Financially motivated cybercriminal group known for social engineering help desks, SIM swapping, and MFA manipulation to breach networks.
Group-IB found the Telegram channel in ASOS's October 6 rogue push alert was opened that day by an account once used for gaming-item trading. Until data surfaces, the Snowflake claim is unproven and the abused messaging platform is the lead to work.
Reality
SecurityWeek says awareness training has failed against help desk vishing, citing attacks that cost MGM an estimated $100 million. The fix it profiles is Netarx's live-call scanner for cloned voices and spoofed devices, but in both breaches it cites, callers talked help desk staff into granting access.
Reality
Ahmed Hossam Eldin Elbadawy, 24, admitted his part in the group's extortion work a year ago. The plea reached the public record through filings seeking more than $17 million in cryptocurrency and luxury assets.
Reality
Elbadawy is the third of the five people charged in 2024 to be convicted. Prosecutors want at least $17.6 million in cryptocurrency and cash out of a spree the indictment ties to 29 compromised victims.
Reality
The Transportation Department's final rule drops amenity obligations for ten causes of disruption. Cyberattacks qualify only while the carrier can show compliance with applicable cybersecurity regulations, language Crowell & Moring calls notably broad.
Reality
A joint CISA and FBI advisory says the group rehearses a company's password-reset process over several calls before it asks for anything. That puts factor-reset workflows in the identity boundary, not the support queue.
Reality
Verizon's 2026 DBIR puts mobile phishing simulation click rates 40% above email. Most of those attempts never reach a security team, because the report button, the gateway and the triage queue all sit in the inbox.
Reality
A July 2026 joint alert on North Korean IT workers and the 2025 M&S breach sit at opposite ends of the identity lifecycle: hiring and recovery. Neither required breaking authentication.
Reality