🚨 Critical #PHP2Shell vulnerabilities put millions of internet-facing assets at risk. Two critical flaws in the PHP core — CVE-2026-109618 and CVE-2026-109619 — can enable unauthenticated remote code execution and sensitive memory disclosure on vulnerable servers. As of October 22, Group-IB Attack Surface Management detected 5.7M+ vulnerable assets across officially affected PHP 8.2–8.5 branches, with the broader potential exposure exceeding 22M assets. With public PoCs already circulating, organizations should act now: 🔹 Update PHP to a fixed release 🔹 Prioritize internet-facing systems 🔹 Monitor for unusual requests, HTTP 500 spikes, and PHP worker crashes 🔹 Keep WAF protections enabled while patching Group-IB continues to monitor underground discussions, potential exploitation attempts, and post-exploitation activity related to PHP2Shell. Group-IB products are not affected — no action required for customers We are sharing what we see so organizations can understand their exposure, respond quickly, and act before attackers do. Learn more about PHP2Shell and what to do next: link.group-ib.com/4BkvOFA

What does it take to get past a bank that checks a customer’s face before every large transfer? A copy of that face, an ID card, and access to the phone’s text messages, all captured through a single malicious app install. The scheme began with a smishing message impersonating a government office and offering a refund on an electricity bill. To claim it, victims installed an app and completed a short face scan, holding the camera steady and blinking or turning their head when prompted. Behind the scenes, the app (GoldPickaxe.iOS, part of the GoldFactory campaign) also exfiltrated identity documents and intercepted incoming SMS messages. Group-IB identified it as the first iOS trojan of its kind to steal facial recognition data. The stolen faces were used to create AI-generated deepfake videos convincing enough to pass the bank’s own biometric checks, and at least one victim lost more than $40,000. A face scan functions like a password, and biometric fraud depends on people forgetting that. Legitimate refunds, banks, and government offices do not ask for a biometric scan through a chat app.

How can organizations stay ahead of increasingly sophisticated #cybercrime and financial fraud? On October 19, Group-IB and Amazon Web Services (@awscloud) brought together leaders from Bahrain’s banking, financial services, telecommunications, government and other key sectors at Fraud Prevention & Resilience: Bahrain Majlis 2026, held at the InterContinental Bahrain. 🇧🇭 The discussions focused on key priorities: 🔹 Cyber Fraud Fusion: Connecting #cybersecurity and #fraudintelligence to anticipate and prevent emerging threats. 🔹 Predictive defense: Identifying criminal tactics, infrastructure and networks before attacks cause financial or operational damage. 🔹 Collective resilience: Strengthening intelligence sharing and collaboration across industries to address evolving digital threats. With more than 1,600 high-tech crime investigations conducted and established collaboration with INTERPOL, Europol and AFRIPOL, Group-IB brings frontline investigative expertise to the fight against cyber crime. Learn more: group-ib.com/resources/knowl…

🚨1,462 arrests. 10,909 malicious networks disrupted. More than USD 105 million recovered. Group-IB supported INTERPOL’s #OperationSerengetiIII, a multinational law-enforcement operation targeting #cybercriminal networks across Africa. Coordinated by @INTERPOL_Cyber and involving 21 countries, the operation tackled cyber-enabled fraud, #ransomware, business email compromise, #onlinescams, and digital extortion, identifying nearly 66,000 victims and linking criminal activity to losses exceeding USD 385 million. As part of the operation, Group-IB provided INTERPOL with threat intelligence on malicious infrastructure, including phishing kits, botnets, and other malicious resources hosted in Africa or used to target the region. The company also shared intelligence on threat actors involved in fraudulent activities, including social media accounts linked to suspected fraudsters. The results reinforce a simple reality: cybercrime crosses borders, and fighting it requires coordinated action across them. Read the full press release to learn more: link.group-ib.com/4z1RapE @INTERPOL_HQ

🚨 What looks like a Windows RAT is actually a much broader threat platform. Our analysis of SiriusQT uncovered more than 280 client samples and 146 unique licenses, along with features such as hidden virtual network computing (HVNC), credential theft, multiple process injection techniques, and custom encrypted C2 traffic. Read the full technical analysis: link.group-ib.com/4kaseaU #CyberSecurity #MalwareAnalysis #ThreatIntel #SiriusQT

Around $355,000 moved through stolen bank-card data in under a year, and the cards never left their owners’ pockets. It often starts with a text or call that appears to come from a bank. The victim is told to install a “security” app, then tap their bank card against the back of the phone to “verify” it. During that tap, the malicious app reads the card through the phone’s NFC chip and relays the data to a criminal’s device connected to a POS terminal or mobile wallet far away. The fraudulent transaction is then completed remotely. Group-IB researchers call this #GhostTap. Their investigation identified more than 54 malicious APK samples built for this scheme, with the service behind them openly advertised on Telegram. Remember: a legitimate bank will not ask you to install an app from a text link and then tap your card against your phone to “verify” it. A banking app should only be installed from an official app store, never from a link in a #Smishing text.

Network edge devices can give threat actors a direct path into an organization. In a campaign linked to threat actor #k0t, Group-IB and NyxLab observed large-scale targeting of internet-facing FortiGate, FortiWeb, and Palo Alto GlobalProtect systems, with more than 70,000 exposed credentials and related data identified. The operators combined vulnerability exploitation and brute force activity to gain initial access, then moved deeper into victim environments using tools such as NetExec, Mimikatz, and Impacket, while MeshCentral and AdaptixC2 provided persistence and command-and-control. The investigation also observed data exfiltration through Rclone to Wasabi S3 and MEGA. Overlaps with organizations later listed by #ransomware groups including #Qilin and #TheGentlemen raise the possibility that the operators may be acting as Initial Access Brokers, although the relationship remains unconfirmed. Read the full technical analysis: link.group-ib.com/4yDaMQY

✨ Group-IB, in collaboration with @awscloud, successfully hosted the Fraud Prevention and Resilience Majlis 2026 in Bahrain yesterday. We were honored to welcome the National Cyber Security Center Bahrain (@NCSC_BH), alongside leading banks and organizations from the government, insurance, aviation, and e-commerce sectors. The Majlis featured two strong panel discussions: “The Era of Financial Crimes in the Region” and “Fraud, #Cybersecurity, Compliance & Operational Resilience.” Industry experts shared valuable perspectives on the evolving fraud landscape, emerging threats, regulatory challenges, and the importance of strengthening operational resilience across sectors. As fraud becomes an increasingly complex challenge, collaboration is essential to staying ahead of sophisticated threats. The discussions highlighted the need for a more unified approach, bringing together industry leaders to exchange insights, share experiences, and explore practical ways to strengthen #fraudprevention across the ecosystem. A sincere thank you to our partners at #AWS, NCSC Bahrain, our distinguished panelists, and everyone who joined us and contributed to these meaningful discussions. We look forward to continuing the conversation and working together to build a safer, more resilient digital economy across the region.

🚨 The last incident you witnessed probably crossed domains: an exposed asset, a stolen credential, a payment that shouldn't have cleared. One operation. Several teams, each holding a piece of the puzzle. But attackers never work in silos, and that's the gap they count on. It's why a new platform category emerged, Enterprise Risk Mitigation and Management (ERMM), built to defend across domains instead of one at a time. Frost & Sullivan assessed the field in 2026 and set three requirements to make the cut: 🔹 Native attack surface management, cyber threat intelligence and digital risk protection 🔹 Native remediation 🔹 Outside-in and inside-out visibility From more than 30 vendors, Frost benchmarked 15, and named Group-IB a Visionary Leader in the Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026. Frost singles out two reasons: intelligence Group-IB originates rather than resells, and Cyber-Fraud Fusion, defending cyber and fraud as the single operation attackers actually run. If you're weighing your next investment, the report is a way to scrutinise the capabilities behind the platform claim, not just the marketing around it. Learn More: link.group-ib.com/4k1pr3N

🚨 46,200 high-risk transactions identified. A significant drop in fraud incidents observed. As digital transactions grew, JSCB Business Development Bank in Uzbekistan needed to stay ahead of evolving online fraud, from phishing and vishing to malicious APKs. Together with TrustTech, the bank implemented Group-IB Fraud Protection to detect risk throughout the user session, uncover new fraud methods, and strengthen protection without adding unnecessary friction for customers. See the results: link.group-ib.com/4yq99VN

🚨Pop culture turns hackers into heroes. Real hacking looks very different. Behind the screen names and forum reputations sit pressure, guilt and a hard path out. In the latest #MaskedActors episode, Gary Ruddell and former INTERPOL Cybercrime Director Craig Jones sit down with Marcus Hutchins. Marcus is best known for helping stop #WannaCry. Here he tells the part of his story that rarely gets airtime. They discuss: → What draws people into cybercrime communities → How status, identity and belonging keep them there → Why walking away is so hard → How offensive skills can become defensive ones #Cybercrime is about more than money. Understanding the communities behind it helps us understand the threat itself. 🎧 Listen now: Spotify: open.spotify.com/episode/05M… Apple podcasts: podcasts.apple.com/us/podcas… YouTube: youtu.be/yMBlLeNvsAA?si=oF73…

🚨 What happens behind the scenes of KGB RAT? #KGBRAT is marketed as a legitimate Windows administration tool, but our latest research reveals a Malware-as-a-Service platform built for surveillance, credential theft, #ransomware deployment, and victim intimidation. Key findings from the investigation: 🔹 Infrastructure linked to KGB RAT dates back to January 2022, years before its public promotion on underground forums. 🔹The malware combines keylogging, credential theft, HVNC, ransomware, and an advertised #CryptoClipper capability within a single builder. 🔹 Operators abuse legitimate services such as #Telegram Bot API for victim notifications and ip-api.com for geolocation profiling. 🔹 KGB RAT includes unusual harassment features, including screamers, jump scares, and forced BSOD events, blending #financialcrime with psychological disruption. 🔹 Analysis revealed extensive anti-analysis and defense-evasion functionality, including Windows Defender exclusion tampering, suspicious PowerShell execution, AV enumeration, and protections targeting .NET reverse engineering tools. 🔹 Despite being marketed as a new offering, KGB RAT shares significant overlap with the NjRAT/Lime-Worm ecosystem, demonstrating how established malware frameworks continue to be repackaged and commercialized. Read the full analysis: link.group-ib.com/4hYPuWG