Threat Actor Brief 2026-10-27

51 stories reviewed from 22 sources over the last 24 hours.

Act (6)

Software supplier to many Belgian municipalities hacked; councils warn of phishing

MEDIUM · monitor

An unnamed software supplier serving a large number of Belgian municipalities was hacked, causing a range of disruptions. Several municipalities are now warning citizens about phishing after the attack on this external supplier, a supply-chain incident close to the Netherlands.

Security.NL · source

KillSec ransomware gang exposed as teen-run operation; three arrests across Europe

HIGH · investigate

An investigation led by Hamburg’s State Criminal Police Office and Public Prosecutor’s Office, with Europol and Eurojust, led to three arrests and searches of eight properties in the UK, Greece, Spain and Romania. Ten countries took part and Group-IB and Bitdefender gave technical help; the KillSec ransomware operation is reported to have been run by teenagers.

Brave News Search · source

Suspected core member of Qilin cybercrime group arrested in Osaka, Japan

HIGH · monitor

A Russian national believed to be a core member of the Qilin group was detained in Osaka as part of Japan’s cybercrime crackdown. An arrest of an alleged Qilin core member would be a notable blow to a watchlisted actor, though the report comes from a low-trust source and needs confirmation.

Brave News Search · source

Crypto thieves serve iPhone malware via hundreds of compromised websites and ads

HIGH · monitor

Researchers told Forbes that crypto thieves are targeting iPhone users at scale with attacks that only require viewing a malicious ad or visiting an infected webpage. Hundreds of websites have been compromised, making this mass exploitation of consumer devices.

DataBreaches.net · source

Hive and Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months in US

MEDIUM · investigate

US District Judge Pamela K. Chen in Brooklyn sentenced Ukrainian national Artem Stryzhak, 36, to 70 months for conspiracy to commit computer fraud; he pleaded guilty in December 2025. He took part in Hive and Nefilim ransomware attacks on hospitals, governments and law firms from mid-2018 to late 2021, which DOJ says caused over $100 million in losses.

CyberScoop · source

INTERPOL Operation Serengeti 3.0: 1,462 arrests and $105M recovered in Africa

MEDIUM · monitor

The third edition of INTERPOL’s Operation Serengeti against cybercrime in Africa led to 1,462 arrests across 21 countries and the recovery of US$105 million. INTERPOL’s accompanying African threat assessment points to growing use of AI in cybercrime and rising financial losses.

Brave News Search · source

Signal (14)

• Limburg cybercrime team, piloting on bank helpdesk fraud, arrests fake bank employee after dozens of elderly people were scammed (Brave News Search)
• South Korean police arrest man accused of using AI to hack 90 organizations and steal 8.2 million records (Brave News Search)
• Capcom confirms breach of Capcom ID: a hacker accessed data on 11.7 million accounts and began changing passwords (DataBreaches.net)
• Quest Diagnostics lab system breached, patient records accessed; report also cites arrest of Canadian exec in FBI ShinyHunters crackdown (Brave News Search)
• Moldova: cyberattack on government digital services may have exposed personal data of about 750,000 people, PM Vasile Tofan says (DataBreaches.net)
• US Federal Election Commission e-filing system offline after hacking attempts, a week before the November 3 elections (DataBreaches.net)
• French energy giant ENGIE confirms customer data stolen after attackers breached a marketing platform used by business partners (BleepingComputer)
• Check Point: fake GitHub projects posing as ChatGPT and Claude desktop apps spread custom ‘Yoba’ malware chain (Check Point Research)
• Apple backports fix for CoreGraphics zero-day, exploited in targeted attacks, to older iPhones and iPads (BleepingComputer)
• Bulletproof domain virtualine.net seized in international operation; used for CSAM ads, intimate image abuse and money laundering (Brave News Search)
• DOJ indicts Malaysian national in action against five foreign nationals after scam operation uncovered in Madagascar (The Record)
• Infostealer malware hidden in fake Russian apps tracking fuel prices, police activity and drone strikes (The Record)
• UK police inspectorate: police data breached several times this decade via hacked third-party IT suppliers (The Record)
• India: hackers breach all nine servers of Kamalnayan Bajaj Hospital, steal sensitive data and encrypt systems (DataBreaches.net)