Weekly CTI roundup: Bitget $387M DPRK-linked heist, Pentagon DMDC breach of 3M, KillSec takedown, ex-military cybercrime sentences
This SentinelOne weekly roundup covers law enforcement wins and two major breaches. A federal court sentenced former U.S. Army soldier Cameron John Wagenius to 70 months for attacks on technology and telecom firms, and former U.S. Air Force members Chijioke Timothy Odimegwu and Harafat Mogaji received a combined 189 months for business email compromise (BEC). Operation KillSwitch dismantled the KillSec ransomware gang, seizing its leak site, five core servers and 110 TB of stolen data. Crypto exchange Bitget lost $387.5M in an intrusion it attributed to North Korean state-sponsored actors who exploited a zero-day in two third-party security appliances. The Pentagon's Defense Manpower Data Center (DMDC) is notifying more than three million people that their unencrypted PII was accessed.
Technical Details
- Wagenius: helped develop the SSH Brute tool to steal network credentials and customer records, then tried to extort at least $1M; stolen data was also used for SIM-swapping. Restitution: $294,978.
- BEC case: the pair stole employee credentials and spoofed business partner emails to hijack wire transfers, including $1.68M from an Iowa victim and $720,000 from an Ohio victim. Restitution totals $1.3M.
- KillSec: active since 2024, about 500 successful data theft attacks via software flaw exploitation and AI-assisted ransomware infrastructure. Eight searches across four countries, three provisional arrests, including the alleged 16-year-old primary administrator.
- Bitget: attackers exploited a zero-day in two third-party security appliances, harvested database passwords and dropped web shells, obtained high-level internal credentials, then moved laterally to the production wallet job server and deployed custom malware to issue fraudulent withdrawals. Losses of $351.6M were revised to $387.5M across eleven blockchains. Attribution to DPRK rests on IP behavior and on-chain analysis, and laundering infrastructure is linked to the Bybit exploit. SlowMist assisted the investigation and recovered the attacker's custom tool.
- DMDC: vulnerability discovered July 16, 2026; a small number of unauthorized users had accessed unencrypted files since October 2025. Affected: 2.8M living individuals and 294,000 deceased service members. Data includes SSNs, names, dates of birth, contact details, race, gender and assignment records. No evidence of sale or misuse so far.
- The article also mentions ShinyHunters breaching FBIjobs.gov via an Oracle PeopleSoft zero-day.
Remediation
- Bitget suspended then phased in withdrawals, covered losses from its $464M protection fund and launched a 5% recovery bounty.
- DMDC began incident response and security enhancements and is offering credit and identity protection to affected people.
Linha do tempo
-
Weekly CTI roundup: Bitget $387M DPRK-linked heist, Pentagon DMDC breach of 3M, KillSec takedown, ex-military cybercrime sentences
ler a análise desta fonte ocultar
This SentinelOne weekly roundup covers law enforcement wins and two major breaches. A federal court sentenced former U.S. Army soldier Cameron John Wagenius to 70 months for attacks on technology and telecom firms, and former U.S. Air Force members Chijioke Timothy Odimegwu and Harafat Mogaji received a combined 189 months for business email compromise (BEC). Operation KillSwitch dismantled the KillSec ransomware gang, seizing its leak site, five core servers and 110 TB of stolen data. Crypto exchange Bitget lost $387.5M in an intrusion it attributed to North Korean state-sponsored actors who exploited a zero-day in two third-party security appliances. The Pentagon's Defense Manpower Data Center (DMDC) is notifying more than three million people that their unencrypted PII was accessed.
Technical Details
- Wagenius: helped develop the SSH Brute tool to steal network credentials and customer records, then tried to extort at least $1M; stolen data was also used for SIM-swapping. Restitution: $294,978.
- BEC case: the pair stole employee credentials and spoofed business partner emails to hijack wire transfers, including $1.68M from an Iowa victim and $720,000 from an Ohio victim. Restitution totals $1.3M.
- KillSec: active since 2024, about 500 successful data theft attacks via software flaw exploitation and AI-assisted ransomware infrastructure. Eight searches across four countries, three provisional arrests, including the alleged 16-year-old primary administrator.
- Bitget: attackers exploited a zero-day in two third-party security appliances, harvested database passwords and dropped web shells, obtained high-level internal credentials, then moved laterally to the production wallet job server and deployed custom malware to issue fraudulent withdrawals. Losses of $351.6M were revised to $387.5M across eleven blockchains. Attribution to DPRK rests on IP behavior and on-chain analysis, and laundering infrastructure is linked to the Bybit exploit. SlowMist assisted the investigation and recovered the attacker's custom tool.
- DMDC: vulnerability discovered July 16, 2026; a small number of unauthorized users had accessed unencrypted files since October 2025. Affected: 2.8M living individuals and 294,000 deceased service members. Data includes SSNs, names, dates of birth, contact details, race, gender and assignment records. No evidence of sale or misuse so far.
- The article also mentions ShinyHunters breaching FBIjobs.gov via an Oracle PeopleSoft zero-day.
Remediation
- Bitget suspended then phased in withdrawals, covered losses from its $464M protection fund and launched a 5% recovery bounty.
- DMDC began incident response and security enhancements and is offering credit and identity protection to affected people.