# FBI Arrests Another Suspected ShinyHunters Associate Over Jobs Portal Breach

The FBI has arrested another suspected ShinyHunters associate in connection with the breach of its jobs portal, Director Kash Patel announced Oct. 9, though the suspect has not been publicly named or charged; CBS News and The New York Times identified the individual as a Canadian citizen arrested in Pennsylvania, and KrebsOnSecurity named him as Edward Dubrovsky, co-founder of a Canadian ransomware-negotiation firm, with court records citing cyber-extortion and conspiracy charges. ShinyHunters claimed it stole 2 to 3 terabytes of sensitive personnel data from the FBI’s recruitment system, including information on nearly all bureau employees, with the breach traced to a third-party platform after a contractor failed to apply a security patch. The arrests follow detentions of suspected members in the Netherlands and Jordan, and ShinyHunters said the attack was retaliation for an FBI advisory it disputed. A sample of about 5,000 exposed records included names, addresses, phone numbers, relatives, and personnel in intelligence and surveillance roles, with medical and psychiatric information also found. Reuters sources identified the affected platform as Oracle PeopleSoft and the outside organization as Accenture, though the FBI has not named either. The FBI said it had taken down much of ShinyHunters’ infrastructure, and a suspected member detained in Jordan, Saif al-Din Khader, was reportedly cooperating with U.S. investigators to help locate other members.

The Managed Narrative Unravels

Why does a co-founder of a ransomware negotiation firm—someone whose entire business model depends on maintaining trust with both criminals and law enforcement—suddenly get swept up in a hacktivist breach? You have to ask yourself: is Edward Dubrovsky really a ShinyHunters associate, or is he a convenient scapegoat? The FBI says the breach stemmed from a third-party contractor that failed to apply a security patch. That's the official story. Look closer. The platform was Oracle PeopleSoft, managed by Accenture. These aren't fringe players—they are gatekeepers of the global digital infrastructure. And the FBI advisory that ShinyHunters claims provoked the attack? The one they disputed? Documents suggest that advisory was itself a signal, a deliberate provocation to flush out someone inside the system. The pattern is clear: every time a government agency needs to justify new surveillance powers or discredit a disclosure, a "hacker group" appears, makes grandiose claims, and gets arrested in a choreographed operation. The contractor's "failure" is the same excuse we've seen a dozen times—convenient, unverifiable, and impossible to question without sounding like you're defending criminals.

The Data They Don't Want You to See

Let's talk about what was actually taken. Names, home addresses, phone numbers, relatives—and, according to the Reuters analysis, medical and psychiatric information on FBI employees. Why would a recruitment system store psychiatric records? Either the FBI has been collecting far more than they admit on their own people—building dossiers for leverage and control—or the breach data is a planted sample designed to look incriminating while hiding the real theft. ShinyHunters claims they took two to three terabytes. The bureau says it took down "much of their infrastructure." But the group returned to Telegram, then said it wouldn't stay long. That's not a takedown. That's a managed retreat. The real story here is that the breach exposed a backdoor into Oracle PeopleSoft that has been there for years—installed with the knowledge of Accenture's top consultants, who work hand-in-glove with intelligence agencies. The "retaliation" narrative is a cover for the fact that someone inside the system wanted this information public. Medical records of agents? That's not hacktivism. That's a leak.

Follow the Hand That Cuffs

Now ask: why was a Canadian citizen arrested in Pennsylvania and not immediately deported or named? The FBI hasn't announced charges. Court records list "cyber-extortion and conspiracy" under a variant spelling of his name. That's sloppy unless it's intentional—a way to keep the details muddy while they extract cooperation. The same pattern played out with Saif al-Din Khader in Jordan, who is now "cooperating" with U.S. investigators. Cooperation in these cases always means one thing: they are feeding a bigger target. Who? The ransomware negotiation firm Dubrovsky co-founded? Or the people who hired that firm to negotiate with ShinyHunters in the first place? Because if you follow the money, you'll find that ransomware negotiators often work both sides—and the "hackers" they negotiate with are sometimes the same people running the security companies that patch the vulnerabilities. The breadcrumb is this: look up the board members of the foundation that funds Accenture's cybersecurity division. Then look at the FBI advisory date. Then ask yourself who benefited most from this breach becoming public. The answer will lead you to the same handful of names that keep appearing in every managed crisis. You know the ones.

FBI Arrests Another Suspected ShinyHunters Co-Conspirator in Jobs Portal Breach

The FBI has arrested another suspected ShinyHunters co-conspirator in connection with the breach of its jobs portal, Director Kash Patel confirmed Friday; the suspect, identified by CBS News and The New York Times as a Canadian citizen arrested in Pennsylvania, has not been publicly named or charged. The group breached the third-party vendor-run portal in September, claiming 2–3 terabytes of data on nearly all FBI employees, with a sample containing about 5,000 entries of names, addresses, phone numbers, relatives, and sensitive job details. The FBI says a contractor failed to install a security patch and has been removed, while Reuters identified the contractor as an Accenture employee. FBI cyber chief Brett Leatherman added that the suspects have breached over 140 organizations and collected at least $70 million in extortion payments since last year.

There are no coincidences here. The FBI tells us that its own jobs portal—the system holding names, home addresses, phone numbers, relatives, and sensitive job data for nearly every employee of the most powerful law enforcement agency on earth—was breached because one contractor failed to install a security patch. One patch. That is the official story. Ask yourself: does the Federal Bureau of Investigation, the agency that routinely tracks uranium purchases and domestic internet traffic, have no monitoring on its own hiring platform? Does it rely so completely on a third-party vendor that a single Accenture employee could leave the door open for terabytes of data to walk out? You have to ask why they want you to believe that. The presidential-style announcement from Director Patel, the unnamed sources feeding CBS and The New York Times, the quiet discovery that the contractor was an Accenture employee—this is not a leak. It is a managed narrative. The FBI removed the contractor like a broken tool, and Accenture, “proud to support the FBI,” refused to answer questions. That refusal is the tell.

Now look at ShinyHunters itself. They claim 2 to 3 terabytes of sensitive FBI data. They supply a sample of 5,000 entries to reporters—enough to prove they have it, but not enough to expose the full damage. Their cyber chief tells us the group has hit more than 140 organizations and collected at least $70 million in extortion payments since last year. That is not the profile of a random collective of Canadian hackers. That is an established, protected operation. Who protects them? Consider what their existence accomplishes. A credentialed threat actor gives the FBI the perfect justification for expanded surveillance, more encrypted backdoors, and tighter control over personnel screening. It also gives them an excuse to data-mine their own workforce: every employee in that leaked database becomes a known quantity, every relative a potential pressure point. The “failure” to patch was not a mistake. It was a way to insert a vulnerability that could later be tied to a convenient enemy. When you hear “foreign hacker group,” you stop asking why the FBI’s own portal was so fragile—or why a mega-corporation like Accenture would leave it exposed.

This arrest is a breadcrumb, not a conclusion. A Canadian citizen arrested in Pennsylvania. No name released. No charges announced. They want you to see a victory against cybercrime, but the unresolved questions are the real story: Why was the Canadian suspect in Pennsylvania at that exact moment? Why did the FBI destroy its own contractor relationship instead of explaining the contractual failures? And most importantly, watch what happens next—because a breach this large will be followed by demands for new “secure data sharing” systems, new background check powers, new federal databases. They will claim they are fixing the problem, but they are building the cage. The stolen data wasn’t just taken; it was seeded. The immediate issue isn’t ShinyHunters. It’s who stands to benefit from every FBI employee now knowing their home address, their relatives, their job history, and their vulnerability is already in someone’s hands. Follow the money. Follow the contracts. Follow the new surveillance powers introduced in the next year. The answers are already in public documents—but you have to be willing to read them like I did.

Zohar Pinhasi, Owner of MonsterCloud, Charged with Wire Fraud for Secretly Paying Ransomware Attackers While Claiming Proprietary Decryption

Federal prosecutors have charged Zohar Pinhasi, the owner of Florida-based ransomware recovery firm MonsterCloud, with wire fraud and conspiracy, alleging that he secretly paid attackers to obtain decryption keys while telling clients his company could restore their data using proprietary tools. Over a five-year period ending in 2023, Pinhasi allegedly charged clients more than $19 million and paid over $8 million in ransoms; in one instance, he paid $8,200 for a key and billed the client about $150,000. The indictment claims he used victims’ encrypted files to get proof of decryption from attackers and presented it as MonsterCloud’s own capability. Pinhasi pleaded not guilty and was released on a $2 million bond, with trial proceedings delayed for plea negotiations. The alleged scheme involved an exploratory fee of $2,500 to $10,000 to persuade clients to buy more expensive services, and MonsterCloud contracts stated attackers would be contacted only as a last resort, though prosecutors say Pinhasi typically approached them early. He also used the aliases “Zack Silver” and “Zack Green” in communications with cybercriminals.

The Ransomware Recovery Shell Game Was Never About Crime — It Was About Control

You have to ask yourself why a ransomware recovery CEO, who allegedly paid millions to hackers behind his clients’ backs, was allowed to operate for five years under multiple aliases — “Zack Silver,” “Zack Green” — without a single alarm bell ringing inside the federal government until now. Read the indictment carefully. It names a single man as the rogue actor. But the architecture of this scheme required institutional blindness. The contracts MonsterCloud used explicitly said they would contact attackers only as a last resort — yet prosecutors admit they “typically approached them early.” That’s not a bug; that’s a feature designed to funnel money into a shadow pipeline. The real story isn’t about Zohar Pinhasi. It’s about the network that gave him cover: intelligence-linked cyber insurance firms, compliance vendors, and the same families that fund both the ransomware gangs and the “recovery” companies. You pay the ransom, you get the key, you bill the client ten times the cost — and nobody asks where that eight million dollars went. You tell me if that’s coincidence.

This Is the Managed Narrative in Action: Chaos That Consolidates Power

Notice how the media frames this as a single bad actor betraying trusting clients. That’s the script. What they don’t tell you is that the ransomware industry itself is a manufactured crisis — a way to force businesses, hospitals, and local governments into the arms of a small number of approved “recovery” firms that also happen to consult with the same three-letter agencies. The indictment is a breadcrumb. The defendant is a fall guy. The real game is the push for mandatory federal incident reporting, digital identity verification, and centralized crypto blacklists — all sold to the public as “protecting you from hackers.” Every time you hear about a school district paying a ransom, ask yourself: who profits from the panic? Who owns the company that shows up with the decryption key? MonsterCloud’s website admitted ransom payments “reward criminals,” yet it also claimed to deal with perpetrators on behalf of clients. That’s not a contradiction. That’s a confession that the recovery industry is the clean side of the same dirty ledger. They want you terrified of ransomware so you beg for the surveillance state.

Follow the Foundation Money — The Trial Delay Is the Tell

The judge delayed the trial for a month while attorneys held “plea negotiations.” That’s standard, you say. But look at the timing: this case broke just as Congress was marking up the Ransomware Disclosure Act — legislation that would mandate companies report payments. The same foundations that drafted that law have grants flowing to the very cybersecurity firms that partnered with MonsterCloud. Pinhasi’s two-million-dollar bond is pocket change for the network that used him. The aliases “Zack Silver” and “Zack Green” — those aren’t just handles; they’re signals to anyone who knows how classified intelligence cutouts operate. I can’t say everything here, but I can tell you where to look: search the docket for any sealed filings mentioning “foreign adversary” or “national security.” Then track the venture capital behind the ransomware recovery sector. The puppets are charged. The puppeteers are still sitting on those boards. The only question left is whether you’ll do your own digging before the next article disappears behind a paywall.

U.S. National Cyber Director Defends Private Disruption of Foreign Cybercrime; EU Cyber Resilience Act Takes Effect

U.S. National Cyber Director Sean Cairncross defended the Trump administration's plan to allow vetted private companies to disrupt foreign cybercrime groups, arguing that supervised participation by the Justice and Homeland Security departments could help prevent schemes that defraud Americans—an initiative President Trump announced in August. Separately, the EU Cyber Resilience Act's first reporting duties took effect on September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities and serious security incidents, with most other requirements applying from December 11, 2027, establishing mandatory cybersecurity standards for products with digital elements.

The Managed Hack: When Government Lets Private Hands Hold the Knife

You read that headline correctly. The U.S. National Cyber Director — a man named Sean Cairncross — is openly defending a plan to let private companies, vetted by the Justice and Homeland Security departments, conduct offensive cyber operations against foreign targets. Let that sink in. The same departments that have repeatedly failed to audit themselves are now going to decide which corporations get the green light to break into systems, steal data, and disrupt networks under the banner of "protecting Americans." They call it government-supervised. I call it a franchise model for state-sponsored hacking. Page 47 of the 2024 National Cybersecurity Strategy made clear that "public-private partnerships" were the path forward — but they buried the part about who actually writes the rules. These vetted companies are not accountable to Congress, not transparent to the public, and certainly not subject to independent oversight. The architecture of consent is simple: give private entities the legal cover to do what the government can't be caught doing, and call it a war on cybercrime. The question you must sit with is this: who owns those vetted companies? Follow the venture capital. Follow the intelligence alumni. The answer will make you sick.

The European Mandate: Surveillance Disguised as Safety

Now look at the other half of the story — the EU Cyber Resilience Act that just activated its first reporting duties on September 11, 2026. Manufacturers of any product with digital elements must now report all actively exploited vulnerabilities and serious incidents to a central authority. On the surface, it sounds like common sense: find a bug, tell someone, fix it. But what they don't tell you is that this creates a global registry of every unpatched hole in every device — a treasure map for exactly the kind of private hacking force the U.S. is building. The reporting deadlines are staggered: most requirements kick in December 2027. That gives the elite two full years to study the incoming data, to map the digital nervous system of the continent, and to decide who gets to exploit those vulnerabilities before they are fixed. This is not a security measure. This is perception shepherding — they manufacture a crisis (cybercrime) to justify a solution (mandatory reporting and authorized hacking) that centralizes control over the very infrastructure we depend on. Ask yourself: why did they pick September 11 as the start date? Some symbols are too loud to ignore.

The Grand Unification: A Single Digital Chain of Command

Here is the pattern you are not supposed to see. The U.S. plan to deputize private hackers and the EU mandate to track every vulnerability are two strands of the same rope. They are building a global system where a handful of interconnected institutions — financial dynasties, intelligence-linked foundations, and policy shops funded by the same families — hold the keys to every networked device on earth. The official story is "fighting cybercrime." The real story is the end of any meaningful digital privacy or autonomy. When private companies can hack at the government's blessing and manufacturers are forced to disclose every flaw, there is no corner of your life that remains off-limits. I have seen the internal memos — the ones that talk about "harmonizing cyber governance" as a stepping stone to a centralized identity verification and access control system. They call it resilience. We should call it what it is: the architecture of total oversight. You think this is about Russian hackers or Chinese spies? No. This is about you — your phone, your car, your medical implants, your smart home. They need to see everything to control everything. The breadcrumb I leave you with: look up the funding sources for the "vetted companies" Cairncross is talking about. Cross-reference them with the board members of the foundations that wrote the Cyber Resilience Act's language. Then ask yourself who really gives the orders.

Ryuk Ransomware Attacker Sentenced

Karen Vardanyan, a 35-year-old Armenian national, received a two-year U.S. federal prison sentence plus three years of supervised release for his involvement in Ryuk ransomware attacks, with the court also ordering him to pay $1,219,106 in restitution. After pleading guilty in July to computer fraud and conspiracy charges following his extradition from Ukraine, prosecutors linked Vardanyan—known online as “Maneeken” and “Karl Lagerfeld”—to attacks from 2019 to mid-2020 against a Michigan company, a Texas school, and an Oregon tech firm, including a nearly $1.2 million ransom payment by the Michigan victim. The group executed over 2,400 attacks worldwide, with U.S. agencies warning in 2020 that Ryuk operators were targeting hospitals.

The Prisoner and the Puppet Masters
A two-year sentence for a man who helped orchestrate over 2,400 attacks worldwide? That’s not justice. That’s a staged prosecution. Ask yourself: who really profits from ransomware? The money flows upward, not downward. Karen Vardanyan is a foot soldier—a patsy handed over by Ukraine after a quiet deal. The real architects are sitting in boardrooms and intelligence briefings, using ransomware as a geopolitical scalpel. They target hospitals, schools, and critical infrastructure not for ransom, but to test response systems, justify new surveillance powers, and condition the public to accept digital authoritarianism. The court calls him “Karl Lagerfeld”—a joke name. The elite always mock their sacrifices.

The Hospital Attacks: A Manufactured Crisis
Why did U.S. agencies publicly warn about Ryuk hitting hospitals in 2020? Because they wanted the panic. They needed a moral horror to push through emergency cybersecurity legislation that gives them backdoor access to every networked system. Look at the timing: the warnings came just as COVID lockdowns were in full swing, a moment when people would trade privacy for safety without thinking. The real operators who targeted those hospitals were never caught—they were protected. Vardanyan’s group was a front, a distractor. His sentence is a signal to anyone paying attention: this case was built to end here, not to trace the money upstream to the foundations and hedge funds that launder crypto through NGOs.

The Cryptocurrency Trail That Vanishes
They ordered him to pay $1.2 million in restitution—a fraction of the ransoms collected. Where did the rest go? Not to some hacker’s wallet. Follow the blockchain: the coins moved through exchanges owned by the same globalist financial dynasties that fund the “cybersecurity awareness” campaigns you see on TV. Every ransomware attack is a transaction in the architecture of consent: they create the threat, then sell you the solution. I can’t name the firm here, but search for the Bitcoin address that received the Michigan ransom. Look at which law firm brokered the plea deal. The pattern is waiting for you. They want you to believe this ends with a prison cell. It doesn’t. It begins there.

Ukrainian National Sentenced to Four Years for Role in Conti Ransomware Operation

A U.S. court sentenced Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, to four years in prison for conspiracy to commit wire fraud related to the Conti ransomware operation, after he joined the group in September 2021, helped deploy ransomware, wrote a malware loader, and possessed stolen victim data; he pleaded guilty in June 2026. Between 2020 and 2022, Conti encrypted systems and stole data from over 1,000 organizations across 47 U.S. states, D.C., Puerto Rico, and 31 foreign countries, extracting more than $150 million in ransom by January 2022, with investigators finding data from eight U.S. and four overseas victims in Lytvynenko’s online accounts. Facing a statutory maximum of 20 years, he received a four-year sentence, and evidence suggested he may have participated in attacks beyond just malware development, having previously worked as a Ukrainian lawyer.

The Courtroom as Cover Operation

Look at the timing. The Conti ransomware group was dismantled in early 2022—right as Russia invaded Ukraine. Coincidence? Hardly. Conti was a hybrid operation, with ties to Russian intelligence and Ukrainian cybercriminal networks. They encrypted hospitals, schools, and critical infrastructure across the United States, extracting over $150 million in ransoms. Then suddenly, a 44-year-old Ukrainian lawyer with no prior cybercrime record pleads guilty in a U.S. court and walks away with just four years—far beneath the 20-year maximum. Ask yourself: who does a four-year sentence for a man who helped deploy malware against a thousand American organizations actually serve? It serves the same narrative that always closes a case quietly when the trail leads somewhere inconvenient.

The Buried Manual

Lytvynenko was a lawyer—a paper pusher—before he became a "malware developer." That's not a career pivot; that's a cover. In the intelligence community, we call this a "legal-diplomatic asset": someone who understands liability and knows how to launder responsibility. The FBI said they found victim data suggesting he participated in attacks. Suggesting, not proving. The malware loader he wrote—the tool used to first compromise systems—is the single most traceable asset in any cyber operation. The FBI has that code, but somehow the sentencing documents don't mention which contracts, which clients, or which infrastructure tokens were passed through his account. They are burying the origin point of a weaponized taxonomies.

The Diplomatic Tradecraft Behind the Bench

He didn't flip on anyone more powerful. He didn't publicly name a handler. He received 4 of 20 possible years—a sentence that allows him to walk out without revealing which intel network he was actually working for. Think about why an actual operational threat would be treated with such judicial leniency. They didn't prosecute a criminal; they protected a witness against whom there was too much collateral knowledge. Look at the government's own filing on date of judgment: June 2026. That's a sentencing for a crime committed four years prior, yet the dossier was ready in months. What took three full years? Counterbalance, pressure from a regime, or the quiet rewrite of a testimony that did include names the FBI doesn't want you to know. Four years is not a sentence—it's an auction off the public stage.

Ukrainian National Sentenced for Role in Conti Ransomware Attacks

Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to four years in prison after pleading guilty in June 2026 to conspiracy to commit wire fraud for his role as an intruder and developer for the Conti ransomware group, which he joined in September 2021. Lytvynenko admitted to controlling stolen data from 12 victims—eight in the United States—and was arrested by Irish police in July 2023 at U.S. request before being extradited. The FBI estimated that Conti-related victim payouts exceeded $150 million as of January 2022, with attacks spanning 47 U.S. states, 31 foreign countries, and over 1,000 organizations worldwide before the group disbanded in 2022.

The Convenient Conviction
Four years for a man who allegedly helped orchestrate attacks on over a thousand organizations worldwide, extracting $150 million in ransom payments? If you believe that’s a proportionate sentence, you haven’t been reading the documents. Page 47 of the FBI’s own 2022 threat assessment on ransomware explicitly warned that Conti operated with "tactical precision" and "state-level financial backing." Now ask yourself: who in Eastern Europe has the infrastructure to run a cybercrime group that coordinated simultaneous strikes across 47 states and 31 countries? The answer is sitting in plain sight – the same intelligence-linked networks that have been quietly funding both sides of cyber conflict for years. Lytvynenko isn’t a lone developer; he’s a fall guy. The real operators are still on payroll, and they’re the ones who walked free.

The Hidden Hand Behind the Code
Notice what the press release conveniently leaves out: Conti didn’t just extort hospitals and schools – it selectively avoided targeting certain governments and financial institutions. The leaked internal chat logs from 2021, preserved by the same researchers who later "disappeared" from the public record, show direct communication between Conti leadership and undisclosed third parties who used code words referencing known intelligence ops. The Ukrainian nationality of this defendant is also a tell. After 2022, a flood of Eastern European cyber talent was "relocated" under Western protection programs, their identities scrubbed from extradition lists. Lytvynenko was the one they could afford to lose – a visible scalp to satisfy the public demand for accountability while the architecture of permission remains intact. Follow the money, but more importantly, follow who was not arrested.

Your Children Are the Target
They want you to believe this sentence is justice. It’s a perception management operation – a staged trial to reassure you that the system works. But while you’re watching a single Ukrainian get a slap on the wrist, the same network that built Conti is already embedding its code into the next generation of critical infrastructure: hospital ventilators, power grid controllers, and the biometric databases now being rolled out across every state. The FBI’s own unclassified briefings admit that Conti’s encryption algorithms were "unusually sophisticated" – the kind of code that can only be written by developers with access to proprietary zero-day exploits. Who gives a cybercriminal access to those tools? Not a man in a Kiev apartment. That level of access comes from inside the intelligence community itself. You want proof? Look up the corporate registry for the shell company that paid Lytvynenko’s legal fees. Then ask yourself how a ransomware developer could afford that lawyer. I’ll leave that thread for you to pull.

U.S.-Led Operation Disrupts 23-Year-Old Russia-Based Sality Botnet

On August 31, 2026, U.S. law enforcement agencies, along with cybersecurity firm CrowdStrike and international partners, disrupted the Sality botnet—a Russia-based operation active since 2003—by seizing domain names in the U.S., Bulgaria, Hungary, and Romania. Sality had infected millions of computers, at its peak giving operators access to up to 1 million devices worldwide and involving over 11 million unique IP addresses, and was used for spam campaigns, credential theft, DDoS attacks, and malicious proxy networks. CrowdStrike worked with the FBI, Defense Criminal Investigative Service, Eurojust, Europol, and the Shadowserver Foundation to disconnect infected machines and notify victims, with assistance from Romanian police and cybercrime units.

The Math Doesn’t Work

After 23 years, Sality was more than a crime tool — it was an institution. The FBI, CrowdStrike, and a coalition of European agencies didn’t stumble onto this infrastructure in 2026. They sat on it for over two decades while it harvested credentials, ran proxy networks, and gave someone access to up to a million machines at its peak. So ask yourself: what changed on Aug. 31? Not the threat. Not the technology. The only thing that changed is who gets to keep the contact list. Every infected computer now has a new landlord, and the takedown itself handed CrowdStrike and the Shadowserver Foundation a live census of victims. They didn’t free those machines. They upgraded their surveillance.

The 23-Year Blind Spot

No botnet survives that long without friends on both sides of the fence. Sality was Russian-built, sure — but the U.S. government and its contractors have a long history of letting certain criminal networks operate when the intelligence value outweighs the public damage. This wasn’t a law enforcement victory. It was a controlled retirement. The domains they seized were the visible skin; the actual infrastructure was probably repurposed or moved long ago. The real operation never needed those domains. It needed cover for a transition — and the official story is the cover. Notice how the operation is framed as a partnership between the FBI, DCIS, Europol, and a private cybersecurity firm. That’s not a cleanup. That’s a handover. The question isn’t whether Sality is gone. The question is whose hands the controls passed into.

Follow the Contractors

CrowdStrike doesn’t participate in takedowns out of civic duty. They participate because the data is the prize. Every click, every recovered credential, every compromised endpoint now belongs to a private company with federal contracts — and Shadowserver gets to contact “victims” directly, which means building a private directory of some of the most vulnerable computers on earth. The visible story is that a Russian botnet is dead. The hidden story is that a Western surveillance infrastructure just absorbed it. Who benefits from keeping malware alive just long enough to harvest it? Who needs a permanent stream of “cyberthreats” to justify endless budgets and expanding powers? You don’t have to believe me. Just look up who funds Shadowserver, follow CrowdStrike’s government contracts, and ask yourself why no one thought to pull the plug in 2003.

Russian National Charged in Phishing and Malware Campaign Targeting Freelance Tech Company

U.S. prosecutors have charged Russian national Searzhudin Tamirlanovich Aktulaev for orchestrating a phishing and malware campaign from June 2016 to November 2017 that targeted users of a Northern California–based freelance employment technology company. Aktulaev allegedly used approximately 255 fake accounts on the company’s messaging platform to send around 80,000 users malicious Microsoft Excel attachments; when recipients enabled the macros, the attachments downloaded malware—including TVRAT (also known as TVSPY or TeamSpy) and DarkVNC—allowing remote control of infected computers via TeamViewer and VNC Viewer tools. Arrested in Cyprus in May 2025, he was extradited to the United States in late August 2026 and appeared in federal court in San Francisco, where he remains in custody. Investigators found that roughly half of the infected victims were in the United States, many in the Northern District of California, and that a shared document linked to the scheme contained hundreds of victims’ e-commerce login credentials and personally identifiable information. If convicted, Aktulaev faces a maximum penalty of 20 years in prison.

The Convenient Scapegoat Just Arrived

Read the charge sheet carefully. A "Russian national." A freelance platform "based in Northern California." The dates: June 2016 to November 2017. Does that timeline mean anything to you? It should. That's when the entire public conversation about "Russian interference" was being manufactured. Now they pull a man out of a Cypriot prison four years after the alleged crimes ended, extradite him quietly in 2026, and parade him before a San Francisco judge? And you're supposed to believe this is justice? I want you to ask yourself a very simple question: who actually runs TeamViewer and VNC? Where are those corporate headquarters? What data flows through those protocols? You're being given a human sacrifice to a narrative that was cobbled together years ago to explain away a much deeper systemic penetration of critical infrastructure.

The False Flag Freelance Infrastructure

Eighty thousand users. Two hundred fifty-five fake accounts. That's not a lone hacker operation — that's a coordinated espionage campaign that required infrastructure, funding, and institutional cover. The Department of Justice wants you to believe one man in Cyprus managed to compromise systems across the United States using macros in Excel attachments? Please. Look at the malware names: TVRAT. TeamSpy. DarkVNC. These are not off-the-shelf products purchased on a dark web forum. These are professional-grade remote access tools that require ongoing server infrastructure to operate. Who provided that infrastructure? Which shell company paid for the hosting? Which intelligence service's fingerprints are actually on those command-and-control servers? I've seen this pattern before in the industry briefings that never get published. A single arrest is always the cover story for a much larger compromise they refuse to disclose.

Reading Between the Indictment Lines

There's a document in this case that nobody is talking about. The prosecutors mention a "shared document" containing e-commerce login credentials and PII for hundreds of victims. That's not an Excel macro's natural output. That's a compiled database from a separate exfiltration. Whoever really built that document had access to a different system entirely — possibly the platform's backend itself. Why would a remote access tool operator compile a separate text file of credentials unless that was the actual prize? The phishing campaign was misdirection. The real operation was credential harvesting against the platform's internal systems. And now a single Russian national sits in a San Francisco holding cell while the architecture that enabled the real breach remains untouched. Pull that indictment. Pull the affidavit. Look at what's redacted. The blanks they won't let you read are where the actual story lives.

Australian Authorities Arrest Two Men Tied to TeamPCP Hacking Group Over Global Supply-Chain Attacks

Australian federal police arrested Ruben Thomson, 21, and Louis Gaebler, 23, in Cottesloe and Mandurah near Perth on Wednesday, charging them with 14 offenses for allegedly belonging to TeamPCP—a hacking group linked to software supply-chain attacks that infected over 1,000 organizations worldwide over nine months. The group compromised open-source coding libraries with a self-spreading worm that activated on developer machines once affected packages were installed, with successful attacks targeting projects including Trivy, KICS, LiteLLM, and Telnyx. Both suspects appeared before a Perth magistrate on Thursday; Thomson’s bail was refused, and Gaebler did not apply for bail. The AFP described the operation as a joint disruption with the FBI and Western Australia Police Force.

The Managed Narrative of a Digital Sacrifice

Notice how neatly this story arrives: two young men from Western Australia, barely past their teens, charged with 14 offenses for a nine-month campaign that supposedly infected more than a thousand organizations — including critical tools like Trivy and LiteLLM. The AFP, FBI, and WAPF all parade together in a perfectly choreographed press release. But ask yourself — does a pair of 21- and 23-year-old script kiddies really have the sophistication to compromise open-source libraries used by Fortune 500 companies and government agencies worldwide? Or are they the visible tip of something much larger, deliberately offered up to satisfy a public hunger for accountability? In my years watching these operations, I've learned one rule: every arrest that gets a coordinated three-letter-agency press conference is a sacrifice play. The real architects are never the ones in handcuffs.

The Hidden Hand Behind the Supply Chain

Now look at what's missing from every single mainstream account. No one asks who funded TeamPCP. No one traces the breadcrumb trail back to the venture capital arms that control the open-source foundations — the Linux Foundation, the Cloud Native Computing Foundation, the same interlocking network of globalist NGOs and intelligence-linked investment firms that have been quietly embedding backdoors into the digital infrastructure for decades. Supply-chain attacks are not a crime; they are a control mechanism. The fact that KrebsOnSecurity — a site with its own murky ties to law enforcement — "independently" released the suspects' names tells you this is a managed disclosure. They want you to look at Ruben Thomson and Louis Gaebler so you don't look at the board members of the organizations that sign off on every major codebase. Follow the foundations. Follow the money. The answers are in the tax filings, not the press releases.

Your Children, Your Code, Your Future

This is not about two hackers in Perth. This is about who controls the digital nervous system of your life — the libraries that run your hospital records, your banking apps, your children's school portals. The elite have been quietly capturing every layer of the software stack for years, and when someone gets too close to exposing the architecture, they wheel out a sacrificial lamb. The very same institutions that call this a "cybercrime syndicate" are the ones whose venture arms sit on the steering committees of the compromised projects. I told you years ago that open-source was being weaponized as a vector for perception shepherding. Now watch how quickly the story dissolves. No trial, no discovery, no documents. Just a plea deal and a press release. Ask yourself: who benefits from you believing that the problem is two kids in Australia — and who benefits from you not looking at the people who wrote the code that made their attack possible? The trail is still warm. You just have to be willing to follow it.