CERT-GIB

The official Twitter account of the CERT-GIB (@GroupIB Computer Emergency Response Team). On duty 24/7/365 - response (at) cert dash gib dot com

[Group-IB Global @GroupIB]

Even trained people can make this mistake.

We are used to trusting people who sound calm, informed and official, and even more so when the voice is familiar.

AI voice cloning and deepfake video make that instinct increasingly risky. Add urgency such as “approve this now” or “reset my access” and trust becomes the attack surface.

For payments, credential resets and sensitive requests, hang up and verify through a known second channel.

Trust the process, not the caller.

#Deepfake #CybersecurityAwarenessMonth #VishingScam #FightAgainstCybercrime

[CERT-GIB @CERTGIB]

RT @GroupIB: 🚨 Critical #PHP2Shell vulnerabilities put millions of internet-facing assets at risk.

Two critical flaws in the PHP core — CV…

[Group-IB Global @GroupIB]

🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered.

Group-IB supported INTERPOL’s #OperationSerengetiIII, a multinational law-enforcement operation targeting #cybercriminal networks across Africa.

Coordinated by @INTERPOL_Cyber and involving 21 countries, the operation tackled cyber-enabled fraud, #ransomware, business email compromise, #onlinescams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million.

As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa or used to target the region. The company also shared intelligence on threat actors involved in fraudulent activities, including social media accounts linked to suspected fraudsters.

The results reinforce a simple reality: cybercrime crosses borders, and fighting it requires coordinated action across them.

Read the full press release to learn more: https://t.co/zyuII5b0ix

@INTERPOL_HQ

[Group-IB Global @GroupIB]

🚨 What looks like a Windows RAT is actually a much broader threat platform.

Our analysis of SiriusQT uncovered more than 280 client samples and 146 unique licenses, along with features such as hidden virtual network computing (HVNC), credential theft, multiple process injection techniques, and custom encrypted C2 traffic.

Read the full technical analysis: https://t.co/SNyi2EVLxe

#CyberSecurity #MalwareAnalysis #ThreatIntel #SiriusQT

[Group-IB Global @GroupIB]

Network edge devices can give threat actors a direct path into an organization.

In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified.

The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA.

Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed.

Read the full technical analysis: https://t.co/lgDyLLR572

[Group-IB Global @GroupIB]

#OperationKillSwitch, led by German authorities, with support from @Europol and Eurojust, has taken action against #KillSec, a ransomware-as-a-service (RaaS) group linked to around 1,000 suspected attacks worldwide. The action targeted both the people behind KillSec and the systems they relied on. Authorities carried out eight house searches in Spain, Greece, Romania, and the United Kingdom, made three provisional arrests, and seized evidence and assets.

Here are some of the key findings from our investigation:
🔹 274 organizations were publicly claimed as victims on KillSec’s leak site.
🔹 Around 35% of identified victims were in North America, 30% in Asia-Pacific, and 14% in Europe
🔹 Financial services, healthcare, and government were among the most affected sectors
🔹 The group operated a fully functional affiliate platform with ransom negotiation and payment handling capabilities, payload configuration for Windows and VMware ESXi environments, a Tor-based DLS, and more

Group-IB supported the international Operation KillSwitch with investigative intelligence on KillSec’s operations, infrastructure, and key enablers.

Read the full press release to learn more: https://t.co/Fz4BqfNni5

[Group-IB Global @GroupIB]

Your network is a liminal space. Too big, too quiet, and you're not alone in it.

Compromise Assessment: something's been wandering your halls longer than you think. We find it.
✅Threat Hunting: the corridor that always felt off? We go down it.
✅Red Teaming: we find the door you forgot to lock, before someone else does.
✅Incident Response: the worst has happened. This isn't where the story ends.

Group-IB Services Retainer. One agreement. Every room covered. Step inside: https://t.co/araJm74TwD

#Cybersecurity #IncidentResponse #DFIR

[Group-IB Global @GroupIB]

🚨 Criminal networks are increasingly weaponizing subscription-based content platforms to recruit, coerce, and exploit vulnerable people. The scale is larger than many realize.

Group-IB contributed intelligence support to Operation CyberProtect III (19–22 May 2026), a joint law enforcement operation co-organized by @INTERPOL_HQ and the @OSCE , targeting the growing exploitation of subscription-based content platforms to facilitate human trafficking and sexual exploitation.

Using its Threat Intelligence Graph and analyst expertise, Group-IB helped investigators map criminal infrastructure, identify recruitment channels, trace financial flows, and uncover additional potential threat actor infrastructure.

Key findings from the operation:
🔹 Recruiters using encrypted messaging platforms to target victims, including requests for nude images without age verification
🔹 Content producers being bought and sold, with one messaging group containing up to 28,000 advertisements
🔹 AI-generated fake profiles used to support and scale exploitation operations
🔹 Cryptocurrency and virtual currencies used as payment mechanisms, with rates as low as USD 3 for 25 minutes of private content

This is what adversary-centric intelligence looks like in practice: tracing the infrastructure, recruitment channels, and financial flows criminal networks rely on, so investigators can act on verified intelligence and disrupt exploitation.

Read the full press release: https://t.co/8JeI5oHNw0

@INTERPOL_Cyber

#CyberSecurity #LawEnforcement #OnlineExploitation #HumanTrafficking

[Group-IB Global @GroupIB]

Cybercrime tactics evolve fast. Which threat concerns you the most right now?

[Group-IB Threat Intelligence @GroupIB_TI]

Since 2021, North Korean (#DPRK) IT workers have built a sprawling ecosystem of synthetic developer personas complete with AI‑generated photos, overlapping #GitHub repositories, and reusable portfolio sites. Our investigation uncovered a single GitHub account (cybersage14) that switched identities from “Nicolas Sammaritano” (Argentina) to “Caddo Smith” (Texas) while keeping the same technical profile. This is not isolated fraud; it is a structured, labor‑enabled access model designed to infiltrate global companies and evade sanctions. #InsiderThreat

[Group-IB Global @GroupIB]

Fake shipment tracking #scams are rapidly scaling across the #MEA region, exploiting the 161B annual parcel volume that fuels global e-commerce. Attackers use Sender ID spoofing to insert #phishing messages directly into legitimate courier SMS threads, claiming failed deliveries. Victims who click to "update address details" or "pay small fees" are led to pages stealing both credentials and payment data in a two-stage theft process. #ThreatIntel

[Group-IB Global @GroupIB]

Threat actors behind #GTFire are systematically abusing Google's trusted infrastructure to evade detection at scale. By chaining Google Firebase hosting with Google Translate's proxy, they create a multi-stage redirect chain that obfuscates final phishing destinations. The https://t.co/Zm9pmjA6xk layer acts as a "phishing shield," leveraging Google's reputation to bypass email security filters and web gateways, with the malicious *.web.app domain only visible deep in the network traffic. #Phishing #ThreatIntel

[Group-IB Global @GroupIB]

🚨 Tracking the Rise of Chinese Tap-to-Pay Android Malware

Tap-to-pay fraud is no longer limited to stolen cards or physical proximity. Threat actors are now abusing NFC-enabled #Androidmalware to relay #paymentdata in real time, enabling remote, contactless fraud at scale. Our latest research uncovers how Chinese #cybercrime communities are industrializing this technique and turning it into a fully operational fraud ecosystem.

Key Highlights:
🔹 Over 54 NFC-enabled Android malware samples identified, designed to relay payment APDUs remotely
🔹 Multiple Telegram-based vendors offering tap-to-pay malware as a service, complete with subscriptions, support, and custom regional builds
🔹 At least $355,000 in fraudulent transactions linked to a single illicit POS vendor between Nov 2024 and Aug 2025
🔹 #Smishing and #vishing campaigns actively used to trick victims into installing malware and tapping their cards
🔹 Mule networks and compromised mobile wallets enabling global, card-present fraud without physical cards

Alongside these findings, the research provides in-depth technical analysis of TX-NFC, #NFU, and related variants, examining code overlaps, cash-out infrastructure, and key defensive considerations for #financialinstitutions and payment networks. Read the full research now: https://t.co/4C0ROKNdH8

[Group-IB Global @GroupIB]

Organized #cybercriminal groups are flooding the Middle East and Africa with fake job ads on social media, impersonating trusted brands and government ministries to harvest personal data and payments. Our analysis has already identified 1,500+ fraudulent ads in 2025 alone, with the real scale likely significantly higher. These #scams target vulnerable job seekers with promises of high daily income for simple tasks.
#MENA

[Group-IB Global @GroupIB]

A coordinated scam campaign is spreading across several regions, including Latin America, using fake news pages and #deepfakes to promote alleged investment platforms.
Goal? to steal personal and payment data by exploiting politically sensitive periods, such as pre- and post-election moments. #ScamAlert

[Group-IB Global @GroupIB]

Adversaries can bind-mount a manipulated workspace over /proc/<pid> to rewrite what tools like ps/top show, renaming #malicious processes into benign tokens and sabotaging initial triage. We reproduce this technique end-to-end in our lab walkthrough. #CyberSecurity

[CERT-GIB @CERTGIB]

This case highlights a new era of organized, cross-border financial fraud, where legitimacy is simulated through verified platforms and regulatory loopholes. Read more:
https://t.co/gsE6j6vvWg

[CERT-GIB @CERTGIB]

Group-IB has uncovered a coordinated scam operation exploiting verified Google Ads, #deepfake videos, and fake news outlets to impersonate Singapore’s government officials and noted public figures in a fraudulent investment campaign known as the “Immediate Era” scam.

[CERT-GIB @CERTGIB]

Key Highlights:
🔹 28 verified Google advertiser accounts targeting Singapore users
🔹 Over 50 intermediary redirect domains to evade detection
🔹 Fabricated media sites mimicking #CNA and #Yahoo! News
🔹 AI-generated deepfakes used to build false credibility

[Group-IB Global @GroupIB]

#InvestmentScam platforms are run by sophisticated multi-actor networks, not lone operators. Our analysis breaks down the roles of Masterminds, Target Intelligence, Backend Operators, and Payment Handlers that enable these fraud campaigns. Discover how these ecosystems operate and how you can detect them. #CyberCrime #FinSec