This week’s roundup reads like a courtroom docket crossed with an infrastructure threat briefing: a steady drumbeat of law enforcement wins against dark web kingpins and ransomware gangs, a fresh reminder that even the people hired to help victims can be part of the problem, and a sobering slate of ICS advisories showing how much of the physical world still runs on fragile software. There’s also a squid. Let’s get into it.
The 40-year sentence handed to Empire Market co-creator Raheim Hamilton is one of the stiffer penalties we’ve seen for dark web marketplace operators, and the forfeiture of over $100 million in Bitcoin underscores just how lucrative these platforms were before their operators got caught. Empire Market was a major successor to AlphaBay and Hansa in the post-2017 dark web economy, and this sentence sends a clear signal that running a drug marketplace at scale carries consequences on par with traditional narcotics trafficking — crypto laundering aside.
Perhaps the most jaw-dropping item this week is Brian Krebs’s report on the arrest of a ransomware negotiation firm’s founder, tied to the investigation into ShinyHunters’ breach of FBI data. The ransomware “negotiation” industry has long drawn scrutiny over conflicts of interest — firms that claim to help victims while sometimes quietly brokering payments that enrich the same criminal ecosystem they’re supposedly fighting. If this arrest bears out the worst suspicions, it could force a reckoning across the incident-response industry about who exactly is on whose side.
That suspicion is echoed directly by the DOJ’s charges against a ransomware recovery CEO accused of secretly paying hackers while overbilling clients who believed their data was being recovered through legitimate means. Together with the Krebs story, this points to a disturbing pattern: the “recovery” layer of the ransomware economy may itself be rife with undisclosed payments and fraud, turning victims’ desperation into a second revenue stream for the same criminal networks.
On the enforcement side, Japan’s confirmation of a Qilin ransomware operative’s arrest and extradition to Germany is a useful reminder that international cooperation against ransomware gangs, while slow, is producing real results. Qilin has been one of the more prolific ransomware-as-a-service operations in recent years, and peeling off individual operatives — especially ones willing to travel or transit through cooperative jurisdictions — chips away at the operational security these groups rely on.
Further down the pipeline of justice, Oleg Korniev’s guilty plea for running the “Your Mule Cashout” network from 2007 to 2014 is a reminder that money laundering infrastructure for cybercrime often predates and outlasts the headline-grabbing hacking groups themselves. These mule networks are the unglamorous plumbing that makes cybercrime profitable, and prosecutions like this matter even when the underlying hacks are over a decade old.
Speaking of ShinyHunters, another arrest tied to the group shows the FBI leaning hard into public messaging about its pursuit of the collective, with Director Kash Patel vowing to “disrupt what’s left” of the group. Given that ShinyHunters has reportedly touched everything from corporate breaches to the FBI’s own agent data, this is as much reputational damage control as it is law enforcement — though that doesn’t make the arrests less meaningful.
Healthcare wearables got their own scare this week with news that iRhythm, maker of cardiac monitoring sensors, is notifying states about a breach from this summer that affected hundreds of thousands of people. Medical device and health-tech companies continue to be attractive targets precisely because the data they hold — biometric, financial, and medical — is some of the most sensitive and difficult to remediate once exposed. Expect more detail to trickle out as state notification requirements force disclosure.
On the geopolitical front, the Belarusian Cyber Partisans’ admission that they spent months inside Moscow’s Department of Health network back in 2023 is a fascinating data point in the murky world of hacktivism-as-geopolitics. That the hacktivists’ account now aligns with Russian researchers’ own findings lends credibility to both sides’ claims, and it’s a useful case study in how politically motivated hacking groups are increasingly operating with nation-state-level persistence and patience.
AI’s role in information warfare also surfaced this week, with OpenAI’s disclosure that it disrupted Russian and Iranian influence operations using ChatGPT, including a Latin American propaganda effort and a cluster of fake Iranian “journalist” personas. These disclosures have become a near-routine feature of OpenAI’s safety reporting, and while the company deserves credit for transparency, the steady cadence of these takedowns is also a reminder that generative AI has become a standard tool in the influence-operations playbook — not a hypothetical risk, but an operational reality.
Then there’s the eyebrow-raising report that lawmakers are warning about a proposed $10 million deal that could see Google use Spirit Airlines data — including some 100 million emails and 500 million Teams messages — for AI training. If accurate, this would represent an extraordinary volume of employee and corporate communications data flowing into a training pipeline, raising obvious questions about consent, scope, and whether bankruptcy-driven data sales are becoming a backdoor around normal privacy safeguards. This is a story worth watching closely as more companies look to monetize data troves during financial distress.
On the nation-state front, the international seizure of tools used by Integrity Tech, the firm behind the Flax Typhoon campaign, is a notable multinational effort to disrupt Chinese state-linked hacking infrastructure. This pairs directly with CISA’s advisory detailing how Chinese government-linked actors are blending automated scanning, botnets, and hands-on exploitation to target critical infrastructure. Reading these two items together paints a clear picture: this isn’t a single opportunistic campaign but a persistent, resourced operation with both automated reach and human expertise applied where it counts — exactly the combination that makes state-linked threats so hard to fully dislodge even after a takedown.
Closer to home for consumers, ASOS’s disclosure that attackers social-engineered their way into an employee account and pushed a rogue notification is a familiar story in 2026: technical defenses are only as strong as the humans who can be phished, MFA-fatigued, or tricked into approving a push they shouldn’t. Retailers holding large customer databases remain prime targets precisely because the payoff from a single successful social engineering attempt can be enormous.
Meanwhile, a smaller but illustrative case out of London saw a SIM-swapper sentenced to two and a half years for stealing nearly $260,000, reportedly spent in part on gold grills. It’s a reminder that not every cybercrime story involves nation-states or ransomware cartels — SIM-swapping remains a persistent, profitable crime against individuals, and the flashy spending habits of convicted fraudsters continue to provide prosecutors (and headline writers) with easy material.
More unsettling is the report on leaked chats showing a Russian extortion gang directing human “agents” embedded in US law firms. This moves beyond pure cyber intrusion into something closer to old-school human infiltration, with operatives tracking victims and negotiating multimillion-dollar payments from the inside. Law firms hold uniquely sensitive client data, and if extortion gangs are now willing to insert people physically rather than rely solely on remote hacking, that’s a meaningful escalation in tradecraft worth flagging to corporate security teams.
Religious institutions weren’t spared either: two of South Korea’s largest megachurches are investigating breaches that may have exposed personal, financial, and internal data on hundreds of thousands of congregants. Large religious organizations often hold membership and donation databases comparable in size and sensitivity to those of mid-sized corporations, yet frequently lack equivalent security budgets — making them an increasingly attractive, and increasingly targeted, class of victim.
Rounding out the infrastructure side of the ledger, this week’s CISA ICS advisories are worth a careful read for anyone managing industrial environments. The Red Lion Controls N-Tron 700 Series advisory flags vulnerabilities that could let an attacker gain administrative access to network switches and trigger continuous reboots — a potentially serious availability risk for industrial networks relying on these devices. The Grid Protection Alliance openPDC and openHistorian advisory covers a cluster of CVEs affecting software used in power grid monitoring and historian systems, which is particularly concerning given how central these tools are to grid situational awareness. And the Satel Netco Design advisory details cross-site scripting and resource exhaustion flaws that could allow arbitrary code execution. None of these individually scream catastrophe, but collectively they reinforce a now-familiar truth: industrial control software remains under-patched and under-scrutinized relative to its real-world stakes, and this week’s Chinese state-actor advisory above should make patching these particular systems feel less theoretical.
And finally, in the spirit of ending on something lighter: Bruce Schneier’s Friday squid blogging entry about catching an actual longfin squid off Gloucester, MA is a welcome palate cleanser after a week of ransomware gangs, state-linked hackers, and vulnerable grid software. Sometimes the best security blogging tradition is the one that has nothing to do with security at all — just a reminder that there’s a whole analog world out there, best enjoyed grilled hot and fast.
Leave a Reply