A global ad fraud and click fraud operation, dubbed SlopAds, comprising 224 Android apps that collectively amassed more than 38 million downloads across 228 countries and territories. Under the guise of AI-themed utilities, these apps employ advanced obfuscation techniques—such as steganography and hidden WebViews—to deliver a fraud payload that generates billions of ad impressions and […]
Conor Brian Fitzpatrick, the 22-year-old founder of BreachForums, has been resentenced to three years in federal prison for operating one of the world’s largest cybercriminal marketplaces.
The New York resident was sentenced on September 16, 2025, for creating and administering a platform that facilitated the sale of stolen data and harbored child sexual abuse material (CSAM).
Key Takeaways 1. Conor Fitzpatrick received three years for running BreachForums. 2. The forum amassed 330 K users and 14 B stolen records. 3. He forfeited domains, devices, and crypto amid the DOJ crackdown.
The resentencing follows a U.S. Court of Appeals for the Fourth Circuit decision on January 21, 2025, which vacated Fitzpatrick’s original lenient sentence of 17 days served and ordered a new sentencing hearing.
Fitzpatrick pleaded guilty to access device conspiracy (18 U.S.C. § 1029), access device solicitation, and possession of CSAM under federal statutes.
BreachForums: The Global Hub for Stolen Data
BreachForums emerged in March 2022 as the successor to RaidForums, which law enforcement seized in February 2022.
The platform rapidly expanded to over 330,000 registered users, establishing itself as the premier English-language hacking forum globally.
The Department of Justice stated that the forum maintained access to 888 datasets containing over 14 billion individual records of stolen information.
Notable breaches included a database with contact information for approximately 200 million users of a major U.S. social networking platform and sensitive details of 87,760 InfraGard members—a critical infrastructure protection partnership between the FBI and private sector entities.
The platform also trafficked credentials from telecommunications providers, healthcare services, and internet service providers.
As part of his plea agreement, Fitzpatrick forfeited over 100 domain names associated with BreachForums’ infrastructure, more than a dozen electronic devices used in the criminal enterprise, and cryptocurrency proceeds generated from the illegal marketplace.
The Computer Crime and Intellectual Property Section (CCIPS) led the prosecution, which has secured convictions of over 180 cybercriminals since 2020 and facilitated the return of over $350 million to victims.
Acting Assistant Attorney General Matthew R. Galeotti emphasized the Justice Department’s commitment to dismantling cybercriminal infrastructure, stating that operators of similar forums should expect relentless investigation and prosecution.
The FBI’s Washington Field Office conducted the investigation under its Cyber Division’s ongoing efforts to combat dark web marketplaces that enable data theft, fraud, and other cybercrimes targeting critical infrastructure and private citizens.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
Two cybersecurity industry leaders have made significant announcements regarding their participation in the upcoming MITRE ATT&CK Evaluations, marking a notable shift in how major security vendors approach independent testing validation. Diagram illustrating core features of Palo Alto Networks’ Cortex XDR cybersecurity platform, including threat intelligence, endpoint protection, and automation Palo Alto Networks Steps Back After […]
Microsoft’s Digital Crimes Unit (DCU) has seized control of 338 websites facilitating RaccoonO365, the rapidly expanding phishing-as-a-service platform that enables anyone to harvest Microsoft 365 credentials. Acting under a court order from the Southern District of New York, the DCU disrupted the operation’s technical infrastructure, denying cybercriminals access to victims and cutting off their revenue […]
Conor Brian Fitzpatrick, the founder and operator of BreachForums, has been resentenced to three more years in prison after a federal appeals court vacated his earlier light sentence. Authorities say Fitzpatrick created and ran one of the world’s largest English-language hacker forums, where criminals bought and sold stolen data. The Justice Department and FBI emphasized […]
Cybersecurity researchers have tied a fresh round of cyber attacks targeting financial services to the notorious cybercrime group known as Scattered Spider, casting doubt on their claims of going “dark.”
Threat intelligence firm ReliaQuest said it has observed indications that the threat actor has shifted their focus to the financial sector. This is supported by an increase in lookalike domains
Malicious advertising campaigns have surged in sophistication, with cybercriminals exploiting and even operating adtech firms to deliver malware, credential stealers and phishing schemes directly through mainstream ad networks. A cluster of interconnected companies—run through shell corporations, hosted on compromised infrastructure, and registered en masse via a notorious registrar—has enabled a prolific threat actor, dubbed “Vane […]
A threat actor who gained initial access through a SonicWall VPN device was able to escalate their attack by finding Huntress recovery codes saved in a plaintext file on a user’s desktop.
This allowed the attacker to log into the client’s security portal, where they attempted to remediate incident reports and uninstall security agents to cover their tracks.
This incident is part of a larger campaign that targets SonicWall VPNs. This campaign quickly spread the Akira ransomware to many victims.
This particular case highlights the significant risk of storing sensitive credentials in easily accessible formats.
The Huntress Security Operations Center (SOC) in the APAC region first detected suspicious activity when multiple administrative users began executing commands to delete shadow copies across several hosts within an organization. In response, analysts initiated a mass isolation of systems to contain the threat.
The investigation revealed that the Akira ransomware binary, w.exe, had been executed from a user’s desktop, leading to the encryption of that workstation.
Attack Chain
However, the quick containment prevented the ransomware from spreading throughout the entire environment.
SOC analyst Michael confirmed through event log analysis that the compromised user accounts were accessed from internal IP addresses in the 192.168.x.x range.
These IPs were likely assigned via DHCP to systems controlled by the Akira threat actors after they compromised the organization’s SonicWall VPN.
This technique allows attackers to blend in with legitimate network traffic, bypassing endpoint detection and response (EDR) solutions, as the rogue systems do not have security agents installed and their activity appears to originate from a trusted internal source.
The Huntress SOC issued a formal incident report identifying the SonicWall VPN as the likely point of entry and justifying the mass isolation response.
The team then collaborated with the Threat Hunting & Response team for a deeper analysis to provide the partner with comprehensive intelligence on the active threat.
Certificate Export And Abuse
During the investigation of the Domain Controller (DC), analysts observed the compromised user executing commands to list and export certificates from the local certificate store.
The attacker specifically used certutil -store My to enumerate certificates in the personal store, which could contain sensitive keys for authentication, encryption, or signing.
Subsequently, the attacker exported a certificate in PFX format, which includes both the public and private keys.
Compromising such a certificate, if used for user or device authentication, could allow an attacker to impersonate legitimate users or machines, facilitating credential theft and lateral movement.
While this activity is a strong indicator of preparations for persistent access, the root cause for this specific action could not be determined during the incident.
While enumerating administrative shares from the DC, the threat actor discovered and accessed a plaintext file on an internal security engineer’s desktop named Huntress_recovery_codes-<redacted>.txt.
Huntress code Exposed
These codes serve as a backup to bypass multi-factor authentication (MFA). Their compromise effectively grants an attacker full access to the Huntress console, allowing them to tamper with detection and response capabilities.
Huntress analysts noticed a security engineer’s account began resolving active incident reports within the Huntress portal, which was anomalous given the ongoing incident.
The SOC team quickly escalated their concerns, and the partner confirmed that the activity was not performed by their personnel.
A review of portal activity revealed that a known malicious IP address, 104.238.221[.]69, previously associated with other SonicWall compromises, had accessed the portal using the stolen recovery codes.
The attacker then manually closed incident reports and initiated the uninstallation of Huntress agents from compromised systems to suppress visibility and hinder the response.
This sequence of events highlights how improperly stored recovery codes can become a single point of failure, allowing an attacker to bypass MFA and gain privileged access.
In this case, the attacker was able to impersonate a trusted user, access the security portal, suppress alerts, and attempt to remove endpoint protection.
The Dangers Of Credentials Stored In Plaintext
Storing credentials and recovery codes in plaintext poses a significant security risk. Once obtained, they can be used to compromise hosts and access critical third-party applications and security platforms.
This access can be weaponized to disable defenses and execute further malicious actions.
Organizations should treat recovery codes with the same level of security as privileged account passwords. Recommended practices include:
Avoid plaintext storage: Do not save recovery codes in unprotected text files or on shared drives.
Use a password manager: Store codes and credentials in an encrypted password manager with a strong master password.
Encrypt offline storage: If using offline storage, ensure the file is encrypted and password-protected on an encrypted drive.
Rotate and monitor: Periodically regenerate recovery codes and monitor for unusual login activity.
A recently disclosed vulnerability in the Kubernetes C# client library allows attackers to carry out man-in-the-middle (MiTM) attacks against the API server. The flaw stems from improper certificate validation when using custom certificate authorities (CAs). As organizations increasingly rely on Kubernetes for container orchestration, this weakness could enable interception or alteration of critical control-plane traffic, […]
The developers behind the PureHVNC remote access trojan (RAT) have been uncovered using GitHub repositories to host critical components and plugin source code for their Pure malware family. Check Point Research’s recent forensic analysis of an eight-day ClickFix intrusion campaign reveals that PureHVNC’s command-and-control (C&C) server delivered GitHub URLs to infected machines, a practice previously […]
