Issue #196 | October 2026, Week 5
October 29, 2026AI-voiced bank scams and automated hacking tools are now stealing millions from victims and enterprises alike. Meanwhile, US courts are locking up ransomware architects and crypto fraud ring leaders for decades, while the FBI dismantles the shady hosting infrastructure that keeps them online.
Dutch police arrest two suspects in a €380K AI-powered bank fraud
- Jurisdiction
- Netherlands
- Threat Actor
- Individual
- Incriminated Activity
- Bank fraud
- Estimated Damage
- €380,000
- Enforcement Action
- Arrest
- Case Status
- Investigation pending
Dutch police have arrested two men suspected of using artificial intelligence (AI) to steal more than €380,000 from 170 victims in a bank fraud scheme.
The suspects reportedly used AI-generated voice messages to impersonate banks and warn people about suspicious activity in their accounts. Victims were asked to press a number to speak with a fake bank employee.
The fraudsters then told victims to download an app and scan their bank cards by holding the cards against their phones. This allowed the criminals to collect card data through near-field communication (NFC) technology and use it to withdraw money from ATMs.
The suspects, aged 23 and 25, were arrested on October 6. One is believed to have developed the system used in the attacks, while the other helped coordinate the operation.
Police have taken the suspects' servers offline and seized their phones and laptops. Both men remain in custody as the investigation continues.
A former pentester used ARTEX AI in attacks affecting over 90 orgs
- Jurisdiction
- South Korea
- Threat Actor
- Multiple threat actors
- Incriminated Activity
- Cyber-attacks
- Estimated Damage
- Not disclosed
- Enforcement Action
- Arrest
- Case Status
- Investigation pending
South Korean police have apprehended seven suspects linked to a cybercrime operation that breached more than 90 organizations and exposed an estimated 8.2 million records. Police say the group used the ARTEX AI penetration testing framework in most of the attacks.
According to local media, the alleged leader is a 32-year-old self-taught hacker who previously worked at a cybersecurity company from 2019 to 2022. The attacks reportedly began in September 2025 and targeted educational institutions, hospitals, major companies, and golf courses. In 38 incidents, the attacker allegedly demanded a total of 360 million won (€243,600) in ransom payments to not leak the stolen data.
Police said the suspect initially leveraged conventional hacking tools but in late August 2026 adopted AI tools to expand the operation, including ARTEX AI, which was used in attacks against South Korean banks.
Authorities detained all seven suspects, but only the alleged leader remains in custody. He was arrested on October 15, formally detained two days later, and referred to prosecutors on October 23. The other six suspects remain under investigation without detention.
An investigation into the case was launched in June following a victim’s complaint and traced the suspects using server logs from breached organizations.
A hacker sentenced for Nefilim and Hive ransomware attacks causing over $100M in losses
- Jurisdiction
- United States
- Threat Actor
- Individual
- Incriminated Activity
- Computer fraud and extortion
- Estimated Damage
- $100 million
- Enforcement Action
- Arrest
- Case Status
- Prison imprisonment
Artem Stryzhak, a 36-year-old Ukrainian national, has been sentenced to 70 months in prison for his involvement in ransomware attacks targeting hospitals, businesses, law firms, and government agencies worldwide. The attacks caused more than $100 million in losses.
According to court documents, Stryzhak joined the Nefilim ransomware group in June 2021. He worked with other hackers to steal sensitive data, lock victims out of their computer systems, and demand ransom payments to restore access to the files.
He also became one of the early affiliates of the Hive ransomware group, which targeted around 1,500 victims worldwide between June 2021 and January 2023. The attacks disrupted businesses and healthcare services. In one case, a hospital was forced to stop accepting new patients immediately after an attack.
The FBI helped one of Stryzhak’s victims recover its encrypted files by providing a decryption key, allowing the victim to avoid paying a ransom.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December 2025 to two counts of conspiracy related to computer fraud and extortion.
FBI shuts down the Virtualine bulletproof hosting accused of supporting cybercrime
- Jurisdiction
- United States
- Threat Actor
- A bulletproof hosting service
- Incriminated Activity
- Providing support for illegal activities
- Estimated Damage
- Not disclosed
- Enforcement Action
- A domain takedown
- Case Status
- Investigation pending
The FBI has seized the domain of Virtualine, a hosting provider accused of helping criminals carry out cyber-attacks, launder money and distribute child sexual abuse material. The service operated under several names, including Secury, Massgod, Spamhouse, Lanedo and Omegatech.
According to prosecutors, Virtualine advertised hosting services for illegal activities such as phishing, credit card fraud and spam. Despite claiming to ban certain types of illegal content, the company allegedly ignored complaints and continued providing services to suspicious websites.
Court records say that Virtualine helped operators of a criminal online forum create a new website after receiving complaints from authorities in Germany, Canada and Australia, as well as child protection groups and a victim’s lawyer.
The provider also accepted Bitcoin payments through a service designed to avoid anti-money laundering checks and attempt to hide the source of its earnings.
The investigation was led by the FBI’s Washington Field Office, with support from law enforcement agencies in Germany, the Netherlands and the United Kingdom.
A Chinese national arraigned in a $37M crypto scam case
- Jurisdiction
- United States
- Threat Actor
- Individuals
- Incriminated Activity
- Cryptocurrency investment fraud
- Estimated Damage
- $37 million
- Enforcement Action
- Arrest
- Case Status
- Criminal charges
A Chinese national has been arraigned in California after being extradited from the Netherlands over his alleged role in a cryptocurrency investment scam that stole nearly $37 million from 174 victims across the United States.
Prosecutors allege that 44-year-old Zhen Zhao worked with accomplices in the US and Cambodia to trick victims into transferring money for fake digital asset investments. The scammers contacted targets via text messages, social media, phone calls, and online dating platforms, gaining victims’ trust by promising profits.
Officials say that more than $36.9 million was transferred from US bank accounts to an account at Deltec Bank in the Bahamas before being converted into Tether (USDT) and sent to a digital wallet controlled in Cambodia.
Zhao was charged in August 2025 with conspiracy to commit money laundering. If convicted, he faces up to 20 years in prison.
Eight other members of the alleged crime ring have already pleaded guilty. Two have received prison sentences of 51 months and 46 months for their roles in the scheme.
Disclaimer: The information in this blog is provided from open and governmental sources. We respectfully remind our readers about the presumption of innocence. The information herein is provided for educational purposes only and does not constitute legal opinion or advice.