An unnamed US county – perhaps in Ohio – paid $1M extortion demand to cybercriminals

theregister.com Jul 10, 2026

An unnamed US county – perhaps in Ohio – paid $1M extortion demand to cybercriminals

Curated by Shubham · TechCapsules · Jul 10, 2026

AI-summarised brief · reviewed before publication

An unnamed U.S. county, believed to be in Ohio, paid a $1 million ransom to the Kairos extortion gang after the group claimed to have exfiltrated more than 2 terabytes of government data. The payment, traced on a blockchain, was documented in a leaked negotiation transcript shared by threat‑intel researcher Rakesh Krishnan on the Ransom‑ISAC platform. County officials initially offered $100,000, citing limited resources, before agreeing to the full demand following weeks of back‑and‑forth. Kairos provided no verifiable proof that the stolen files were destroyed, leaving the data vulnerable to resale on dark‑web markets and exposing the county to potential future extortion. The case underscores the tension between federal guidance discouraging ransom payments and local agencies’ assessment of immediate risk for public safety.

💡 Why It Matters

· The incident shows how limited‑budget local governments may choose to pay ransoms, granting cyber‑criminals a profitable foothold and encouraging further attacks on similar entities.

Capsules Cybersecurity

Read full article on theregister.com

Florida ransomware negotiator convicted for helping ransomware gang extort US companies

Florida resident Angelo Martino was sentenced to more than five years in federal prison for conspiring with hackers to deploy the BlackCat ransomware while employed as a negotiator for a U.S. cybersecurity firm. The Department of Justice said investigators seized over $10 million in cryptocurrency and assets, including a food truck and a luxury fishing boat, that Martino purchased with stolen proceeds. Martino joins two former security professionals, Kevin Martin and Ryan Goldberg, already convicted for the same scheme. Prosecutors allege the trio coordinated BlackCat attacks on U.S. companies throughout 2023, extracting roughly $1.2 million in one case and dividing the loot equally after laundering. The case underscores a rare instance of insiders leveraging legitimate negotiation roles to facilitate ransomware extortion operations.

💡 By turning a trusted negotiator into a conduit for ransomware, the case reveals how insider access can amplify cyber‑crime profits, prompting firms to reassess the vetting and oversight of their own security teams.

bitcoinworld.co.in · Jul 10

Kim Jong Un Orders Major Expansion of North Korea’s Cyber Warfare Capabilities

North Korean leader Kim Jong Un has ordered a significant expansion of the Reconnaissance General Bureau (RGB), the agency responsible for the regime’s global cyber warfare and intelligence operations. This directive aims to strengthen activities against South Korea and other international targets, marking an escalation in non-kinetic warfare strategies. The RGB, identified by the U.S. as the primary force behind major hacking campaigns, has previously executed large-scale cryptocurrency thefts, ransomware distribution, and cyber espionage. These illicit operations generate billions of dollars, which fund Pyongyang’s weapons programs. The expansion occurs amid heightened tensions on the Korean Peninsula and increased international sanctions. Experts warn that enhanced capabilities pose direct threats to global financial institutions, cryptocurrency exchanges, and government networks. Previous RGB-linked attacks include the 2014 Sony Pictures hack and the 2017 WannaCry ransomware outbreak. With improved sophistication, North Korea may increasingly target critical infrastructure, supply chains, and emerging technologies like artificial intelligence, necessitating robust international cybersecurity countermeasures.

💡 The regime is pivoting from traditional military posturing to digital predation, turning cybercrime into a primary revenue stream for its nuclear ambitions. This strategic shift forces global financial systems to defend against a state-sponsored adversary that views hacking not just as espionage, but as essential economic survival.

techtimes.com · Jul 10

Meta Absorbs AI Security’s Top Red Team as Autonomous Ransomware Arrives

Dawn Song, a renowned UC Berkeley computer security professor and MacArthur Fellow, joined Meta Superintelligence Labs as Vice President of AI Research on June 25. She brought three of Virtue AI’s four co-founders and key team members with her. Virtue AI, founded in 2024, specialized in continuous automated red-teaming for production AI agents. Its platform addressed probabilistic agent failures through real-time screening and adversarial testing. Major clients included Anthropic, NVIDIA, Uber, and Microsoft. The acquisition coincided with Sysdig’s July 1 publication of proof that an autonomous AI agent could execute a full ransomware operation without human intervention. This timing highlights the urgency of securing AI systems as threats evolve. Meta now integrates top-tier security expertise directly into its open-source AI deployment strategy. The move positions Meta to address emerging risks like JADEPUFFER, which demonstrated fully autonomous malicious capabilities. This consolidation of talent and technology aims to mitigate structural vulnerabilities in enterprise AI applications.

💡 The simultaneous emergence of autonomous ransomware and the absorption of its primary defense team into Meta creates a critical conflict of interest for competitors like Anthropic. Enterprises must now navigate a landscape where the leading security tools for their AI agents are owned by a direct rival in the foundational model market.

openpr.com · Jul 10

Investigation Management Software Market Analysis: Leading Vendors & Future Projections with IBM…

The HTF Market Intelligence report on the global Investigation Management Software market, spanning over 140 pages, outlines a projected compound annual growth rate of 11.6% between 2026 and 2033. Growth is driven by heightened cybercrime, financial fraud, stricter regulatory oversight, and modernization efforts in law‑enforcement and corporate compliance. Vendors—including IBM, NICE, Oracle, Microsoft, and ServiceNow—are prioritizing AI‑enhanced analytics, workflow automation, and cloud‑based deployments to improve case handling, evidence collection, and risk management across sectors such as government, BFSI, healthcare, and corporate enterprises. The study details market segmentation by deployment type (cloud, on‑premise, hybrid), AI‑powered platforms, and application area, and highlights emerging innovations, digital transformation trends, and competitive dynamics shaping the industry through 2033.

💡 AI‑driven, cloud‑native investigation tools are becoming essential infrastructure for organizations battling sophisticated cyber threats and regulatory pressure.

politico.eu · Jul 10

Europe’s conservatives revive zombie bill on child abuse scanning

The European Parliament voted Thursday in Strasbourg to forward a bill that would grant technology firms the legal authority to scan content for child sexual abuse material and submit the findings to EU member states for approval. The measure revives legislation that was rejected in March, after the centre‑right European People’s Party urged a restart of negotiations. The proposal has drawn comments from figures ranging from German Chancellor Friedrich Merz to X owner Elon Musk. Child‑rights organisations argue the law is essential to protect minors, while privacy advocates warn it could expand surveillance. Lawmakers also added an amendment exempting end‑to‑end encrypted services such as WhatsApp and Signal from the scanning requirement, leaving both sides dissatisfied in the ongoing debate today.

💡 Exempting encrypted messaging apps creates a loophole that could let illegal content slip past detection, undermining the bill’s core protective aim.

windowslatest.com · Jul 10

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings…

Microsoft’s Global Device Identifier (GDID) enabled law enforcement to track Peter Stokes, an alleged Scattered Spider hacker, across VPNs and three countries. Finnish police arrested Stokes in April 2026 based on an Interpol Red Notice, leading to a US federal complaint unsealed in July. Prosecutors allege Stokes breached a luxury jewelry retailer in May 2025, demanding an $8 million ransom. The GDID, a persistent device-level identifier assigned during Windows installation or Microsoft account sign-in, uniquely identifies the operating system installation. It survives updates but not clean reinstalls. Independent researchers reverse-engineered the system, revealing the ID originates from a server-assigned Device PUID stored in the Windows registry. Background services like Connected Devices Platform and Delivery Optimization transmit this identifier to Microsoft’s servers. While primarily used for licensing and cloud features, the GDID links online activities to a single device identity. This mechanism allowed the FBI to bypass anonymity tools, tracing Stokes’ Windows PC despite his use of proxy servers. The case highlights the forensic utility of Microsoft’s internal tracking infrastructure for international criminal investigations.

💡 The GDID functions as an unremovable digital fingerprint that persists even when users employ sophisticated anonymity tools like VPNs. This reveals a critical vulnerability in digital privacy assumptions, proving that standard consumer operating systems can facilitate cross-border law enforcement tracking without user consent or explicit forensic cooperation.