VulnHub

Real-time Cybersecurity News

Critical

$250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets

Help Net Security
Actively Exploited

Overview

Marlon Ferro, a 20-year-old from California, was sentenced to over six years in prison for his involvement in a massive cryptocurrency theft that totaled more than $250 million. This criminal network operated from late 2023 to early 2025, with members located across multiple states and even internationally. Ferro's role included hacking databases and making fraudulent phone calls to execute the theft. The stolen funds were reportedly used to finance a lavish lifestyle, including luxury fashion, nightclub parties, and private jets. This case highlights the ongoing risks associated with cryptocurrency theft and the lengths to which criminals will go for financial gain.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Cryptocurrency assets
  • Timeline: Ongoing since late 2023

Original Article Summary

20-year-old California resident Marlon Ferro, known online as “GothFerrari,” was sentenced to 78 months in prison for his role in a cryptocurrency theft operation tied to more than $250 million in stolen digital assets. Federal prosecutors said Ferro participated in a criminal network active between late 2023 and early 2025. Members of the group, based in California, Connecticut, New York, Florida, and overseas, carried out roles that included database hacking, target identification, fraudulent phone calls, … More → The post $250 million cryptocurrency heist funded luxury fashion, nightclub parties, and private jets appeared first on Help Net Security.

Impact

Cryptocurrency assets

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since late 2023

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

The Hacker News

In June 2026, a new malware framework named GoCaracal was identified during an intrusion at a communications organization in Venezuela. Linked to the Dark Caracal group, this Go-based malware allows attackers to gain remote shell access and execute malicious payloads. It also has capabilities for stealing browser data, logging keystrokes, and controlling remote desktops. The use of Ethereum smart contracts to dynamically fetch replacement command-and-control (C2) addresses makes it particularly sophisticated and harder to track. This incident is concerning as it highlights the evolving tactics of cybercriminals and the potential risks to sensitive information within the communications sector.

Aug 27, 2026

CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday

BleepingComputer

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that U.S. government agencies must address a serious remote code execution vulnerability affecting Citrix NetScaler appliances by this Saturday. This flaw is currently being exploited by attackers, which raises urgent concerns for the security of government networks. Citrix NetScaler is widely used for application delivery and load balancing, making it critical for agencies to implement the patch to prevent unauthorized access and potential data breaches. The deadline emphasizes the need for swift action to mitigate risks, as failure to patch could lead to significant security incidents. Agencies are strongly advised to prioritize this update to protect their systems and sensitive information.

Aug 27, 2026

ATF confirms “major incident” after recent Qilin breach claims

BleepingComputer

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has confirmed that one of its systems was compromised following claims from the Qilin ransomware group. This breach raises significant concerns as the ATF is responsible for enforcing federal laws related to firearms and explosives in the U.S. The agency has not disclosed specific details about what information may have been accessed or how the breach occurred. The incident is particularly troubling given the sensitive nature of the data the ATF handles. With ongoing threats from ransomware groups, this incident underscores the need for robust cybersecurity measures within federal agencies to protect critical information.

Aug 27, 2026

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating that they are being actively exploited. Among these, a significant high-severity flaw affects Citrix NetScaler ADC and NetScaler Gateway, allowing for remote code execution. This vulnerability, identified as CVE-2019-1068, poses a serious risk to organizations using these products, as attackers can potentially gain full control of affected systems. Other vulnerabilities listed impact Linux and SQL Server products, underscoring a wide array of systems at risk. Organizations using these technologies should prioritize applying patches and implementing security measures to mitigate these threats.

Aug 27, 2026

Ring adopts new TAKE encryption standard for smart home devices

SCM feed for Latest

Ring has adopted a new encryption standard called TAKE for its smart home devices. This standard uses a rotating set of encryption keys that are temporarily stored in the cloud, allowing Ring to secure active user features. The implementation of TAKE is designed to enhance the security of user data and improve the overall safety of smart home devices. While this development aims to bolster encryption practices, it raises questions about the security of cloud-stored keys and how they are managed. Users of Ring devices should stay informed about these changes to understand how their data is protected and what potential vulnerabilities may exist in the cloud storage approach.

Aug 26, 2026

Nimbus Manticore expands infrastructure and malware arsenal

SCM feed for Latest

Nimbus Manticore, linked to the Tortoiseshell hacking group, has expanded its capabilities by deploying a new SSH-based tunneling tool and a C++ backdoor that resembles its existing malware known as TWOSTROKE. This development indicates a shift in tactics, allowing attackers to establish more secure communications with compromised systems. The increase in their malware arsenal raises concerns for organizations that may be targeted, as it suggests a growing sophistication in their operations. Companies need to be vigilant and enhance their defenses against potential intrusions, especially those using SSH protocols. The implications of this escalation could lead to more successful breaches and data exfiltration if not addressed promptly.

Aug 26, 2026