news sites and social media accounts controlled by the