Loading story…
Thai authorities, acting on intelligence provided by the FBI, arrested Denis Obrezko, an alleged member of the Russia-linked threat group Void Blizzard, at a hotel in Phuket on November 6. The operation, conducted jointly by the FBI and Thai police, resulted in the seizure of multiple electronic devices, including laptops, mobile phones, and cryptocurrency wallets. Obrezko, who had entered Thailand on October 30, was detained in Bangkok's Criminal Court pending extradition to the United States, with the Russian embassy confirming the arrest and considering consular assistance.
Obrezko is suspected of having previously breached security systems and attacked government agencies in both Europe and the United States. The arrest was made after authorities received information that he was targeting Thailand, and an arrest warrant was obtained based on a U.S. extradition request. The U.S. Department of Justice has not yet commented on the case, while Russian officials have acknowledged the detention and are monitoring the situation.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
After the detention became public, the Russian embassy in Thailand confirmed that a Russian citizen had been arrested at the request of the United States. At the time of reporting, the U.S. Department of Justice had not publicly commented on the case.
In a joint operation involving the FBI and Thai police, Thai authorities detained Obrezko and brought him before Bangkok’s Criminal Court ahead of extradition proceedings to the U.S. Thailand’s Cyber Crime Investigation Bureau said the suspect had previously breached security systems and targeted government agencies in Europe and the United States.
Thai authorities said they found Russian national Denis Obrezko in a hotel room in Thailand on 2025-11-06, about a week after his arrival. During the operation, officers seized multiple electronic devices, including a mobile phone, notebook computer, and a digital wallet.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026
Thai authorities arrested German national Noah Christopher in Bangkok over allegations that he operated the **Fluxstress** and **Neldowner** cybercrime-as-a-service platforms, which investigators say enabled customers worldwide to launch distributed denial-of-service attacks and pay with cryptocurrencies including **Bitcoin**. The arrest followed a years-long investigation involving Thai officials and German authorities, who allege Christopher ran the services from 2021 to 2025 while moving through Dubai, China, and later Thailand to evade capture. Thai officials revoked Christopher's visa under Section 12(7) of the Immigration Act before taking him into custody, and he is now awaiting extradition to Germany, where authorities reportedly seek him on **74 cybercrime warrants** tied to DDoS, ransomware, and hacker-for-hire activity. Investigators in Thailand are examining his computers for possible attacks against local organizations, while security experts warned that **Fluxstress may still remain online and operational** despite the arrest.
Jun 29, 2026
U.S. and Canadian authorities arrested 23-year-old Ottawa resident Jacob Butler, also known as **"Dort,"** and unsealed charges alleging he was a principal administrator of the **Kimwolf** DDoS botnet. Prosecutors said Kimwolf was a variant of the **Aisuru** botnet and part of a broader ecosystem that hijacked millions of internet-connected devices, including more than 2 million Android TV devices and other IoT hardware such as webcams and digital photo frames. Investigators said the botnet enabled hundreds of thousands of attacks, issued more than 25,000 attack commands, and was linked to DDoS activity reaching nearly **30 Tbps**, including attacks affecting Department of Defense network IP ranges. Authorities said Butler was identified through overlapping IP usage, Google account artifacts, machine cookies, Discord and messaging records, transaction data, and other account information. Canadian officials arrested him on a U.S. extradition warrant while also filing domestic computer crime charges, and the Justice Department said law enforcement had already seized infrastructure tied to **Kimwolf**, **Aisuru**, **JackSkid**, and **Mossad** in March. Court records and reporting indicate Kimwolf resumed operations after that takedown, and the case also includes allegations that Butler harassed security researchers and claimed responsibility for swatting attacks against Synthient founder Ben Brundage after the company helped mitigate a flaw that Kimwolf had exploited for rapid spread.
Jun 29, 2026