ThreatPaper

#takedown

3 cases

EvilTokens: Microsoft's DCU dismantles an AI-chatbot phishing service that hit 12,000 inboxes

Microsoft's Digital Crimes Unit seized 50 sites and 150+ domains behind EvilTokens, a cybercrime-as-a-service platform pairing device-code phishing with an AI chatbot for inbox analysis and BEC targeting. It hit 12,000+ inboxes across 10,000+ orgs. The AI did the targeting, not the intrusion.

Social EngineeringAI & Machine LearningFinancial Fraud
Operation Saffron: Europol dismantles First VPN, the bulletproof anonymity layer behind years of ransomware cases

On May 19-20, 2026, Europol and Eurojust's Operation Saffron took down First VPN — a bulletproof service running since 2014 and used by 25+ ransomware groups. Investigators infiltrated it, seized 33+ servers and unmasked ~506 users. The Ukrainian admin was searched and interviewed, not arrested.

Darknet & Illicit MarketsRansomware
Sality Botnet Takedown: How a 23-Year-Old P2P Network Was Turned Against Itself

On 31 August 2026 investigators cut a 23-year-old peer-to-peer botnet off from its operator by poisoning the peer lists of its own bots. The protocol they exploited had been documented publicly since 2011 and could never be patched.

Botnet & DDoSMalware