Crypto news

The past week brought several landmark incidents showcasing the evolution of threats: from primitive scams to complex multi-layered attacks on critical infrastructure and the use of blockchain to protect hacker networks.

Ukrainian cyber police dismantled the Money 24/7 fraud network

Ukrainian law enforcement detained the organizer of a large-scale fraud scheme operating under the guise of the legitimate currency and crypto asset exchange Money 24/7. The criminals built a full-fledged "showcase" of trust: quality websites, an active Telegram channel, a registered trademark, and even an office with a cash register.

The mechanics of the deception were cynically simple. The victim left an online request to purchase cryptocurrency, after which they were invited to the office to hand over cash. The money disappeared, and the promised coins never reached their wallets. To buy time, the fraudsters made partial crypto payments and issued "written guarantees" of transaction completion.

During more than 20 searches across seven regions of the country, over 20 million hryvnias in cash, equipment, and documentation were seized. Damages from just one confirmed episode exceeded 1.6 million hryvnias. The organizer faces up to 12 years in prison with asset confiscation.

FBI reports an epidemic of hacks aimed at stealing intimate photos

The American bureau warns of a sharp rise in attacks targeting the theft of private photos and videos from cloud and social accounts. Student athletes have become a specific target for hackers. The scheme is standard: a phishing message threatening account suspension, clicking a link, or providing a verification code.

After gaining access, the attackers blackmail the victim, demanding a ransom to prevent the distribution of materials. However, even after payment, the stolen content often ends up on the dark web along with personal data, triggering a new wave of harassment and extortion. This is a classic example of how one crime spawns a series of subsequent ones.

Hacker attack aboard a Delta Air Lines flight

Delta Air Lines is investigating an incident on flight 591 traveling from Las Vegas to Atlanta. On board were participants of the DEF CON 34 hacking conference. The attackers forcibly disconnected passengers' devices from the legitimate Wi-Fi and deployed a fake network called "Delta WiFi Fast" with a phishing login page to steal Google passwords.

The crew, detecting the anomaly, completely powered down the onboard Wi-Fi for 30 minutes. Delta emphasized that the aircraft's navigation systems are isolated and were not affected. After landing in Atlanta, police interrogated suspects and seized their Wi-Fi hacking equipment.

Chinese hackers Jewelbug: the double life of spies and fraudsters

Symantec analysts revealed the activities of the Jewelbug group, which combined cyber espionage on behalf of the government with large-scale crypto fraud. Attacks on government institutions in the Middle East and Asia were conducted through a compromised web hosting platform, granting access to the email of 15 ministries. The injected code stole session cookies, and for particularly valuable targets, the Antino backdoor was installed.

In parallel, the group profited from scams. Neural networks generated fake articles on hundreds of domains masquerading as Binance and OKX. Botnets pushed these sites to the top of search engines. In the hackers' database, analysts found over a million logs, 580,000 stolen cookies, and thousands of credentials. The use of the Rust-based ClientKing trojan to infect Linux servers and ASUS routers indicates a high technical level.

DeadLock ransomware shifted to decentralized infrastructure on Polygon

The DeadLock ransomware group, which attacks companies in the US, Europe, and Turkey, has made a revolutionary move. Instead of traditional servers, it uses the Polygon blockchain to manage its infrastructure. The ransom note is now a standalone HTML file (RECOVERY_CHAT.<UID>.html) that runs in the browser without a server.

The JavaScript code inside the file directly reads the proxy server's IP address from a smart contract. If law enforcement blocks the address, hackers only need to update the contract record, and the chat works again. This creates "literally endless options" for bypassing blocks. Technically, the malware uses hybrid encryption with Curve25519 and XChaCha20, and pauses the process under high CPU load to mask its activity. The group also avoids running in CIS countries.

Cyberattack on a Polish combined heat and power plant via a private cellular network

CERT Polska revealed details of an attack on a heating plant providing heat to 50,000 residents. The incident occurred in December 2025, but investigation details were only published now. The uniqueness of the case lies in the penetration vector: hackers used the power grid operator's private cellular network.

The attack began at a wind power station where MFA was absent. From there, the attackers moved through a firewall and a Teltonika cellular router into a network where settings allowed direct traffic between clients. The target was a WAGO PFC200 controller with a factory default password. Through it, hackers penetrated the plant's internal network, stopped Siemens S7 controllers, and physically shut down the steam turbine. To cover their tracks, they destroyed evidence by resetting equipment settings. Operations were restored by staff efforts.

My comment: The use of blockchain to manage ransomware infrastructure is an alarming signal. Decentralization makes combating such groups fundamentally harder, requiring intelligence agencies to adopt new approaches, including monitoring activity on networks like Polygon. The incident in Poland, in turn, reminds us that even the most modern protection systems are useless if basic elements—default passwords and lack of segmentation—remain overlooked.