Researchers from TrendAI have been tracking the infrastructure, as well as the campaigns and operator behaviors that can be linked to Tycoon 2FA to build a clearer picture of how its services was being used at scale.
By November 2025, TrendAI had collected enough data to link the operation to an actor using the monikers “SaaadFridi” and “Mr_Xaad”, likely the developer/operator of Tycoon 2FA. Historical activity showed this actor previously focused on web defacements before moving into building and running this phishing toolkit. Intelligence gathered by TrendAI also included details on tooling, infrastructure, and activity patterns, which was shared with Europol to support law enforcement action.
Read more…
Source: Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- FIN10 Extorting Canadian Mining Companies, Casinos
June 20, 2017
Cybercriminals targeting casinos and mining firms in North America have extorted as much as $620,000 per theft during a four-year run in which they threaten victims with the destruction or public release of stolen data. Between 2013 and 2016, mostly Canadian firms were hit with nearly a dozen seemingly unrelated hacks, but after an analysis of the ...
- Brit hacker admits he siphoned info from US military satellite network
June 16, 2017
A UK-based computer hacker has admitted stealing hundreds of usernames and email addresses from a US military communications system. Sean Caffrey, 25, of Sutton Coldfield in the West Midlands, broke in and pinched the ranks, usernames and email addresses of more than 800 users of a satellite communications system and of about 30,000 satellite phones, back ...
- German police nick alleged admin of dark web gun sales site
June 12, 2017
German police have arrested a man they suspect of being the administrator of a dark net website. The site is said to have been used to buy a gun used in a 2016 mass murder. The unnamed 30-year-old man was arrested on 8 June in “south west Germany”, according to Sky News. The server used to host ...
- Hackers Started Using “SambaCry Flaw” to Hack Linux Systems
June 10, 2017
Two weeks ago we reported about a 7-year-old critical remote code execution vulnerability in Samba networking software (re-implementation of SMB networking protocol) that allows a remote hacker to take full control of a vulnerable Linux and Unix machines. To know more about the SambaCry vulnerability (CVE-2017-7494) and how it works, you can read our previous article. At ...
- New SEC enforcement chiefs see cyber crime as biggest market threat
June 9, 2017
Hackers are increasingly breaking into brokerage accounts to steal assets or make illegal trades, prompting U.S. securities regulators to start tracking cyber crimes more closely, two newly appointed enforcement officials said in an interview on Thursday. On Thursday, the U.S. Securities and Exchange Commission named Stephanie Avakian and Steven Peikin as new co-directors of enforcement. In an ...
- Cybercrime agreement to be signed by global leaders
June 3, 2017
Global leaders are preparing to agree how police access digital evidence which may physically be located in another jurisdiction. The amendment to the Budapest Convention on Cybercrime will allow signature states’ police forces to receive digital evidence in criminal investigations in a timely manner – something those forces complain is currently a major problem. Since the opening ...