Issue #197 | November 2026, Week 1

The US extradites Israeli-Russian national over $2.89M Nomad Bridge hack

Jurisdiction

United States

Threat Actor

Individual

Incriminated Activity

Hacking, cryptocurrency theft, money laundering

Estimated Damage

$2.89 million

Enforcement Action

Arrest, extradition

Case Status

Charges filed

The United States has extradited Alexander Gurevich, a 49-year-old dual Russian-Israeli national, from Israel to face charges over his alleged role in the 2022 hack of the Nomad Bridge cryptocurrency platform.

According to a 2023 indictment, Gurevich exploited a vulnerability in Nomad Bridge’s smart contract, stealing approximately $2.89 million in cryptocurrency. He allegedly took 103 WBTC and 300 WETH before moving the funds through several crypto addresses to hide their origin.

After the theft, Gurevich reportedly demanded a $500,000 reward to return the stolen funds and provide details about the vulnerability. The attack was part of a series of exploits that resulted in more than $190 million being stolen from Nomad Bridge in August 2022.

Gurevich was arrested in Israel in May 2025 and has now been extradited to the US. He faces charges including causing damage to a protected computer, transporting stolen money across state lines and money laundering. If convicted, he could face up to 20 years in prison for money laundering, along with additional prison time and fines for the other charges.

Syrian hacker sentenced to 42 months in US prison

Jurisdiction

United States

Threat Actor

Individual

Incriminated Activity

Hacking

Estimated Damage

Not disclosed

Enforcement Action

Arrest

Case Status

Prison imprisonment

A member of the Syrian Electronic Army hacking group has been sentenced to 42 months in prison by a US court.

Ahmad Umar Agha, aka Th3Pr0, was responsible for hacking around 47 Western media organizations, businesses, non-governmental organizations (NGOs), and government agencies. He remained on the FBI’s Cyber Most Wanted list for almost a decade before his arrest last year.

According to US authorities, the hacking group targeted organizations that reported on the former Syrian government’s actions during the Arab Spring and the Syrian Civil War. The group’s activities also included spreading false information, collecting intelligence for the Syrian government, and attempting to influence members of the US military.

Authorities said that the attacks caused serious financial damage, including contributing to a stock market crash that temporarily wiped $136 billion off the value of companies listed on the Dow Jones Industrial Average. In another incident, a global NGO suffered losses of around $480,000 after spending money on new security tools, system upgrades, and staff training.

Agha and another Syrian Electronic Army member, Firas Dardar, were indicted in 2018. Dardar remains a fugitive and is still wanted by US authorities.

Two Canadians charged with hacking US universities

Jurisdiction

United States

Threat Actor

Individual

Incriminated Activity

Hacking

Estimated Damage

At least $5,000

Enforcement Action

Arrest, extradition

Case Status

Charges filed

Two Canadian men have been charged with hacking several US universities and using their computer systems to mine cryptocurrency.

Ryan James Roach, 35, and Mathiew James Stubbings, 41, are accused of carrying out cyber-attacks between June 2016 and December 2019.

According to prosecutors, the duo infected university networks in New York, Tennessee, North Carolina and Massachusetts with malware.

The men allegedly stole data and login details, installed cryptocurrency-mining software and accessed university supercomputers to research security weaknesses. They are also accused of damaging at least 10 computers, causing losses of more than $5,000.

If found guilty, both men could face up to 10 years in prison and a fine of $250,000. Roach was extradited from Canada to the United States on October 28 and appeared in court on November 3. Stubbings is expected to face court after his extradition.

Seven arrested in international crackdown on online investment scams

Jurisdiction

Europe

Threat Actor

Multiple threat actors

Incriminated Activity

Online investment scams

Estimated Damage

Over €4 million

Enforcement Action

Arrest

Case Status

Investigation pending

European law enforcement authorities have arrested seven suspects and seized more than 100 servers in an international operation targeting an unnamed company accused of providing fraudulent trading websites to criminal groups. According to Europol, the fraudulent operation caused over €4 million in losses.

Police discovered links between several call centers involved in investment scams, with victims identified in at least 50 countries. The company is suspected of running a criminal service from Cyprus and Israel, providing fake investment platforms to criminal groups.

Scammers attracted victims through online advertisements promising quick and high returns from trading in foreign currencies, stocks and cryptocurrencies. They collected personal information and sold it to criminal groups operating call centers.

The victims were then contacted and encouraged to make small investments. Fraudsters showed them fake accounts displaying fictional profits to gain their trust and pressure them into transferring larger amounts of money. When victims tried to withdraw their funds, the scammers delayed payments and eventually stopped responding.

The operation involved authorities from Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, with support from Europol and Eurojust. It followed a four-year investigation that began in 2022 after a German couple reported being unable to withdraw money invested through an online trading platform.

Russia dismantles VasyGrek cybercrime group, three suspects arrested

Jurisdiction

Russia

Threat Actor

Multiple threat actors

Incriminated Activity

Phishing attacks

Estimated Damage

Not disclosed

Enforcement Action

Arrest

Case Status

Investigation pending

Russian authorities have dismantled the VasyGrek (aka Fluffy Wolf) cybercrime group and arrested three suspected members. The group has been active since at least 2016 and mainly targeted Russian companies through phishing emails designed to steal login details and gain access to corporate networks.

The alleged group leader has been placed under house arrest; two other suspects have been released under travel restrictions.

Police said the hackers used fake websites posing as financial and accounting services, as well as malicious email attachments, to infect computers and access company systems.

In one reported incident, a company employee opened an infected attachment disguised as a financial document. The hackers then gained access to the company's online banking system and allegedly stole more than 660,000 rubles (around $8,000).

Police searched the suspects' homes and offices, seizing computers and other equipment. Researchers linked the group to more than 100 attempted attacks between January and September 2026, targeting organizations in Russia, Belarus and Kazakhstan.

The main targets included industrial companies, government agencies and businesses in the healthcare, energy, finance and oil and gas sectors.