“No Lives Matter” has emerged in recent months as a particularly violent splinter group within the extremist crime network known as Com and 764, and experts are at a loss for how to stop its spread.

The kids are all grown up. In the face of international law enforcement pressure, dozens of prosecutions, and worldwide disrepute, the network of young sadists, misanthropes, child predators, and extortionists known as Com and 764 has not shrunk away into obscurity.

Rather, its members have progressed from online extortion and crimes related to child sexual abuse material, to real-world violence, a trajectory that alarms extremism researchers and government officials alike. Knifings, killings, firebombings, drive-by shootings, school shootings, and murder-for-hire plots in North America and Europe have all been connected to a splinter group called “No Lives Matter” that, per the group’s own manifesto, “idolizes death” and “seeks the purification of all mankind through endless attacks.” The group has released at least two “kill guides” that have been connected to violent attacks and plots in Europe and the United States.

The US Department of Justice classifies Com and 764 as a “Tier One” terrorism threat, the highest priority afforded to an extremist group, ideology, or tendency in American law enforcement’s internal rubric. Intelligence documents reviewed by WIRED show a stream of concern from analysts about the group’s harm to juvenile exploitation victims and the growing exhortations to physical violence that embody the No Lives Matter ethos.

However, the phenomenon has proved incredibly hard to combat due to a lack of coherent structure or ideology. Along with the insidious neo-Nazi propaganda group the Terrorgram Collective, over the past four years, Com/764 has morphed into a twisted amalgam of the Columbine Effect and older domestic terror groups like the Atomwaffen Division: Young extortionists and assailants egg each other on to progressively more lurid and debased acts of violence for the sake of internet notoriety and status.

In response, Western governments have employed terrorism charges against young people accused of conspiring to kill homeless people or phoning in bomb threats to schools and religious institutions beyond their own borders. In the United Kingdom, the Crown Prosecution Service recently secured a six-year prison term for 19-year-old Cameron Finnegan, who went by the handle “Acid,” for a raft of 764-related offenses, including possessing CSAM, urging young people to kill themselves, and possessing a “kill manual” authored by No Lives Matter adherents, replete with viable instructions for carrying out lethal attacks with knives, firearms, and vehicles.

"We want to make the public aware of \[Com/764\]," Detective Chief Superintendent Claire Finlay, the head of Counter Terrorism Policing Southeast, told the BBC following Finnegan’s guilty plea in January. "The threat that they pose, not just within the United Kingdom but globally, is immense."

According to senior DOJ officials who were granted anonymity to speak about internal law enforcement matters, the feds have come across related cases in every field office in the US. US authorities are so hell-bent on pursuing this trend that they are trying to extradite a 17-year-old Romanian boy who prosecutors at the Southern District of New York claim took part in exploiting minors and soliciting and distributing CSAM. The teenager also faces US terrorism charges for allegedly phoning in several hundred bomb threats to dozens of schools and institutions in the US as part of 764 and its splinter groups, according to information obtained by this reporter.

"We’ve seen a lot of hybrid movements and ideologies, new trends that we can’t categorize under the traditional categories,” says Bàrbara Molas, a senior analyst at RAND Europe who specializes in far-right extremism and who testified as an expert witness for the prosecution in Finnegan’s recent Com/764-related case.

For Molas, Com/764 represents that type of hybridity, where participants in the network will pick and choose elements from a series of discrete ideologies—neo-Nazism; the satanist group Order of Nine Angles, which has become prevalent throughout the most transgressive spheres of the transnational far right; Ted-Kaczynski-inspired neo-Luddism—and assemble their own belief pantheon.

“When 764 was only about CSAM, their targets tended to be women—but specifically women from diminished social groups, who were seen as the weak party of society,” Molas says. “That ideal of imposing violence on this part of society has carried on and become more violent.” When members of the network commit violence in the name of the group, Molas says, it “helps them rise within the group and advance the larger cause, which is to change society through violence and chaos.”

The lodestar for this transition towards wanton violence is a German teenager named Nino Luciano, who went by the handle “Tobbz” within 764. Sent to live in a foster home in Romania because his mental illnesses overwhelmed the capacity of institutions in his home country, Tobbz was drawn into 764 during the Covid-19 pandemic and quickly became enthralled with the group, daubing its name on a wall in his room and tattooing himself with “764” and a septagram from the Order of Nine Angles. In March 2022, he committed and livestreamed a series of knife attacks, stabbing an elderly woman to death and severely wounding an old man. He was convicted in August 2023 and is serving 14 years in prison.

Tobbz’s behavior inspired other young extremists in the Com/764 network, who have since either tried to emulate his livestreamed attacks or commit similar acts of violence to boost their notoriety and status within their extremist peer group. No Lives Matter’s exhortations to commit mass casualty events and distribution of detailed guides to violence are patterned off Tobbz’s example, according to experts who’ve studied the network.

Baron Martin, a resident of Tucson, Arizona, was charged in federal court with cyberstalking and sexual exploitation of a child that included the production of CSAM. According to court records, the government also accused Martin of soliciting the murder of the grandmother of one of his victims under the handle “Convict.” He allegedly sent the following message to a Discord server, court records show: “know anyone in \[state\] thats willing to do kidnappings or shootings...i need someone to tobbz a grandma. Somebody wanted to dox one of my egirls. now I’m getting their grandma merked.” The use of “Tobbz” as a synonym for murder was not casual: Martin allegedly offered to pay another user to carry out the hit, which was never realized.

According to court documents, Martin, through his handle, was connected to authoring a detailed guide widely distributed in 764’s channels on how to groom victims for extortion, which the FBI claims Martin bragged online was “the catalyst for thousands of extortions.” (Martin has pleaded not guilty.)

Molas, of RAND Europe, says Martin’s alleged path from extortion to soliciting a homicide traces a familiar path of transgressive behavior often seen in Com/764’s online world. “They’ll start with little acts of sin—shoplifting, then robberies, abuse of minors, weapons violations, then all the way up to kidnapping and murder,” Molas says.

In mid-February, Jairo Tinajero, a 25-year-old Arkansas man who took part in the 764 splinter group 8884, pleaded guilty to CSAM and conspiracy charges for extorting an underage girl in Louisville, Kentucky. According to his plea agreement, Tinajero confessed to plotting to kill the girl once she stopped complying with him, posting her address and personal information about her and her family family in 764’s servers, unsuccessfully trying to buy an assault rifle, and talking through a murder plot with other 764 members.

Tinajero also admitted taking part in 764 online chats where prior mass casualty attacks were discussed along with “future attacks on heavily populated areas such as malls or other large gatherings, LGBTQ+ events and gatherings, schools, public places, government buildings and police stations” with the intent to “destabilize society and cause the collapse of governments and rule of law.”

Most recently, neo-Nazi Aidan Harding’s inspiration from 764 was brought up during a mid-February federal court hearing for CSAM possession charges. In addition to participating in public actions with a number of Pittsburgh-area extremist groups, prosecutors claimed that Harding and another man were deeply interested in the Columbine massacre, visiting the memorial in Littleton, Colorado, and posing for a photo in front of a swastika flag while dressed as Dylan Klebold and Eric Harris. “Eric and Dylan were kickstarting a revolution,” Harding wrote in a message, which prosecutors showed in court. Harding and the other man, who hasn’t been charged, also discussed carrying out mass shootings through Instagram direct messages, which were presented in court. “The only thing holding me back is a partner … I don’t want to do it alone or die alone,” Harding wrote.

According to two researchers who attended Harding’s three-and-a-half-hour court appearance related to probable cause on February 12, an FBI agent claimed during questioning that investigators found reams of videos depicting children being raped, ultraviolent videos of executions, and the extremist mass shootings in Buffalo, Nashville, and Columbine, along with a photo on Harding’s phone of a phrase daubed in blood: “I sold my soul to 764,” above a swastika and a Lviathan cross often used by 764. Another photo, handed up to the judge and not shown in court, depicted the naked chest of a young girl wearing a cross, with the words “No Lives Matter” carved into her body with a sharp instrument.” Harding has pleaded not guilty.

The crimes described in court cases this year follow a months-long surge in No Lives Matter–related violence. In October, authorities claim, a 14-year-old Swede committed eight attacks on unsuspecting passersby in Stockholm. The attacker, per national broadcaster SVT, took part in 764 and went by the handle “Slain” in the group. Documents circulated by 764 participants on Telegram and elsewhere claim “Slain764” as one of their own, and identify Sweden, the UK, and Bulgaria as countries where their group has a presence.

In mid-February, Italian police arrested a 15-year-old boy on suspicion of planning to murder a homeless man and livestream the act. Police said the teenager was reportedly involved in 764 and faces charges for explosives possession and possession of CSAM material. Italian authorities claim he planned his actions as part of a “week of terror” along with unspecified colleagues.

There is also evidence of 764’s praxis and imagery merging with that of the Terrorgram Collective, a neo-Nazi propaganda network that aims to radicalize young people and inspire solo acts of sabotage and mass murder.

Solomon Henderson, a Tennessee teenager whom police said shot up his high school last month, posted a sprawling manifesto that referenced both mass shooters inspired by Terrorgram as well as homicidal 764 members, including Tobbz. Henderson’s social media accounts also show extensive imagery from 764’s channels as well as the Order of Nine Angles “The influence I see most heavily in that agenda is the Order of Nine Angles,” Molas says.

That confluence of extremist inspirations is highly unpredictable, and may prove influential: There is reportedly evidence that social media accounts connected to Henderson may have communicated with accounts linked to Natalie “Samantha” Rupnow, a young Wisconsin woman who killed two and wounded classmates in a mid-December shooting at her school before dying by suicide. Earlier in December, a high school student in Guadalajara, Mexico, livestreamed an axe attack on his classmates before they were able to subdue him. The young man’s social media posts were rife with O9A influence, including photos of himself with butchered animals and another with a blood pact, a common O9A practice.

The Violent Rise of ‘No Lives Matter’

Tel Aviv, Israel, 12th March 2025, CyberNewsWire

**Tel Aviv, Israel, March 12th, 2025, CyberNewsWire**

CYREBRO, the AI-native Managed Detection and Response (MDR) solution, announced today that it won Silver in the category of Security Operations Center (SOC) solutions at the annual 2025 Globee Awards. The program aims to raise awareness about cybersecurity issues and honor those who have made significant contributions in protecting organizations and individuals from cyber threats.

This award comes on the heels of significant advancements for CYREBRO, solidifying its position as a future-proof cybersecurity leader. The company has recently launched its proprietary security data lake, enabling unparalleled threat analysis and faster, more precise detection. This innovation, coupled with a strategic partnership with Google Cloud, enhances CYREBRO’s ability to scale and deliver cutting-edge security solutions across diverse environments.

CYREBRO’s commitment to global expansion is evident in its rapidly growing customer base across new markets, demonstrating the universal need for proactive threat detection and response across companies of all sizes.

CYREBRO remains steadfast in its 100% channel-based strategy, empowering its partners to deliver exceptional MDR services to their clients. This approach ensures seamless integration and personalized service, maximizing the value of CYREBRO’s MDR capabilities.

> “We are honored to receive this prestigious award,” said Ori Arbel, CYREBRO CTO. “This recognition validates our relentless pursuit of innovation and our dedication to empowering businesses with robust cybersecurity defenses. We’re particularly proud of the strides we’ve made in enhancing our platform, directly translating to superior security outcomes for our partners and customers.”

**About CYREBRO**

CYREBRO is an AI-native, end-to-end Managed Detection and Response (MDR) solution, designed for hands-off or hands-on control through its future-proof SOC platform.

With its advanced Security Data Lake revolutionizing SIEM and SOAR capabilities, CYREBRO includes 24/7 SOC monitoring and threat intelligence, augmented with exceptionally swift incident response and forensic investigations. CYREBRO delivers precision-guided threat detection and response across any tech stack, providing clear, actionable insights to ensure world-class security and compliance.

With comprehensive visibility and expert guidance, CYREBRO empowers over 900 businesses of all sizes to manage threats proactively, enhancing their security posture and delivering full and complete protection.

**Contact**

**CMO**  
**Gil Harel**  
**CYREBRO**  
**\[email protected\]**

CYREBRO’s AI-Native MDR Platform Earns Silver at the 2025 Globee Cybersecurity Awards

Threat intelligence firm GreyNoise is warning of a "coordinated surge" in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities spanning multiple platforms.
"At least 400 IPs have been seen actively exploiting multiple SSRF CVEs simultaneously, with notable overlap between attack attempts," the company said, adding it observed the activity on March 9, 2025.
The countries which

Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber Attack

Elon Musk said a “massive cyberattack” disrupted X on Monday and pointed to “IP addresses originating in the Ukraine area” as the source of the attack. Security experts say that's not how it works.

The social network X suffered intermittent outages on Monday, a situation owner Elon Musk attributed to a “massive cyberattack.” Musk said in an initial X post that the attack was perpetrated by “either a large, coordinated group and/or a country.” In a post on Telegram, a pro-Palestinian group known as Dark Storm Team took credit for the attacks within a few hours. Later on Monday, though, Musk claimed in an interview on Fox Business Network that the attacks had come from Ukrainian IP addresses.

Web traffic analysis experts who tracked the incident on Monday were quick to emphasize that the type of attacks X seemed to face—distributed denial-of-service, or DDoS, attacks—are launched by a coordinated army of computers, or a “botnet,” pummeling a target with junk traffic in an attempt to overwhelm and take down its systems. Botnets are typically dispersed around the world, generating traffic with geographically diverse IP addresses, and they can include mechanisms that make it harder to determine where they are controlled from.

“It’s important to recognize that IP attribution alone is not conclusive. Attackers frequently use compromised devices, VPNs, or proxy networks to obfuscate their true origin," says Shawn Edwards, chief security officer of the network connectivity firm Zayo.

X did not return WIRED's requests for comment about the attacks.

Multiple researchers tell WIRED that they observed five distinct attacks of varying length against X's infrastructure, the first beginning early Monday morning with the final burst on Monday afternoon.

The internet intelligence team at Cisco's ThousandEyes tells WIRED in a statement, “During the disruptions, ThousandEyes observed network conditions that are characteristic of a DDoS attack, including significant traffic loss conditions which would have hindered users from reaching the application.”

DDoS attacks are common, and virtually all modern internet services experience them regularly and must proactively defend themselves. As Musk himself put it on Monday, “We get attacked every day.” Why, then, did these DDoS attacks cause outages for X? Musk said it was because “this was done with a lot of resources,” but independent security researcher Kevin Beaumont and other analysts see evidence that some X origin servers, which respond to web requests, weren't properly secured behind the company's Cloudflare DDoS protection and were publicly visible. As a result, attackers could target them directly. X has since secured the servers.

“The botnet was directly attacking the IP and a bunch more on that X subnet yesterday. It's a botnet of cameras and DVRs,” Beaumont says.

A few hours after the final attack concluded, Musk told Fox Business host Larry Kudlow in an interview, “We're not sure exactly what happened, but there was a massive cyberattack to try to bring down the X system with IP addresses originating in the Ukraine area.”

Musk has mocked Ukraine and its president, Volodymyr Zelensky, repeatedly since Russia invaded its neighbor in February 2022. A major campaign donor to President Donald Trump, Musk now heads the so-called Department of Government Efficiency, or DOGE, which has razed the US federal government and its workforce in the weeks since Trump's inauguration. Meanwhile, the Trump administration has recently warmed relations with Russia and moved the US away from its longtime support of Ukraine. Musk has already been involved in these geopolitics in the context of a different company he owns, SpaceX, which operates the satellite internet service Starlink that many Ukrainians rely on.

DDoS traffic analysis can break down the firehose of junk traffic in different ways, including by listing the countries that had the most IP addresses involved in an attack. But one researcher from a prominent firm, who requested anonymity because they are not authorized to speak about X, noted that they did not even see Ukraine in the breakdown of the top 20 IP address origins involved in the X attacks.

If Ukrainian IP addresses did contribute to the attacks, though, numerous researchers say that the fact alone is not noteworthy.

“What we can conclude from the IP data is the geographic distribution of traffic sources, which may provide insights into botnet composition or infrastructure used,” Zayo’s Edwards says. “What we can’t conclude with certainty is the actual perpetrator’s identity or intent.”

_Additional reporting by Zoë Schiffer._

What Really Happened With the DDoS Attacks That Took Down X

The telecom industry is at a major turning point. With 5G, IoT, and AI reshaping global connectivity, the…

The telecom industry is at a major turning point. With 5G, IoT, and AI reshaping global connectivity, the need for scalable, secure, and smart networks is higher than ever. Cloud IMS is stepping up as a game-changer, combining the flexibility of cloud technology with the reliability of traditional IMS systems. Virtualizing core network functions helps telecom operators roll out next-generation services while keeping security strong in a time of growing cybersecurity threats.

This article breaks down how Cloud IMS has evolved, the key benefits it brings to telecom, and the advanced security measures that help protect essential digital infrastructure.

****Cloud IMS: Redefining Telecommunications Architecture****

Traditional IMS has long served as the foundation for delivering voice, video, and multimedia services over IP networks. However, its reliance on dedicated hardware and inflexible architecture presents limitations in scalability, cost efficiency, and adaptability to emerging network paradigms like 5G and edge computing.

Cloud IMS disrupts this paradigm by decoupling software from hardware, enabling network functions to operate on a highly scalable cloud infrastructure. This expansion introduces several key advantages:

*   Elastic Scalability: Dynamic resource allocation ensures seamless network expansion and load balancing across regions.

*   5G Integration: Cloud IMS seamlessly interfaces with 5G core networks, enabling ultra-low latency communications and network slicing for enterprise applications.

*   Edge Computing Synergy: By distributing processing closer to end users, Cloud IMS enhances real-time applications such as autonomous systems, augmented reality (AR), and smart city infrastructure.

By integrating cloud-native flexibility with IMS standards, operators establish a future-proof foundation for global connectivity.

****Strategic Benefits of Cloud IMS in Modern Networks****

1\. Accelerating Service Deployment

Cloud-native architecture, coupled with DevOps and Continuous Integration/Continuous Deployment (CI/CD) practices, allows operators to launch new services—such as VoNR (Voice over New Radio), 5G-enabled telemedicine, or high-definition video conferencing—in days rather than months. This agility enhances network responsiveness to evolving market demands.

2\. Cost Optimization and Infrastructure Efficiency

By leveraging multi-tenancy and cloud-based resource pooling, Cloud IMS significantly reduces capital expenditure (CAPEX) and operational expenditure (OPEX). Operators transition from hardware-intensive deployments to an on-demand, pay-as-you-go model, optimizing resource utilization.

3\. Global Reach with Localized Performance

Cloud IMS enables geo-distributed deployments, ensuring minimal latency while optimizing bandwidth for mission-critical applications such as emergency services, industrial automation, and defence communications.

4\. 5G Monetization & Network Slicing

With network slicing, telecom operators can create dedicated virtual networks tailored to specific industries, including autonomous transportation, smart grids, and financial services. This customization unlocks new revenue streams while maintaining strict Quality of Service (QoS) and cybersecurity standards.

5\. Sustainable and Energy-Efficient Networks

The transition to cloud-native IMS minimizes physical hardware dependency, reducing energy consumption and carbon footprints. By optimizing server utilization and leveraging AI-powered energy management, telecom providers align with global sustainability initiatives while improving cost efficiency.

****Fortifying National Infrastructure: The Security Imperative of Cloud IMS****

Given the critical role of telecommunications in modern infrastructure, network security remains a paramount concern. As cyber threats evolve in complexity, telecom networks require a multi-layered security framework to safeguard both national and commercial interests.

1\. Zero-Trust Architecture (ZTA)

Cloud IMS adopts a “never trust, always verify” approach, requiring strict authentication and continuous security monitoring. Techniques such as mutual TLS (mTLS), biometric authentication, and blockchain-based identity verification ensure that only authorized entities access network resources.

2\. AI-Powered Threat Intelligence

Artificial intelligence (AI) and machine learning (ML) algorithms continuously monitor network traffic, detecting anomalies such as DDoS attacks, signalling fraud, and unauthorized access. Automated threat response mechanisms neutralize attacks before they escalate.

3\. Quantum-Resistant Encryption

With the impending advancements in quantum computing, traditional encryption methods face obsolescence. Cloud IMS integrates post-quantum cryptographic algorithms to safeguard sensitive communications, ensuring future-proof data protection for national and enterprise-level security.

4\. Secure Network Slicing for Critical Infrastructure

Network slices dedicated to healthcare, finance, and emergency response operate in fully isolated, encrypted environments, ensuring data integrity and operational continuity during crises. For instance, a 5G-powered emergency response network remains segregated from public internet traffic, prioritizing low-latency, high-reliability communication.

5\. Immutable Audit Trails and Regulatory Compliance

With blockchain-backed logging and tamper-proof audit trails, Cloud IMS simplifies compliance with international security regulations, including GDPR, HIPAA, and CALEA. This capability enhances transparency in network operations while facilitating forensic investigations in case of security breaches.

****Cloud IMS in Action: Real-World Applications****

Cloud IMS is already driving technological advancements across multiple sectors:

*   Enterprise Unified Communications (UCaaS): Multinational corporations deploy end-to-end encrypted communication platforms with ultra-low latency.

*   Smart Cities: Cloud IMS supports real-time traffic management, AI-powered surveillance, and emergency response systems.

*   Rural Broadband Expansion: Enables cost-effective VoLTE and 5G deployments in underserved regions, bridging the digital divide.

*   Industrial IoT (IIoT): Manufacturers leverage private 5G slices for predictive maintenance, AI-driven automation, and robotics.

****Future Trajectory: Trends Shaping Cloud IMS****

Cloud IMS will continue evolving through:

*   AI-Driven Network Optimization: Predictive analytics for traffic routing, cybersecurity, and personalized telecom experiences.

*   Edge-Native Deployments: Low-latency solutions for autonomous vehicles, remote surgery, and immersive metaverse applications.

*   Public-Private Regulatory Collaboration: Standardized security frameworks for national infrastructure protection and data sovereignty.

*   Green Networks: Energy-efficient architectures leveraging renewable-powered data centers for sustainable telecom solutions.

Cloud IMS represents a defining shift in telecommunications, merging agility, security, and scalability into a unified framework. Telecom operators who fail to embrace this transformation risk obsolescence in an increasingly AI-driven, hyperconnected world.

For consumers, Cloud IMS promises seamless, low-latency, and secure digital experiences, whether in high-definition communication, AI-driven automation, or national security applications. For telecom providers, it unlocks unparalleled efficiency, cost optimization, and revenue diversification.

As telecommunications becomes the backbone of modern infrastructure, keeping it secure, reliable, and resilient is more important than ever. Cloud IMS isn’t just a breakthrough; it’s a necessity. The time to act is now.

Cloud IMS: The Confluence of Innovation and Security in Modern Telecommunications

Push notifications are a common feature that many websites use to keep users engaged. However, what happens when these notifications turn malicious? Renée Burton, Vice President of Threat Intel at Infoblox, recently shared her firsthand experience with this alarming trend. Here’s a look at how scammers exploit push notifications to deliver scams, including fake gift cards and sweepstakes.

****The Push Notification Trap****

Renée found that when users visit a website that requests permission to send notifications, they may unknowingly grant scammers a powerful tool. Cybercriminals take advantage of this by tricking users into accepting notifications, often without fully understanding the consequences. Once accepted, users are bombarded with misleading messages that redirect them to fraudulent content.

These misleading messages often pose as legitimate alerts from trusted brands like Google or Walmart. They may falsely claim that a user’s account has been hacked or that they have won a gift card. Engaging with these notifications can lead to downloading harmful apps or surrendering personal information.

****The Gift Card Scam****

As part of her investigation, Renée visited sites that employ push notification scams and observed how scammers entice users with promises of substantial winnings. A notification may claim the recipient has won a $10,000 Walmart gift card, prompting them to click on it. Instead of receiving a prize, users are redirected through multiple domains before landing on a fraudulent site.

To claim the gift card, users are asked to provide personal details, including their email and home address. In many cases, they must complete a survey before they can “win.” However, the survey never ends, keeping users trapped in a cycle of never-ending ads and data collection schemes.

Screenshot of a series of non-stop email spam pushing gift card scams (Credit: Renée Burton – Infoblox)

****The Survey Scam****

Renée discovered that survey scams are a prevalent tactic used by scammers. Upon clicking a notification that promises a prize, users are led to websites like reward-lockercom. These sites request personal details such as name, email, address, and phone number under the guise of confirming eligibility.

Once users provide this information, they are required to complete a series of surveys. Each survey leads to additional advertisements, and scammers keep them engaged with the illusion of an imminent reward. However, the prize never materializes, and users remain stuck in an endless loop of data harvesting.

****The Sweepstakes Scam****

Similar to survey scams, sweepstakes scams exploit users’ trust. Renée investigated fraudulent sites like zippywinnercom, which advertise lucrative sweepstakes that appear genuine. These sites lure users into believing they have won big prizes, but in reality, the odds of winning are practically nonexistent. Instead, users are funnelled into more surveys and deceptive schemes designed to extract personal information and generate ad revenue for scammers.

****The Bigger Picture****

Through her research, Renée uncovered that scammers use advanced techniques to evade detection. They employ domain cloaking and traffic distribution systems (TDSs) to deliver varied content, making it difficult for security teams to identify and mitigate these threats.

Infoblox has observed this malicious adtech (advertising technology) operating across various websites, including scientific research platforms, car dealership pages, and activist blogs. The problem is extensive, with millions of websites compromised by push notification scams each year.

****The Impact****

While some may dismiss these scams as minor nuisances, Renée’s findings highlight their severe consequences. Scammers harvest personal and financial information, keeping users locked in cycles of misleading ads and phishing attempts. The only beneficiaries of this system are the scammers themselves.

In conclusion, Renée’s research underscores the dangers of push notifications when misused by cybercriminals. While push notifications can be valuable engagement tools, they can also serve as a gateway for scams. Users should remain alert, avoid clicking suspicious notifications, and never share personal information in response to unsolicited alerts.

What Happens When Push Notifications Go Malicious?

Plus: The world’s “largest illicit online marketplace” gets hit by regulators, police seize the Garantex crypto exchange, and scammers trick targets by making up ransomware attacks.

As Donald Trump’s administration continues its relentless reorganization of the United States federal government, documents obtained by WIRED showed this week that the Department of Defense is looking at cutting as much as three-quarters of its workforce that’s specifically focused on stopping proliferation of chemical, biological, and nuclear weapons. Meanwhile, the US Army is using its “CamoGPT” AI tool to “review” diversity, equity, inclusion, and accessibility policies per Trump administration orders. The military originally developed the AI service to improve productivity and operational readiness.

US civil liberties organizations are pushing the director of national intelligence. Tulsi Gabbard, to declassify details about Section 702 of the Foreign Intelligence Surveillance Act—a central overseas wiretap authority that is notorious for also capturing a large number of calls, texts, and emails made or sent by Americans. And the US Justice Department on Wednesday charged 10 alleged hackers and two Chinese government officials over digital crimes spanning more than a decade as part of China’s extensive hack-for-hire ecosystem.

Ongoing analysis from a consortium of researchers led by Human Security found that at least a million low-price Android devices, like TV streaming boxes and tablets, have been compromised as part of a scamming and ad fraud campaign known as Badbox 2.0. The activity, which the researchers say comes out of China, is an evolution of a previous effort to backdoor similar devices.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Cybercriminals Allegedly Used a Backdoor to Steal Taylor Swift Tickets**

Two people who allegedly worked as part of a group to access nearly 1,000 tickets to concerts and other events—many for Taylor Swift’s Eras Tour—before selling them on for more than $600,000 profit were arrested and charged with the potential crimes in Queens this week. Tyrone Rose, 20, and Shamara P. Simmons, 31, of Jamaica, Queens, were arrested and arraigned in connection to the theft and sales, according to Queens district attorney Melinda Katz.

Between June 2022 and July 2023, it is alleged that 350 orders—totaling 993 tickets—on ticketing platform StubHub were accessed at a third-party contractor called Sutherland. “The Sutherland employees, defendant Tyrone Rose and an unapprehended accomplice, allegedly used their access to StubHub’s computer system to find a backdoor into a secure area of the network where already sold tickets were given a URL and queued to be emailed to the purchaser to download,” the district attorney’s office wrote in a statement.

They then emailed URLs to another accomplice who has since died, the office says, before posting the tickets to StubHub for resale. While the investigations are ongoing, the District Attorney’s office claimed the proceeds of the cybercrime totaled around $635,000 and also involved tickets for Ed Sheeran concerts, NBA games, and the US Open Tennis Championships.

**Payment Provider Linked to ‘Largest Illicit Online Marketplace’ Loses Banking License**

Every year, criminals make billions from the operations of highly organized scam compounds in Southeast Asia. As these operations have grown in sophistication, so has the wider ecosystem that supplies them with the technology and services needed to run the scams. And experts say there’s no bigger marketplace than Huione Guarantee—a Cambodian gray market selling scam services that researchers claim has facilitated more than $24 billion in transactions.

This week, according to a report by Radio Free Asia, the banking arm of Huione Guarantee’s parent company, Huione Group, had its financial license suspended by officials in Cambodia. According to the report, the Huione Pay service had its license withdrawn for failing to comply with “existing regulations.” The United Nations Office on Drugs and Crime and crypto tracing firm Elliptic previously had linked money moving through Huione Pay to cyberscamming. “They are willing facilitators of pig butchering and other fraud, so any regulatory action against them should be welcomed,” Elliptic founder Tom Robinson claimed to Radio Free Asia.

**Russian Cryptocurrency Exchange Garantex Taken Down in Law Enforcement Action**

The US Department of Justice announced an operation this week with Germany and Finland to disrupt the digital infrastructure behind notorious Russian cryptocurrency exchange Garantex. For years, the platform has allegedly been used for money laundering and other criminal transactions, including sanctions evasion. The DOJ claimed in its announcement that “transnational criminal organizations—including terrorist organizations” have utilized the exchange. Law enforcement said that the platform has processed at least $96 billion in cryptocurrency transactions since April 2019. US authorities said they froze over $26 million in funds used to facilitate money laundering as part of the Garantex takedown.

**Scammers Are Impersonating Notorious Ransomware Attackers to Extort Targets**

The FBI warned this week that scammers pretending to be attackers from the BianLian ransomware gang are demanding ransoms from corporate executives in the US. The demands include claims that the group has breached a company’s network and threaten to publish sensitive information unless a target pays up. Such criminal digital extortion is common enough that scammers apparently feel that they can plausibly make the claims and intimidate targets without even attacking them. The FBI says that the scammers’ ransom demands say that they come from BianLian and range from $250,000 to $500,000 payable via a QR code that links to a Bitcoin wallet. The real BianLian group has links to Russia and has targeted US critical infrastructure since June 2022, according to a November alert from the US Cybersecurity and Infrastructure Security Agency.

Cybercriminals Allegedly Used a StubHub Backdoor to Steal Taylor Swift Tickets

Outpost24’s KrakenLabs reveals EncryptHub’s multi-stage malware campaign, exposing their infrastructure and tactics through critical OPSEC failures. Learn how…

Outpost24’s KrakenLabs reveals EncryptHub’s multi-stage malware campaign, exposing their infrastructure and tactics through critical OPSEC failures. Learn how this rising cybercriminal group operates and the threats they pose.  

In a recent in-depth investigation, Outpost24’s specialized threat intelligence team, KrakenLabs, identified previously undisclosed aspects of a sophisticated malware operation known as EncryptHub. KrakenLabs’ analysis, shared with Hackread.com, provides a detailed understanding of the group’s operational infrastructure, tools, and characteristic behavioural patterns.

This enhanced understanding was made possible by a series of security lapses on the part of EncryptHub, which, according to Outpost24, inadvertently exposed crucial elements of their malicious ecosystem.

These operational errors include the enabling of directory listings on their core infrastructure, the storage of stolen data alongside malware files, and the exposure of Telegram bot configurations used for data theft and campaign oversight.

EncryptHub’s attack campaigns are characterized by multi-layered PowerShell scripts, designed to collect system information, extract valuable data, implement evasion techniques, inject malicious code, and deploy additional data-stealing programs. Their distribution methods include the use of trojanized versions of popular applications and the employment of third-party pay-per-install services. The group prioritizes stolen credentials based on factors such as cryptocurrency holdings, corporate network access, and VPN usage.

Furthermore, EncryptHub is developing a remote access tool, “EncryptRAT,” which features a command-and-control panel for managing infected systems, suggesting potential future commercialization. The group also actively monitors the ongoing cybersecurity trends, integrating newly discovered vulnerabilities into their attacks.

EncryptHub has tested various methods to deploy malware without detection, including disguising malicious software as legitimate applications. During the investigation, researchers observed the group used counterfeit versions of applications like QQ Talk, WeChat, and Microsoft Visual Studio 2022 signed with revoked code-signing certificates, and later with certificates issued by Encrypthub LLC. These trojanized applications contained PowerShell scripts to download and execute further malicious code, gathering system information and deploying data stealers.

Another distribution method involved the use of LabInstalls, a pay-per-install service, which facilitates the rapid deployment of malware through automated Telegram bots. It is available for as low as $10 (for 100 loads) to up to $450 (for 10,000 loads). EncryptHub confirmed their use of this service through feedback posted on an underground forum.

Encrypthub’s positive feedback on an underground forum “XSS” (Source: Outpost24)

The group’s attack process, or killchain, has evolved, with the latest version involving a multi-stage PowerShell script execution. The initial script steals sensitive data, including messaging sessions, cryptocurrency wallet information, and password manager files. It then downloads and executes a second script, which deploys further malicious components, including a modified Microsoft Common Console Document. The final stage involves the deployment of Rhadamanthys, an information stealer.

EncryptHub’s Killchain and Attack Process (Source: Outpost24)

EncryptHub is also developing a command-and-control panel, EncryptRAT, which allows for the management of infected systems, remote command execution, and the monitoring of stolen data. The tool’s development suggests a potential move towards commercialization, with features like multi-user support and segregated data storage.

KrakenLabs’ findings emphasise the need for continuous monitoring and enhancing security measures to counter the evolving threats posed by groups like EncryptHub. The group’s ability to adapt and utilize both in-house tools and third-party services highlights the importance of multi-layered security strategies.

EncryptHub’s OPSEC Failures Expose Its Malware Operation

Microsoft Threat Intelligence exposes a malvertising campaign exploiting GitHub, Discord, and Dropbox. Discover the multi-stage attack chain, the…

Microsoft Threat Intelligence exposes a malvertising campaign exploiting GitHub, Discord, and Dropbox. Discover the multi-stage attack chain, the use of LOLBAS, and the various malware payloads. Get detailed analysis, IOCs, and mitigation recommendations.

Microsoft’s Threat Intelligence team has recently dismantled a large-scale malvertising campaign that impacted nearly one million devices worldwide. The primary targets were Windows systems running various browsers, including Chrome and Edge and it impacted a wide range of organizations, from individual users to large enterprises, which demonstrates its widespread impact.

Tracked under the name Storm-0408, this campaign was discovered in December 2024 and involved a multi-stage attack chain. According to Microsoft’s research report, shared with Hackread.com, the attack originated from illegal streaming websites where the attackers utilized compromised GitHub repositories to distribute malware as well as Discord and Dropbox for hosting some payloads. The malicious GitHub repositories have since been removed.

Users were initially redirected from illegal streaming sites, which embedded malicious advertisements within video frames “to generate pay-per-view or pay-per-click revenue,” leading to intermediate websites. These websites then redirected users to GitHub, where the first-stage malware payloads were hosted.

These repositories served as a launchpad for deploying additional malware and scripts. The initial malware established a foothold on the compromised devices, enabling the deployment of subsequent payloads – designed to collect system information and exfiltrate documents and data from the affected systems. 

The initial access payloads on GitHub were typically obfuscated JavaScript files that initiated the download and execution of further malware. The attack chain consisted of multiple stages, each with specific objectives as Microsoft explained in this image:

Attack Stages and Attack Chain (Source: Microsoft)

The first-stage payload, hosted on GitHub, acted as a dropper for the second-stage files. These files were used for system discovery, collecting information such as memory size, graphics details, screen resolution, operating system, and user paths. This data was then Base64-encoded and exfiltrated to a command-and-control (C2) server. A typical redirection chain might look like this:

illegalstreamingsite.com/movie.html -> malvertisingredirector.com/redirect.php -> intermediarysite.net/landing.html -> github.com/malicioususer/malware.js.

Depending on the second-stage payload, various third-stage payloads were deployed, which conducted additional malicious activities, including C2 communication, data exfiltration, and defence evasion techniques.

The attackers also utilized legitimate tools and scripts, and most importantly a technique known as “living-off-the-land binaries and scripts” (LOLBAS), to blend in with normal system activity. For example, one common tactic was to inject malicious code into the legitimate RegAsm.exe process to establish C2 connections and exfiltrate data.

The campaign employed a modular approach, with each stage dropping another payload with distinct functions including system discovery, credential theft, and data exfiltration. Persistence was achieved through modifications to the registry and the creation of shortcut files in the Windows Startup folder.

The prompt collaboration between Microsoft and GitHub in taking down malicious repositories highlights the importance of industry cooperation in combating cyber threats.

Microsoft has provided detailed recommendations to mitigate the impact of this threat, including strengthening Microsoft Defender for Endpoint configurations, enhancing operating environment security, and implementing multi-factor authentication.

Ensar Seker, Chief Security Officer at SOCRadar commented on the latest development stating, “The attackers used geofencing, device fingerprinting, and cloaking techniques to evade detection, which means the malicious payload is only delivered to targeted users, making it harder for security solutions to track and mitigate the campaign.”

“This campaign is likely part of a broader MaaS (Malware as a Service) ecosystem, where attackers use pre-built malvertising kits to distribute payloads like stealers, ransomware, and banking trojans,” Ensar added. “Malvertising has traditionally targeted Windows users, but with more professionals using macOS and Linux, we’ll see cross-platform payloads becoming more common.”

Microsoft Dismantles Malvertising Scam Using GitHub, Discord, Dropbox

Tulsi Gabbard, the director of national intelligence, has long held anti-surveillance views. Now she oversees a key surveillance program she once tried to dismantle.

Former US congresswoman Tulsi Gabbard’s ascendance to director of national intelligence last month signaled a major shift in views toward government surveillance at the highest rung of the US intelligence community. While backing down from some of her more extreme anti-surveillance views in the run-up to her confirmation, Gabbard nevertheless held fast to a few promises of reform that have been traditionally eschewed by federal law enforcement leaders.

Now, some of the nation’s premier civil liberties organizations have begun lobbying America’s “top spy” to follow through on a pledge to bring about new levels of oversight and transparency to a key US surveillance program that’s long been plagued by reports of misuse.

Led by the American Civil Liberties Union, at least 20 major privacy groups this week urged Gabbard to declassify information concerning Section 702 of the Foreign Intelligence Surveillance Act (FISA)—the nation’s cornerstone wiretap authority that, while aimed at collecting intelligence on foreigners overseas, is known to vacuum up large quantities of calls, texts, and emails belonging to Americans.

In a letter first obtained by WIRED, the groups privately urged Gabbard this week to declassify information regarding the types of US businesses that can now be secretly compelled to install wiretaps on the US National Security Agency’s (NSA) behalf.

While it’s no secret that the government routinely compels phone and email service providers like AT&T and Google into conducting wiretaps, Congress passed a new provision last year expanding the range of businesses that can receive such orders. Legal experts had warned in advance that the provision was far too ambiguous and likely to vastly increase the number of Americans whose communications are wiretapped. But their warnings were not heeded.

It is widely assumed that the classified purpose behind the expanded authority is allowing the government to obtain access to communications in US data centers. Lawyers for the US Justice Department attempted to unilaterally expand the reach of the program in 2022, but its efforts were foiled by the secret surveillance court that oversees FISA. Only Congress has the power to expand FISA, the department was told.

As its a matter of secret law, lawmakers were unable to specify much about the limits of the government’s access in the provision they ultimately passed. This inevitably led to the adoption of a vague new definition for what the government calls an “electronic communications service provider” (ECSP)—the term for companies whose cooperation can be compelled under FISA.

Privacy experts and industry leaders had likewise raised concerns about introducing ambiguity into a law that defines the scope of a powerful surveillance tool, warning the changes could expose a near limitless new range of new businesses to secret government demands.

As WIRED reported last spring, opponents of the provision in Washington had cast the surveillance program’s new parameters as effectively “Stasi-like”—a reference to the defunct East German secret police agency notorious for infiltrating industry and forcing private citizens to spy on one another.

Senator Ron Wyden of Oregon, a renowned privacy hawk who has served on the Senate intelligence committee since just after 9/11, has referred to the new provision as “one of the most dramatic and terrifying expansions of government surveillance authority in history.”

Declassifying the new types of businesses that can actually be considered an ECSP is an essential step in bringing about clarity to an otherwise nebulous change in federal surveillance practices, according to the ACLU and the other organizations joined in its effort. “Without such basic transparency, the law will likely continue to permit sweeping NSA surveillance on domestic soil that threatens the civil liberties of all Americans,” the groups wrote in their letter to Gabbard this week.

The Office of the Director of National Intelligence did not respond to multiple requests for comment.

In addition to urging Gabbard to declassify details about the reach of the 702 program, the ACLU and others are currently pressing Gabbard to publish information to quantify just how many Americans have been “incidentally” wiretapped by their own government. Intelligence officials have long claimed that doing so would be “impossible,” as any analysis of the wiretaps would involve the government accessing them unjustifiably, effectively violating those Americans’ rights.

The privacy groups, however, point to research published in 2022 out of Princeton University, which details a methodology that could effectively solve that issue. “The intelligence community’s refusal to produce the requested estimate undermines trust and weakens the legitimacy of Section 702,” the groups say.

Gabbard is widely reported to have softened her stance against government spying while working to secure her new position as director of the nation’s intelligence apparatus. During the 116th Congress, for instance, Gabbard introduced legislation that sought to completely dismantle the Section 702 program, which is considered the “crown jewel” or US intelligence collection and crucial to keeping tabs on foreign threats abroad, including terrorist organizations and cybersecurity threats—exhibiting a stance far more extreme than those traditionally held by lawmakers and civil society organizations who’ve long campaigned for surveillance reform.

While begging off from this position in January, Gabbard’s newly espoused views have, in fact, brought her more closely in line with mainstream reformers. In response to questions from the US Senate ahead of her confirmation, for example, Gabbard backed the idea of requiring the Federal Bureau of Investigation to obtain warrants before accessing the communications of Americans swept up by the 702 program.

Slews of national security hawks from former House speaker Nancy Pelosi to former House intelligence committee chairman Mike Turner have long opposed this warrant requirement, as traditionally have all directors of the FBI. “This warrant requirement strengthens the \[intelligence community\] by ensuring queries are targeted and justified," Gabbard wrote in response to Senate questions in late January.

The Section 702 program was reauthorized last spring, but only for an additional two years. Early discussions about reauthorizing the program once more are expected to kick off again as early as this summer.

Sean Vitka, executive director of Demand Progress, one of the organizations involved in the lobbying effort, notes that Gabbard has a long history of supporting civil liberties, and refers to her recent statements about secret surveillance programs “encouraging.” “Congress needs to know, and the public deserves to know, what Section 702 is being used for,” Vitka says, “and how many Americans are swept up in that surveillance.”

“Section 702 has been repeatedly used to conduct warrantless surveillance on Americans, including journalists, activists, and even members of Congress,” adds Kia Hamadanchy, senior policy counsel for the ACLU. “Declassifying critical information, as well as providing long-overdue basic data about the number of US persons whose communications are collected under this surveillance are essential steps to increasing transparency as the next reauthorization debate approaches.”

Tag

#intel