Loading story…
A 45-year-old Romanian national, Catalin Dragomir, pleaded guilty in U.S. court to hacking computers at Oregon’s Department/Office of Emergency Management in June 2021 and then selling the access for about $3,000 in Bitcoin. Prosecutors said Dragomir operated as an initial access broker, using online monikers including “inthematrixl” to advertise and negotiate sales of administrative credentials on cybercriminal platforms; he repeatedly accessed the victim network to prove the access was valid and provided screenshots and login details.
Dragomir also admitted to hacking 10 other U.S. companies, with total losses cited at at least $250,000. He was arrested in Romania in November 2024, extradited to the U.S. in 2025, and pleaded guilty to obtaining information from a protected computer and aggravated identity theft; sentencing is expected in May, and he faces up to seven years in prison. The case highlights a relatively uncommon prosecution outcome for a municipal/government network intrusion tied to the sale of stolen credentials and access.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities scheduled Dragomir's sentencing for May 26, 2026. He faces up to seven years in prison.
Dragomir pleaded guilty to obtaining information from a protected computer and aggravated identity theft for the 2021 Oregon intrusion and sale of access. The plea also acknowledged his role in compromising other U.S. victim networks.
After his arrest in Romania, Dragomir was extradited to the U.S. to face charges related to hacking Oregon's emergency management department and selling the stolen access. Multiple reports place the extradition in January 2025.
Dragomir was arrested in Romania in connection with the Oregon breach and other intrusions into U.S. victims' networks. Prosecutors alleged his activity affected 10 other U.S. companies and caused at least $250,000 in losses.
After obtaining access, Dragomir advertised the Oregon state network access on cybercriminal platforms under the moniker "inthematrixl" and negotiated its sale for $3,000 in Bitcoin. During the sale, he shared samples of personally identifying information from the compromised system with a prospective buyer.
Catalin Dragomir gained unauthorized administrative access to Oregon's emergency management network in June 2021. Prosecutors said he repeatedly re-entered the system to prove the access remained valid and extracted personal information from it.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romanian national **Catalin Dragomir**, who used the alias **`inthematrixl`**, was sentenced to **56 months in prison** after pleading guilty to hacking Oregon’s Office of Emergency Management and selling administrative access to the state government network on a cybercriminal forum. U.S. prosecutors said Dragomir repeatedly breached the Oregon network, stole an employee’s personal data — including name, email address, date of birth, and Social Security number — and used that access for criminal resale. The case followed Dragomir’s arrest in Romania in November 2024, extradition to the United States, and guilty plea to **aggravated identity theft** and **obtaining information from a protected computer**. Authorities said he was also tied to intrusions affecting **10 other U.S. organizations**, with combined losses of at least **$250,000**, underscoring how stolen government and enterprise credentials continue to be monetized through underground access markets.
Jun 29, 2026
A Jordanian national, **Feras Khalil Ahmad Albashiti** (aliases including **“r1z,” “Feras/Firas Bashiti”**), pleaded guilty in U.S. federal court to **fraud and related activity in connection with access devices** for acting as an **initial access broker** who sold unauthorized access to victim networks. Prosecutors said Albashiti used the **Russian-language cybercrime forum XSS** (XSS.is / XSS.pro) and, in May 2023, sold an undercover law enforcement officer unauthorized access to the networks of **at least 50 companies** in exchange for cryptocurrency; the charge carries a maximum penalty of **10 years in prison** and significant fines, with sentencing scheduled for **May 2026**. Court reporting adds that Albashiti’s dealings with an undercover FBI agent included selling a **cracked penetration-testing tool**, then offering access to dozens of companies via **two firewall exploitation methods** for about **$5,000**, and later marketing an **“EDR killer”** capability; the FBI paid **$15,000** for a version of malware described in filings as “novel” and effective at disabling multiple EDR products. Investigators attributed an IP address linked to Albashiti to activity associated with a **June 2023 ransomware attack** against a U.S. manufacturing firm that reportedly caused roughly **$50 million** in damage, and they tied the “r1z” account to Albashiti via an email address also used in a prior U.S. visa application; he was residing in **Tbilisi, Georgia**, and was **extradited to the U.S. in July 2024** before reaching a plea deal.
Jun 29, 2026
Romanian national **Gavril Sandu**, 53, has been extradited to the United States and appeared in federal court in Charlotte, North Carolina, over allegations that he participated in a cyber-enabled bank fraud scheme that ran from 2009 to 2010. U.S. prosecutors say the operation compromised small businesses’ **VoIP** systems and used spoofed, trusted-looking caller IDs to place vishing calls while impersonating banks, tricking victims into disclosing debit card numbers and PINs. Authorities allege the stolen credentials were used to access victim accounts, encode data onto counterfeit magnetic-stripe cards, and withdraw cash from ATMs through money mule activity, with proceeds shared among co-conspirators. Sandu was indicted in 2017, arrested in Romania in January 2026, extradited on 30 April, and now faces charges of **bank fraud** and **conspiracy** that carry a maximum sentence of **30 years in prison** if convicted.
Jun 29, 2026