Group-IB Global

🚨 The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared. One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on. It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut: 🔹 Native attack surface management, cyber threat intelligence and digital risk protection 🔹 Native remediation 🔹 Outside-in and inside-out visibility From more than 30 vendors, Frost benchmarked 15, and named Group-IB a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026. Frost singles out two reasons: intelligence Group-IB originates rather than resells, and Cyber-Fraud Fusion, defending cyber and fraud as the single operation attackers actually run. If you're weighing your next investment, the report is a way to scrutinise the capabilities behind the platform claim, not just the marketing around it. Learn More: link.group-ib.com/4k1pr3N

✨ Group-IB Digital Risk Protection is now available in @awscloud Marketplace, giving customers worldwide a streamlined way to purchase and manage protection against #phishing, #scams, and brand abuse through their existing AWS Marketplace accounts. Key highlights: 🔹 Continuous monitoring across millions of resources on the open, deep, and #darkweb 🔹 Proprietary neural networks detect up to 90% of violations with the accuracy of a skilled analyst 🔹 Auto-attribution connects individual infringements to the wider criminal infrastructure behind them 🔹 A three-stage takedown process supported by more than 70 brand protection specialists and CERT-GIB, a member of FIRST and Trusted Introducer 🔹 Streamlined purchasing and management through customers’ existing AWS Marketplace accounts 🔹 Monitoring and enforcement available in local languages worldwide 🔹 Group-IB has achieved the #AWS Financial Software Competency designation, recognizing providers that meet AWS’s security, quality, and operational standards for the financial services industry With detection, attribution, and takedown brought together in one solution, organizations can act faster against high-volume and repeat brand abuse. Explore more: aws.amazon.com/marketplace/p…

Group-IB uncovered #MadApe, a previously undocumented phishing kit abusing Microsoft Device Code authentication to target #Microsoft365 accounts through the legitimate Device Login flow. Our investigation mapped 155 root domains, identified reusable #phishing infrastructure, anti-analysis verification gates, backend API patterns, and exposed operator panels. Read the full technical analysis, including IOCs, hunting guidance, and YARA detections: link.group-ib.com/3WTSb4X

Group-IB uncovered #CyberDakait, a threat cluster using Seven #Android trojan families to target #India’s financial sector. Our research identified at least 17,960 compromised devices and 7.6 million intercepted SMS messages. Read the full analysis: link.group-ib.com/4zYErEw

153 million driver's licenses. 10 million ID cards. 3 million travel documents. A massive trove of identity documents allegedly linked to IDScan has surfaced on a dark web marketplace, raising questions about the security of the systems businesses use to verify customers. IDScan provides identity verification technology used across industries including car rentals, hotels, cannabis dispensaries, and other businesses that scan government-issued IDs. The exposed data reportedly includes US and Canadian driver's license scans, along with ID cards, travel documents, and medical cards. Security journalist Brian Krebs reported the breach after verifying samples of the data, including finding his own records in the database. IDScan later confirmed that an unauthorized third party may have accessed customer information, including full names and driver's license numbers. The company said it is cooperating with federal law enforcement, while the FBI is investigating. The dark web marketplace where the data was advertised has since gone offline. But taking down a listing doesn't necessarily mean the underlying data is gone. The bigger concern is the ecosystem behind identity verification. Every time an ID is scanned at a hotel desk, rental counter, or retail business, sensitive identity data may pass through systems that customers never directly interact with or even know about. A breach at one verification provider can therefore have consequences far beyond the company itself.

Even trained people can make this mistake. We are used to trusting people who sound calm, informed and official, and even more so when the voice is familiar. AI voice cloning and deepfake video make that instinct increasingly risky. Add urgency such as “approve this now” or “reset my access” and trust becomes the attack surface. For payments, credential resets and sensitive requests, hang up and verify through a known second channel. Trust the process, not the caller. #Deepfake #CybersecurityAwarenessMonth #VishingScam #FightAgainstCybercrime

A finance employee at a British engineering firm joined what looked like a routine video call with a senior manager and several colleagues he recognised. The faces were familiar, the voices sounded right, and the conversation felt completely normal, so when he was asked to make a series of urgent transfers, he completed the payments without a second thought. It later emerged that every other person on that call had been a #Deepfake, and $25 million had left the company in a single afternoon. Making a convincing moving face no longer needs a studio, and INTERPOL found that talk of deepfakes on criminal forums and messaging channels rose 600% in just five months. Spotting a fake on screen is not a realistic defence either, since only 1 in 1,000 people in a study of 2,000 correctly identified every deepfake shown. What would have stopped this #VideoCallScam was a simple call back on a number already saved, because a request confirmed on a separate line is one that no fake face can follow.

🚨 Not every enterprise risk platform is built the same. For its 2026 assessment, Frost & Sullivan evaluated platforms against three key requirements: 🔹 Native attack surface management, cyber threat intelligence, and digital risk protection 🔹 Native remediation capabilities 🔹 Both outside-in and inside-out visibility More than 30 vendors were considered and 15 were benchmarked. Group-IB was named a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026. Use these criteria when evaluating your own #enterpriserisk platform and see how Group-IB was assessed. Download the full report: link.group-ib.com/4jAfvy9

🚨 Critical #PHP2Shell vulnerabilities put millions of internet-facing assets at risk. Two critical flaws in the PHP core — CVE-2026-109618 and CVE-2026-109619 — can enable unauthenticated remote code execution and sensitive memory disclosure on vulnerable servers. As of October 22, Group-IB Attack Surface Management detected 5.7M+ vulnerable assets across officially affected PHP 8.2–8.5 branches, with the broader potential exposure exceeding 22M assets. With public PoCs already circulating, organizations should act now: 🔹 Update PHP to a fixed release 🔹 Prioritize internet-facing systems 🔹 Monitor for unusual requests, HTTP 500 spikes, and PHP worker crashes 🔹 Keep WAF protections enabled while patching Group-IB continues to monitor underground discussions, potential exploitation attempts, and post-exploitation activity related to PHP2Shell. Group-IB products are not affected — no action required for customers We are sharing what we see so organizations can understand their exposure, respond quickly, and act before attackers do. Learn more about PHP2Shell and what to do next: link.group-ib.com/4BkvOFA

What does it take to get past a bank that checks a customer’s face before every large transfer? A copy of that face, an ID card, and access to the phone’s text messages, all captured through a single malicious app install. The scheme began with a smishing message impersonating a government office and offering a refund on an electricity bill. To claim it, victims installed an app and completed a short face scan, holding the camera steady and blinking or turning their head when prompted. Behind the scenes, the app (GoldPickaxe.iOS, part of the GoldFactory campaign) also exfiltrated identity documents and intercepted incoming SMS messages. Group-IB identified it as the first iOS trojan of its kind to steal facial recognition data. The stolen faces were used to create AI-generated deepfake videos convincing enough to pass the bank’s own biometric checks, and at least one victim lost more than $40,000. A face scan functions like a password, and biometric fraud depends on people forgetting that. Legitimate refunds, banks, and government offices do not ask for a biometric scan through a chat app.

How can organizations stay ahead of increasingly sophisticated #cybercrime and financial fraud? On October 19, Group-IB and Amazon Web Services (@awscloud) brought together leaders from Bahrain’s banking, financial services, telecommunications, government and other key sectors at Fraud Prevention & Resilience: Bahrain Majlis 2026, held at the InterContinental Bahrain. 🇧🇭 The discussions focused on key priorities: 🔹 Cyber Fraud Fusion: Connecting #cybersecurity and #fraudintelligence to anticipate and prevent emerging threats. 🔹 Predictive defense: Identifying criminal tactics, infrastructure and networks before attacks cause financial or operational damage. 🔹 Collective resilience: Strengthening intelligence sharing and collaboration across industries to address evolving digital threats. With more than 1,600 high-tech crime investigations conducted and established collaboration with INTERPOL, Europol and AFRIPOL, Group-IB brings frontline investigative expertise to the fight against cyber crime. Learn more: group-ib.com/resources/knowl…

🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered. Group-IB supported INTERPOL’s #OperationSerengetiIII, a multinational law-enforcement operation targeting #cybercriminal networks across Africa. Coordinated by @INTERPOL_Cyber and involving 21 countries, the operation tackled cyber-enabled fraud, #ransomware, business email compromise, #onlinescams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million. As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa or used to target the region. The company also shared intelligence on threat actors involved in fraudulent activities, including social media accounts linked to suspected fraudsters. The results reinforce a simple reality: cybercrime crosses borders, and fighting it requires coordinated action across them. Read the full press release to learn more: link.group-ib.com/4z1RapE @INTERPOL_HQ

🚨 What looks like a Windows RAT is actually a much broader threat platform. Our analysis of SiriusQT uncovered more than 280 client samples and 146 unique licenses, along with features such as hidden virtual network computing (HVNC), credential theft, multiple process injection techniques, and custom encrypted C2 traffic. Read the full technical analysis: link.group-ib.com/4kaseaU #CyberSecurity #MalwareAnalysis #ThreatIntel #SiriusQT

Around $355,000 moved through stolen bank-card data in under a year, and the cards never left their owners’ pockets. It often starts with a text or call that appears to come from a bank. The victim is told to install a “security” app, then tap their bank card against the back of the phone to “verify” it. During that tap, the malicious app reads the card through the phone’s NFC chip and relays the data to a criminal’s device connected to a POS terminal or mobile wallet far away. The fraudulent transaction is then completed remotely. Group-IB researchers call this #GhostTap. Their investigation identified more than 54 malicious APK samples built for this scheme, with the service behind them openly advertised on Telegram. Remember: a legitimate bank will not ask you to install an app from a text link and then tap your card against your phone to “verify” it. A banking app should only be installed from an official app store, never from a link in a #Smishing text.

Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified. The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA. Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed. Read the full technical analysis: link.group-ib.com/4yDaMQY

✨ Group-IB, in collaboration with @awscloud, successfully hosted the Fraud Prevention and Resilience Majlis 2026 in Bahrain yesterday. We were honored to welcome the National Cyber Security Center Bahrain (@NCSC_BH), alongside leading banks and organizations from the government, insurance, aviation, and e-commerce sectors. The Majlis featured two strong panel discussions: “The Era of Financial Crimes in the Region” and “Fraud, #Cybersecurity, Compliance & Operational Resilience.” Industry experts shared valuable perspectives on the evolving fraud landscape, emerging threats, regulatory challenges, and the importance of strengthening operational resilience across sectors. As fraud becomes an increasingly complex challenge, collaboration is essential to staying ahead of sophisticated threats. The discussions highlighted the need for a more unified approach, bringing together industry leaders to exchange insights, share experiences, and explore practical ways to strengthen #fraudprevention across the ecosystem. A sincere thank you to our partners at #AWS, NCSC Bahrain, our distinguished panelists, and everyone who joined us and contributed to these meaningful discussions. We look forward to continuing the conversation and working together to build a safer, more resilient digital economy across the region.