Cyber Crime Investigations:9 Cases From 2026

In June, investigators seized 326 servers in one operation against the infostealers that feed ransomware gangs. In July, two members of Scattered Spider went to prison for five and a half years each. In October, researchers followed $6.36 billion across ten blockchains after the Binance theft, while another team read an Iran-linked actor’s command center on GitHub.

Cyber crime investigations are how law enforcement and security teams expose how the perpetrators operate and, sometimes, put them in front of a judge. We tracked the biggest cases of 2026 through our weekly roundups and threat reports. Here is what each one shows, and what it means for your defenses.

Why cyber threat investigations matter

Cyber crime investigations bring together many disciplines. Computer forensics recovers deleted files and traces hidden activity on compromised systems. Incident response teams contain breaches, while analysts comb through network traffic and dissect malware to understand how attackers got in and what they touched.

In 2026 the work spread well beyond police. Microsoft’s Digital Crimes Unit ran a court-authorized takedown, a blockchain analytics firm traced the Binance theft, and security vendors read attackers’ own infrastructure. These touch points provide:

• Evidence to prosecute criminals
• Intelligence to protect national security
• Guidance for private sector defenders
• Insight into unnoticed suspicious activity

Investigations are crucial for preventing unauthorized access. Over time they improve resilience against everything from ransomware attacks to phishing schemes and identity theft.

The biggest cyber crime investigations of 2026

Nine cases from June to November show how cybercrime investigations unfolded this year. Some ended in prison sentences. Others ended in seized servers or a published report. All of them exposed attackers and shaped defenses. For the weekly view, our roundups track each story as it breaks, including Cyber Roundup: Week of October 26.

The year’s cases fall into three types. Arrest-led investigations, like Scattered Spider and Snowflake, end in court. Infrastructure-led investigations, like Operation Endgame and the Binance freezes, remove the criminals’ tools or money. Research-led investigations, like DarkBlinders and PHP2Shell, expose the attacker without any arrest at all. Each type produces different intelligence, and each leaves different gaps for defenders to fill. The newest case, still unfolding, fits none of them yet.

1. Operation Endgame hits the infostealer supply chain

Between June 15 and 19, law enforcement agencies from several countries and private partners including Microsoft, ESET, BitSight, Proofpoint, and IBM X-Force went after the malware that feeds ransomware. Europol announced the results on June 24: 326 servers and 142 domains taken down, 27 million stolen credentials recovered, and more than €41 million in criminal crypto frozen. The targets were the Amadey loader, the StealC infostealer, and SocGholish, a dropper delivered through fake browser updates. Dutch police had announced the SocGholish takedown a few days earlier, also under Operation Endgame.

Microsoft’s Digital Crimes Unit identified more than 200 command-and-control servers and executed a court-authorized takedown, using AI, including Copilot, to analyze the malware. Microsoft linked Amadey and StealC to more than 140,000 infected computers in the first two weeks of May alone. As BleepingComputer noted, seizing servers raises costs for the operators, but without arrests they can rebuild.

2. Scattered Spider members are sentenced for the TfL attack

On July 16, Woolwich Crown Court sentenced Thalha Jubair and Owen Flowers to five years and six months each for the 2024 cyberattack on Transport for London. The attack ran from August 31 to September 3, 2024, cost TfL £29 million, and took six months to fix. The NCA called it the largest cybercrime prosecution ever brought before the UK courts. The pair pleaded guilty in June, on the day their trial was due to start.

The judge found they were motivated mainly by selfish bravado, not money alone. The NCA says its action effectively halted the group’s criminal activity, though other criminals may keep using the damaged brand, and SecurityWeek notes that attacks claimed under the Scattered Spider name continued into early 2026. On July 1, prosecutors announced that a 19-year-old US-Estonian national, another alleged member, had been extradited from Finland to Chicago.

3. The Snowflake campaign reaches the courtroom

On August 5, Connor Moucka pleaded guilty in Seattle federal court to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy. Prosecutors say he and his co-conspirators used stolen credentials to compromise at least 165 organizations in 2024, stole billions of records tied to at least 100 million people, and extorted victims for millions. Victims included AT&T, Ticketmaster, Advance Auto Parts, and Santander. Moucka personally collected at least $495,000. The Justice Department stressed that he was arrested six months after the breaches began, in an investigation involving police in Canada, Australia, Spain, Ukraine, and Turkey.

No platform flaw was involved. The attackers logged in with credentials that infostealer malware had collected, some of them years earlier and never rotated, on accounts without multi-factor authentication. In September, former US Army soldier Cameron Wagenius was sentenced to 70 months for his role in the AT&T and Snowflake thefts, while co-defendant John Binns remains outside US custody. Moucka’s sentencing was scheduled for October 27.

4. Gunra ransomware lands in a joint advisory

On August 10, the FBI, CISA, the NSA, the US Secret Service, and South Korea’s National Police Agency published a joint advisory on Gunra, a ransomware-as-a-service group built on leaked Conti code. The advisory documents how affiliates exploit two Fortinet flaws, tamper with VPN authentication, and delete backups at both the primary and disaster recovery sites before encrypting.

The more surprising finding came from researchers. In March, Breakglass Intelligence reported that Gunra’s Linux variant seeds its random number generator with the system time, which makes the encryption key recoverable without paying. Investigators now look for flaws in the criminals’ tools as well as in the victims’ defenses.

5. DarkBlinders: four vendors, one Iran-linked actor

Four research teams documented the same actor under four labels: DarkBlinders (Group-IB), REF8685 (Elastic), and CL-STA-1178 and Blinder Tunnel (Unit 42). Unit 42 published its report on October 6. Around October 10, Dream tied the waves together after reverse-engineering the StarkMeet malware and finding an embedded GitHub token that gave read-only access to the actor’s command-and-control repositories.

That access showed operators working against a government cloud environment in Iraq’s Kurdistan Region and a high-profile individual in Israel. The vendors agree on Iran and disagree on confidence: Dream and Unit 42 say high, while Group-IB says low. Read our full breakdown in DarkBlinders Hit Government Cloud, Israeli Target: 5 Things to Know. For background on the wider conflict, see our Israel-Iran cyber conflict flash report.

6. The AfD leak: a hosting provider, not the party’s own systems

On October 19, an actor calling itself hexane_cc published what it says is 281 GB of data from more than 800 hosts tied to Germany’s Alternative for Germany (AfD): about 420,000 emails and 102,985 files. The AfD confirmed the breach and says the attack on its hosting provider took place in September. Our analysts tracked the forum post and the actor’s archive. The profile was one day old, and we found no links to any established hacking or ransomware group.

We assess hacktivism as the most likely motive. What made the leak different was the curation: a searchable archive that rates each item by potential political damage. Many of its claims remain unverified, so investigators should treat the contents as leads until they are confirmed. Read the full analysis from our analyst Leah Koonthamattam.

7. PHP2Shell: investigators find the attacker’s own toolkit

Dream researchers identified a complete attack operation from a suspected China-nexus actor: target lists, exploitation logs, about 40 custom post-exploitation scripts, and a custom build of the PHP2Shell exploit chained with the Fragnesia Linux kernel flaw. The campaign rooted 25 servers across the United States, Japan, Taiwan, and South Korea, 24 of them perimeter firewalls. Dream says each chain took under 15 minutes from first request to persistent root access.

Dream’s updated report names Palo Alto Networks PAN-OS, and Palo Alto confirmed active exploitation against management interfaces exposed to the internet. Dream names no actor, says multiple indicators point to a Chinese-nexus operation, and found Claude Code installed alongside an attack platform configured with DeepSeek and Kimi, without direct evidence that those tools wrote the exploit. CISA added Fragnesia to its KEV catalog on October 28.

A free PHP check is available here.

Paste your domains, see which sites still run a PHP version exposed to php2shell, ranked by what to patch first.

8. Binance: following $6.36 billion across ten blockchains

On October 29, attackers moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes, according to TRM Labs. Binance’s initial investigation points to a compromised DevOps engineer’s laptop that gave the attacker access to a service container, and a later update found additional breaches beyond it. TRM attributes the theft with high confidence to North Korea’s TraderTraitor group, and Chainalysis called it likely. Binance has not confirmed the attribution. It says it will cover the losses from its SAFU fund and company funds, and that user funds are safe.

Tracing was the fast part. TRM counts about $2.7 billion frozen by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council by early October 30, and Binance says close to $3 billion. The attackers still hold more than 420,000 ETH and 18,270 BTC, about $2.4 billion. Stolen crypto stays visible on the chain, but it freezes fastest where an issuer or a chain’s governance can act.

9. Ukraine’s Air Alert app: an attack that is still being attributed

Late on November 1, hackers compromised Ukraine’s Air Alert app, built by the Digital Transformation Ministry with Ajax Systems, and sent users fake warnings of nuclear and chemical threats and street fighting. One alert invoked Russia’s nuclear-capable Oreshnik missile and pointed users to a Telegram channel linked to a previously unknown group calling itself Hitcore Corp. Ukraine’s Air Force said the app was most likely compromised by the enemy, and service was gradually restored. Hours later, Russia’s emergencies ministry reported a massive cyberattack on its own alert app, which also pushed fake nuclear warnings.

Attribution is still thin. Zelensky told PBS the Air Alert hack was a Russian attack, and Kyiv Post reported that he also confirmed Ukraine retaliated against Russia’s app. Days later, the Kyiv Independent’s website and newsletter service were hit with fake messages about a nuclear launch. The outlet blamed suspected Russian actors based on the content of the messages, and The Record noted that it offered no technical evidence and that there is no confirmed link between the two incidents. The Independent cited CybelAngel on the asymmetry of the attacks between the two countries, which our Russia-Ukraine report documents.

Investigative techniques and tools

Behind every cyber crime investigation is a set of specialized methods that turn raw digital traces into usable evidence. The 2026 cases show which ones mattered most.

• Computer forensics & digital evidence: Investigators recover deleted files, examine infected drives, and pull apart malware samples to see how attackers broke in. In 2026, reverse-engineering the StarkMeet loader exposed DarkBlinders’ command-and-control repositories, and Dream’s analysis of PHP2Shell turned up the attacker’s own logs.
• Blockchain tracing: TRM followed Binance’s stolen funds across ten blockchains, which gave issuers the addresses they needed to freeze about $2.7 billion. Europol froze more than €41 million in criminal crypto during Operation Endgame.
• Infrastructure takedowns & court orders: Operation Endgame combined police action with a court-authorized takedown by Microsoft’s Digital Crimes Unit, which removed more than 200 command-and-control servers.
• Network traffic analysis: By reviewing logs and packet data, investigators spot unusual patterns, from repeated unauthorized access attempts to phishing payloads. Group-IB advises watching endpoint traffic to GitHub and DNS lookups for DarkBlinders, because the malware uses both.
• OSINT & attribution: Analysts profile actors from forum posts, repositories, and infrastructure. In the AfD case we found a one-day-old forum profile and no links to established groups. Vendors then state their attribution as a confidence level. Public claims become data too: our Russia-Ukraine report counts roughly 5,000 attacks claimed by NoName057(16) since January 2025, about four times its nearest rival.
• Public-private collaboration: Operation Endgame paired agencies from several countries with Microsoft, ESET, BitSight, Proofpoint, and IBM X-Force. Many of the year’s most useful investigations came from companies, not police.
• Certifications & training: Skilled investigators often hold credentials such as GCFA (GIAC Certified Forensic Analyst), CHFI (Computer Hacking Forensic Investigator), or CCE (Certified Computer Examiner). These programs build forensic analysis, incident response, and courtroom-ready evidence handling skills.
• Public reporting resources: Victims play a role, too. In the US, the FBI’s Internet Crime Complaint Center (IC3) lets people report internet crime, and those reports help agencies connect cases across jurisdictions.

What this means for CISOs

The same clues that help investigators can help you tighten your defenses. The 2026 cases point to five habits:

• Rotate credentials and enforce MFA. The Snowflake attackers walked in with old infostealer credentials on accounts without multi-factor authentication, and Operation Endgame recovered 27 million stolen credentials.
• Know who holds your data. The AfD leak came through a hosting provider, and Binance’s investigation starts at one laptop with a path to production.
• Find your exposed management interfaces. Palo Alto says the PAN-OS risk is highest when the management interface is reachable from the internet.
• Treat attribution as a confidence level. Vendors disagreed on DarkBlinders and Binance has not confirmed TRM’s finding. Brief your board accordingly.
• Preserve evidence before you rebuild. Investigators can only follow trails that still exist.

Aligning with investigators matters too. When agencies share indicators from ransomware or phishing investigations, or when firms publish forensic findings on malware campaigns, those signals should feed directly into your defense strategy.

Introducing CybelAngel’s special threat investigation services

When a security incident goes beyond the routine, CybelAngel’s Special Threat Investigation service delivers the intelligence you need to act. Our REACT Team extends your resources and handles everything from urgent threat investigations to cyber due diligence assessments.

Our analysts map threat actor activity, verify what is exposed, and deliver a confidential report with clear next steps. The AfD analysis above is one example: we tracked the actor’s forum post and archive, profiled the actor, and assessed the likely motive.

Our research reaches beyond client work. For our Russia-Ukraine cyber threat report, our REACT team recorded 1,651 incidents against Ukrainian entities and 575 against Russian entities between January 2025 and January 2026, and The Independent cited CybelAngel in its coverage of the Air Alert hack described above.

FAQs

Conclusion

Cybercrime investigations solve cases, and in 2026 they also changed how defenders work. Infostealer logs, exposed tokens, and attacker toolkits became evidence, and evidence became intelligence. For CISOs that means a clearer view of what attackers do and a shorter path to acting on it.

CybelAngel gives you that visibility before criminals make their next move. Explore our Special Threat Investigation services to learn more.