Intelligence Hub

On 30 September 2026, law enforcement seized control of KillSec's leak site and secured approximately 110 terabytes of stolen data. KillSec, suspected to be led by a teenager, operated a ransomware group that threatened organizations with data publication unless ransom payments were made.

European law enforcement conducted coordinated raids against KillSec ransomware-as-a-service operation, resulting in the arrest of a high-profile teenage suspect believed to lead the criminal enterprise. This represents a major disruption of ransomware infrastructure.

A year-old Chinese ransomware threat actor operating under the name Warlock targets large organizations in Spain and Portugal. The group exhibits characteristics of both cybercriminal gangs and state-associated APT activities, employing sophisticated attack methods against organizations in geographically unexpected regions.

US Treasury's OFAC sanctioned multiple Venezuelan nationals and companies under their control for orchestrating ATM malware theft operations. The scheme involved stealing funds from dozens of ATMs and laundering proceeds, with connections to Tren de Aragua criminal organization.

OFAC designated 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million. The fugitive organization laundered proceeds through cryptocurrency. This represents a major law enforcement action against organized criminal activity involving ATM theft and crypto money laundering.