Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Command references published to a ledger nobody can delete. Seizure assumes there is an object in a jurisdiction to seize.
Two disruptions survived, ~394,000 machines. Takedowns remove infrastructure; the code, operators and customer base persist.
326 servers and 142 domains seized, and 27 million credentials recovered. The credentials outlast the infrastructure.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
17 million devices sold as residential addresses. This is the component that defeats impossible-travel checks and geographic risk scoring.
One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
Twenty successors, and daily endpoints up from one million to nine. Enforcement removed operators; the device pool never changed.
Four botnets, three million consumer devices, a record 31.4 Tbps. The record measures domestic bandwidth growth, not attacker skill.
“Attacks rose despite enforcement” is equally compatible with enforcement having prevented a much larger rise. There is no counterfactual.
Removing seven participants from a population defined by willingness rather than skill leaves the population substantially intact.
Domains are replaced in days. Escrow is the mechanism that lets parties who would defraud each other trade at all.
A conviction is the highest-confidence attribution in this corpus — and it convicts a person, not a cluster, because the cluster is not an entity.
Twenty-six times smaller than a single ransom payment filed elsewhere in this database. Watching money you cannot seize is the ordinary condition.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
A single business email compromise took $7.9 million. A continental operation recovered $3 million.
No zero-day, no custom tooling, no organisation. One person in their late teens and a credential without MFA.
“Group X has been dismantled” is the form the good news usually takes in this field. It describes the destruction of the cheapest component.
An arrest is an allegation. Publication is not reversible, and this corpus cannot correct a wrong identification once it propagates.
A stolen password is defeated by a second factor. A stolen session cookie is the second factor already satisfied.
A rule that only ever withholds is not a rule about evidence; it is a policy of silence. Here the threshold was met.
A password is a claim to be checked. A cookie is the receipt showing the check already happened.
A remedy that fitted the harm and could not reach the party holding it.