ransom

A former core infrastructure engineer, Daniel Rhyne, from an industrial company in New Jersey, was sentenced to 32 months in prison for attacking his employer's computer network and demanding a ransom in Bitcoin. The 59-year-old Rhyne, who is from Kansas City, Missouri, was sentenced on September 28 by U.S. District Judge Michael A. Shipp in Trenton. He pleaded guilty in April this year to charges including extortion by threatening to damage a protected computer and intentionally damaging a protected computer. The prosecution did not disclose the name of the company, which is headquartered in Somerset County, New Jersey, serving clients in industries ranging from biopharmaceuticals to oil and gas.According to the FBI's criminal complaint, around 4 PM on November 25, 2023, the company's network administrator began receiving hundreds of password reset notifications for accounts, and subsequently discovered that all other domain administrator accounts had been deleted. Forty-four minutes later, employees received an email titled "Your Network Has Been Penetrated," claiming that the company's IT administrator had been locked out, backups had been deleted, and warning that unless 20 Bitcoins (approximately $750,000 at the time) were paid by December 2, an additional 40 servers would be shut down daily for 10 days. The ransom was set at 700,000 euros, to be paid in Bitcoin.Investigators traced the attack back to an unauthorized virtual machine created on the company network on November 9, 2023, with the password "TheFr0zenCrew!", which was subsequently set for the administrator account, 301 user accounts, and the email used to send the ransom note.

A 28-year-old core member of the globally renowned ransomware group Qilin has been arrested in Japan and was extradited to Germany on October 2. Reports indicate that the man is suspected of illegally infiltrating the systems of a logistics company in Germany in September 2024, encrypting data, and demanding a ransom of approximately $165,000 (about 26 million yen) in Bitcoin.Investigations show that he was responsible for building the attack systems within the Qilin criminal network and took a cut from the ransoms collected by various branch execution teams. Japanese police apprehended him while he was traveling to Osaka in late May this year, and he was subsequently handed over to German authorities after being deemed eligible by the Tokyo High Court. Qilin operates under a "ransomware as a service" (RaaS) model and previously claimed responsibility for a cyber attack on Japan's Asahi Group in 2025.

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

According to a report by Fabien Arnaud from the French media Midi Libre, a resident in Saint-Jean-de-Védas near Montpellier, France, was the victim of a home invasion and extortion related to cryptocurrency. The police acted quickly after the incident and have arrested three suspects.It is reported that the victim had previously encountered a similar violent extortion related to cryptocurrency on April 11 of this year.

According to CriptoNoticias, a court in Costa Rica sentenced two men to 12 years in prison each for money laundering. The case involves the kidnapping and murder of American businessman William Shawn Crichton Kopko in 2018, for which his family paid a ransom of approximately 148 bitcoins, valued at around 1 million dollars.The court found that the two defendants received part of the ransom and deposited it into wallets under their control to conceal the source of the related assets.

According to CoinDesk, hackers claiming to hold Revolut user data have begun to publicly release related documents, which include passports, selfies, and Bitcoin transaction records.The hackers threatened that if Revolut does not pay the ransom, they will continue to leak data daily. Currently, Revolut has not publicly responded.

Following the attack on the Liquid Network, Blockstream rejected the hacker's demand for a 10% ransom on the remaining approximately 598.5 bitcoins and requested the hacker to return the bitcoins. "Unauthorized acquisition of assets and refusal to return them is a criminal act, not responsible disclosure; this is by no means white hat hacking, but outright theft."Previously, after Blockstream confirmed that the vulnerability in the bridging node had been fixed, the Liquid Network attacker returned 3,400 BTC and retained approximately 598.5 BTC (worth about 47.3 million USD).

Blockstream tweeted that it will not pay a ransom for the return of the stolen Bitcoin from the Liquid Network, stating that acquiring assets without authorization and refusing to return them constitutes theft, which does not fall under responsible disclosure or white hat behavior.Blockstream stated that if the stolen funds are not returned, it will cooperate with law enforcement agencies, exchanges, service providers, and forensic experts to track, recover the assets, and identify the responsible parties through all legal means, while emphasizing that Bitcoin transactions are transparent and relevant evidence will not disappear. Blockstream is the main developer and technical provider of the Liquid Network. Liquid Network stated that "approximately 4,000 BTC were taken by white hat hackers," and the sidechain has therefore suspended operations.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

According to Caixin, the Hong Kong Court of Appeal yesterday rejected the sentence reduction application of the mastermind behind the electric fraud and human trafficking, Ma Zhihao, and upheld the original sentence of 56 months in prison. During the investigation of the case, the Hong Kong police tracked the criminal funds through blockchain and cryptocurrency transaction records, identifying the key points where ransoms and criminal proceeds were received.It is reported that a victim's family paid approximately 9,527 Tether (USDT) to a cryptocurrency wallet designated by the criminals. The blockchain tracking records conclusively prove that 8,127 USDT flowed into an exchange account registered under Ma Zhihao's real name and Hong Kong ID, which was then exchanged for about 63,000 Hong Kong dollars and transferred to his personal HSBC bank account, becoming important evidence of his involvement in the crime and obtaining profits. The Court of Appeal pointed out that if it were not for the 7-year sentencing cap imposed by the District Court, the punishment faced by the defendant would be much heavier than this.

Cybersecurity company Check Point Research discovered that the StopAndProtect ransomware campaign uses nearly 2,000 compromised WordPress sites to spread malware, steal data, monitor victims, and deploy ransomware. This campaign was identified in mid-May. As of July 24, it has compromised over 6,000 unique IP addresses, including 1,852 in the United States, and 630 each in Russia and India.The compromised websites were also used to host malware, send commands, and store stolen files, screenshots, and activity logs. Attackers lure Windows users into running PowerShell commands through fake CAPTCHAs, thereby stealing credentials and cryptocurrency wallet recovery phrases, and spreading through networks and USB devices. Researchers have collected over 31,000 screenshots and more than 700 data compression packages, and believe that the attackers may have inadvertently infected themselves.

According to CCTV News, recently, the National Computer Virus Emergency Response Center and the National Engineering Laboratory for Computer Virus Prevention and Control, relying on the National Computer Virus Collaborative Analysis Platform (https://virus.cverc.org.cn), discovered multiple incidents of users being attacked by the "Sorry" ransomware virus within our country. After the user's important files were encrypted, the file names were changed to the original file name + .sorry suffix string. The attackers also left a ransom note on the user's host, demanding that the user download an encrypted communication tool to contact them.

The "China Business Journal" issued a statement saying: "Recently, our company discovered that illegal individuals are impersonating 'China Business Journal' and sending emails to some companies through non-official company email accounts, falsely claiming to have obtained significant negative information about the companies through so-called 'undercover investigations,' and threatening that if financial compensation (in Bitcoin) is not paid, the related 'undercover articles' will be published."The "China Business Journal" stated that all its news reports strictly comply with national laws and regulations, and interviews and communications are conducted through official channels. Such behavior is suspected of fraud and has been closely monitored, with evidence collected, and all rights to pursue legal responsibility are reserved. The statement reminds relevant companies to remain vigilant; if they receive such impersonated emails, they should not pay any financial compensation, and should immediately preserve all evidence and report to the local public security authorities.

According to News.bitcoin, the Kenyan government is investigating the hacking incident of President William Ruto's official website, where attackers briefly disabled the site and altered the homepage content, demanding a ransom of 5 Bitcoins.William Kabogo, the Cabinet Secretary for the Ministry of Information, Communication and the Digital Economy, stated that the Kenyan law enforcement agency ICT Authority immediately activated the cybersecurity response protocol to control the incident and conduct forensic investigations, temporarily restricting public access to the portal. Currently, there is no evidence that sensitive data has been accessed without authorization, leaked, or lost, and government systems and digital services remain securely operational.

The United States, the European Union, and the United Kingdom jointly announced sanctions against a group involving state-level hacker organizations, cybercrime gangs, and their infrastructure providers. The targets are accused of causing billions of dollars in losses to global businesses, critical infrastructure, and government agencies. Among the most notable is the EU's sanction against the Russian cybercriminal Vitaly Nikolayevich Kovalev (alias "Stern").The EU has identified Stern as one of the core managers of the notorious Trickbot Group ransomware organization, which includes several high-risk ransomware variants such as Conti ransomware and Ryuk. On-chain analysis shows that wallet addresses associated with Stern have received over $300 million in ransom payments, potentially making him the "largest confirmed ransomware operator" to date. According to analysis, the $300 million only represents the profits obtained by Stern personally, and the overall illegal income of the Trickbot group may be much higher.On-chain fund flows indicate that Stern has had transactional connections with multiple ransomware ecosystems, including Ryuk, Conti, Diavol, Karakurt, Royal, and Quantum. Investigations show that Stern plays a role similar to "CEO" within the Trickbot organization, responsible for budget management, personnel recruitment, infrastructure procurement, and attack planning.

According to Financefeeds, the U.S. Department of Justice has announced criminal charges against 19-year-old dual citizen Peter Stokes, who is accused of being a member of the cybercrime organization "Scattered Spider," and has been extradited from Finland to the United States.

According to Cambodian media KohsantepheapDaily, a 53-year-old Chinese real estate company owner, Yang Weixin, was kidnapped by a criminal gang in Phnom Penh. The suspects demanded a ransom of 2 million dollars in cryptocurrency from the victim's wife via the victim's phone in the early hours of May 30. After failing to receive the ransom, they subsequently killed the victim and abandoned the body in a car.Surveillance footage shows that three suspects forcibly took the victim away from his residence parking lot on the evening of May 29. Local police have confirmed that the case is classified as kidnapping for ransom resulting in death, and the investigation is ongoing.

The French newspaper "Le Monde" revealed that there has been new progress in the investigation of a cryptocurrency-related kidnapping case that occurred in 2023. French law enforcement discovered a transnational money laundering network involving multiple countries and cryptocurrency wallets while tracing the flow of a €1.7 million cryptocurrency ransom. The victim was the father of the well-known crypto influencer "TeufeurS." The kidnappers threatened the victim's family via text messages and demanded ransom payment in cryptocurrency. Ultimately, TeufeurS transferred a total of €1.7 million to the kidnappers' designated wallet in two installments, after which his father was released.The investigation showed that part of the ransom flowed into wallet accounts controlled by foreign nationals after multiple transfers. One transfer of $131,000 was successfully traced by the French gendarmerie, with leads ultimately pointing to a cryptocurrency wallet controlled by Venezuelan nationals. The case further revealed the complex chain of money laundering utilized by criminal organizations through cross-border cryptocurrency transfers, anonymous wallets, and overseas platforms. The report stated that this case is considered one of the significant examples of kidnapping and extortion cases in the European cryptocurrency industry and may serve as an early template for multiple kidnapping cases targeting cryptocurrency practitioners in France and Europe in 2025.

Bitcoin mining company MARA Holdings allocated approximately $4.3 million for CEO Fred Thiel's personal security expenses in fiscal year 2025, which includes $430,780 for vehicle bulletproof modifications, as well as expenses for bodyguards and residential security facilities. According to documents submitted to the U.S. SEC, MARA also provided approximately $3.9 million in security expenses for CFO Salman Khan, including $438,380 for vehicle bulletproof costs.Reports indicate that as incidents of "ransom attacks" targeting executives and investors in the crypto industry increase, crypto companies are significantly ramping up their investment in executive physical security. The so-called "ransom attack" typically refers to forcing victims to hand over private keys or account access through kidnapping, violence, or coercion. Data shows that in 2025, there were 72 confirmed incidents of crypto-related entity coercion globally, a year-on-year increase of 75%. Among these, France recorded 19 incidents, the highest in the world.

The open-source data visualization tool Grafana stated on platform X that it recently discovered an unauthorized attacker had obtained a token that could access the Grafana Labs GitHub environment and used it to download the code repository.An investigation confirmed that this incident did not involve customer data or personal information leakage, and no impact on customer systems or business operations was found. After the incident, forensic analysis was immediately initiated, and it is believed that the source of the credential leak has been identified. Additional security measures have also been deployed to strengthen environmental protection.Furthermore, Grafana disclosed that the attacker attempted to demand a ransom to prevent the code repository from being made public, but the company ultimately decided to refuse to pay the ransom and will release more information about the incident review after the investigation is completed.