Six cases this week: the Snowflake extortion campaign, the Rydox marketplace, a ShinyHunters arrest, a €1M payment-tampering scheme, and a Bitcoin theft inside the UK’s National Crime Agency.

18
19
17
10
Plus
15
12
11

Vues: 2.9k Temps de lecture:5 min.

Cybercrime Weekly – October 2026, Week 1 – Issue #192

Soldat US condamné à 70 mois pour la campagne d'extorsion Snowflake

Threat Actor: Malicious Actor
Dates of Activities: 2024
Compétence: United States
Offense: Campagne de piratage et d’extorsion
Victims: 165 organizations
Financial Losses: Unknown

Former US Army soldier Cameron John Wagenius, 21, has been sentenced to 70 months in prison for his role in a hacking and extortion campaign targeting at least 10 US technology and telecommunications companies. Wagenius, who used the online names “kiberphant0m” and “cyb3rph4nt0m,” was arrested in Texas in December 2024 and pleaded guilty to hacking AT&T and Verizon, along with aggravated identity theft, wire fraud conspiracy and computer-related extortion.

Court documents say Wagenius and his accomplices stole login credentials and breached corporate networks, then threatened to release stolen data on cybercrime forums unless victims paid ransoms. The group tried to extort at least $1 million and used some stolen information in other fraud schemes.

He is the third person prosecuted over the 2024 Snowflake campaign, which also involves Connor Riley Moucka and John Erin Binns, accused of helping breach more than 165 organizations through accounts linked to Snowflake’s cloud data platform. Victims included AT&T, Ticketmaster, Santander, Los Angeles Unified, LendingTree, Pure Storage, Advance Auto Parts and Neiman Marcus. Moucka pleaded guilty in August 2026 and faces up to 30 years; sentencing is set for 27 October 2026.

Par ailleurs: deux anciens membres de l'US Air Force emprisonnés pour business email fraud

Two former US Air Force members were sentenced to a combined 189 months for phishing and business email compromise. While stationed at Dover Air Force Base, they stole email and financial information and used fake emails to redirect victims’ payments to accounts controlled by their accomplices.

Rydox marketplace admin pleads guilty after 7,600 deals

Threat Actor: Malicious actor
Dates of Activities: Active since 2016
Compétence: United States
Offense: ID theft, money laundering
Victims: Plus de 7 600 transactions
Financial Losses: $232,000 or more

Ardit Kutleshi, 28, a Kosovar national, has pleaded guilty to charges linked to Rydox, an illicit marketplace used to buy and sell stolen personal information and cybercrime tools. According to court documents, Rydox carried out more than 7,600 transactions since at least 2016, generating at least $232,000 in revenue.

Kutleshi pleaded guilty in the US District Court for the Western District of Pennsylvania to aggravated identity theft and conspiracy to commit money laundering. He was arrested in Kosovo in December 2024 and extradited to the United States in 2025; that same month US authorities seized the Rydox[.]cc domain. He faces a mandatory minimum of two years for aggravated identity theft and up to 20 years on the laundering charge.

Dutch police arrest a ShinyHunters suspect in Amsterdam

Threat Actor: Hacker group
Dates of Activities: Unknown
Compétence: Pays-Bas
Offense: Involvement with hacker group
Victims: Unknown
Financial Losses: Unknown

Dutch police have arrested a 24-year-old man from Amsterdam suspected of involvement with the ShinyHunters hacker group. The man was apprehended on 15 September 2026. During a search, police found a large amount of information on his laptop, including details about two planned murders abroad, and suspect he may have ordered the killings; that part of the investigation is separate from the ShinyHunters case. Police also seized several data carriers and have not ruled out further arrests. Authorities have not released the man’s name or further details.

Un Américain condamné à 40 ans pour chantage sexuel sur des mineurs via un compte Snapchat piraté

Malachi Morgan Thomas, a US resident, has been given a 40-year prison sentence for sexual exploitation of children and possession of child sexual abuse material. The US Department of Justice says Thomas used a hacked Snapchat account to coerce girls aged 12 to 17 into performing explicit acts, threatening to hack the victims’ accounts or harm them and their families if they did not comply. Prosecutors said he knew that several victims had a history of anxiety, depression and other mental health issues, that many had previously been subjected to sexual abuse, and that at least one was in foster care.

Spain arrests a suspect behind a €1M parameter-tampering scheme

Threat Actor: Malveillant interne
Dates of Activities: Unknown
Compétence: Espagne
Offense: Online scam
Victims: Major companies, payment gateways
Financial Losses: Plus d'un million d'euros

Spanish National Police have arrested a man allegedly responsible for a network of online scams targeting major companies, with combined losses estimated at more than €1 million. According to authorities, the suspect manipulated communications between users and payment gateways using parameter tampering: by altering transaction parameters, he caused payment systems to validate transactions that had not actually been paid for in full.

Ce stratagème lui a permis d'obtenir des billets pour des concerts et des événements, des billets d'avion, des réservations d'hôtel et d'autres services, y compris des livraisons de repas provenant de restaurants haut de gamme. Il a également accédé à des plateformes internes des entreprises pour bénéficier d'avantages réservés aux employés et rediriger des transactions. Selon la police, il utilisait de nombreux comptes e-mail, identités et moyens de paiement pour dissimuler ses activités, et a finalement été arrêté dans une suite d'un hôtel de luxe du quartier de Salamanca à Madrid.

Ex-NCA officer ordered to repay £1.8M after stealing seized Bitcoin

Threat Actor: Malveillant interne
Dates of Activities: 2025
Compétence: Royaume-Uni
Offense: Money theft and laundering
Victims: Unknown
Financial Losses: 50 BTC, worth ~£60,000

Un ancien agent de la National Crime Agency britannique a été condamné à rembourser plus de 1,8 million de livres sterling après avoir volé des bitcoins saisis lors d’une enquête sur un réseau criminel du Dark Web. Paul Chowles, 44 ans, a été condamné à cinq ans et six mois de prison en 2025 après avoir reconnu le vol et le blanchiment d’argent. Dans le cadre de cette enquête, Chowles avait accès aux appareils numériques saisis par les autorités et avait contribué à l’analyse des cryptomonnaies détectées sur ceux-ci.

Il a volé 50 Bitcoin, d’une valeur d’environ 60 000 £ à l’époque, puis les a transférés via une série de transactions en tentant de brouiller les pistes. La police a récupéré 30 Bitcoin. Cette cryptomonnaie avait été saisie lors de l’enquête sur Silk Road 2.0. Une ordonnance de confiscation de 1 810 678,93 £ a été prononcée contre Chowles, montant incluant la valeur actuelle des Bitcoin récupérés.