A leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime. Combating cybercrime since 2003
Singapore
Joined August 2016
- Tweets4K
- Following641
- Followers10.1K
- Likes2.2K
Pinned Tweet
🚨 The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared.
One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on.
It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut:
🔹 Native attack surface management, cyber threat intelligence and digital risk protection
🔹 Native remediation
🔹 Outside-in and inside-out visibility
From more than 30 vendors, Frost benchmarked 15, and named Group-IB a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026.
Frost singles out two reasons: intelligence Group-IB originates rather than resells, and Cyber-Fraud Fusion, defending cyber and fraud as the single operation attackers actually run.
If you're weighing your next investment, the report is a way to scrutinise the capabilities behind the platform claim, not just the marketing around it. Learn More: link.group-ib.com/4k1pr3N
That’s a wrap on @cairoict 2026! 🇪🇬
✨ It was a pleasure connecting with customers, partners, and industry leaders at one of Egypt’s leading #technology events.
Throughout the event, Group-IB engaged in meaningful discussions on the evolving #cybersecurity landscape, emerging threats, and the growing importance of strengthening cyber resilience and #fraudprevention. Our experts also contributed to the panel discussions, sharing valuable insights and perspectives on the challenges shaping today’s cybersecurity industry.
A big thank you to everyone who visited our booth in Hall 1, joined our sessions and panel discussions, and took the time to connect with our team.
We look forward to continuing these conversations and building stronger partnerships across Egypt and the wider region.
Until next time, Cairo! 👋
176
🏃♀️ Running for a cause that matters.
On November 6, our teammates in Santiago took part in the Corrida Familiar Banco de Chile–Visa, supporting @Teleton and its work to advance rehabilitation and inclusion for children and young people with disabilities across Chile.
Vanessa Escudero Leyton, Matias Olave, Julio David Trigo Medina, and Javiera Paz, hit the track together to support the cause and represent Group-IB’s #GiveWhatYouCan initiative.
The #Teleton2026 raised more than 44 billion Chilean pesos, helping the foundation continue providing specialized care to over 32,000 active patients across 16 rehabilitation centers nationwide.
A huge thank you to our Chilean teammates for bringing their energy, teamwork, and community spirit to the track.
192
October's ANZ threat landscape in numbers:
🔹 113 threat events across Australia and New Zealand, up 49% from September
🔹 Database sale and leak claims accounted for half of all activity, with financial services and crypto platforms the most targeted
🔹 1.7 million compromised account records, more than double the previous month
🔹 14 #ransomware victims, all in Australia
Our Adversary of the Month is #TheGentlemen, a ransomware group that listed six Australian victims in October, including schools, a health provider, and an emergency service.
Also in this month's report: our analysts break down the #Lazarus linked #Binance hot-wallet compromise and what it means for organisations across ANZ.
Get the full ANZ Threat Landscape Report from Group-IB's Threat Intelligence team: link.group-ib.com/4iC5f7D
1
7
435
Ghana's #mobilemoney ecosystem has scaled faster than most institutions' fraud controls have kept pace with, and the numbers are starting to reflect that gap. According to the Ghana Bankers Association's Q1 2026 fraud report, mobile money fraud accounts for 31.5% of all recorded fraud cases, the highest share of any category tracked. For CISOs and fraud leads managing digital banking channels, this isn't a future risk to plan around. It's the primary vector today.
The regulatory response has already caught up to this reality. Group-IB’s CISD 2026: What Ghana's Financial Institutions Must Know Now report specifically mandates detection of rooted devices, emulators, cloned apps, and overlay attacks across mobile banking platforms, closing the exact device-trust gap this fraud category has been exploiting. For institutions still relying on session-level monitoring alone, this is a #compliance requirement with a hard operational dependency: you cannot report on what you cannot detect.
This is where #frauddetection and #regulatorycompliance stop being separate conversations. Meeting CISD 2026 means having device intelligence embedded before the transaction, not layered on after a dispute is filed.
Group-IB's compliance mapping breaks down exactly how Fraud Protection addresses this requirement, and where the remaining gaps sit. Read the full mapping and assess your institution's exposure: link.group-ib.com/4jsISSQ
#CyberSecurity #FraudPrevention #FinancialCrime #Ghana
1
296
🚨 Inside DarkLunnen's operations: 14+ months of cyber activity exposed
Group-IB #ThreatIntelligence researchers uncovered an exposed server that provided a rare look inside more than 14 months of offensive cyber operations targeting Europe and linked to a Russian-speaking threat actor we track as #DarkLunnen.
The investigation revealed:
🔹 A modified watchTowr PoC used to scan FortiGate devices and create a backdoor administrator account.
🔹 VNC brute-force activity involving thousands of endpoints, including HMI/ICS related indicators.
🔹 Attempts to identify vulnerable Hikvision cameras across Ukrainian IP addresses.
🔹 Apparent targeting of Ukrainian defense and aviation organizations.
🔹 Evidence of Sliver command-and-control infrastructure.
Only 35 of the 457 files exposed on the server were recovered before it went offline. The remaining 422 files included references to a Sliver database, SSH records, credential databases, a Kerberos golden ticket, a WireGuard configuration, custom malware, and a code-signing key, leaving significant intelligence gaps.
Group-IB has not attributed DarkLunnen to a previously identified threat actor. We invite the wider CTI community to examine the findings and identify potential overlaps in infrastructure, tooling and TTPs.
Read the full investigation: link.group-ib.com/4iCIrVu
September saw a notable rise in #cyberthreat activity across Australia and New Zealand.
🔹 85 threat events were recorded across ANZ, up from 64 in August
🔹 Database sale and leak claims doubled to 39, making them the largest threat category of the month
🔹 717,399 compromised account records and 25,466 compromised bank cards were identified
🔹 Initial access brokers resurfaced, with 7 listings targeting Australian organisations after none were observed in August
Our Adversary of the Month is #Qilin, a ransomware-as-a-service operation that listed new Australian victims across the real estate, grocery, and non-profit sectors.
Explore the full ANZ Threat Landscape Report: link.group-ib.com/3XiaIIm
Every #RedTeaming pitch deck looks the same. Same #killchain. Same ATT&CK screenshot.
So how do you tell a real Red Team from a rebranded pentest?
A pentest asks, “How many vulnerabilities can you find?”
A Red Team asks, “Can we reach the objective unseen, and did anyone notice?”
Swipe for a quick buyer’s guide to choosing a Red Team.
Learn more about Group-IB Red Teaming: link.group-ib.com/4ghUHJH
Trezor kept digging and found the real exposure was nearly six times larger than first reported. Its shipping provider, ShipMonk, had failed to delete customer data from its systems as required by contract, despite Trezor repeatedly requesting written confirmation that the deletion had happened. That failure meant an additional 67,000 US customers, whose orders dated all the way back to November 2019, were sitting in a system that should have been cleared years earlier.
The attackers reportedly exploited a critical SQL injection zero-day in Metabase, a third-party analytics platform ShipMonk used. The extortion gang #ShinyHunters has been linked to the campaign through extortion emails and attribution analysis, though the group has not been definitively confirmed as the initial intruder.
Total impact: 81,000 customers. Exposed data includes full names, shipping addresses, emails, phone numbers, and order numbers. Trezor warns this information could fuel phishing attempts. Because the leaked data links real names and shipping addresses to Trezor orders, it can also be used to infer that recipients own cryptocurrency hardware, which raises potential physical security risks. That link is an inference, though a reasonable one.
A vendor contract promising your data gets deleted is only as strong as someone actually verifying it happened. Trezor asked. ShipMonk apparently didn't deliver. 67,000 people found out the difference the hard way.
4
225
#Ransomware group #TheGentlemen advised its affiliates to target compromised VPN accounts linked to Active Directory. Such access could enable privilege escalation.
Meanwhile, those accounts may look perfectly normal in your directory, with passwords that meet every security requirement.
Yet Verizon’s 2026 DBIR found that the median share of accounts using breached passwords was four times higher than the share failing complexity requirements.
A compliant password isn't necessarily a secret one.
Discover how #GroupIBXDR identifies compromised accounts and helps reset their passwords before attackers use them: link.group-ib.com/3V97WVg
🏦 Most banks treat an #infostealer infection as an event: it happens, gets detected, gets cleaned, ends.
It’s a supply line. One stolen log is resold for account takeover, mule onboarding, session hijacking and #ransomware. Uncover what's actually going on: link.group-ib.com/4C4fEAT
Once Accessibility Service is granted, #Mirax can intercept SMS and notifications, capture lock-screen credentials, inject banking overlays, start VNC sessions, and remotely control the device. Its SOCKS5 module can also route traffic through the victim's own residential IP address. #CyberCrime
1
2
193
The #Aquafina campaign shows how server-controlled #Androidmalware can make static APK analysis reveal only part of an active operation. Explore Mirax's infection chain, C2 architecture, ATT&CK mapping, detection guidance, C2 commands, and IOCs in the full technical blog: link.group-ib.com/4A2hIHq
1
109
Fraud doesn’t stop at checkout anymore, and neither do we!
✨ We had an incredible time in Chicago for the inaugural Merchant Fraud Alliance conference.
As a proud sponsor, Group-IB loved seeing merchants and vendors under one roof, sharing real talk on what’s actually working in the fight against fraud.
Our very own product manager for #CyberFraud Intelligence Platform, Julien Laurent, took the stage for "The New Fraud Playbook: Trends, Threats, and What Merchants Should Do Next" alongside heavy hitters Eric Goodman (Visa Acceptance Solutions) and Dajana Gajic-Fisic (Wolfe).
The big takeaway? Fraud now spans the entire customer journey: from account creation to post-purchase. Relying on isolated point solutions just won't cut it anymore.
"Fraud is moving upstream and downstream of the transaction, so merchants need to look across the whole customer journey, separate self-inflicted policy gaps from real risk gaps, and build on threat intelligence and real-time data sharing rather than an AI-versus-AI arms race.", said Julien Laurent.
A huge thank you to everyone who dropped by our booth! Your insights on account takeover, #scams, and cross-channel fraud gave our team plenty of inspiration.
Shoutout to Karisse Hendrick, Ronald Praetsch, and PJ Rohall for creating such a fantastic, needed community right from day one.
👋 See you all at the next one!
More than 2,300 domains tied to Lumma Stealer were seized or blocked in May 2025.
Within weeks, Lumma was rebuilding.
Its infrastructure shifted to providers including Russia-based Selectel, and activity climbed back toward pre-takedown levels, according to Trend Micro.
Microsoft had observed roughly 394,000 infected Windows devices in the two months before the disruption.
The lesson is bigger than Lumma.
Taking down domains and servers can disrupt an operation. But when the underlying model is Malware-as-a-Service, affiliates can adapt to new infrastructure and keep campaigns moving.
A takedown can interrupt the malware.
It doesn't necessarily dismantle the ecosystem that keeps it running.
6
665