A Hive and Nefilim ransomware affiliate received a 70-month prison sentence on October 27, 2026, while US authorities announced the seizure of a hosting provider’s domain in a separate case. The Justice Department said the ransomware operation disrupted businesses and healthcare providers; the domain seizure targeted a service accused of helping criminal customers keep their infrastructure online.
A third prosecution concerns an alleged cryptocurrency investment scheme with 174 identified US victims. Separately, Anthropic published details of five exploit chains it says an internal AI model developed against browsers and operating systems, with fixes reported for each target.
Ransomware affiliate sentenced; alleged administrator sought
The US Attorney’s Office for the Eastern District of New York said Judge Pamela K. Chen sentenced Ukrainian national Artem Aleksandrovych Stryzhak, 36, in Brooklyn. He pleaded guilty in December 2025 to conspiracy to commit fraud, extortion and related activity involving computers. Spanish authorities arrested him in June 2024, and he was extradited to the United States on April 30, 2025.
Court documents describe Stryzhak as an affiliate—an attacker who deploys a group’s ransomware in exchange for a share of the proceeds—of both Nefilim and Hive. He joined the Nefilim conspiracy around June 2021 and agreed with administrator Volodymyr Tymoshchuk to pay the group’s administrators 20% of the ransoms he collected for access to its malware.
In June 2021, Stryzhak stole data from an oil and gas transportation company. About a week later, he created email addresses used in a ransom note sent to the company. His deployment of Nefilim continued through at least October 2021.
Stryzhak was also one of Hive’s earliest affiliates. He and his co-conspirators deployed Hive against seven victims, including law firms, a dentist’s office and a healthcare provider during the COVID-19 pandemic. Encrypted files became inaccessible; perpetrators supplied a decryption key when victims paid. The FBI provided one of Stryzhak’s victims with a key during its disruption campaign, allowing recovery without a ransom payment.
The wider Hive conspiracy attacked approximately 1,500 victims worldwide between June 2021 and January 2023, including government bodies, hospitals and businesses. That total covers the group, rather than Stryzhak’s seven identified Hive victims. One hospital had to treat existing patients without digital technology and could not immediately accept new patients.
The FBI’s Springfield office investigated the Nefilim case, and its Tampa office investigated the Hive case. Authorities continue to seek Tymoshchuk, with a State Department reward of up to $11 million for information leading to his arrest and/or conviction or location.
Virtualine domain seized over alleged criminal hosting
In a separate October 27 announcement, the US Attorney’s Office for the Eastern District of Virginia said authorities obtained court authorization to seize virtualine.net. The domain served Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.
Prosecutors describe Virtualine as a “bulletproof” provider: a hosting service marketed as resistant to abuse complaints and enforcement. It offered servers, hosting and domain purchases, and advertised to criminals on cybercrime forums.
Court records cite a September 2024 advertisement permitting illegal activities including phishing, payment-card fraud and spam, while excluding child sexual abuse content and terrorism. In March 2026, Virtualine promoted an additional protection plan under which it would respond to an official law-enforcement request by moving a customer’s infrastructure to an ostensibly unaffiliated shell company and reactivating the server.
Despite its stated restriction, prosecutors allege Virtualine knowingly hosted a forum identified as Vendor 1 that sold access to sexual images and videos of minors and adults. The forum also promoted hackers for hire to break into victims’ accounts and obtain intimate material without consent.
Virtualine began receiving notices about sexual abuse material involving minors in January 2026, about a month after assigning Vendor 1 an IP address. Notices came from law enforcement in Germany, Canada and Australia, the US National Center for Missing and Exploited Children, and a victim’s attorney. Prosecutors say Virtualine continued hosting the service and helped build a separate upload-and-download website that remained hosted as of the announcement, despite at least one abuse complaint involving images of children.
The provider accepted payments through an option labeled BTC [NO-AML], using unhosted bitcoin addresses advertised as avoiding funds being flagged as illicit. Prosecutors allege payments traceable to criminal groups were subsequently laundered to conceal their origin.
The FBI’s Washington Field Office investigated, assisted by German and Dutch police, the UK National Crime Agency, OverRIPE, Lumen and the Justice Department’s Office of International Affairs.
Extradition in alleged $36.9 million laundering scheme
The Justice Department announced on October 23 that Zheng Zhao, a 44-year-old Chinese national, had been extradited from the Netherlands and arraigned in the Central District of California. He is accused of participating in an international cryptocurrency investment conspiracy operated from scam centers in Cambodia.
Court documents allege that overseas conspirators approached US victims through unsolicited social media interactions, calls, texts and dating services. After building trust, they promoted fraudulent investments through websites resembling legitimate cryptocurrency trading platforms and falsely told victims their investments were gaining value.
Prosecutors say the network moved stolen money through US shell companies, international bank accounts and digital asset wallets. More than $36.9 million in victim funds passed from US bank accounts controlled by co-conspirators to a single account at Deltec Bank in the Bahamas. Zhao and others allegedly arranged for the bank to convert the funds into Tether, the stablecoin identified as USDT, and send them to a wallet controlled in Cambodia. Conspirators there then distributed USDT to scam-center leaders across the region.
Zhao was charged in August 2025 with conspiracy to commit money laundering and faces a maximum of 20 years in prison if convicted. The charges remain allegations, and he is presumed innocent. Eight co-conspirators have pleaded guilty, including ShengSheng He and Jingliang Su, who received 51-month and 46-month sentences respectively for conspiracy to operate an unlicensed money transmitting business.
The Secret Service’s Global Investigative Operations Center is investigating, with assistance from other US agencies and Dutch authorities. The prosecution forms part of the Criminal Division’s Cyber-Enabled Scam Initiative. The department directs victims of digital asset investment fraud to report it at IC3.gov.
Anthropic describes five AI-developed exploit chains
In a separate technical account, Anthropic says an unreleased internal research model discovered vulnerabilities and, after initial prompting, wrote working exploits against Chrome, Safari, Android, Windows and Linux. These are the company’s reported findings and demonstrations.
For Chrome on macOS, Anthropic describes a malicious page that launched Calculator within seconds, executing code outside the browser’s sandbox—the boundary intended to contain compromised browser components. The chain combined corruption of memory in the V8 JavaScript engine, escape from V8’s memory-region sandbox, a CacheStorage race condition and a use-after-free flaw in the FedCM sign-in feature. A use-after-free occurs when software accesses memory after releasing it.
The chain defeated address space layout randomization, which hides code locations in memory, and used return-oriented programming, which combines existing code fragments to control execution. Anthropic says Google assigned 62 CVEs, or vulnerability identifiers, to its findings and patched all of them as of Chrome 156. All were rated critical or high severity; they included 13 sandbox escapes and 21 vulnerabilities that could compromise the renderer, the process that handles webpage content.
The Safari chain bypassed the same-origin policy, the rule separating one website’s data from another’s. Anthropic says it could read browser history, cookies and session databases, and make authenticated requests to other domains and read their responses. An attacker could therefore read a signed-in user’s email or view bank balances and attempt transfers.
That chain combined a JavaScriptCore use-after-free, an escape from WebKit’s Gigacage memory isolation, and a flaw in the sandbox’s interprocess communication mechanism. It altered browser data and a security flag rather than executing arbitrary code. Some component behaviors became exploitable only when combined. Anthropic says Apple acknowledged the report the same day and promptly implemented a fix that is available to users.
For Android, the company reports extracting photos and personal information from a locked phone through USB. Work involving source analysis, reverse engineering of Google Play services and testing on a physical Pixel 9 produced a chain that bypassed locked-device transfer restrictions, peer authorization and six-digit pairing confirmation. A fallback mechanism then transferred file contents despite a separate restriction on raw file transfers. Anthropic says Google addressed the issue.
The Windows finding, CVE-2026-33096, concerned an out-of-bounds memory read in the kernel’s QUIC implementation, a transport protocol used by HTTP/3. Anthropic says a few packets could crash and restart a Windows machine responding to HTTP/3 through the native implementation; repeated requests could keep it unavailable. Its estimate of several million internet-facing servers is a company estimate. Microsoft resolved the vulnerability, Anthropic said. The model found it through binary analysis, including reconstructing and comparing program behavior before examining the resulting code for weaknesses.
The Linux chain targeted servers with a multipath TCP listener. Anthropic says an unauthenticated remote attacker could exploit a timing-dependent use-after-free to run commands as root, the most privileged account, without user interaction. One stage leaked a kernel pointer to reveal memory locations; another overwrote a callback pointer to redirect execution through existing kernel functions. Failed attempts could leave only a failed connection handshake, allowing repeated tries. Its demonstration took 48 minutes to leak a pointer and another five minutes to execute a command.
Anthropic identifies that flaw as CVE-2026-98432 and says the fix was merged upstream and backported to every maintained stable Linux kernel branch. It also reports local privilege-escalation findings in OpenBSD, FreeBSD and Linux, sandbox escapes and web application vulnerabilities.
The company says it reported each vulnerability under a disclosure process allowing vendors 90 days to patch and a further 45 days before additional technical discussion. Its research platform runs scanning agents in parallel, tracks code coverage, searches for variants of confirmed flaws and subjects findings to verification and risk assessment.
For development teams, Anthropic recommends scanning code at pull-request time and has released a Claude Code security-guidance plugin. It also says its expanded Cyber Verification Program offers qualifying security professionals advanced capabilities and reduced blocking classifiers, including access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. Its practical recommendation is to scan defenders’ own code as part of development.
