Crypto news

The past week was packed with events in the cybersecurity sphere. From physical scams with "offices" to sophisticated attacks on critical infrastructure and the use of blockchain for dark purposes — we break down the most high-profile cases.

Ukraine: Dismantling a Network of Fake Exchangers

Ukraine's cyber police shut down the fraudulent network Money 24/7, which disguised itself as a legitimate currency and crypto-asset exchange service. The scheme was meticulously planned: the attackers created high-quality websites, actively ran a Telegram channel, registered a trademark, and even rented an office with a cash register to create an appearance of reliability.

Clients were invited to the office for a "physical" transaction, where they handed over cash but never received cryptocurrency. To stall for time, the fraudsters transferred part of the amount and issued written "guarantees." During more than 20 searches across seven regions of the country, over 20 million hryvnias in cash, computer equipment, and documentation were seized. The organizer faces up to 12 years in prison. In one confirmed episode, the damage amounted to nearly 1.6 million hryvnias.

FBI Warns of a Wave of Cyberbullying

The FBI, together with the National Collegiate Athletic Association, is recording a surge in attacks aimed at stealing intimate photos and videos from social networks and cloud storage. Hackers pay particular attention to student-athletes. The attack begins with a phishing SMS or email about an account lockout. After the breach, the attackers demand a ransom, threatening to publish the materials. Even after payment, the stolen content and victims' personal data are often sold on the darknet, triggering a new wave of harassment.

Attack in the Sky: Incident on a Delta Air Lines Flight

Delta Air Lines is investigating a cyber incident on flight 591, traveling from Las Vegas to Atlanta immediately after the conclusion of the DEF CON 34 hacking conference. According to available data, attackers on board forcibly disconnected passengers from the legitimate Wi-Fi by sending spoofed data packets and created a fake network called "Delta WiFi Fast." Connecting to it opened a fraudulent authentication page designed to steal Google account passwords.

The crew, noticing something was wrong, completely powered down the onboard Wi-Fi for 30 minutes. The airline emphasized that navigation systems were not affected. Upon arrival in Atlanta, police boarded the aircraft, suspects were interrogated, and their equipment was seized.

Jewelbug: The Double Life of Chinese Hackers

Symantec analysts uncovered the group Jewelbug (Earth Alux), which combined government cyberespionage with large-scale crypto fraud. The attacks targeted government and military structures in the Middle East and Asia. The hackers compromised the web hosting platform of a state provider and injected malicious JavaScript code to steal session cookies from 15 ministries.

In parallel, the group operated a network of hundreds of fake domains masquerading as Binance and OKX exchanges. Botnets were used to promote these sites in search engines, and content was generated by neural networks. More than a million logs, 580,000 stolen cookies, and thousands of credentials were found in Jewelbug's infrastructure.

DeadLock: Ransomware on the Polygon Blockchain

The ransomware group DeadLock, which attacks companies in the US, Europe, and Turkey, has revolutionized its approach to infrastructure. Instead of traditional servers, they have moved to decentralized solutions based on the Polygon blockchain, as reported by experts from Microsoft Threat Intelligence and Group-IB.

The key innovation is the format of the ransom note. Instead of a text file, the victim receives an HTML file called RECOVERY_CHAT, which is a standalone web application. Its JavaScript code directly interacts with smart contracts on Polygon to rotate proxy server addresses. If law enforcement blocks one address, operators only need to update a record in the smart contract, and communication is restored. This creates "literally endless options" for bypassing blocks.

The malware itself uses hybrid encryption with Curve25519 and XChaCha20, assigning files the .dlock extension. It masks its activity by pausing during high system load and self-destructs after completing its work.

Cyberattack on a Polish Combined Heat and Power Plant

CERT Polska has revealed details of an attack on a combined heat and power plant that provides heat to 50,000 residents. The incident occurred in December 2025, but the investigation was only completed now. The uniqueness of the case lies in the penetration vector: the hackers entered the network through the private cellular network of the power grid operator, using exclusively standard equipment functions.

Starting with a wind farm without MFA, the attackers moved through a firewall and a Teltonika router to reach a WAGO controller at the CHP plant, protected by a factory password. On December 29, they switched Siemens S7 controllers to stop mode, leading to a physical shutdown of the steam turbine. The hackers methodically destroyed evidence by resetting equipment settings, but staff managed to restore system operations.

My comment: DeadLock's move to the blockchain is a wake-up call for the entire security market. Using smart contracts to manage ransomware infrastructure makes fighting them fundamentally harder. This is not just evolution but a paradigm shift that requires defenders to adopt fundamentally new approaches, including monitoring on-chain activity.