fbi11 articles
OpenAI Engineer Arrested After Bugging Conference Room with Hidden Recording Device
An OpenAI engineer, identified as 35-year-old Saudi national Abdulrahman Alfozan, was arrested after secretly planting an audio recording device inside a company conference room in an apparent attempt to capture sensitive conversations. The device was discovered on September 30, hidden in toilet paper and inserted into a USB port on a television, after which OpenAI used its own AI models to identify Alfozan as the culprit and reported the matter to the FBI. OpenAI stated there is no indication that the employee improperly accessed or stole model weights, source code, or customer data, and he has since been fired and charged with illegally intercepting oral communications.
Ransomware Negotiator Arrested in FBI's Expanding ShinyHunters Crackdown
A Canada-based cybersecurity expert specializing in ransomware response, identified as Edward Dubrovsky, has been arrested in the United States as a suspected member of the ShinyHunters hacking group, which recently breached FBI systems and obtained data on nearly all agents and job applicants. He was arrested after traveling to Philadelphia for a conference and faces charges including conspiracy to extort and interference with commerce by threats. This is the third ShinyHunters arrest in recent weeks as the FBI works to dismantle the group, with two other alleged key members detained in the Netherlands and Jordan respectively.
Third ShinyHunters Suspect Arrested as FBI Slowly Dismantles Group That Hacked Its Own Jobs Portal
The FBI has arrested a third suspected ShinyHunters co-conspirator, a Canadian citizen apprehended in Pennsylvania, following earlier arrests in the Netherlands and Jordan related to the group's breach of the FBI's jobs portal. The hack, announced by ShinyHunters in September, exposed sensitive personal, medical, and employment data on FBI agents and applicants, and reportedly resulted from a contractor's failure to apply a security patch to a PeopleSoft platform managed by Accenture. FBI Director Kash Patel has vowed to continue pursuing remaining members of the group, which the FBI alleges has breached over 140 organisations and extorted at least $70 million since last year.
FBI Seizes Chinese Hacking Infrastructure as Seven Nations Warn of Ongoing PRC Espionage Campaign
The FBI seized seven web domains linked to Chinese security firm Integrity Technology Group, which allegedly provided hacking tools — including a vulnerability scanner and malware — used by Beijing-backed hackers known as Flax Typhoon to target critical infrastructure worldwide, including a South Carolina power company. A joint advisory from seven governments warned that these actors use botnets, malware, and various intrusion techniques to steal sensitive data from organisations globally, prompting CISA to add five new CVEs to its Known Exploited Vulnerabilities Catalog. Despite the partial dismantling of Flax Typhoon's 260,000-device botnet in 2024, Western governments and security researchers warn that Chinese state-sponsored hacking activity against critical infrastructure continues unabated.
FortiBleed Is Still Running: FBI Flags 86,644 Stolen Fortinet Credentials and Counting
The FBI and Secret Service have issued a warning that the FortiBleed campaign remains an active threat, having harvested over 86,644 credentials from Fortinet FortiGate firewalls and VPN gateways across 194 countries by exploiting reused passwords and legacy password storage methods. The five-stage Russian-speaking operation uses credential stuffing, passive traffic interception via a tool called FortigateSniffer, and GPU-accelerated password cracking to gain and maintain persistent access, with stolen credentials linked to INC and Lynx ransomware groups, suggesting the actors operate as an initial access broker. Organizations are urged to enable phishing-resistant authentication, reset passwords, review logs for suspicious activity, and isolate any affected devices if a compromise is detected.
FBI Boots Accenture Contractor After ShinyHunters Breach Traced to Unpatched System
The FBI removed an Accenture contractor following a data breach by the ShinyHunters cybercrime group, which exploited an unpatched vulnerability in Oracle's PeopleSoft HR platform to access personal information of thousands of bureau employees. FBI cyber chief Brett Leatherman confirmed the breach resulted from the contractor's failure to apply a security patch issued to secure the system. ShinyHunters claimed the attack was intended to pressure the FBI over a report the group alleged contained false information about them, though law enforcement has since arrested two alleged leaders of the group.
FBI Nabs Developer Behind Ploutus ATM Malware in Tren de Aragua Takedown
A Venezuelan national, Anibal Alexander Canelon Aguirre, believed to be the developer of the Ploutus ATM malware and a key figure in the Tren de Aragua criminal organization, has been arrested and charged with bank burglary, fraud, and money laundering conspiracy. The group used the malware to carry out ATM jackpotting attacks across 47 US states and foreign countries, forcing machines to dispense cash without debiting accounts. Canelon Aguirre, who had been on the FBI's top 10 most wanted list since March 2026, pleaded not guilty and will remain detained pending trial, as part of a broader case involving 120 charged defendants.
FBI Boots Accenture Contractor Over Unpatched System That Handed ShinyHunters Thousands of Agent Records
The FBI has removed an Accenture contractor following a data breach by the hacking group ShinyHunters, which exploited an unpatched vulnerability in an Oracle PeopleSoft platform to steal personal details of thousands of FBI employees. The contractor failed to apply a security patch that had been explicitly issued to secure the platform. Two ShinyHunters members have already been arrested, and the FBI has warned that further arrests are likely as its investigation continues.
Fake Cops, Real Losses: FBI Says Government Impersonation Scams Topped $1.6 Billion in 19 Months
Scammers impersonating law enforcement and government officials have cost US victims over $1.6 billion since January 2025, with nearly 61,000 complaints filed with the FBI's IC3 over a 19-month period. The scams typically involve unsolicited calls threatening arrest or legal consequences unless victims make payments, with tactics ranging from fake criminal charges and missed jury duty fines to targeted schemes aimed at professionals, foreign nationals, and international students. The FBI has reminded the public that law enforcement agencies will never call individuals to demand payment or sensitive information.
FBI Takes Down Chinese State Hacking Tools Used Against NASA, Senate, and DOE
The FBI has disrupted a botnet and seized two hacking platforms — QScan and QTRouter — used by a Chinese government-backed group called QTFY to infiltrate major US institutions, including NASA, the Department of Energy, the US Senate, and several other agencies, dating back to at least 2018. QTFY, operated through a private Chinese company called Nanjing Xinjiuwei, used the tools to build networks of compromised IoT devices that obscured the origin of their cyberattacks, exploiting critical vulnerabilities in products from Ivanti and Citrix. The seizure of three QTFY-linked domains has rendered both hacking services inoperable, marking the latest in a series of FBI actions targeting Chinese state-sponsored hacking operations.
Google and FBI Kneecap NetNut's 2 Million-Device Proxy Botnet
Google, the FBI, and other partners have significantly disrupted NetNut, a residential proxy network that had enrolled at least 2 million devices — mostly TV-streaming hardware — into a botnet used by cybercriminals to disguise malicious traffic as coming from ordinary homes and businesses. In a single week in June 2026, over 316 distinct threat clusters, including cybercriminal and espionage groups, were observed using NetNut exit nodes for activities such as password spraying and masking their origins. Researchers warn that lasting disruption is difficult, as proxy operators tend to simply buy capacity from competitors when their own networks are degraded, and call for broader, coordinated efforts involving ISPs and technology platforms.