Issue #194 | October 2026, Week 3

Dos ciudadanos estadounidenses detenidos por ayudar en un fraude TI norcoreano

Jurisdicción

The United States

Actor de amenazas

Individuo

Actividad delictiva

Fraude informático

Daño estimado

Over $3 million

Medida de aplicación

Arresto

Estado del caso

Investigación en curso

Two US nationals have been arrested for allegedly helping North Korean IT workers get remote jobs at American companies using fake identities. The scheme reportedly generated more than $3 million between 2019 and July 2025.

The suspects, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, allegedly helped workers hide their real locations and appear to be based in the United States. The scheme affected more than 70 US companies.

According to the indictment, the suspects hosted company-issued laptops at US locations, allowing overseas workers to access them remotely. The workers allegedly used fake identities, VPNs, and proxy services to secure jobs.

As part of Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of operating as laptop farms. Authorities seized 187 laptops and KVM devices linked to the alleged scheme. The indictment also names 10 individuals based in China.

Hacker convicted of stealing $53M from the Uranium Finance crypto exchange

Jurisdicción

The Unites States

Actor de amenazas

Individuo

Actividad delictiva

Cryptocurrency theft

Daño estimado

Over $53.3 million

Medida de aplicación

Arresto

Estado del caso

Conviction

A 36-year-old man has been found guilty of stealing more than $53 million from the Uranium Finance cryptocurrency exchange in two attacks in April 2021.

Jonathan Spalletta, also known online as “Jspalletta” and “Cthulhon,” exploited flaws in the exchange’s smart contract code to steal cryptocurrency. The first attack took place on April 8, when he stole about $1.4 million. Three weeks later, he carried out a second attack, stealing around $53.3 million, after which the exchange was forced to shut down due to lack of funds.

Spalletta later moved the stolen funds through cryptocurrency services to hide their origin. He used some of the money to buy expensive collectibles, including rare Pokémon and Magic: The Gathering cards, as well as an ancient Roman coin.

In February 2025, law enforcement seized the collectibles from his home and recovered about $31 million in cryptocurrency from linked wallets. Spalletta now faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.

An international operation targets online scams in West Africa

Jurisdicción

West Africa

Actor de amenazas

Multiple actors

Actividad delictiva

Fraude en línea; trata de personas

Daño estimado

Over $8.3 million

Medida de aplicación

Arresto

Estado del caso

Investigación en curso

The US Department of Justice has announced the results of an international operation targeting online scam accounts and criminal networks operating in West Africa.

The operation involved law enforcement agencies from the United States, the United Kingdom, Nigeria, Ghana, and several other countries, along with INTERPOL and private technology companies.

In Ghana, authorities arrested 19 people and seized 303 electronic devices. Police also identified 117 suspected human trafficking victims awaiting repatriation to Nigeria and 89 scam victims who reportedly lost around $8.3 million.

In Nigeria, authorities arrested nine people and seized 53 electronic devices during the operation. Across six locations in Ghana, officials also reported dozens of arrests, the identification of 34 trafficking victims, and the seizure of 129 electronic devices.

The disrupted schemes included scams in which criminals impersonated law enforcement officers, threatened victims with fake arrests, and offered fraudulent cryptocurrency investments.

Chinese-language phishing market; hacking tools disrupted in a series of actions

Jurisdicción

The Unites States

Actor de amenazas

Varias entidades

Actividad delictiva

Phishing, online fraud

Daño estimado

Tens of millions of dollars

Medida de aplicación

Infrastructure takedown

Estado del caso

Investigación en curso

Microsoft and Health-ISAC have seized and redirected domains linked to three services (YAM Store, CoGUI and Iron Man) used by cybercriminals to obtain accounts, phishing kits and tools for online fraud.

Según Microsoft, con estos servicios se enviaron más de mil millones de mensajes maliciosos desde enero de 2026. Las campañas apuntaron a consumidores y a más de 75 000 organizaciones en más de 150 países. Al parecer, los operadores ganaron decenas de millones de dólares.

Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking over 100,000 domains used for impersonation and fraud.

YAM Store (aka Storm-3119) sold access to compromised or fraudulently obtained accounts and online environments, including accounts linked to Microsoft and Google. Buyers could select accounts based on factors such as age, subscription and organization type.

The marketplace also offered phishing kits tracked as Storm-2990, including CoGUI, Haozi and Iron Man. CoGUI was used against victims in Japan and the United States; Iron Man began gaining ground by mid-2026 after YAM Store started promoting it in June.

In a separate action, US authorities seized two tools (Microscan and FishHub) allegedly used by China-linked Flax Typhoon threat actors. Microscan was used to find weaknesses in computer networks; FishHub helped attackers gain access through phishing, install malware, and steal files.

Según se ha informado, estas herramientas se utilizaron contra organizaciones en Estados Unidos, Taiwán, Japón, Polonia y otros países, incluidas empresas eléctricas, aeropuertos, universidades y organizaciones no gubernamentales.

Police arrest alleged operators of the OLVX and Stryx cybercrime platforms

Jurisdicción

North Macedonia, France

Actor de amenazas

Individuo

Actividad delictiva

Operation of the cybercrime platforms

Daño estimado

Not disclosed

Medida de aplicación

Arresto

Estado del caso

Investigación en curso

Police in North Macedonia have arrested the alleged administrator of OLVX, an online marketplace used by cybercriminals to buy and sell stolen personal data, login credentials, and tools for illegal activities.

The suspect was not publicly named. The police said that the suspect managed OLVX-related websites and domains between 2023 and 2025. During that time, the platform offered more than 1,500 sets of stolen login credentials that could give criminals access to user accounts and computer networks.

Authorities also linked the suspect to an online Telegram group called ONEMILI, which allegedly offered software and services for cybercrime, including fraudulent refund schemes. Authorities also found evidence that the suspect had obtained and possessed child sexual abuse material (CSAM) through Telegram.

In the meantime, France’s anti-cybercrime unit has shut down two websites suspected of selling stolen data and arrested three 17-year-olds believed to be behind them. The platform, initially known as Reacher and later renamed Stryx, allegedly offered stolen personal information, including names, addresses, and bank account numbers. It claimed to hold 730 million lines of data and had received 3.1 million requests. If convicted, the three teenagers could face up to 10 years in prison.