Myanmar Scam Compound Managers Charged

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, scam compounds. Attackers exploit flaws pre-disclosure. A crackdown on DDoS-for-hire. No Mythos for CISA, yes for Mozilla. France ID portal breach. Israeli and Venezuelan critical infrastructure targeted. Russian hacking in Ukraine. An Apache flaw. A ransomware negotiator aided BlackCat.

See Also: Why Cyberattackers Love ‘Living Off the Land’

U.S. federal prosecutors unsealed criminal complaints and arrest warrants for two Chinese nationals being held in Thailand. Federal prosecutors say the men, Jiang Wen Jie and Huang Xingshang, managed scam compounds operated by forced labor in the Southeast Asian country of Myanmar. They face charges of wire fraud conspiracy.

Prosecutors announced the complaints Thursday, also publicizing the seizure of more than 503 domains used to defraud U.S. victims through false promises of cryptocurrency investment. Prosecutors additionally seized a Telegram messaging app channel used to recruit human trafficking victims to a scam compound in Cambodia.

Southeast Asia has become a magnet for organized crime compounds using country using trafficked and forced workers to perpetuate romance and investment scams. The FBI says Americans lost at least $7.2 billion in 2025 to such scams, a figure it believes is a significantly underrepresentation of actual losses. Independent estimates put the global tally of losses to such scams at tens of billions of dollars annually.

Prosecutors say Jiang directly supervised workers at a compound known as Shunda Park in the village of Min Let Pan before it was seized in November 2025 by a regional militia active in Myanmar’s long-standing civil war. Jiang’s team targeted Americans, including one scammer who defrauded one victim of $3 million. Following the seizure, Jiang and Huang attempted to operate another scam compound in Myanmar before briefly relocating to Cambodia, which has its own problems with scam centers (see: Breach Roundup: Cambodia Scam Center Crackdown ).

Prosecutors say Thai police earlier this year arrested the pair on immigration charges. Conditions for workers forced to operate the scams can be horrific, with an FBI affidavit recounting beatings, electrocutions and murder.

Attackers are increasingly moving before vulnerabilities are publicly disclosed, using a window of reconnaissance activity that gives defenders a brief but critical early warning, according to a new report from threat intel firm GreyNoise.

The study finds that surges in malicious internet traffic precede CVE disclosures by a median of about 10 to 11 days. The analysis, based on nearly 148 million sessions observed over a 103-day period, shows that these spikes are structured probing tied to vulnerabilities that are yet to be announced.

GreyNoise tracked activity across 18 major network and edge device vendors and identified dozens of cases where unusual traffic patterns appeared well ahead of disclosure. In more than half of those instances, a related vulnerability was publicly disclosed within three weeks of the spike. The data suggests attackers independently discover flaws or gain early access to exploit flaws before details become public.

Traffic builds in waves, often accelerating as disclosure nears. In one case involving a Cisco vulnerability, probing activity intensified across multiple surges, compressing from weeks-long intervals to just days before disclosure. In another, traffic targeting a SonicWall flaw drew three distinct surge events in the weeks before its CVE announcement, with activity peaking at the midpoint before a final push just three days out.

The study also finds that session volume, not just the number of attacking IP addresses, provides the clearest signal. Traditional security models tend to treat widespread scanning as routine internet noise. GreyNoise argues that this approach misses the significance of sharp increases in interaction volume, which often reflect coordinated pre-exploitation activity rather than opportunistic scanning.

The findings reinforce a broader shift in the threat landscape where exploitation timelines have effectively turned “negative.” Attackers are no longer waiting for disclosure; in many cases, they are already active by the time a vulnerability is assigned a CVE. The report shows a significant share of exploited vulnerabilities are abused on or even before the day they are publicly disclosed.

A Europol-supported international law enforcement operation targeted more than 75,000 individuals of distributed denial-of-service attack platforms, in a coordinated crackdown on the “DDoS-for-hire” ecosystem.

The effort, part of the long-running Operation PowerOFF initiative, brought together authorities from 21 countries and focused on both enforcement and prevention against customers of “booter” or “stresser” services, which enable anyone to launch DDoS attacks for a fee.

Authorities made four arrests, executed 25 search warrants and dismantled 53 domains. More than 100 URLs advertising DDoS-for-hire services were removed from search engine results, and Europol placed targeted ads on search engines to intercept users actively searching for such tools. Warning messages were also sent through blockchains used by criminals to process illegal payments.

Investigators seized backend systems from illegal platforms to locate users and enable coordinated follow-on actions across countries. U.S. Department of Justice prosecutors in Alaska seized eight DDoS-for-hire sites, including “Vac Stresser” and “Mythical Stress,” which launched tens of thousands of DDoS attacks per day.

The U.S. Cybersecurity and Infrastructure Security Agency lacks access to Anthropic’s Claude Mythos Preview artificial intelligence model, even as a Discord group of unauthorized users has been using it freely since the day it launched (see: Report: Discord Group Uses Claude’s Supposedly Secret Mythos).

The AI company has so far extended access to more than 40 organizations, including Amazon, Microsoft, Apple, Cisco and Mozilla, for controlled testing. CISA received briefings on the model’s capabilities but did not obtain access, Axios reported Tuesday. The NSA and the Commerce Department’s Center for AI Standards and Innovation are testing the model. National Cyber Director Sean Cairncross is negotiating broader civilian access to Mythos, and the Department of the Treasury is also seeking entry.

Anthropic’s Mythos AI model can now identify software vulnerabilities in bulk, challenging the assumption that zero-days are rare and difficult to find, Firefox browser maker Mozilla said in a Tuesday blog post.

Mozilla’s earlier test using Anthropic’s Opus 4.6 model scanned nearly 6,000 C++ files across Firefox’s codebase, producing 112 unique reports of which 22 were confirmed as security-sensitive vulnerabilities – 14 of them classified as high-severity, representing almost a fifth of all high-severity Firefox vulnerabilities remediated in the whole of 2025. Those fixes shipped in Firefox 148. A subsequent run using the more advanced Claude Mythos Preview model, part of Anthropic’s restricted Project Glasswing initiative, spotted 271 vulnerabilities, all patched in this week’s Firefox 150 release, the report says.

Mozilla described software flaws as “finite” and said it found “no category or complexity of vulnerability that humans can find that this model can’t.”

A security incident impacted France’s National Agency for Secure Documents government portal responsible for processing passports, national identity cards, driving licenses and residence permits, the French Interior Ministry said Monday.

The agency detected the breach on April 15 and confirmed days later that data linked to approximately 12 million user accounts may have been compromised. The exposed data includes names, email addresses, login identifiers, dates of birth and account IDs, with some records also containing postal addresses, places of birth and phone numbers.

Authorities said supporting documents submitted during administrative processes were not affected and that the exposed data cannot be used to directly access user accounts.

A threat actor operating under the name “breach3d” claimed responsibility, alleging possession of up to 19 million records.

Earlier this year, a cyberattack on France’s Ministry of Education exposed personal data linked to roughly 243,000 public school employees, most of them teachers, through the centralized Compass human resources platform (see: Breach of French Education Platform Impacts 243,000 Staff).

A new strain of operational technology malware designed to manipulate water treatment processes in Israeli industrial control systems can alter chlorine dosing and water pressure levels, recent analysis from cybersecurity company Darktrace found.

The malware, dubbed ZionSiphon, is engineered to identify industrial control environments linked to water treatment and desalination operations and activate only under specific conditions. It checks for Israeli IP ranges and the presence of processes or files associated with water systems before executing its payload.

Once deployed, ZionSiphon scans networks for industrial protocols such as Modbus, DNP3 and Siemens S7 to map and interact with OT environments. Researchers said the malware uses standard intrusion techniques including privilege escalation, persistence mechanisms and propagation via removable media.

The code contains embedded strings with politically driven messaging referencing harm to Israeli cities, and the malware is narrowly configured to avoid execution outside Israeli water infrastructure.

Despite these capabilities, the current sample appears non-functional. A critical flaw in the malware’s own country-validation logic – the IsTargetCountry() function – causes it to trigger its self-destruct routine rather than deploy its payload. Darktrace assessed the sample as either a development build, a prematurely deployed version, or an intentionally defanged test variant.

A previously unknown and highly destructive malware was deployed in a targeted attack against Venezuela’s energy and utilities sector, said Russian cybersecurity firm Kaspersky.

The malware, dubbed Lotus Wiper, was designed to permanently destroy compromised systems by overwriting physical drives. Researchers say the attack relied on two batch scripts to prepare the environment before the final payload deploys: disabling user accounts, forcing logoffs, blocking cached logins and shutting down network interfaces to isolate machines.

Once active, Lotus Wiper operates at the disk level via IOCTL calls, clearing USN journal entries, wiping restore points and overwriting physical sectors. The batch scripts pile on further with diskpart clean all to zero out drives, robocopy to overwrite directory contents and fsutil to fill remaining disk space, closing off any recovery path. Locked files are queued for deletion on reboot, and the destruction cycle runs multiple times to ensure nothing survives.

The malware was likely compiled in September 2025 and later uploaded from a system in Venezuela in December 2025.

A cyberespionage campaign by Russia’s GRU Military Unit 26165 targeted Ukrainian prosecutors and anti-corruption agencies through Roundcube webmail exploits, compromising more than 170 email accounts, research from Ctrl-Alt-Intel found.

Ukrainian authorities said attackers executed malicious code when victims opened emails in the Roundcube platform. Researchers identified an exposed command-and-control server used in the operation that remained accessible for months and contained stolen emails, credentials and operational tooling.

Attackers harvested credentials, exfiltrated inboxes and mapped contact networks across compromised accounts. Researchers also identified more than 140 email forwarding rules configured to redirect communications to attacker-controlled inboxes.

Attackers maintained persistence by extracting time-based, one-time password secrets. Affected Ukrainian institutions include Specialized Anti-Corruption Prosecutor’s Office and the Asset Recovery and Management Agency. Additional victims were identified in Romania, Bulgaria, Greece and Serbia.

GRU Military Unit 26165 is tracked by threat intel companies as APT28, Fancy Bear, BlueDelta and Forest Blizzard. Ukrainian authorities said the campaign appears to be part of a broader operation tracked since 2023, with CERT-UA identifying three waves of attacks.

Ukraine’s Security Service, in coordination with the National Police, dismantled a large-scale bot farm operation in the northwestern city of Zhytomyr used to support Russian information warfare efforts.

Authorities arrested the alleged operator, who is accused of creating and selling more than 3,000 fake Telegram accounts each month to Russian buyers. The accounts were used to amplify Kremlin propaganda, spread disinformation about Ukraine’s military and domestic situation, and send anonymous messages falsely reporting bomb threats at various facilities.

The bot farm relied on Ukrainian mobile numbers and SIM cards to create credible-looking accounts, which were then sold via underground online platforms. Investigators say Russian intelligence services used the infrastructure to conduct influence operations and psychological campaigns.

Law enforcement seized computer systems, USB modem hubs, mobile devices and roughly 2,000 SIM cards during the raid. Nearly 20,000 fake accounts linked to the operation have been blocked.

A high-severity vulnerability in a now patched Apache ActiveMQ is under active exploitation, with researchers warning that a built-in management feature can be abused to achieve remote-code execution on exposed systems.

The flaw, tracked as CVE-2026-34197, affects ActiveMQ Classic and stems from its integration with Jolokia, a JMX-over-HTTP interface used for broker management. Researchers at Horizon3.ai said the issue allows attackers to execute arbitrary commands by invoking legitimate management operations in unintended ways.

The weakness lies in how Jolokia exposes internal MBeans. Attackers can use these functions to force the broker to load external configuration files and execute system-level commands.

Researchers said an attacker can send crafted requests to the Jolokia endpoint, invoking the broker’s addNetworkConnector operation with a malicious discovery URI that instructs the broker to fetch and process a remote configuration file, ultimately executing commands on the host machine.

Default or weak credentials reduce the barrier to entry, as many environments still run ActiveMQ with default admin credentials. On versions 6.0.0 through 6.1.1, a separate vulnerability – CVE-2024-32114 – inadvertently exposes the Jolokia interface without any authentication, making CVE-2026-34197 effectively an unauthenticated remote-code execution flaw on those versions.

The flaw has existed for more than a decade, embedded in widely deployed messaging infrastructure used across sectors including finance, healthcare and government. Compromise of an ActiveMQ broker can expose sensitive data in transit and provide a foothold into connected systems, research warns.

The vulnerability has also been added to CISA’s Known Exploited Vulnerabilities catalog.

A Florida-based ransomware negotiator pleaded guilty to conspiring with cybercriminals to deploy ransomware attacks against U.S. companies, while simultaneously advising victims on how to respond.

Angelo Martino, 41, admitted to working with the BlackCat/ALPHV ransomware group in 2023, the U.S. Department of Justice announced Monday.

Martino worked as a negotiator at DigitalMint, a crypto broker that helps ransomware victims negotiate and pay demands. Prosecutors say he exploited that position by feeding BlackCat operators confidential client details, including insurance policy limits and internal negotiation strategies.

Prosecutors said the insider access helped drive multimillion-dollar payouts, with some victims paying ransoms exceeding $25 million after negotiations Martino influenced.

His two co-conspirators, Ryan Clifford Goldberg, 33, a former Sygnia incident response manager from Georgia, and Kevin Tyler Martin, 28, a fellow DigitalMint negotiator from Texas, already pleaded guilty to the same charge in December 2025. All three used their cybersecurity expertise to operate as BlackCat affiliates, paying the ransomware group’s administrators a 20% cut of proceeds in exchange for access to its platform.

U.S. authorities have seized more than $10 million in assets from Martino, including $9.2 million in cryptocurrency, two properties, a trailer, a luxury fishing boat, a 1999 Nissan Skyline.

Other Stories From This Week

With reporting by ISMG’s David Perera in Northern Virginia.