Skip to content

Topic

Law Enforcement Takedowns

Multi-agency raids, searches, seizures and suspect notifications aimed at disrupting cybercrime and fraud infrastructure.

Current stories

investConfirmed11 publishers

Brooklyn prosecutors seize 112 servers from a crypto scam network that took tens of millions

Brooklyn's District Attorney and the FBI seized 241 domains and 112 servers from a three-year crypto scam aimed at Russian speakers. The same operators then offered victims fake fund recovery, and about $300,000 has been recovered against tens of millions lost.

Perspective Coverage

11 publishers
Builder
Builder 6%
Operator
Operator 53%
Investor
Investor 41%

Reality

Evidence68
Adoption
Not scored
Hype gap+30
Incentives
Not scored
Confidence72
buildOne report1 publisher

After the Flax Typhoon domain seizure, operators are left to hunt the group's tradecraft

FBI and Justice Department investigators seized seven domains that China-linked Flax Typhoon used to scan and in some cases infiltrate critical infrastructure. The risk remains, and with no patch to install, exposed operators have to hunt the group's tradecraft themselves.

Publishers:dev.to

Reality

Evidence55
Adoption
Not scored
Hype gap0
Incentives
Not scored
Confidence45
securityOne report1 publisher

OmniTrust's Sequino says the QScan takedown leaves the hijackable edge devices in place

The DOJ and FBI pulled down two platforms a commentary attributes to Chinese state-sponsored operators. The same piece argues the routers and gateways recruited into those relays are still deployed and still weakly governed.

Publishers:scworld.com

Reality

Evidence20
Adoption
Not scored
Hype gap+35
Incentives80
Confidence55
productOne report1 publisher

DOJ takedown puts hijacked cameras and routers on the critical-path asset inventory

A court order killed two Chinese contractor hacking platforms because their command domains were hard-coded into the malware. The pivot hardware they infected is still nobody's asset.

Publishers:pcmag.com

Reality

Evidence68
Adoption71
Hype gap+14
Incentives62
Confidence60
productOne report1 publisher

DOJ names China's proxy quartermaster; the seizure took domains, not devices

Prosecutors say a Nanjing contractor rented IoT botnets and commercial proxies to the MSS and PLA from 2018. No individuals were charged, and the conscripted hardware stays conscripted.

Publishers:wired.com

Reality

Evidence58
Adoption47
Hype gap+24
Incentives62
Confidence61
securityOne report1 publisher

94 call centres, 1,794 seats, 5,200 SIMs: fraud infrastructure you can actually count

Ukraine's week-long sweep shut 94 impersonation call centres and found 1,794 equipped workstations. The itemised haul is a usable sizing model for anyone tuning fraud detection.

Publishers:cyberpolice.gov.ua

Reality

Evidence54
Adoption63
Hype gap+12
Incentives72
Confidence58
securityOne report1 publisher

Kimwolf's new flood wears Chrome's fingerprints and takes orders from a blockchain

Unit 42 says the Android TV box botnet now floods over HTTP/2 with full Chrome fingerprints and resolves its command server through the Ethereum Name Service, with Tor as a fallback.

Publishers:cyberscoop.com

Reality

Evidence55
Adoption45
Hype gap+15
Incentives65
Confidence50