Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
326 servers and 142 domains seized, and 27 million credentials recovered. The credentials outlast the infrastructure.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
17 million devices sold as residential addresses. This is the component that defeats impossible-travel checks and geographic risk scoring.
One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
Four botnets, three million consumer devices, a record 31.4 Tbps. The record measures domestic bandwidth growth, not attacker skill.