Issue #194 | October 2026, Week 3

Two US nationals arrested for aiding North Korean IT fraud

Compétence

The United States

Threat Actor

Individu

Activité incriminée

IT fraud

Préjudice estimé

Over $3 million

Action d'exécution

Arrest

Statut de l'affaire

Enquête en cours

Two US nationals have been arrested for allegedly helping North Korean IT workers get remote jobs at American companies using fake identities. The scheme reportedly generated more than $3 million between 2019 and July 2025.

The suspects, Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas, allegedly helped workers hide their real locations and appear to be based in the United States. The scheme affected more than 70 US companies.

According to the indictment, the suspects hosted company-issued laptops at US locations, allowing overseas workers to access them remotely. The workers allegedly used fake identities, VPNs, and proxy services to secure jobs.

As part of Operation Lonestar Roundup, the FBI searched 40 locations in Texas suspected of operating as laptop farms. Authorities seized 187 laptops and KVM devices linked to the alleged scheme. The indictment also names 10 individuals based in China.

Hacker convicted of stealing $53M from the Uranium Finance crypto exchange

Compétence

The Unites States

Threat Actor

Individu

Activité incriminée

Cryptocurrency theft

Préjudice estimé

Over $53.3 million

Action d'exécution

Arrest

Statut de l'affaire

Conviction

A 36-year-old man has been found guilty of stealing more than $53 million from the Uranium Finance cryptocurrency exchange in two attacks in April 2021.

Jonathan Spalletta, also known online as “Jspalletta” and “Cthulhon,” exploited flaws in the exchange’s smart contract code to steal cryptocurrency. The first attack took place on April 8, when he stole about $1.4 million. Three weeks later, he carried out a second attack, stealing around $53.3 million, after which the exchange was forced to shut down due to lack of funds.

Spalletta later moved the stolen funds through cryptocurrency services to hide their origin. He used some of the money to buy expensive collectibles, including rare Pokémon and Magic: The Gathering cards, as well as an ancient Roman coin.

In February 2025, law enforcement seized the collectibles from his home and recovered about $31 million in cryptocurrency from linked wallets. Spalletta now faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.

An international operation targets online scams in West Africa

Compétence

West Africa

Threat Actor

Multiple actors

Activité incriminée

Online fraud; human trafficking

Préjudice estimé

Over $8.3 million

Action d'exécution

Arrest

Statut de l'affaire

Enquête en cours

The US Department of Justice has announced the results of an international operation targeting online scam accounts and criminal networks operating in West Africa.

The operation involved law enforcement agencies from the United States, the United Kingdom, Nigeria, Ghana, and several other countries, along with INTERPOL and private technology companies.

In Ghana, authorities arrested 19 people and seized 303 electronic devices. Police also identified 117 suspected human trafficking victims awaiting repatriation to Nigeria and 89 scam victims who reportedly lost around $8.3 million.

In Nigeria, authorities arrested nine people and seized 53 electronic devices during the operation. Across six locations in Ghana, officials also reported dozens of arrests, the identification of 34 trafficking victims, and the seizure of 129 electronic devices.

The disrupted schemes included scams in which criminals impersonated law enforcement officers, threatened victims with fake arrests, and offered fraudulent cryptocurrency investments.

Chinese-language phishing market; hacking tools disrupted in a series of actions

Compétence

The Unites States

Threat Actor

Plusieurs entités

Activité incriminée

Phishing, online fraud

Préjudice estimé

Tens of millions of dollars

Action d'exécution

Infrastructure takedown

Statut de l'affaire

Enquête en cours

Microsoft and Health-ISAC have seized and redirected domains linked to three services (YAM Store, CoGUI and Iron Man) used by cybercriminals to obtain accounts, phishing kits and tools for online fraud.

According to Microsoft, the services were used to send more than one billion malicious messages since January 2026. The campaigns targeted consumers and more than 75,000 organizations across over 150 countries. The operators reportedly earned tens of millions of dollars.

Microsoft has disabled more than 20,000 accounts linked to YAM Store and is blocking over 100,000 domains used for impersonation and fraud.

YAM Store (aka Storm-3119) sold access to compromised or fraudulently obtained accounts and online environments, including accounts linked to Microsoft and Google. Buyers could select accounts based on factors such as age, subscription and organization type.

The marketplace also offered phishing kits tracked as Storm-2990, including CoGUI, Haozi and Iron Man. CoGUI was used against victims in Japan and the United States; Iron Man began gaining ground by mid-2026 after YAM Store started promoting it in June.

In a separate action, US authorities seized two tools (Microscan and FishHub) allegedly used by China-linked Flax Typhoon threat actors. Microscan was used to find weaknesses in computer networks; FishHub helped attackers gain access through phishing, install malware, and steal files.

The tools were reportedly used against organizations in the United States, Taiwan, Japan, Poland, and other countries, including power companies, airports, universities, and non-governmental organizations.

Police arrest alleged operators of the OLVX and Stryx cybercrime platforms

Compétence

North Macedonia, France

Threat Actor

Individu

Activité incriminée

Operation of the cybercrime platforms

Préjudice estimé

Not disclosed

Action d'exécution

Arrest

Statut de l'affaire

Enquête en cours

Police in North Macedonia have arrested the alleged administrator of OLVX, an online marketplace used by cybercriminals to buy and sell stolen personal data, login credentials, and tools for illegal activities.

The suspect was not publicly named. The police said that the suspect managed OLVX-related websites and domains between 2023 and 2025. During that time, the platform offered more than 1,500 sets of stolen login credentials that could give criminals access to user accounts and computer networks.

Authorities also linked the suspect to an online Telegram group called ONEMILI, which allegedly offered software and services for cybercrime, including fraudulent refund schemes. Authorities also found evidence that the suspect had obtained and possessed child sexual abuse material (CSAM) through Telegram.

In the meantime, France’s anti-cybercrime unit has shut down two websites suspected of selling stolen data and arrested three 17-year-olds believed to be behind them. The platform, initially known as Reacher and later renamed Stryx, allegedly offered stolen personal information, including names, addresses, and bank account numbers. It claimed to hold 730 million lines of data and had received 3.1 million requests. If convicted, the three teenagers could face up to 10 years in prison.