GroupIB_DFIR

Group-IB researchers identified a new Android NFC relay #malware, tracked as #WindRelay, which is deployed alongside #SpyNoteRAT in live-call fraud schemes. The combination gives threat actors remote access to Android devices while enabling real-time NFC card-data relay to an attacker-controlled device.

A newly observed Linux #XMRig campaign shows how modern #cryptomining operations are evolving beyond simple resource hijacking. The intrusion originated through a trusted third-party relationship, allowing threat actors to move from a trusted environment into the victim network before escalating privileges and establishing covert persistence. #SupplyChainSecurity

A threat actor operating as "888" advertised the sale of 35GB of data allegedly stolen from #Accenture, claiming the dataset contains source code, RSA keys, SSH keys, Azure PATs, Azure Storage access keys, and configuration files. Unlike many breach sale listings, the actor published evidence intended to support the claim, including repository screenshots and a file tree of the alleged data. #ThreatIntel

Group-IB uncovered a sophisticated ticket fraud operation targeting fans searching for #CelineDion's 2026 France tour tickets. The campaign combines #socialengineering on Facebook groups with fraudulent websites impersonating Ticketmaster, AXS, the artist's official channels, and Paris La Défense Arena. The operation demonstrates how threat actors blend trusted platforms with psychological manipulation to maximize victim conversion. #ThreatIntel

Your network is a liminal space. Too big, too quiet, and you're not alone in it. Compromise Assessment: something's been wandering your halls longer than you think. We find it. ✅Threat Hunting: the corridor that always felt off? We go down it. ✅Red Teaming: we find the door you forgot to lock, before someone else does. ✅Incident Response: the worst has happened. This isn't where the story ends. Group-IB Services Retainer. One agreement. Every room covered. Step inside: group-ib.com/services/servic… #Cybersecurity #IncidentResponse #DFIR

🚨 Criminal networks are increasingly weaponizing subscription-based content platforms to recruit, coerce, and exploit vulnerable people. The scale is larger than many realize. Group-IB contributed intelligence support to Operation CyberProtect III (19–22 May 2026), a joint law enforcement operation co-organized by @INTERPOL_HQ and the @OSCE , targeting the growing exploitation of subscription-based content platforms to facilitate human trafficking and sexual exploitation. Using its Threat Intelligence Graph and analyst expertise, Group-IB helped investigators map criminal infrastructure, identify recruitment channels, trace financial flows, and uncover additional potential threat actor infrastructure. Key findings from the operation: 🔹 Recruiters using encrypted messaging platforms to target victims, including requests for nude images without age verification 🔹 Content producers being bought and sold, with one messaging group containing up to 28,000 advertisements 🔹 AI-generated fake profiles used to support and scale exploitation operations 🔹 Cryptocurrency and virtual currencies used as payment mechanisms, with rates as low as USD 3 for 25 minutes of private content This is what adversary-centric intelligence looks like in practice: tracing the infrastructure, recruitment channels, and financial flows criminal networks rely on, so investigators can act on verified intelligence and disrupt exploitation. Read the full press release: link.group-ib.com/4vYxjWr @INTERPOL_Cyber #CyberSecurity #LawEnforcement #OnlineExploitation #HumanTrafficking

Cybercrime tactics evolve fast. Which threat concerns you the most right now?

Fake shipment tracking #scams are rapidly scaling across the #MEA region, exploiting the 161B annual parcel volume that fuels global e-commerce. Attackers use Sender ID spoofing to insert #phishing messages directly into legitimate courier SMS threads, claiming failed deliveries. Victims who click to "update address details" or "pay small fees" are led to pages stealing both credentials and payment data in a two-stage theft process. #ThreatIntel

Threat actors behind #GTFire are systematically abusing Google's trusted infrastructure to evade detection at scale. By chaining Google Firebase hosting with Google Translate's proxy, they create a multi-stage redirect chain that obfuscates final phishing destinations. The translate.goog layer acts as a "phishing shield," leveraging Google's reputation to bypass email security filters and web gateways, with the malicious *.web.app domain only visible deep in the network traffic. #Phishing #ThreatIntel

🚨 Tracking the Rise of Chinese Tap-to-Pay Android Malware Tap-to-pay fraud is no longer limited to stolen cards or physical proximity. Threat actors are now abusing NFC-enabled #Androidmalware to relay #paymentdata in real time, enabling remote, contactless fraud at scale. Our latest research uncovers how Chinese #cybercrime communities are industrializing this technique and turning it into a fully operational fraud ecosystem. Key Highlights: 🔹 Over 54 NFC-enabled Android malware samples identified, designed to relay payment APDUs remotely 🔹 Multiple Telegram-based vendors offering tap-to-pay malware as a service, complete with subscriptions, support, and custom regional builds 🔹 At least $355,000 in fraudulent transactions linked to a single illicit POS vendor between Nov 2024 and Aug 2025 🔹 #Smishing and #vishing campaigns actively used to trick victims into installing malware and tapping their cards 🔹 Mule networks and compromised mobile wallets enabling global, card-present fraud without physical cards Alongside these findings, the research provides in-depth technical analysis of TX-NFC, #NFU, and related variants, examining code overlaps, cash-out infrastructure, and key defensive considerations for #financialinstitutions and payment networks. Read the full research now: link.group-ib.com/3Li56bI

🚨Bloody Wolf Expands Across Central Asia 🚨 Since June 2025, Group-IB analysts have been tracking a rapidly evolving campaign by #BloodyWolf, an #APTGroup weaponizing trusted government identities to deliver lightweight but highly effective JAR-based loaders. By impersonating Ministries of Justice and abusing legitimate remote-access software like #NetSupport Manager, the group has quietly scaled its operations from Kyrgyzstan to Uzbekistan supported by geo-fenced infrastructure, tailored lures, and a custom JAR generator designed for stealth and persistence. Our latest technical blog provides a deep dive into: 🔹 Their #spearphishing techniques and localized PDF lures 🔹 How custom JAR loaders deploy NetSupport RAT 🔹 Infrastructure masquerading as #government portals 🔹 Multi-layered persistence and evasion methods 🔹 IOCs, MITRE mapping, and defensive recommendations Bloody Wolf shows how low-cost tools and precise #SocialEngineering can evolve into regionally impactful cyber operations. Read the full analysis: link.group-ib.com/49YTwfF

A coordinated scam campaign is spreading across several regions, including Latin America, using fake news pages and #deepfakes to promote alleged investment platforms. Goal? to steal personal and payment data by exploiting politically sensitive periods, such as pre- and post-election moments. #ScamAlert

Adversaries can bind-mount a manipulated workspace over /proc/<pid> to rewrite what tools like ps/top show, renaming #malicious processes into benign tokens and sabotaging initial triage. We reproduce this technique end-to-end in our lab walkthrough. #CyberSecurity

🚨 #LockBit has unveiled LockBit 5.0, timed with the 6th anniversary of its affiliate program in a bid to regain market share. Early reporting suggests a modular architecture, faster multi-threaded encryption, enhanced EDR bypass techniques, and updated affiliate incentives.

#InvestmentScam platforms are run by sophisticated multi-actor networks, not lone operators. Our analysis breaks down the roles of Masterminds, Target Intelligence, Backend Operators, and Payment Handlers that enable these fraud campaigns. Discover how these ecosystems operate and how you can detect them. #CyberCrime #FinSec

🎯 Cybercriminals don’t need to hack your system. They just need to hack your trust. From fake job offers to “verified account” messages, social media has become a playground for scammers who prey on emotion, urgency, and curiosity. Understanding how these tactics work is the first step in stopping them. Our latest carousel breaks down the most common social media scams and how to stay ahead of them. Think before you click. Verify before you trust. #CyberSecurityAwarenessMonth #GroupIB #FraudProtection #OnlineSafety #FightAgainstCybercrime #CyberSecurity #OnlineScams #SocialMedia

Can you trust the voice on the other end? #Cybercriminals are leveraging accessible #AI voice cloning platforms, needing only seconds of public audio, combined with telecom SS7/PSTN vulnerabilities for caller ID spoofing to execute highly convincing Vishing attacks. Explore technical analysis of real-world incidents, including a $243K UK scam and an $18.5M Hong Kong stablecoin theft, and learn actionable defense strategies for telecom providers and enterprises to counter AI-driven #SocialEngineering. Download the report to understand how to defend against #Deepfake enabled fraud: link.group-ib.com/3IzDe1p