The ringleader of a sprawling cybercrime operation has pleaded guilty in the US after helping to steal and launder hundreds of millions of dollars in cryptocurrency. Malone Lam, 22, a Singaporean national and Miami resident, spearheaded the scheme to steal cryptocurrency from wealthy individuals between October 2023 and May 2025. He first visited the US in 2023 after meeting two of the group's earliest alleged members – Jeandiel Serrano and Veer Chetal – while playing Minecraft online. Lam performed various functions within the group, although court documents [PDF] identify victim selection and social engineering support as his principal roles. The ringleader was responsible for obtaining databases of high-net-worth individuals who had cryptocurrency holdings to inform the group's targeting. He would also trigger account access notifications on victims' devices to convince them that their accounts were under attack. He was also involved in laundering the proceeds through exchanges that, according to court documents, had lax KYC requirements. Other group members carried out the social engineering calls, claiming to represent Google, Yahoo, Coinbase, Gemini (the crypto exchange, not the AI chatbot), and other online platforms. Their job was to convince victims to surrender personal information and "access codes" that could be used to access their accounts. Once they secured access, Lam's crew would look for cryptocurrency accounts, seed phrases, and passwords they could use to steal victims' assets. In most cases, social engineering techniques were enough to meet the thieves' goals, although in one case involving a victim who stored their holdings in a hardware wallet, Lam's gang arranged for Marlon Ferro to physically break into a house and steal it. The Register covered Ferro's sentencing earlier this year. He was brought into Lam's fold when he was just a teenager, tasked with carrying out multiple burglaries across the US when remote social engineering attacks lacked the necessary reach. During the crew's nearly two-year operation, its members stole hundreds of millions of dollars' worth of cryptocurrency. The individual thefts ranged from about $800,000 to tens of millions of dollars, while one victim lost more than $245 million, according to court documents. Lam's crew, allegedly comprising at least 12 individuals, knew how to spend their illicit gains. Prosecutors claim they splurged up to $500,000 on a single evening at a nightclub, dished out handbags worth tens of thousands of dollars to partygoers, and bought luxury clothing and watches priced between $100,000 and $500,000. They rented expensive properties in Miami, Los Angeles, and the Hamptons, chartered private jets, hired a team of private bodyguards, and splashed out on exotic cars, with some worth up to $3.8 million. Lam was arrested at a rented property in Miami on September 18, 2024. His sentencing hearing has not yet been scheduled. The court has set a status hearing for December 8. Lam pleaded guilty to one count of participating in a racketeering conspiracy, an offense carrying a maximum sentence of 20 years in prison. "If you build a cybercrime empire, we will find you, dismantle your operation, and hold you accountable," said US Attorney Jeanine Ferris Pirro. "This defendant led an international network that preyed on victims through deception, invaded their privacy, and stole hundreds of millions of dollars in cryptocurrency. "Working with our partners at the FBI and IRS-CI, we will continue to hunt down the criminals who weaponize technology to steal from innocent people." ®

Security researcher Scott Helme says his analysis supports FulcrumSec's claim that Manchester Airports Group (MAG) exposed privileged API keys in client-side JavaScript. Helme says he reached that conclusion after using information provided by the cyber extortion group to reconstruct how data belonging to roughly 8.8 million MAG customers was allegedly stolen last month. The crooks behind the attack described MAG's security failure as "tragi-comical." They claimed MAG exposed overprivileged API keys for Iterable, a marketing automation platform, in front-end JavaScript served by the websites of MAG's three airports: Manchester, Stansted, and East Midlands. Helme used the Internet Archive's Wayback Machine to retrieve older versions of the JavaScript and found that the three keys first appeared across the airport websites in June and July 2022. The same values remained exposed until August 2026, he said. "Read the timeline the other way round and it's worse," said Helme. "Anyone who looked at that page source on any day between June 2022 and August 2026 could have taken the key. FulcrumSec just happen to be the ones who told us. "There is no way to know, from the outside, who else did, and the honest answer is that MAG can't know either without going back through four years of Iterable API logs, if they even have four years of Iterable API logs." The API keys were not embedded directly in the HTML, Helme explained, but anyone who examined the JavaScript bundles loaded by the sites could find them. This would explain how the vulnerability could go unnoticed by the airport's IT teams for over four years. Helme says the browser-delivered code was using the keys to authorize server-side API operations – something Iterable's documentation explicitly warns against. The requests should instead have passed through MAG's own servers, where the credentials could be kept secret and access restricted. MAG's alleged exposure of the credentials was not the only issue at play. The keys were vastly overprivileged for their intended job, which was to attribute page clicks to marketing emails, Helme said. The keys had read/write access to core Iterable endpoints, giving anyone who obtained them the ability to access data such as customer profiles, parking and lounge bookings, and Fast Track purchases. Helme said the structure and contents of the stolen data indicated that it had been exported from Iterable. He said he also found that the keys could access endpoints capable of deleting customer records and lists or rewriting profiles. "There's no indication FulcrumSec did any of this, and I'm glad, but they could have just nuked everything from orbit and MAG would have been really screwed," said Helme. "For four whole years, the capability to delete Manchester Airports Group's database was a view-source away. "This wasn't only a confidentiality exposure. It was a colossal integrity and availability exposure too, and MAG just got lucky. How do they now trust any of the data that remains in the database?" When it disclosed the incident, MAG described the cyberattack as "sophisticated" and said it was "a hack, not a lapse." The company declined to comment on Helme's conclusions. MAG is continuing its investigation alongside the Information Commissioner's Office (ICO) and supporting the National Crime Agency with its inquiries. It is understood that MAG maintains it was the victim of a crime and disputes Helme's "no hacking required" characterization. FulcrumSec released the company's data on September 2, a week after MAG confirmed it had refused to pay. According to the ICO, the group's extortion demand was lower than those typically made by cybercriminals. ®

CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Still, the ransomware biz’s expanding operations, unique payload, and white-label hacking service make it one to watch, and a few recent analyses provide tips for defenders to keep the crooks out of their IT environments. Rakesh Krishnan, a threat-intel analyst who writes about cybercrime investigations on TheRavenFile blog, was one of the first researchers to publish details about CRPx0 at the beginning of the month, including previously unreleased malware samples. The operators offer a hacking service, providing “complete database extraction” from victim organizations and “optional public leak coordination upon request.” This platform also advertises full network compromise, “from initial access, through lateral movement, to full domain compromise,” plus persistent access across the victim’s infrastructure. A second, white-label, ransomware-as-a-service platform makes it really easy for wannabe crooks to get into the data-theft and extortion biz. CRPx0 builds, deploys, and configures everything from command-and-control infrastructure to the negotiation panel and malware, allowing its criminal customers to bring their own brand identity to their operations - and originally offered these services for a $10,000 one-time fee. At first, the operators promised to allow affiliates to keep 100 percent of their profits - this is unheard of in ransomware-as-a-service operations. This has since shifted to a 70-30 model, with affiliates receiving 70 percent of the extortion payments (after a one-time $333 enrollment fee) and the remaining 30 percent going to the operators. CRPx0 rules prohibit affiliates from infecting Commonwealth of Independent States (CIS) member countries and organizations based in these countries. This is a pretty common rule among Russia-based ransomware operations, and in an earlier interview with The Register, Recorded Future threat intelligence analyst Allan Liska called it the “first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.” The gang also prefers Monero (XMR) payments, rather than Bitcoin (BTC). ClickFix ransomware delivery Affiliates can also customize their own ClickFix payload delivery. The operators offer two lures, a fake Windows Update and a fake Google reCAPTCHA, to socially engineer victims into executing the initial command, according to a Ransom-ISAC research team analysis published on Thursday. The Windows lure tricks a victim into pasting a PowerShell command into the Run dialog. This drops a DLL stager chain and ultimately deploys Python-based ransomware. The macOS lure, however, uses a curl|bash command that downloads portable Python and the ransomware directly. The lures and the rest of CRPx0’s malware run on Windows and macOS, and according to the researchers, there are four payload formats: “the two HTML lures plus a standalone DLL and a standalone EXE, both of which discard the social engineering step entirely.” All four deliver the same ransomware: a 1,769-line Python script that steals high-value files before encrypting them with AES-128-CBC (Fernet). The malware moves laterally via WMI/schtasks, and delivers a ransom note that gives victims a 48-hour deadline to pay up - or see their files leaked. 'Complete, professional offensive control center' On August 23, the CRPx0 operators published a v3.0 update note on the group’s clearnet leak site, promising “a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.” It provides crims with tools to steal valuable files, credentials, and wallet recovery phrases and keys, while “watching stolen cryptocurrency wallet addresses flow in.” This service also provides scripts to run remote commands, and the control panel sets up “automated attack reactions that fire on their own when something valuable happens on a target.” As the operators note: “Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.” CRPx0’s hacking and ransomware services, enabling everything from crypto theft to encryptors and full network compromise, “could be a strategic move to attract new recruits, or a scam targeting a range of affiliate hopefuls seeking cybercrime services,” according to an August 12 analysis from Jade Brown, a threat researcher at Bitdefender. What defenders should do Still, “other threat actors may attempt to adopt similar techniques,” she warns. “This is a reminder that organizations should balance detection capabilities in preparation for different types of compromises, configuring technologies to detect and block malicious behavior that aligns with both crypto theft and encryption processes.” The Ransomware-ISAC team says defenders should prioritize five actions, in this order. “The first three cost nothing and blunt the entire ClickFix class of attack, not just CRPx0,” they note. First: remove the Run dialog for standard users - this will entirely block the Windows path. For macOS users: restrict Terminal via MDM for non-technical staff. Next, the threat-intel analysts advise defenders to alert on RunMRU writes containing powershell, curl or long base64 strings. “Every ClickFix victim leaves a trace at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU,” they wrote. “This is the highest-fidelity ClickFix detection available and it is trivial to deploy.” The team also lists adversary network indicators and suggests blocking those. Make sure to hunt for indicators and malicious behavior in the pre-encryption exfiltration window. “Data leaves before a single file is encrypted, so .crpx0 extensions and ransom notes are a post-mortem indicator, not a warning,” according to the Ransomware-ISAC. Finally, confirm backups are unreachable from the account that would be compromised, and treat anything reachable with the victim's credentials as destroyed. ®