Another week brought several high-profile incidents in the field of cybersecurity. From secret ransom payments by government agencies to the exposure of mass surveillance by VPN services, the market once again demonstrates that trusting "free cheese" in the digital world is not worth it.
US Authorities Secretly Transferred 9.4 BTC to Hackers
A sensational investigation by Ransom-ISAC analysts uncovered a secret ransom payment by a US government agency. On June 13, 2025, the Union County (Ohio) administration transferred 9.44 BTC to the Kairos group — approximately $1 million at the exchange rate at the time of the transaction.
Notably, the hackers did not use classic ransomware programs. The attack boiled down to extortion: the attackers stole 2 TB of confidential data, including information from the "prosecutor's office" folder, social security numbers, and citizens' fingerprints. Initially demanding $3 million, after a month of negotiations, the criminals agreed to $1 million. The funds were fragmented and passed through a chain of mixers and exchanges, including Bybit, OKX, and the Russian service BELQI. The Kairos group has already ceased activity, but wallets associated with it continued to move funds until May 2026.
Free VPNs: Protection from Surveillance or a Surveillance Tool?
A large-scale study of over 280 free VPN applications from Google Play, conducted by a team of scientists from the University of Michigan and the Indian Institute of Technology, revealed shocking facts. The total number of installations of problematic utilities exceeded 2.4 billion.
Key findings: five applications downloaded configurations via unsecured HTTP, 29 services allowed DNS query leaks, and 169 did not mask traffic at all, despite advertising bypass of restrictions. Over 80% of applications contacted ad servers, transmitting unique device identifiers and GPS coordinates. Experts emphasize: "Verified" badges in the app store are just marketing, not a guarantee of security.
Interpol: $293 Million Intercepted, 6,000 Arrested
The global special operation First Light 2026 yielded impressive results. Law enforcement from 97 countries detained 5,811 suspects, blocked 31,000 accounts and crypto wallets, and intercepted assets worth $293 million. Of particular interest is the use of the I-GRIP mechanism, which allows freezing transactions in real time, including transfers to crypto wallets. In Thailand, for example, a network was uncovered through whose crypto wallet $122.5 million in illegal funds passed over 10 months.
Expert Opinion from Cryptalist
The cybersecurity market is undergoing a tectonic shift. Hackers are moving away from complex encryption to pure extortion, and regulators are learning to block crypto transactions on the fly. However, the main lesson of the week is that free VPN services often turn out to be an expensive illusion of security. Users should reconsider their habits and either pay for proven solutions or fully rely on built-in OS protection mechanisms. Otherwise, your traffic may end up not just unprotected, but sold to the highest bidder among cybercriminals.