Group-IB Global

A leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime. Combating cybercrime since 2003

[Group-IB Global @GroupIB]

Around $355,000 moved through stolen bank-card data in under a year, and the cards never left their owners’ pockets.

It often starts with a text or call that appears to come from a bank. The victim is told to install a “security” app, then tap their bank card against the back of the phone to “verify” it. During that tap, the malicious app reads the card through the phone’s NFC chip and relays the data to a criminal’s device connected to a POS terminal or mobile wallet far away. The fraudulent transaction is then completed remotely.

Group-IB researchers call this #GhostTap. Their investigation identified more than 54 malicious APK samples built for this scheme, with the service behind them openly advertised on Telegram.

Remember: a legitimate bank will not ask you to install an app from a text link and then tap your card against your phone to “verify” it. A banking app should only be installed from an official app store, never from a link in a #Smishing text.

[Group-IB Global @GroupIB]

Network edge devices can give threat actors a direct path into an organization.

In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified.

The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA.

Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed.

Read the full technical analysis: https://t.co/lgDyLLR572

[Group-IB Global @GroupIB]

✨ Group-IB, in collaboration with @awscloud, successfully hosted the Fraud Prevention and Resilience Majlis 2026 in Bahrain yesterday.

We were honored to welcome the National Cyber Security Center Bahrain (@NCSC_BH), alongside leading banks and organizations from the government, insurance, aviation, and e-commerce sectors.

The Majlis featured two strong panel discussions: “The Era of Financial Crimes in the Region” and “Fraud, #Cybersecurity, Compliance & Operational Resilience.” Industry experts shared valuable perspectives on the evolving fraud landscape, emerging threats, regulatory challenges, and the importance of strengthening operational resilience across sectors.

As fraud becomes an increasingly complex challenge, collaboration is essential to staying ahead of sophisticated threats. The discussions highlighted the need for a more unified approach, bringing together industry leaders to exchange insights, share experiences, and explore practical ways to strengthen #fraudprevention across the ecosystem.

A sincere thank you to our partners at #AWS, NCSC Bahrain, our distinguished panelists, and everyone who joined us and contributed to these meaningful discussions.

We look forward to continuing the conversation and working together to build a safer, more resilient digital economy across the region.

[Group-IB Global @GroupIB]

Fraud can be detected before money moves. By correlating device, behavioural, email, network, and graph signals across account creation, first outbound messages, and initial bank or card linking, Group-IB reduced the time to block fraudulent accounts from several hours to under a minute. More than 230 fraudulent accounts were stopped in May 2026 alone. Read the full technical analysis: https://t.co/5p82yofc2m

[Group-IB Global @GroupIB]

What happens when a legitimate spend-management platform becomes part of a fraud operation? In a case investigated by Group-IB, suspected #Classiscam operators abused a platform’s trusted email and payment-notification systems to distribute #phishing that impersonated online marketplaces, reaching thousands of recipients daily. The platform was not the target. It was the infrastructure. #CyberCrime

[Group-IB Global @GroupIB]

Disposable email addresses, multi-accounting, manipulated device identities, and extensive network anonymisation helped the operation evade conventional controls. Group-IB analysts correlated device and geo-fingerprints across accounts used for #phishing and card testing, connecting seemingly separate activities to the same operation. The findings highlight why IP blocking and transaction-based monitoring alone may be insufficient.

[Group-IB Global @GroupIB]

🚨 The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared.

One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on.

It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut:
🔹 Native attack surface management, cyber threat intelligence and digital risk protection
🔹 Native remediation
🔹 Outside-in and inside-out visibility

From more than 30 vendors, Frost benchmarked 15, and named Group-IB a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026.

Frost singles out two reasons: intelligence Group-IB originates rather than resells, and Cyber-Fraud Fusion, defending cyber and fraud as the single operation attackers actually run.

If you're weighing your next investment, the report is a way to scrutinise the capabilities behind the platform claim, not just the marketing around it. Learn More: https://t.co/hjO2e5Duu2

[Group-IB Global @GroupIB]

🚨 46,200 high-risk transactions identified. A significant drop in fraud incidents observed.

As digital transactions grew, JSCB Business Development Bank in Uzbekistan needed to stay ahead of evolving online fraud, from phishing and vishing to malicious APKs.

Together with TrustTech, the bank implemented Group-IB Fraud Protection to detect risk throughout the user session, uncover new fraud methods, and strengthen protection without adding unnecessary friction for customers.

See the results: https://t.co/g41P4wL7x7

[Group-IB Global @GroupIB]

🚨Pop culture turns hackers into heroes. Real hacking looks very different.

Behind the screen names and forum reputations sit pressure, guilt and a hard path out.

In the latest #MaskedActors episode, Gary Ruddell and former INTERPOL Cybercrime Director Craig Jones sit down with Marcus Hutchins.

Marcus is best known for helping stop #WannaCry. Here he tells the part of his story that rarely gets airtime.

They discuss:
→ What draws people into cybercrime communities
→ How status, identity and belonging keep them there
→ Why walking away is so hard
→ How offensive skills can become defensive ones

#Cybercrime is about more than money. Understanding the communities behind it helps us understand the threat itself.

🎧 Listen now:
Spotify: https://t.co/2YyesrMouq
Apple podcasts: https://t.co/FZACPjKGi2
YouTube: https://t.co/40DmliXbVS

[Group-IB Global @GroupIB]

🚨 What happens behind the scenes of KGB RAT?

#KGBRAT is marketed as a legitimate Windows administration tool, but our latest research reveals a Malware-as-a-Service platform built for surveillance, credential theft, #ransomware deployment, and victim intimidation.

Key findings from the investigation:
🔹 Infrastructure linked to KGB RAT dates back to January 2022, years before its public promotion on underground forums.
🔹The malware combines keylogging, credential theft, HVNC, ransomware, and an advertised #CryptoClipper capability within a single builder.
🔹 Operators abuse legitimate services such as #Telegram Bot API for victim notifications and https://t.co/w9ckkAYljY for geolocation profiling.
🔹 KGB RAT includes unusual harassment features, including screamers, jump scares, and forced BSOD events, blending #financialcrime with psychological disruption.
🔹 Analysis revealed extensive anti-analysis and defense-evasion functionality, including Windows Defender exclusion tampering, suspicious PowerShell execution, AV enumeration, and protections targeting .NET reverse engineering tools.
🔹 Despite being marketed as a new offering, KGB RAT shares significant overlap with the NjRAT/Lime-Worm ecosystem, demonstrating how established malware frameworks continue to be repackaged and commercialized.

Read the full analysis: https://t.co/OVRihx0EtH

[Group-IB Global @GroupIB]

Veradigm’s core systems weren’t breached. A vendor working with Veradigm was, and that’s the part that should worry every healthcare company that outsources anything at all.

The #ransomware group calling itself “The Gentlemen” claims it stole 3.5 million patient records from Veradigm, the Chicago-based healthcare technology company formerly known as Allscripts. According to Veradigm’s own SEC filing, the attackers never touched Veradigm’s core systems. They obtained login credentials from a third-party vendor’s environment and used that single set of credentials to reach one narrow customer-service API. Through that one door came names, home addresses, Social Security numbers, email addresses, phone numbers, and guarantor information: the exact ingredients needed for identity theft, not clinical charts.

Veradigm says clinical data stayed secure and that only a “small number of customers” were impacted. #TheGentlemen dispute that scale, listing the company on their leak site on September 5 and setting a Sept. 11 deadline to pay before the data goes public.

Nobody at Veradigm clicked a #phishing link or left a server exposed. Someone at a vendor did, weeks or months ago, and as many as 3.5 million patients may be the ones living with the consequences of a mistake they never had a chance to prevent.

[Group-IB Global @GroupIB]

✨ Group-IB at Cybersecurity Summit Central Eurasia 2026! 🇺🇿

On October 6–7, Group-IB joined cybersecurity leaders, industry experts, and business representatives in Tashkent, Uzbekistan, to discuss emerging cyber threats, the impact of AI, and the future of cybersecurity across Central Eurasia.

Our team contributed to the discussions through two speaking sessions:
🔹 Amirbek Kurbanov, Head of Cyber Intelligence, Central Asia, explored how artificial intelligence is transforming the cyber threat landscape and why organizations need to adapt their defense strategies.
🔹 Anastasia Barinova, Head of Academic Programs, joined the panel discussion on investing in cybersecurity talent, highlighting the importance of developing expertise to address evolving security challenges.

Beyond the sessions, the summit offered valuable opportunities to exchange insights, connect with customers and partners, and explore new avenues for collaboration.

Thank you to the organizers and everyone who connected with our team in Tashkent!

[Group-IB Global @GroupIB]

⚡ One approval can create access far beyond one account.

Attackers do not always need to bypass your defenses. They can compromise an app, integration, service, or access token that already has permission to reach your environment.

Legitimate access becomes attacker access.
For CISOs, the question is not only who has access.
What has been authorized?
What can it reach?
Does it still need that access?

This #CybersecurityAwareness Month:
🔹 Review connected apps
🔹 Restrict excessive permissions
🔹 Revoke unused access
🔹 Investigate unusual OAuth activity

See what is trusted. Verify what it can reach. Revoke what is no longer needed.

[Group-IB Global @GroupIB]

OpenAI says prompt injection may never be fully “solved.”

The reason is structural: AI agents can process untrusted web content and act on a user’s behalf.

Researchers have demonstrated attacks against AI browsers where hidden instructions in webpages, and even screenshots, could steer agents toward actions involving authenticated sessions and sensitive data.

Brave researchers demonstrated an attack against Perplexity’s Comet where hidden text in a Reddit spoiler tag could prompt the agent to extract a one-time passcode from an authenticated Gmail session. Researchers have also demonstrated prompt-injection risks across other AI browsers.

OpenAI says it is continuing to strengthen defenses through automated red teaming, adversarial training, and layered safeguards. Its December 2025 ChatGPT Atlas update also introduced a newly adversarially trained model and strengthened surrounding safeguards.

The UK’s National Cyber Security Centre has similarly warned that there is a good chance prompt injection will never be fully mitigated.

For security teams, the takeaway is clear: AI agents need to be treated as a new security boundary, not just another interface.

[Group-IB Global @GroupIB]

⚠️ CORF Version 1.0 replaced Kuwait's 2020 #Cybersecurity Framework.
A policy on paper is no longer a control. #Kuwait regulation now asks for tested recovery plans, reviewed architecture and live vendor monitoring, scored on a five level maturity scale.
📘 See what changes and where to start: https://t.co/w7bhUx05Lr

[Group-IB Global @GroupIB]

📈 #Cyberfraud is one of the fastest-growing threats facing the region today.

Yesterday, Ahmed Tharwat joined @OssamaKamaltv on مساء @dmctv for a conversation on how fraud has evolved from traditional scams to #phishing, social engineering and account takeover, to today's AI-powered fraud and why fighting it takes more than technology alone.

The discussion covered the Cyber Fraud Lifecycle, why victims keep falling into increasingly sophisticated traps, and how stronger intelligence sharing across the financial ecosystem can move the industry from reacting to fraud to predicting and disrupting it.

Fraud doesn't stop at the boundary of one institution. Neither should the intelligence used to fight it.

Watch the full episode here: https://t.co/xASWf8vPXg