From Dirty Crypto to Clean Money – The Laundering Playbook of Russophone Cybercriminals

“A thief may sleep full-fed with stolen bread, But flames will one day burn his bed.” — Saadi Shirazi, The Rose Garden (Gulistan), 1258 According to TRM Labs’ 2025 Crypto Crime Report, illicit cryptocurrency transaction volumes reached at least $45 billion in 2024. Although that staggering sum covers every corner of the digital underground, including […]

Deciphering Black Basta’s Infrastructure from the Chat Leak

This article has originally appeared on Cybercrime Diaries On February 20, 2025, the cybersecurity community received an unexpected stroke of luck as internal strife seemingly spread within the infamous Black Basta ransomware group. On that day, an unknown individual using the alias ExploitWhispers released a file on Telegram, allegedly containing the group’s internal chat logs. […]

The Underground’s Favorite Messenger: Telegram’s Reign Continues

The data and visualizations presented on this webpage are based on information collected from January 2024 to January 2025. These graphs are static and do not reflect real-time updates or recent developments. Any trends, insights, or conclusions should be interpreted with this timeframe in mind. Executive Summary Telegram remains the dominant messaging platform in the […]

MOVEit Repackaged and Recycled

The largest repackage and re-post of an old leak In November 2024, a hacker known as “Nam3L3ss” allegedly released previously undisclosed data from the MOVEit breach in May 2023. This leak consisted of millions of records, including sensitive employee and big brand corporate information, significantly escalating the breach’s impact. Digging into this story reveals that […]

Infostealer Malware: An Introduction

This blog was updated June 26, 2025 with updated information Stolen credentials are big business among cybercriminals. According to Verizon’s latest Data Breach Investigation Report (DBIR), credentials were involved in 88% of basic web application attack breaches, making them the most common initial attack vector — and sometimes, the only vector used in an attack. […]

Actualités cybercriminelles: une brèche de sécurité pour une agence de vérification d'antécédents, une reprise de possession de blogue rançongiciel, une querelle entre forums et la double arrestation de "J.P. Morgan"

Fond bleu foncé avec le logo de Leaky Weekly sur le côté gauche dans un cercle. À droite se trouve un ovale vert avec « Podcast » à l'intérieur. En dessous se trouve le texte en blanc : « Background Check Organization Breach, A Repossessed Ransomware Blog, Feuding Forums, and the Double Arrest of « JP Morgan » »

There’s so much to keep up with in the world of cybercrime…especially for security practitioners. Leaky Weekly is a bi-weekly podcast hosted by security researcher Nick Ascoli as he dives into the most pressing stories on data leaks, cybercrime, and the dark web in the last week or so. On this episode of Leaky Weekly, […]