Group-IB
- №162 в категории «Технологии»
- №1 678 среди международных каналов
- №4 821 среди каналов на языке «английский»
- №5 526 в мире
Your daily source of cybersecurity news brought to you by Group-IB, one of the global industry leaders.
- 24 часа
- +3
- 7 дней
- –
- 30 дней
- +99
- Реакции
- 13
- Репосты
- –
- Комментарии
- –
Динамика подписчиков
Подписчиков у канала «Group-IB»: 2 674. Прирост за последние 30 дней: 99 (3,8 %).
По дням, последние 30 дней
| Дата | Подписчики | Изменение | Посты | Ср. просмотры поста |
|---|---|---|---|---|
| 11 ноя | 2 674 | +3 | 0 | – |
| 10 ноя | 2 671 | +5 | 0 | – |
| 9 ноя | 2 666 | +5 | 0 | – |
| 8 ноя | 2 661 | +90 | 0 | – |
| 11 окт | 2 571 | – | 0 | – |
Когда публикует
Время по UTC. 20 постов за 90 дней.
Последние посты
-
🚨Group-IB researchers uncovered an active Mirax Android Device Take-Over campaign targeting retail banking customers across the META region. Between March and September 2026, thousands of Android phones belonging to retail banking customers in META were confirmed to be infected with the malware Group-IB tracks as Mirax, with activity spikes over the Eid holidays & at the end of July. Mirax relies heavily on server-side control. Its C2 infrastructure uses dual WebSocket channels with an HTTP long-poll fallback, while DNS-over-HTTPS, transport parameters, phishing templates, and target-app mappings can be configured remotely. This means analysis of the installed APK may reveal only part of...
-
Group-IB has uncovered CyberDakait, a financially motivated threat cluster operating against India’s financial services sector through a combination of social engineering, Android malware, phishing infrastructure, RAT functionality, and cryptojacking. The campaign deploys seven distinct Android trojan families through coordinated smishing and vishing attacks impersonating bank representatives. Victims are directed to phishing pages that collect banking credentials and card data, while GitHub-hosted APKs act as droppers for RAT and XMRig-based mining components. Across the investigated infrastructure, Group-IB identified at least 17,960 compromised devices and 7.6 million intercepted SMS me...
-
🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered. Group-IB supported INTERPOL’s Operation Serengeti III, a multinational law-enforcement operation targeting cybercriminal networks across Africa. Coordinated by INTERPOL and involving 21 countries, the operation tackled cyber-enabled fraud, ransomware, business email compromise, online scams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million. As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa o...
-
🔎 Inside SiriusQT: A seriously skilled RAT SiriusQT has been circulating on underground forums since April 2026, combining HVNC, credential theft, browser automation, keylogging, persistence, process injection and custom encrypted C2 communication. The analysis identified more than 280 SiriusQT client samples linked to different campaigns and 146 unique licenses, including 110 leaked licenses. The malware supports techniques such as Process Hollowing, QueueUserAPC/Early-Bird Injection and Remote Thread Injection, while its credential recovery functionality can target more than 100 different data sources. The latest technical analysis examines SiriusQT’s server and client components, lice...
-
🚨Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified. The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA. Overlaps with...
-
🚨The Checker You Pay For: How Spend-Management Onboarding Became Fraud Infrastructure How can cybercriminals turn a legitimate financial platform into a tool for fraud? In a new investigation, Group-IB researchers examined a suspected Classiscam operation that abused a spend-management platform’s notification systems to distribute Poshmark-impersonation phishing and its open-banking account-linking flow to validate stolen bank and card credentials. 🔹 Trusted payment notifications used to deliver phishing. 🔹 Open-banking abused to check stolen credentials. 🔹 Device and graph analysis linked phishing and card-testing accounts. 🔹 Group-IB reduced fraudulent account blocking time from se...
-
🚨Group-IB has been named a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026. The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared. One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on. It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut: → Native attack surface management, cyber threat intelligence an...
-
⚠️ KGB RAT: behind the capabilities of a Windows Remote Access Trojan KGB RAT is sold as Malware-as-a-Service, combining credential theft, keylogging, hidden desktop access, cryptocurrency, clipboard hijacking, and ransomware functionality in a configurable tool. In its technical analysis, Group-IB researchers examined how KGB RAT establishes persistence, conducts system reconnaissance, communicates with its command-and-control infrastructure, and uses evasion techniques to complicate detection. The investigation also identified multiple operators using a common builder, highlighting why shared code alone is not enough to establish that activity comes from the same threat actor. The findi...
-
🚨What if a fully authenticated 3DS payment was still fraudulent? That is what Group-IB uncovered in a card fraud scheme targeting the GCC. Fraudsters used phishing, eSIM swaps, and account takeover to gain control of victims’ identities and banking access, then used that access to settle genuine government bills and fines using stolen cards. The payments satisfied valid 3DS authentication. Group-IB identified approximately 300 related incidents. Of these, 80 compromised cards were linked to around $2.01 million in confirmed fraudulent payments across three government institutions. How does a fraudster turn a stolen card into a legitimate-looking government payment? Our new report follo...
-
🚨Operation KillSwitch, led by German authorities, with support from Europol and Eurojust, has taken action against KillSec, a ransomware-as-a-service group linked to around 1,000 suspected attacks worldwide. Key Highlights: 🔹 274 organizations were publicly claimed as victims on KillSec’s leak site. 🔹 Around 35% of identified victims were in North America, 30% in Asia-Pacific, and 14% in Europe 🔹 Financial services, healthcare, and government were among the most affected sectors 🔹 The group operated a fully functional affiliate platform with ransom negotiation and payment handling capabilities, payload configuration for Windows and VMware ESXi environments, a Tor-based DLS, and more...
-
Group-IB has uncovered CyberDakait, a financially motivated threat cluster operating against India’s financial services sector through a combination of social engineering, Android malware, phishing infrastructure, RAT functionality, and cryptojacking. The campaign deploys seven distinct Android trojan families through coordinated smishing and vishing attacks impersonating bank representatives. Victims are directed to phishing pages that collect banking credentials and card data, while GitHub-hosted APKs act as droppers for RAT and XMRig-based mining components. Across the investigated infrastructure, Group-IB identified at least 17,960 compromised devices and 7.6 million intercepted SMS me...
-
🚨Group-IB researchers uncovered an active Mirax Android Device Take-Over campaign targeting retail banking customers across the META region. Between March and September 2026, thousands of Android phones belonging to retail banking customers in META were confirmed to be infected with the malware Group-IB tracks as Mirax, with activity spikes over the Eid holidays & at the end of July. Mirax relies heavily on server-side control. Its C2 infrastructure uses dual WebSocket channels with an HTTP long-poll fallback, while DNS-over-HTTPS, transport parameters, phishing templates, and target-app mappings can be configured remotely. This means analysis of the installed APK may reveal only part of...
-
⚠️ KGB RAT: behind the capabilities of a Windows Remote Access Trojan KGB RAT is sold as Malware-as-a-Service, combining credential theft, keylogging, hidden desktop access, cryptocurrency, clipboard hijacking, and ransomware functionality in a configurable tool. In its technical analysis, Group-IB researchers examined how KGB RAT establishes persistence, conducts system reconnaissance, communicates with its command-and-control infrastructure, and uses evasion techniques to complicate detection. The investigation also identified multiple operators using a common builder, highlighting why shared code alone is not enough to establish that activity comes from the same threat actor. The findi...
-
🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered. Group-IB supported INTERPOL’s Operation Serengeti III, a multinational law-enforcement operation targeting cybercriminal networks across Africa. Coordinated by INTERPOL and involving 21 countries, the operation tackled cyber-enabled fraud, ransomware, business email compromise, online scams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million. As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa o...
-
🔎 Inside SiriusQT: A seriously skilled RAT SiriusQT has been circulating on underground forums since April 2026, combining HVNC, credential theft, browser automation, keylogging, persistence, process injection and custom encrypted C2 communication. The analysis identified more than 280 SiriusQT client samples linked to different campaigns and 146 unique licenses, including 110 leaked licenses. The malware supports techniques such as Process Hollowing, QueueUserAPC/Early-Bird Injection and Remote Thread Injection, while its credential recovery functionality can target more than 100 different data sources. The latest technical analysis examines SiriusQT’s server and client components, lice...
-
🚨Group-IB has been named a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026. The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared. One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on. It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut: → Native attack surface management, cyber threat intelligence an...
-
🚨Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified. The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA. Overlaps with...
-
🚨The Checker You Pay For: How Spend-Management Onboarding Became Fraud Infrastructure How can cybercriminals turn a legitimate financial platform into a tool for fraud? In a new investigation, Group-IB researchers examined a suspected Classiscam operation that abused a spend-management platform’s notification systems to distribute Poshmark-impersonation phishing and its open-banking account-linking flow to validate stolen bank and card credentials. 🔹 Trusted payment notifications used to deliver phishing. 🔹 Open-banking abused to check stolen credentials. 🔹 Device and graph analysis linked phishing and card-testing accounts. 🔹 Group-IB reduced fraudulent account blocking time from se...
Вопросы о канале «Group-IB»
Сколько подписчиков у канала «Group-IB»?
У канала «Group-IB» (@group_ib) 2 674 подписчика на 12 ноября 2026 г.
Растёт ли канал «Group-IB»?
Да. Прирост за последние 30 дней: 99 (3,8 %).
О чём канал «Group-IB»?
Канал в категории «Технологии», язык постов: английский. Описание канала: «Your daily source of cybersecurity news brought to you by Group-IB, one of the global industry leaders.»
Какое место занимает канал «Group-IB»?
По числу подписчиков: №162 в категории «Технологии», №1 678 среди международных каналов, №4 821 среди каналов на языке «английский», №5 526 в мире.
Публикует ли канал «Group-IB» рекламу?
За последние 30 дней ни один из 8 постов не помечен как реклама (#ad, Sponsored, «Реклама»). Рекламу без пометки определить нельзя.
Когда публикует канал «Group-IB»?
Пик публикаций: четверг, около 07:00 по UTC. Выходит около 2 постов в неделю.
Статистика обновлена 37 минут назад.