Crypto news

The week was packed with events in the field of digital security. From physical scams at exchange office locations to sophisticated attacks on energy systems and the use of blockchain to protect ransomware infrastructure — we break down the key incidents.

Ukrainian cyber police dismantled the Money 24/7 fraud network

Law enforcement detained the organizer of a scheme that operated under the guise of a legitimate exchange service. The attackers created an illusion of reliability: quality websites, an active Telegram channel, a registered trademark, and even an office with a cash register. Clients were invited in person, where they handed over cash but never received cryptocurrency. To buy time, victims were transferred a small portion of the amount and given "written guarantees."

During more than 20 searches across seven regions of the country, over 20 million hryvnias in cash were seized. In one episode alone, the damage amounted to nearly 1.6 million hryvnias. The organizer faces up to 12 years in prison with confiscation of property.

FBI records a wave of attacks on intimate photos

The Bureau warns of a rise in cyberattacks targeting the theft of personal photos and videos from cloud accounts. Special attention is being paid to student athletes. The scheme begins with phishing SMS or emails that scare victims with account blocking. After the breach, hackers demand a ransom under the threat of publishing the materials. Even after payment, the stolen content is often sold on the dark web along with personal data, triggering a new wave of extortion.

Hackers from DEF CON attacked Delta Air Lines passengers

On flight 591, traveling from Las Vegas to Atlanta, an incident occurred involving onboard Wi-Fi. The attackers disconnected passengers' devices from the legitimate network and deployed a fake access point called "Delta WiFi Fast." Upon connection, users were shown a fraudulent authorization page to collect passwords. The crew cut power to the Wi-Fi for 30 minutes. After landing, police questioned the suspects and seized their equipment. It is important to note that the aircraft's navigation systems were not affected.

Chinese hackers Jewelbug: espionage and crypto scam

The Jewelbug group, also known as Earth Alux, combined cyber espionage with financial fraud. Analysts found that the hackers attacked government institutions in the Middle East and Asia using a compromised web hosting platform. In parallel, they ran a large-scale scam campaign: neural networks generated fake articles on hundreds of domains masquerading as Binance and OKX, while botnets pushed them to the top of search engines. The group's database contained over a million logs, 580,000 stolen cookies, and thousands of credentials.

DeadLock: ransomware on the Polygon blockchain

The DeadLock group, which attacks companies in the US, Europe, and Turkey, has fully transitioned to decentralized infrastructure. Instead of traditional servers, they use smart contracts on the Polygon network to rotate proxy server addresses. The ransom note is a standalone HTML application with a chat and a browser for stolen data. If law enforcement blocks a server, the hackers simply update the record in the smart contract. Technically, the malware uses hybrid encryption with Curve25519 and XChaCha20, and to disguise itself, it pauses the process under high CPU load.

Cyberattack on a Polish thermal power plant via the cellular network

CERT Polska revealed details of an incident that occurred in December 2025. The attackers infiltrated the power plant's network through the private cellular network of the grid operator. Exploiting vulnerabilities in WAGO and Siemens S7 controllers with factory passwords, they halted the steam turbine and the water treatment system. The attack was carried out using standard equipment functions, making it the first documented case of such a vector. The hackers carefully destroyed evidence by resetting the devices to factory settings.

My comment: The DeadLock incident is a wake-up call for the entire cybersecurity market. The use of public blockchains to manage ransomware infrastructure makes them nearly invulnerable to traditional blocking methods. Law enforcement will have to develop fundamentally new approaches to counteraction, including monitoring activity in smart contracts. At the same time, the attack on the Polish thermal power plant demonstrates that critical infrastructure remains extremely vulnerable due to neglect of basic security measures, such as multi-factor authentication and changing default passwords.