Montenegrin authorities have apprehended an Iranian-Turkish dual citizen wanted by the United States for his alleged role in a cybercrime campaign that caused more than $3.4 billion (€2.98 billion) in damages.

Der 39-jährige Verdächtige, der nur als A.B. identifiziert wurde, wurde in der Küstenstadt Kotor im Rahmen einer gemeinsamen Operation der montenegrinischen Polizei und des US Federal Bureau of Investigation (FBI) festgenommen. Er wird unter anderem wegen Verschwörung zum Computerbetrug, Hacken, Identitätsdiebstahl und organisierter Kriminalität gesucht.

According to Montenegrin police, the suspect allegedly took part in large-scale cyber-attacks against US organizations starting in 2013 while working with an Iranian legal entity. Officials said the attacks targeted more than 150 American universities, where hackers stole academic research and other data, causing an estimated $3.4 billion in losses.

Authorities also claim the stolen data and compromised university accounts were used to support Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian institutions, including universities. The suspect is expected to appear before a court in Podgorica, which will decide whether he will be extradited to the United States.

Im Jahr 2018 anklagten die US-Behörden neun iranische Staatsangehörige, Universitäten und andere Organisationen gehackt zu haben, um akademische Forschungsergebnisse und geistiges Eigentum zu stehlen. Es ist noch unklar, ob die jüngste Festnahme mit dem Fall aus dem Jahr 2018 in Zusammenhang steht.

Alleged Scattered Spider member was extradited to the US from Finland

A 19-year-old alleged member of the cybercriminal group known as ‘Scattered Spider’ has been extradited from Finland to the United States to face federal charges related to computer hacking, fraud, and conspiracy.

Die US-Bundesstaatsanwälte identifizierten den Verdächtigen als Peter Stokes, einen US-estnischen Doppelstaatsbürger. Laut einer Strafanzeige wurde Stokes im April von finnischen Behörden aufgrund einer Interpol-Rotfahne festgenommen und in der vergangenen Woche in die USA ausgeliefert. Er erschien vor einem Bundesgericht in Chicago, wo ein Richter anordnete, dass er in Gewahrsam bleiben muss.

Authorities allege that Stokes was part of Scattered Spider (also known as Octo Tempest, UNC3944, and 0ktapus), a cybercrime group accused of targeting US companies by gaining unauthorized access to employee accounts via social engineering. The group allegedly stole or encrypted corporate data before demanding cryptocurrency payments in exchange for restoring access or preventing the release of stolen information.

The complaint alleges that Stokes and his co-conspirators breached the computer systems of a luxury jewelry retailer in May 2025, stealing company data and demanding approximately $8 million in cryptocurrency.

Although the retailer's security team removed the attackers from the network before any ransom was paid, the company reportedly suffered more than $2 million in losses from business disruption, investigation costs, and mitigation efforts.

Ukraine and Czech Republic dismantle cross-border investment fraud scheme

Ukrainian cyber police and Czech law enforcement have dismantled an international investment fraud operation that targeted foreign victims via a fake online trading platform.

Authorities say the suspects operated a call center in Turkey, where operators posed as investment advisers and convinced victims to invest in fraudulent financial products. Victims were persuaded to install remote access software, allowing the scammers to take control of their computers, online banking accounts, and cryptocurrency wallets before transferring stolen funds through a network of crypto wallets managed by accomplices in Ukraine.

Authorities conducted 12 searches across Kyiv, the Kyiv region, and Lviv, seizing electronic devices, cryptocurrency wallets, cash totaling more than UAH 250,000 (~$5580) and $25,000, and five luxury vehicles.

Losses from the scheme are estimated at approximately UAH 1.6 million (~$35700). More than $140,000 in cryptocurrency has been traced to wallets controlled by the suspects. Two alleged ringleaders have been charged with fraud-related offenses and money laundering and face up to 12 years in prison if convicted.

Polen verhaftet vier Personen im Rahmen einer großen Ermittlung gegen SIM-Swapping-Kriminalität

Polnische Behörden haben vier mutmaßliche Mitglieder einer organisierten Cyberkriminalitätsgruppe festgenommen, die mit ausgeklügelten SIM-Swapping-Angriffen auf Telekommunikationspartner und Kryptowährungsnutzer beschuldigt werden.

Nach Angaben der Behörden erlangten die Verdächtigen mithilfe spezieller Software und Social-Engineering-Techniken unbefugten Zugriff auf Telekommunikationspartner und die E-Mail-Konten der Mitarbeiter. Die gestohlenen Daten ermöglichten SIM-Swapping-Angriffe, wodurch die Gruppe die Telefonnummern der Opfer übernehmen, SMS-Nachrichten und E-Mails abfangen sowie die Kontrolle über Kryptowährungsbörsen-Konten übernehmen konnte.

Die Behörden schätzen, dass die Gruppe Millionen US-Dollar gestohlen und die Erlöse über mehrere Bankkonten und digitale Geldbörsen in verschiedenen Ländern gewaschen hat. Nach Angaben der CBZC beträgt der Gesamtwert der gewaschenen Gelder mehrere zehn Millionen polnische Złoty (mindestens 5 Millionen US-Dollar).

The four suspects have been placed in pre-trial detention and face charges including participation in an organized criminal group, unauthorized access to IT systems to facilitate theft, and money laundering. If convicted, they could face up to 25 years in prison.

Demo anfordern

ImmuniWeb kann Ihnen helfen, Datenpannen zu verhindern und regulatorische Anforderungen zu erfüllen.

Global crackdown disrupts major sports piracy networks

Die Behörden haben eine Reihe von Operationen zur Bekämpfung der Online-Piraterie durchgeführt. Die Alliance for Creativity and Entertainment (ACE), die UEFA, UC3 und mexikanische Behörden haben 44 PirloTV-bezogene Domains genommen. Das Netzwerk zog schätzungsweise mehr als 950 Millionen Besuche jährlich an.

PirloTV, a network that aggregates and embeds links to unauthorized live sports streams, has long been known for providing access to soccer matches without broadcasting rights. The platform frequently shifts to new web domains after law enforcement actions, which makes it difficult for authorities to shut it down once and for all.

In a separate action, US authorities seized nearly 400 domains that were illegally streaming matches from the 2026 FIFA World Cup. The websites allegedly provided unauthorized real-time broadcasts in violation of US copyright law.

The operation was coordinated with international partners through the International Computer Hacking and Intellectual Property (ICHIP) Network of US prosecutors. Law enforcement agencies targeted servers and domains across multiple countries, including Peru, Bulgaria, Croatia, Romania, Poland, and Colombia.