Despite international crackdowns and high-profile arrests, cybercrime scam centers in Southeast Asia — particularly in Cambodia, Myanmar, Laos, and the Philippines — continue to generate an estimated $40 billion annually. Two new reports from Interpol and Amnesty International reveal that local police corruption is a primary reason enforcement efforts fail, with Cambodian authorities allegedly communicating directly with scam compound managers. Amnesty International found that 73 trafficking survivors were treated as irregular migrants rather than victims, and Cambodia's gambling commission approved casino plans for 16 known scam locations. Internationally, the criminal model is spreading to Africa and other regions, with syndicates adopting multi-layer extortion tactics and improved money laundering strategies. Interpol warns that dismantling individual facilities without addressing the broader ecosystem leads to a Whac-A-Mole dynamic where operations simply relocate.
Nguồn: https://www.darkreading.com/threat-intelligence/police-collusion-crackdown-asian-scam-centers. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
Ransomware attacks in Europe surged 55% in the first four months of 2026 compared to the same period in 2025, with France seeing a 119% increase and Italy 92%. Researchers from Black Kite attribute the shift to US market oversaturation and AI-assisted target research pointing attackers toward European organizations. The number of active ransomware groups has grown from 60 in 2023 to 150 today, filling the vacuum left by law enforcement takedowns of major RaaS operations. Manufacturing and digital services sectors are primary targets, largely because attackers exploit supply chain leverage — breaching one vendor to access hundreds of downstream clients, as demonstrated by the Miljödata attack that exposed data from ~200 Swedish municipalities. Experts recommend organizations map fourth- and fifth-party vendor dependencies and rank vendors by risk proactively rather than reactively.
A Huntress SOC investigation uncovered an Akira ransomware affiliate using an unusual attack chain: the threat actor accessed a hypervisor, spun up a new virtual machine (bypassing installed security tooling), disabled Microsoft Defender, archived target data with WinRAR, and exfiltrated it via Easyupload.io — a file-sharing site now owned by the rebranded LimeWire platform. The VHDX image of the VM provided forensic analysts a clear timeline of attacker activity, including Active Directory enumeration, lateral movement to file servers, and rapid ransomware deployment. The incident highlights how RaaS affiliates adapt TTPs, including creating new VMs to evade endpoint security stacks, and underscores the need to monitor for new endpoint creation within environments.
Mexico's 2025–2030 National Cybersecurity Plan, published by the ATDT in December 2025, outlines a six-phase roadmap to modernize the country's cyber posture. The plan addresses top threats including ransomware, financial malware, hacktivism, state-sponsored attacks, and organized crime. Key milestones include passing a General Cybersecurity Law in 2026, establishing a National Center for Cybersecurity Operations, creating a National Cyber Range by 2027, and integrating AI for cyber defense by 2028. Mexico ranks as a Tier 2 nation in the ITU Global Cybersecurity Index but lags in institutional capacity. The 2026 FIFA World Cup co-hosted by Mexico serves as an immediate stress test for its digital infrastructure. Insikt Group recommends organizations in Mexico adopt international standards like NIST CSF or ISO/IEC 27001, conduct scenario-planning exercises, leverage threat intelligence platforms, and invest in public cyber hygiene education.
India's Tata Electronics has confirmed a cybersecurity incident after ransomware group World Leaks claimed to have stolen over 630GB of data, including purported Apple and Tesla component design files and trade secrets. A 52-page document with Apple's proprietary markings allegedly detailing iPhone circuit-board quality-inspection standards and Tesla Model Y chargeport controller files were listed on a dark-web index. Tata says operations were unaffected, but Apple is investigating and a ransom demand has been received. The authenticity of the files remains unverified. The incident highlights the growing risk of supply chain attacks, where attackers target contract manufacturers to gain leverage over high-profile customers who never directly touched the breached network.
A SANS Internet Storm Center audit of 14 SonicWall firewalls patched for CVE-2024-40766 (CVSS 9.8) found that Akira and Fog ransomware operators had compromised several of them post-patch. The core finding: firmware patching alone is not remediation. Attackers pre-created accounts, harvested credentials, and enrolled their own TOTP devices before patches were applied. Key gaps found across audited devices include stale SSLVPN accounts (12/14), no credential rotation post-patch (11/14), overly permissive LDAP group mappings giving all AD users VPN access (9/14), and publicly reachable TOTP enrollment portals (7/14). Gen 6 hardware is now end-of-life with no further firmware fixes. The recommended checklist covers account auditing, credential rotation, LDAP reconfiguration, portal access restriction, upgrading to SonicOS 7.3.0+, and external log forwarding to a SIEM.
Microsoft's Detection and Response Team (DART) uncovered two separate, unrelated threat actors simultaneously operating inside the same victim network after unpatched on-premises SharePoint servers were exploited. Storm-2603 deployed ransomware using tools like Cloudflare Tunnel and Velociraptor, while a second actor used DLL sideloading, custom backdoors, and attempted Active Directory credential theft. The overlapping intrusions obscured each other, complicating detection and response. DART resolved the case by correlating identity, endpoint, and cloud telemetry. The investigation expanded to a second compromised organization. Key takeaways include prioritizing patching of internet-facing systems, centralizing telemetry, and maintaining tested incident response playbooks.
An international law enforcement operation (Operation Endgame) seized 106 servers and numerous domains tied to SocGholish, a JavaScript malware framework used as an initial-access broker for ransomware groups including Evil Corp. The action also remediated nearly 15,000 compromised WordPress websites. SocGholish relies on traffic distribution systems (TDSs) to redirect users from legitimate sites to fake browser update pages, filtering out researchers and bots while targeting domain-joined enterprise systems for deeper intrusion. The FBI issued guidance urging organizations to change default JavaScript file associations, monitor endpoints for suspicious script execution, keep CMS platforms updated, and audit administrator accounts to defend against TDS-based attacks.
Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.