Risky Bulletin: Dutch police take down giant botnet of 17 million devices

This newsletter is brought to you by Sondera. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

Dutch authorities have conducted one of the largest-ever malware disruptions and took down a botnet that infected more than 17 million devices across the world.

The botnet was made up of computers, tablets, and smartphones that had been used to send out spam emails, phishing lures, and carry out DDoS attacks.

Dutch Police and the country's national cybersecurity agency seized more than 200 servers at a local provider, servers that had been used to grow and control the botnet.

While Dutch Police is often involved in malware takedowns, it is rare to see the Dutch NCSC get involved in such operations. The NCSC says it learned of the botnet after receiving a tip from a security researcher, which it then passed on to the police's cyber unit.

Authorities didn't name the botnet but local media claims the botnet was also the backbone of the Asocks residential proxy service.

The Asocks website is still up, but it's unclear if some parts of the botnet have survived.

The name didn't surprise us since Asocks had been previously mentioned in a 2024 report from Human Security.

The report detailed PROXYLIB, a Go-based library that had been embedded in various Android apps and was secretly turning infected devices into nodes of a residential proxy network, which Human linked to Asocks.

Asocks joins a list of multiple other botnets disrupted by authorities in recent months, such as SocksEscort, Aisuru/Kimwolf, FirstVPN, IPIDEA, and RapperBot.

A day before the takedown, the NCSC published a blog post calling residential proxy networks a major threat to the country's digital security, which is likely a feeling shared by the cybersecurity agencies of most countries.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, Adam, and James at the helm!

Breaches, hacks, and security incidents

Wiley Rein gets sued: American law firm Wiley Rein has been sued over a 2025 hack that was attributed to Chinese state-sponsored hackers. [Reuters]

New Carnival incident: American cruise operator Carnival has disclosed another security incident, this one caused by the ShinyHunters hacking group last month. [BleepingComputer]

VentraIP DDoS attack: Australian web hosting company and domain registrar VentraIP was hit with a "terabit-scale" DDoS last week, and the company blamed the attack on a botnet of compromised local routers and IoT devices. [IDM]

SuperFortune incident: Hackers have stolen $15 million worth of crypto tokens from the SuperFortune Web3 app. The funds were taken from a central wallet designed to store unclaimed user airdrops. SuperFortune is still investigating how the tokens were hijacked. [SuperFortune // Intellectia]

UK Visa Portal leak: A website for obtaining UK immigration visas is leaking applicants' personal data. More than 100,000 documents containing selfies and passport scans are leaking from the UK Visa Portal. The site is not an official UK government portal and has yet to fix the leak. [TechCrunch]

And governments wonder why cybersecurity and data protection experts raise concerns about age verification platforms

[image or embed]

— Brian Honan (@brianhonan.bsky.social) May 27, 2026 at 11:50 PM

General tech and privacy

Amadeus gets GDPR fine: Spain's data protection agency has fined travel software company Amadeus €18 million for GDPR violations. The AEPD says the Spanish IT company collected and stored too much user data and failed to properly notify users. The fine was reduced to €14.4 million after the company admitted its guilt and already paid. [Democrata // AEPD fine, PDF]

EU fines Temu: The European Commission has fined Temu €200 million under the new Digital Services Act (DSA) for all the unsafe or scammy products on its platform. [EU portal]

Project Lightwell: IBM has committed to spend $5 billion to help find and fix vulnerabilities in open-source software packages. The company plans to deploy more than 20,000 engineers with AI tools as part of a new project named Lightwell. The initial focus will be the Maven and Java ecosystem. It will then expand to PyPI, npm, Go, and others. [IBM // Project Lightwell website]

C# improves memory safety: Microsoft is improving memory safety features for its C# programming language. The main change is to how C# handles Unsafe, a class that runs code outside the main .NET runtime and its security guardrails. The new features will ship with C# 16 and were inspired by Rust. [Microsoft]

"We envision a future where C# is among a set of languages chosen and noted for their type- and memory-safety enforcement. With this model change, C#, Rust, and Swift have a more common safety vocabulary and workflow. We imagine teams adopting a complete supply-chain view of their dependencies, whether C# all the way down or C# at the app layer over Rust at the system layer. Our own team has moved large blocks of C++ to C# over the years for exactly this reason: safe C# doesn’t carry a memory-safety review burden."

YouTube AI labels: Google is rolling out more prominent watermarks for AI-generated content on both videos and shorts. It is also rolling out new internal systems to better identify AI-generated content. [YouTube]

DuckDuckGo to the moooooon: Internet search engine DuckDuckGo saw a 30% spike in new app installs after Google overhauled its search engine with loads of AI garbage following its I/O dev conference last week.

People aren’t just complaining about Google's AI search overhaul, they’re leaving. Yesterday alone, our week over week installs surged 30% in the U.S. 🚀 Momentum is growing. It’s time to Fire Google.

— DuckDuckGo (@duckduckgo.com) May 26, 2026 at 11:29 PM

Government, politics, and policy

CISA tells agencies to fix supply chain attack vectors: CISA has told federal agencies to check systems were compromised through three recent supply chain attacks. Agencies were told to look for malicious artifacts related to the DaemonTools, TanStack, and Nx Console incidents this month. Due dates to patch and clean networks are May 30 for the first incident, and June 10 for the other two. [CISA]

US military personnel tracked with location data: US adversaries have used commercially available location data to track and target US troops. The data is believed to have been purchased by Iran and used to strike US bases in the Middle East. US lawmakers are now seeking more details about the incident from the Pentagon. [Reuters]

CyberCom reviews: The newly appointed NSA and CyberCom lead, Army Gen. Joshua Rudd, has commissioned MITRE to review how CyberCom and its activity could be modernized. This is apparently a regular procedure for most new leads. [The Record]

Apple and Google demand Bill C-22 changes: Apple and Google are pushing for an amendment to Canada's new surveillance bill. The proposed Bill C-22 would grant Canadian authorities the legal power to force foreign tech companies to help them investigate security threats. Apple and Google's amendment adds judicial oversight to the process and explicit language to protect encryption. Representatives from both companies introduced the amendment in a testimony before a parliamentary commission on Tuesday. [Reuters]

Sponsor section

In this Risky Business sponsor interview, James Wilson chats with Sondera CEO Josh Devon about why guardrails and instruction files aren’t enough to keep AI agents from going haywire. EDR, DLP and other traditional controls can't and won't prevent agents from going rogue. Josh explains Sondera’s “principle of least autonomy” for agents: let them do useful work, but put them in a deterministic policy harness so they can’t leak secrets, abuse tools or wander off-task.

Arrests, cybercrime, and threat intel

Google engineer arrested for Polymarket bets: US authorities have arrested a Google software engineer for insider trading on Polymarket using internal Google data. Michele Spagnuolo, an Italian national, was arrested on Wednesday in New York. He allegedly made $1.2 million from bets on Google's most popular search terms last year. [ABC News // DOJ]

Woah: Feds arrested a Google employee today, who they say made $1M+ betting on Google-related Polymarket events. Here are a few of the markets the account allegedly belonging to the employee wagered on. abcnews.com/US/google-em...

[image or embed]

— Mia Sato (@miasato.bsky.social) May 28, 2026 at 12:25 AM

Sextortionist gets 33 years: A Canadian man was sentenced to 33 years in prison for a sextortion campaign that targeted more than 100 kids across the US. Ramanan Pathmanathan's campaign lasted seven years between 2014 and until he was caught in 2021. He tricked children into sexually explicit acts and threatened to share recorded footage if they didn't continue. Victims included boys and girls, with some as young as six. His sentence will start after he finishes a 12-year prison term in Canada for the same crimes. [DOJ]

Fraudster gets 10 years: A North Carolina man was sentenced to 10 years and one month in prison for selling the personal information of millions of elderly Americans. Troy Murray sold so-called lead lists to scammers in Jamaica. The groups used the personal information to contact victims for lottery fraud schemes. Murray made over $5.2 million from the sales. [DOJ]

Romanian IAB sentenced: A Romanian national was sentenced to four years and eight months in prison for selling access to the computer networks of American companies. Catalin Dragomir made at least $250,000 as initial access broker until he was arrested in November 2024. One of his victims was an Oregon state government office in 2021. [DOJ]

VenomRAT author extradited to France: A 39-year-old Albanian man has been extradited from Greece to France to face hacking-related charges. The suspect went online as Venom and he allegedly developed and sold the VenomRAT malware. He was raided and detained last November in Europol's Operation Endgame. [eKathimerini] [h/t DataBreaches.net]

World Cup warning: The FBI has finally noticed that threat actors are spoofing World Cup 2026 websites ahead of the competition's start next month. Too bad it didn't notice them since last year when the scams first began and the sites started selling counterfeit tickets. [FBI // Bitdefender // CSC // Group-IB // Palo Alto Networks]

Romance scams in the UK: UK citizens have lost more than £102 million last year to romance  scams. Britons lose almost £280,000 every day, with some reported individual losses reached as high as £1 million. Most of the victims are located around London. [London Police]

Weird npm cluster: Researchers have spotted a cluster of 176 suspicious npm packages that use very high version numbers, such as 99.99.99, in what appears to be a new type of dependency confusion attack. [Sonatype]

npm abused for adware campaigns: A threat actor is using npm server infrastructure to store code used for adware campaigns. A cluster of 141 packages uploaded to a single account are just a popunder delivery and tracking system that's likely loaded somewhere else. [SafeDep]

"This newsletter has decided to stop featuring blog posts about compromised npm, PyPI, Go, or other packages if those packages were barely installed by anyone. There's tens of blog posts like this every week that are repetitive and bring nothing to the table. Unless it's a massive incident, a popular package, or a novel technique discussed in the blogs, we will just ignore them (as I've silently been doing for a few weeks already)."

MCP exposure: There are more than 12,500 MCP servers exposed on the internet, according to a Censys scan from the end of April, with many of them advertising access to sensitive features and services. [Censys]

Global smishing operation hits 19 countries: A massive smishing campaign is impersonating government portals, telecoms, and parcel delivery services across 19 countries looking to collect credit card information that it can later sell on underground hacking portals. While it targeted several countries and the report looks at the phishing infrastructure targeting the Romanian government's e-payment service, the campaign was mostly active in the UK and Ireland. [Hunt Intelligence]

BlackToad profile: A suspected Nigerian e-crime group tracked as BlackToad is disconnecting infected systems from the internet while it runs malicious payloads to prevent some security tools from detecting its presence. The group appears to be part of the larger SilverTerrier group. [JumpSec]

JINX-0164 profile: Google's new cloud baby, the Wiz team, is tracking a new activity cluster targeting the crypto dev community through LinkedIn social engineering to gain an initial foothold and then pivot to corporate CI/CD pipelines. [Wiz]

Malware technical reports

Tycoon 2FA: Elastic has published one of the best deep dives into the Tycoon 2FA phishing-as-a-service we've seen so far. [Elastic]

RatPressto phishing kit: Fortra's security team has discovered a new Adobe-themed phishing kit that has been deployed on a bunch of hacked WordPress sites. [Fortra]

The Gentlemen ransomware: The Gentlemen ransomware group has made more than 300 victims since splintering off the Qilin group mid-2025. It recently also accounted for 10% of all ransomware activity in April, despite a leak of internal comms. [Halcyon // NCC Group // Microsoft]

"The Gentlemen appears to have formed following a payment dispute with Qilin ransomware. Halcyon estimates the core team to be roughly 20 members, many with prior experience in established ransomware ecosystems. The group demonstrated operational maturity from the beginning, with much of its growth driven by its generous offer to pay affiliates 90% of ransom proceeds combined with a multi-OS codebase under continuous development."

SuperProxy botnet: A malicious app that ships with SuperBOX Android streaming devices sold at major US retailers is turning the devices into residential proxy nodes. The Cyberflix TV enrolls user systems into a residential proxy service called Popanet. The proxy enrollment is not disclosed by the app and is likely used to route malicious traffic. [Plume // PDF]

Grandoreiro expands: The Windows banking trojan Grandoreiro appears to have expanded its targeting from Brazil and LATAM to also include some European banks. [WatchGuard]

New JS backdoor: Intrinsec looks at a malspam campaign delivering a new backdoor distributed via malicious JavaScript file attachments. [Intrinsec]

SolyxImmortal: Here's a technical breakdown of the execution flow of SolyxImmortal, a new Python-based information stealer spotted this year. [PulseDive]

EKZ Infostealer: A threat actor is exploiting Fortinet EMS servers with a recently patched zero-day to deploy the EKZ infostealer on connected machines. [ArcticWolf]

Crypto-mining campaign: Microsoft is tracking a cryptomining campaign spreading using SEO poisoned search results for popular AI agent and IT management software apps. [Microsoft]

Sponsor section

In this edition of the Snake Oilers podcast, Sondera's Josh Devon talks about Sondera technology designed to intervene when AI models start doing the wrong thing by statefully tracking their trajectories. This isn't a permissions suite for AI agents, it's a way to stick agents in a harness and make sure they adhere to hard policy boundaries.

APTs, cyber-espionage, and info-ops

Kimsuky April ops: North Korean APT group Kimsuky spent April trying to deploy malware against South Korean military and corporate targets. [ENKI]\

"We identified a technique ("JSONPing") in which the distribution page uses JSONP to verify in real time whether the victim has executed the malware. We identified the final payload as an HttpSpy variant, now operating through a new three-stage execution chain (Installer - Loader - HttpSpy) that replaced the previous single-binary architecture."

ASA's GRAT wiper: Iranian state-sponsored hackers are behind a fake hacktivist group named the Cyber Isnaad Front (aka Cyber Support Front). The group is behind data wiping attacks against Israeli companies using the GRAT wiper. Security firm Profero says the group is operated by Aria Sepehr Ayandehsazan (ASA), an Iranian cyber contractor. The company evolved from Emennet Pasargad, another Iranian cyber contractor that meddled in the 2020 US Presidential Election. [Profero]

GREYVIBE targets Ukraine: A suspected Russian e-crime group has targeted Ukrainian organizations in what appears to be an intelligence-gathering operation to support Russia's war. The campaign has been going on since last August. According to WithSecure, the group used AI tools to develop some of its malware and has made several OPSEC mistakes. The company tracks the group as GREYVIBE. [WithSecure]

Vulnerabilities, security research, and bug bounty

Security updates: Gitea, Jenkins, OpenBSD.

SymJack attack: Malicious code hidden in source code repositories can trick AI coding agents into overwriting their own configuration files and performing malicious actions. The new SymJack technique was successfully tested against six major AI coding agents. The list includes Claude Code, Gemini CLI (Antigravity CLI), Cursor Agent CLI, GitHub Copilot CLI, Grok Build, and OpenAI Codex CLI. Besides Anthropic, none have released patches or hardened their agents against the attack. [Adversa]

Unpatched Gogs RCE: A recently disclosed vulnerability can allow threat actors to hijack Gogs self-hosted Git servers. The bug is still unpatched after the developers have stopped responding to security researchers. The vulnerability allows attackers to run malicious code on Gogs instances and take over the servers. A valid account is needed to run the exploit but Gogs ships with open registration enabled by default. [Rapid7]

Unpatched Casdoor IAM bugs: A collection of nine new vulnerabilities can allow attackers to bypass authentication and take over Casdoor identity and access management (IAM) platforms. The issues impact the platform's SAML processing, account binding, and token exchange systems. They are still unpatched after researchers couldn't contact Casdoor maintainers. [CERT/CC]

Zapocalypse vulnerabilities: Security researchers have put together a five-step exploit chain that could have allowed a malicious Zapier customer to escape their sandboxed business automation environment and take over the entire service. [Token Security]

New fingerprinting technique: Academics have discovered a new user fingerprinting and tracking technique named FROST that works by measuring variations in SSD access times for a site's visitors. [Hannes Weissteiner]

Nightmare Eclipse drama: Microsoft has published a blog addressing a wave of zero-days disclosed by a security researcher going by Nightmare Eclipse, throwing veiled threats of using its Digital Crimes Unit to go after the researcher for not engaging in coordinated disclosure. This comes after both GitHub and GitLab took down the researcher's accounts, and after the researcher was also doxxed on Twitter this week. [Microsoft]

Post by @wdormann@infosec.exchange

View on Mastodon

I've written something about Microsoft's apparent stance that not following made up responsible disclosure frameworks is criminal activity. doublepulsar.com/microsofts-s...

[image or embed]

— Kevin Beaumont (@doublepulsar.com) May 28, 2026 at 4:51 PM

Infosec industry

Threat/trend reports: AU10TIX, Cisco, Iru, Microsoft, NCC Group, Okta, and Proofpoint have recently published reports and summaries covering various threats and infosec industry trends.

New tool—EvidenceForge: Cisco Talos has released EvidenceForge, a tool to generate realistic synthetic security logs for cybersecurity threat hunting training and research.

OffensiveCon 2026 videos: Talks from the OffensiveCon 2026 security conference, which took place earlier this month, are now available on YouTube. 

Risky Business podcasts

In this episode of Risky Business Features, Theori's Brian Pak and Andrew Wesie join James Wilson to discuss why the CopyFail exploit was publicly disclosed before Linux distributions had their patches ready.