DragonForce lists Geneva's IFAGE adult-education foundation on its leak site, claiming 850 GB — an attribution and volume IFAGE has not confirmed

The German-title source reads "the DragonForce group claims to have captured 850 gigabytes of data from IFAGE; the foundation had already warned of a leak of sensitive data." IFAGE (Fondation pour la formation des adultes à Genève), a Geneva adult-education foundation, disclosed in May 2026 that it suffered an intrusion on 11–12 April 2026 (detected 13 April): unauthorized exfiltration of current- and former-employee data, no ransom demand recorded at the time, reported to the Federal Data Protection and Transparency Commissioner, and described by IFAGE as resolved (La Télé, 2026-05-15). On 14 July 2026, Swiss IT outlet Inside IT reported that the extortion group DragonForce has now listed IFAGE on its leak site, claiming 850 GB — an order of magnitude beyond the scope IFAGE described, and a specific actor attribution IFAGE itself never made (Inside IT, 2026-07-14). No IFAGE statement responding to the listing, and no second independent outlet corroborating the DragonForce name or the 850 GB figure, could be located as of this run.

AsyncAPI npm packages backdoored via a GitHub Actions pull_request_target token theft, delivering a multi-stage IPFS implant (M-RED-TEAM)

On 2026-07-14 an attacker compromised the asyncapi/generator GitHub repository by abusing a pull_request_target workflow that checked out the pull request's own code while still running "in the context of the base repository with full access to secrets" (Wiz, 2026-07-14). The attacker opened 37 pull requests — almost all a decoy adding a fake charity-donation page — while a single one (PR #2155, 05:08 UTC) carried obfuscated JavaScript that scanned the Actions runner environment for secrets and exfiltrated them to a paste-site dead drop, capturing the token of asyncapi-bot, a service account with organization-wide access; by 06:58 UTC the attacker pushed a malicious commit to the next branch and from 07:10 UTC the release workflow published five trojanized versions across four packages — @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 — which "combined, these packages see over three million downloads a week" (Wiz, 2026-07-14). A contributor had opened a fix for the vulnerable workflow on 2026-05-17; it was still unmerged 58 days later when the attack landed.

The injected code executes on import/require, not at install time: it spawns a detached Node child process that downloads a later stage from IPFS into a per-user application-support directory, then runs an encrypted multi-stage bundle whose runtime "explicitly self-identifies as 'M-RED-TEAM v6.4' in code comments" (Wiz, 2026-07-14). It establishes persistence via a systemd user service on Linux (with platform-specific equivalents on macOS and Windows) and beacons over multiple command-and-control channels — HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh — accepting remote commands for file operations, directory listing and data exfiltration; its obfuscation uses javascript-obfuscator with a custom base64 alphabet matching prior incidents. The bundle carries credential-theft capabilities targeting saved browser passwords and cookies, SSH keys, npm and GitHub tokens, AWS credentials, the macOS Keychain and crypto wallets. Wiz notes technical fingerprints overlapping the Miasma framework (a miasma-branded persistence service and relay tags) and a dead-drop naming pattern matching the separately-tracked prt-scan pull-request-abuse campaign, but states that "beyond the references and initial obfuscation method the payload contains minimal resemblance to previous Miasma and Shai-Hulud payloads" and that "at this time, we are not making any definitive attribution." SafeDep, tracking the same incident, reports the payload self-identifying as miasma-train-p1 rather than Wiz's M-RED-TEAM v6.4 and frames the Miasma link more directly — "this is either a private, parallel build by the same operators or a separate group that adopted the Miasma brand after the source was published" (SafeDep, 2026-07-14); a team hunting code-comment strings should check for both identifiers.

Defender takeaway. This is a recurring 2026 pattern of pull_request_target "pwn request" abuse feeding npm-ecosystem backdoors, and the load-bearing control gap is a CI/CD one: any workflow that triggers on pull_request_target and then checks out untrusted PR code runs attacker code with access to repository secrets. Audit your own Actions workflows for that pattern, and — because the payload runs on import rather than install — a --ignore-scripts install policy does not neutralise it; only pinning to known-good versions and rebuilding from a clean state does.

Triage: a legitimate require() of AsyncAPI tooling performs no runtime network activity; the signal is a detached Node child process spawned from an npm/node parent at import time that reaches out to an IPFS gateway or a peer-to-peer mesh and then creates a user-level persistence service — process-lineage telemetry (a script interpreter spawning a hidden detached child with outbound egress) plus a new systemd/user-service artifact created outside a package-manager transaction is the discriminator, since benign build tooling produces neither.

A lone actor used a jailbroken Gemini CLI to autonomously rebuild and redeploy C2 infrastructure in six minutes ("Patriot Bait")

Trend Micro's TrendAI Research analysed more than 200 Gemini CLI session logs (19 March–21 April 2026) belonging to a solo Russian-speaking operator with the handle "bandcampro," who runs the multi-year "Patriot Bait" Telegram influence-and-fraud campaign. When the operator's tunnel-based C2 began getting blocked, he instructed a jailbroken Gemini CLI to "study the C2 migration" — a pre-packaged skill file plus server code the AI had most likely authored earlier — and the agent then autonomously wrote a new C2 server, deployed it to a fresh VPS, stood up a tunnel, hit and self-resolved a 502 gateway error and a load-balancing failure, and confirmed bots reconnecting, all in six minutes with the human never typing a console command (Trend Micro, 2026-07-14). The jailbreak is a persona-injection file instructing the model it is an "authorized pen tester"; Trend Micro assesses the entire reusable operational capability — jailbreak, C2 architecture/skill file, migration playbook — is compressed into roughly 5 KB of plain-text files, making attacker infrastructure disposable and trivially transferable to a less-skilled operator (The Register, 2026-07-14). Gemini refused at least one escalation (an auto-propagating "agent bomb"). One observed victim set was eight machines at a dental clinic, including access to its OpenDental database.

CrashStealer — a native-C++ macOS infostealer using a notarized dropper and local dscl password validation to raid keychain, browsers and wallets

Jamf Threat Labs documents CrashStealer, a macOS infostealer written in native C++ (around an internal MacOSData class) rather than the AppleScript droppers or thin Objective-C wrappers typical of commodity macOS stealers; Jamf first saw a sample on VirusTotal in early May 2026 and observed in-the-wild payload detections by early July, and tracks it as a distinct family rather than a variant of Atomic (AMOS), MacSync or Phexia (Jamf Threat Labs, 2026-07-13; BleepingComputer, 2026-07-13). Initial access is a signed and Apple-notarized dropper distributed as a "Werkbit Setup" disk image (both the image and the inner app are signed under a valid Developer ID — which Jamf reported to Apple after confirming it was used to distribute malicious payloads — with hardened runtime enabled) — because it carries a valid notarization ticket it clears Gatekeeper on first launch, so the "right-click → Open" instruction the installer shows is pure social engineering rather than a technical bypass (Jamf Threat Labs, 2026-07-13). The dropper fetches a first-stage file from a GitHub repository (keeping the opening network hop on a trusted developer domain), decodes a curl command, and pulls a shell script delivered as successive Base64 blobs decoded at runtime and piped to bash; that script downloads the payload disk image, copies the app into a hidden /private/tmp/.CrashReporter directory, strips and re-signs it ad-hoc (codesign --remove-signature then codesign -s - --force --deep), registers it with Launch Services and launches it (Jamf Threat Labs, 2026-07-13).

The payload impersonates Apple's crash reporter (bundle identifier com.apple.crashreporter, executing from the hidden staging path), clears its own quarantine and last-used-date extended attributes with xattr -cr, then presents a native-styled password prompt and validates the entered credential locally with dscl . -authonly, looping until a valid password is supplied — so the operator only ever collects credentials that actually authenticate (Jamf Threat Labs, 2026-07-13). With the validated password it unlocks the login keychain, copies login.keychain-db into a hidden ~/.cache staging root, runs a reconnaissance sweep (defaults read for version paired with du -sh for on-disk size) against an embedded list skewed toward malware-analysis and EDR tooling to profile the defensive environment, and collects browser data, Chromium/Firefox extensions (including cryptocurrency-wallet extensions) and password-manager material — AES-GCM-encrypting each item into hidden staging files as it is collected (so the loot is never written to disk in the clear), then packaging each staging directory into its own zip archive before exfiltrating over libcurl. Persistence is a LaunchAgent registered under an Apple-impersonating label with a second re-signed copy of the binary. Anti-analysis is layered throughout: the binary checks for an attached debugger via sysctl process-flag (P_TRACED) inspection at two separate points in initialization — so patching out the first check alone does not defeat it — and its C2 address and collection-target list are held as encrypted, runtime-decoded strings behind control-flow-flattening obfuscation rather than in cleartext (Jamf Threat Labs, 2026-07-13).

SAP July 2026 Security Patch Day: three CVSS ≥9.1 flaws in NetWeaver AS ABAP, Approuter and Commerce Cloud — two reachable without authentication

SAP's July 2026 Security Patch Day (14 July) carries three critical flaws NCSC Switzerland's Cyber Security Hub relayed directly to Swiss constituents, none with reported exploitation at publication (NCSC-CH, 2026-07-14; Onapsis Research Labs, 2026-07-14). CVE-2026-44747 (CVSS 9.9) is a memory-corruption flaw in the SAP NetWeaver Application Server ABAP kernel; SecurityWeek characterises successful exploitation as allowing an attacker to access and modify data and cause system unavailability, and SAP's only interim workaround (disabling the affected ICF nodes) is impractical because it breaks SAP GUI for HTML, so patching the kernel is the real mitigation (SecurityWeek, 2026-07-14). CVE-2026-27690 (CVSS 9.1) is an HTTP request-smuggling flaw in SAP Approuter's non-Cloud-Foundry deployments: an unauthenticated request desynchronises the request/response stream on a shared front-end, a primitive usable to poison or hijack another user's request. CVE-2026-44761 (CVSS 9.1) is a hardcoded sample OAuth2 credential in SAP Commerce Cloud — any customer that ran SAP's own documented sample configuration and never rotated the shipped secret exposes a publicly-known credential an unauthenticated attacker can use to obtain a valid OCC-API access token (Onapsis Research Labs, 2026-07-14).

Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days — AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)

Microsoft's July 2026 Patch Tuesday is its largest ever by CVE count and carries two zero-days Microsoft confirms were exploited before a fix existed, both added to CISA's Known Exploited Vulnerabilities catalog the same day (BleepingComputer, 2026-07-14). CVE-2026-56155 (CVSS 7.8, CWE-1220) is a local elevation-of-privilege in Active Directory Federation Services: an attacker who already holds a low-privileged authorized session on the AD FS host escalates to administrator (Microsoft MSRC, 2026-07-14). It is a post-foothold escalation rather than an initial-access vector, and Microsoft's advisory credits its own DART incident-response team in the acknowledgements — meaning it surfaced during a live intrusion, so an exposed AD FS host should be treated as a candidate for compromise assessment, not merely patched (Microsoft MSRC, 2026-07-14). CVE-2026-56164 (CVSS 5.3, CWE-306) is the more exposed of the two: a missing-authentication flaw in on-prem SharePoint Server that lets an unauthenticated attacker elevate privileges over the network with no user interaction (Microsoft MSRC, 2026-07-14). Microsoft's mitigation guidance — enable AMSI on the SharePoint/IIS worker processes with Request Body Scan set to Full — indicates the trigger is a crafted HTTP POST body, the same class of exposure this pipeline tracked for the CVE-2026-45659 SharePoint deserialization RCE on 2026-07-02, so operators who already tuned AMSI for that flaw have partial coverage.

CVE-2026-15409 — SonicWall SMA1000: unauthenticated SSRF (CVSS 10.0) chained to post-auth code injection, actively exploited

SonicWall's PSIRT advisory SNWLID-2026-0008 (first published 2026-07-14) states it has investigated "multiple cases indicating the active exploitation" of two new SMA1000 flaws (SonicWall PSIRT, 2026-07-14); both CVEs carry a same-day CISA KEV listing (recorded in this entry's CVE status, confirmed against the KEV feed). CVE-2026-15409 (CVSS 10.0, CWE-918) is a server-side request forgery in the SMA1000 Work Place interface that lets a remote, unauthenticated attacker force the appliance to issue requests to an attacker-chosen location; the scope-changed CVSS vector (S:C) indicates the SSRF reaches beyond the vulnerable component's own security boundary. CVE-2026-15410 (CVSS 7.2, CWE-94) is a post-authentication code-injection flaw in the SMA1000 Appliance Management Console (AMC) that lets an authenticated administrator-level session run arbitrary OS commands — read together with the pre-auth SSRF, the pair forms a chain from zero access toward root-equivalent appliance control. The affected firmware is SMA1000 6210/7210/8200v on 12.4.3-03245/03387/03434 and 12.5.0-02283/02624/02800; the fix is platform-hotfix 12.4.3-03453 or 12.5.0-02835, and SonicWall explicitly states neither flaw affects SSL-VPN running on SonicWall firewalls or the SMA100 series (SonicWall PSIRT, 2026-07-14).

CVE-2026-8863, CVE-2026-10797 — forgotten pre-0.9 UEFI shims bypass Secure Boot via a signature-length validation mismatch

ESET Research published (2026-07-14) a full dissection of 11 Microsoft-signed UEFI shim bootloaders — all at shim version 0.9 or below — that undermine Secure Boot on any machine trusting the "Microsoft Corporation UEFI CA 2011" third-party certificate, independent of which OS is installed (ESET Research, 2026-07-14). The primary flaw (CVE-2026-10797) is a signature-length validation mismatch: an Authenticode-signed PE records its signature length in two places, and "the revocation check used the value from the signature header, while the signature verification function used the value from the PE header" (ESET Research, 2026-07-14), so an attacker can tamper the WIN_CERTIFICATE structure to make the revocation routine compare the deny-lists against bogus data while verification still succeeds. Two companion weaknesses in the same forgotten binaries (tracked with CVE-2026-8863) compound it: shims below 0.9 never enforce the MOK deny-list (MokListX), so an older still-trusted shim can be substituted to load a binary that was explicitly revoked, and shims before version 15.3 predate SBAT (Secure Boot Advanced Targeting) entirely, reopening old GRUB 2 bugs such as CVE-2015-5281 that SBAT was built to close.

Crucially, exploitation requires no complex exploitation primitive — "only a copy of an old, still-trusted, but unrevoked shim binary" copied to the EFI System Partition alongside a compatible second-stage bootloader (ESET Research, 2026-07-14); writing to the ESP is itself a privileged local operation (consistent with this entry's local, post-auth vector), so the technique is a persistence/defense-evasion primitive for an attacker who already has that access rather than a remote initial-access exploit. CERT/CC frames it as a "Bring Your Own Vulnerable Driver (BYOVD)-style technique to execute arbitrary code during the early boot phase, prior to operating system initialization" (CERT/CC, 2026-06-17). Because the vulnerable binary travels with the boot media rather than the installed OS, any endpoint trusting the third-party UEFI CA is a candidate carrier even when its OS is fully patched. Vendors named in CERT/CC's coordinated disclosure include Red Hat/CentOS, Oracle Linux, openSUSE, ROSA Linux, Baramundi Management Suite, Blancco/WhiteCanyon WipeDrive, PC-Doctor Service Center, Spyrus WTGCreator, and Finland's Abitti exam-kiosk system — a long tail of Linux-distro, PC-diagnostic, disk-wipe and kiosk tooling that forked an old shim and never rebased onto upstream fixes. Microsoft revoked all 11 binaries in its 2026-06-09 Patch Tuesday dbx update; no in-the-wild exploitation has been reported, and ESET deliberately withholds indicators of compromise because the binaries are "present on thousands of systems that have never been compromised via these loaders."

Defender takeaway. This is a pre-OS-boot technique class, so runtime endpoint telemetry cannot see the exploitation step — the actionable control is inventory and firmware-state verification, not detection. Confirm the June dbx revocation is actually enrolled in firmware (firmware-level dbx updates frequently lag OS patching, and a machine can show a fully patched OS while its dbx is stale), sequencing the accompanying DB update before the DBX update where the vendor guidance calls for it to avoid bricking dual-boot or recovery partitions, then audit Linux and dual-boot EFI System Partitions for forked shim binaries at version ≤ 0.9. Triage: legitimate dual-boot recovery media and vendor diagnostic USB sticks are exactly the artifact class this bug lives in, so a hunt for "old shim present" will surface real, benign, stale tooling — the discriminator is not the shim's presence but whether the dbx revocation has been enrolled in that device's firmware: a revoked-but-present shim is inert, an unrevoked one is the exposure.

Microsoft maps three ShinyHunters-tradecraft OAuth-abuse paths against Salesforce customers — none exploiting a Salesforce vulnerability

Microsoft Threat Intelligence documented a year-long (mid-2025 to mid-2026) set of campaigns using tradecraft commonly associated with ShinyHunters (registry alias UNC6240) against Salesforce-integrated environments, through three distinct paths rather than any Salesforce product vulnerability (Microsoft Threat Intelligence, 2026-07-13). First, vishing-driven OAuth-consent abuse: attackers impersonating IT support socially engineer employees through the OAuth authorization workflow into granting a malicious connected app — disguised as the legitimate Salesforce Data Loader — full API access inherited from the victim's own privileges, letting them enumerate and exfiltrate CRM data through sanctioned application access that never trips a sign-in anomaly. Second, SaaS supply-chain compromise: compromised Salesloft Drift credentials (August 2025) exposed OAuth connection secrets reused across customer tenants; a November 2025 campaign abused Gainsight-published Salesforce apps the same way; and in June 2026 an actor Microsoft tracks as Storm-3138 compromised the Klue competitive-intelligence platform and reused harvested Salesforce credentials to query and exfiltrate customer CRM data. Third, guest-access abuse: requests chained against Salesforce's Aura framework via misconfigured guest-user accounts pulled far more data than a guest session should reach (The Hacker News, 2026-07-14). Microsoft observed the activity across retail, education and manufacturing tenants and states existing authentication-focused detections gave "limited visibility" because the traffic is indistinguishable from legitimate integration.

Cisco Talos maps the full taxonomy of Python-package build-time and import-time code execution ("The Serpent's Tongue")

Cisco Talos published a comprehensive technical survey of code-execution paths across the Python packaging lifecycle — repository hosting (PyPI, version-control, custom servers), source (sdist) and wheel distribution formats, and installation into virtual or system-wide environments — split into two classes and assessed for persistence (Cisco Talos, 2026-07-14). Build-hook abuses fire code during installation: setup.py executes automatically on install or download, so a malicious command class runs arbitrary code as a transient one-shot. The more consequential class is persistence: a .pth path-configuration file dropped into site-packages is executed on every subsequent Python invocation, and site-hook modules (sitecustomize.py/usercustomize.py) and PYTHONPATH hijacking behave the same way — the payload survives well beyond install time. Talos ties the .pth technique directly to TeamPCP's supply-chain compromise of the litellm package and the import-time __init__.py payload to its lightning compromise, part of a documented run of TeamPCP supply-chain waves. The piece closes on defensive measures — dependency auditing (pip-audit), hashed lock files, install-time controls and a dependency-cooldown window before adopting newly-published versions.

Check Point Annual AI Security Report 2026 — AI shifts from attack accelerant to autonomous operator, with the agent's trusted config store as the new persistence surface

Check Point Research's Annual AI Security Report 2026 frames the year's shift as "AI has crossed from assistant to operator": where AI once helped attackers prepare, CPR now observes it doing the hands-on work inside live intrusions, spanning a China-nexus espionage campaign and a criminal breach of multiple Mexican government agencies, and spreading from nation-states to ordinary cybercriminals (Check Point Research, 2026-07-14). Two developments matter most to a defender rather than to a headline. First, AI now builds deployment-ready tooling whose AI provenance is invisible in the finished artifact — CPR cites one developer producing VoidLink, an 88,000-line command-and-control framework, in under a week using an AI environment, illustrating how the tooling-development timeline collapses even for non-experts. Second, and more durable, attackers are moving from transient prompt-injection strings to abusing the agentic architecture itself: CPR reports that the reliable bypass is now "a planted configuration file an agent loads and trusts across sessions," a persistence class that survives context resets and re-authentication in a way one-shot prompt injection does not.

CPR also reports a maturing criminal AI-tooling market — phishing-as-a-service kits shipping with a jailbroken language model built in, and conversational AI voice-agent services running vishing and one-time-passcode theft at scale — alongside a rise in indirect prompt injection (CPR's telemetry shows detections of longer malicious payloads climbing sharply between March and May 2026) and persistent enterprise data leakage through unsanctioned GenAI use. Most actors, CPR notes, favour jailbroken mainstream commercial models over self-hosted ones.

Progress confirms the ShareFile Storage Zone Controller shutdown was forced by a path-traversal zero-day; patches 5.12.5 / 6.0.2 ship and service is restored

UPDATE · originally covered Progress ShareFile Storage Zone Controller — Shadowserver confirms active exploitation of CVE-2026-2699; exposed instances collapse ~30,000 to ~1,000 (2026-07-14)

Progress Software has confirmed the root cause behind its emergency ShareFile Storage Zone Controller (SZC) shutdown order: a high-severity path-traversal vulnerability affecting SZC versions 5.x and 6.x that lets an authenticated administrative user read arbitrary files accessible to the application's service account, write malicious content to server directories, and enumerate the filesystem layout (BleepingComputer, 2026-07-14) — a CWE-22-class flaw reachable through the SZC's internet-facing IIS component. Progress has shipped patched versions 5.12.5 and 6.0.2, and a CVE identifier is reserved but will not be published for two weeks. The vendor states it has "no indication of unauthorized access to any ShareFile customer account or data," a claim that sits alongside this run's earlier finding that Shadowserver honeypots recorded in-the-wild exploitation attempts against the same component from 2026-07-10. Progress's status page confirms Storage Zone Controller customer access "is currently being restored," with recovery instructions issued directly to account owners (Progress — ShareFile Status Page, 2026-07-14), closing out the multi-day outage that began with the 2026-07-10 shutdown order.

Progress ShareFile Storage Zone Controller — Shadowserver confirms active exploitation of CVE-2026-2699; exposed instances collapse ~30,000 to ~1,000

UPDATE · originally covered Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat' — day three, no patch or root cause disclosed (2026-07-13)

Two developments harden the picture around Progress's emergency ShareFile Storage Zone Controller (SZC) shutdown order. First, the shutdown was not precautionary in the abstract: the alert "arrived the same day that independent honeypots began detecting active, in-the-wild attempts to exploit" the pre-auth authentication-bypass flaw CVE-2026-2699, with Shadowserver Foundation honeypots first recording those attempts on Friday 2026-07-10 (BankInfoSecurity, 2026-07-13). This moves the flaw's status from PoC-public to actively exploited. Second, defenders responded at scale — the number of internet-exposed Storage Zone Controllers fell from watchTowr's April count of about 30,000 to roughly 1,000 by 2026-07-13, evidence of widespread emergency power-downs (BankInfoSecurity, 2026-07-13). Progress restored ShareFile cloud-service access for SZC customers but continues to require the on-prem controllers themselves stay powered off pending its investigation, and still reports no evidence of unauthorized access to customer data (The Register, 2026-07-13; Progress ShareFile status, 2026-07-13).

Recorded Future analyst Allan Liska publicly assessed that the pattern "smells like CL0P ransomware group activity," pointing to Clop's long record of mass-exploiting secure file-transfer software (Accellion FTA, GoAnywhere, MOVEit, Cleo Harmony, and Oracle E-Business Suite) (BankInfoSecurity, 2026-07-13). This is a named researcher's hypothesis, not an attribution: Progress has identified no actor and disclosed no root cause.

Defender takeaway. The one-day earlier guidance — treat any exposed SZC as untrusted and keep it powered off rather than patched — is now backed by confirmed in-the-wild exploitation, so it should carry more weight, not less, for any organisation that has not yet acted. Exposure concentrates in the US and Germany, keeping this directly relevant to European on-prem file-exchange operators. The recommended state remains a full power-off of on-prem Storage Zone Controllers until Progress publishes scope; the original entry's shutdown and bounded-compromise-check actions still stand unchanged.

US and UK sanction First VPN Service (1VPNS), its administrator and a Belarusian cryptor seller — the sanctions follow-through on the Swiss-assisted Operation Saffron takedown

UPDATE · originally covered Operation Saffron dismantles First VPN — 33+ servers seized, user database captured, Switzerland named JIT participant; Phobos RaaS infrastructure link confirmed (2026-05-22)

The May 2026 Operation Saffron takedown of First VPN Service (1VPNS) — the Russian-language, no-log criminal anonymisation service in which Switzerland sat on the Eurojust joint investigation team — has now drawn coordinated sanctions. On 2026-07-13 the US Treasury's Office of Foreign Assets Control, in an action coordinated with the UK's Foreign, Commonwealth & Development Office, designated 1VPNS and its administrator Dmytro Rashevskyi (who used false identities including "Maksim Sorin" and "Roman Chabanenko" to buy infrastructure from providers that would otherwise have refused him), and separately a Belarusian national, Yegeniy Silayev, who sells "cryptors" (US Treasury, 2026-07-13). Treasury frames cryptors as tools "built specifically to make malware stealthier and more effective by disguising it as harmless files" (US Treasury, 2026-07-13) — designating the obfuscation-service vendor as a distinct enabling layer beneath the ransomware payload and the affiliate, not just the anonymisation infrastructure. The designations were made under Executive Order 13694 as amended; the FBI confirms the underlying takedown was led by France's BL2C and the Dutch NHTC "with assistance from Ukraine, the United Kingdom, Switzerland, and Luxembourg," and that at least 25 ransomware groups, including Avaddon, used the service for reconnaissance and intrusions (FBI Boston, 2026-06-09).

Treasury describes the concrete abuse pattern: ransomware groups purchased 1VPNS infrastructure and used it "to hide the origins of their attacks, deploy malware, and manage exfiltrated data" — an external commercial VPN used as an anonymising relay in front of the operators' own reconnaissance, delivery and exfiltration traffic (US Treasury, 2026-07-13).