Loading story…
Ukrainian authorities detained three suspects in Lviv accused of stealing more than 610,000 Roblox accounts and reselling them for cryptocurrency through Russian websites and closed online communities. Investigators said the group targeted Ukrainian and foreign players, focusing on accounts with valuable digital items, rare equipment, and large Robux balances, including at least 357 high-value elite accounts. Police estimate the operation generated roughly 10 million hryvnias—about $225,000 to $227,000.
According to investigators, a 19-year-old Ukrainian organized the scheme, built an account-compromise system, and recruited accomplices through gaming forums. The group allegedly spread information-stealing malware disguised as game-enhancement tools or free in-game bonus software, harvesting credentials and other sensitive data from victims’ devices between October 2025 and January 2026. During 10 searches in western Ukraine, police seized digital devices, bank cards, notes, cash, and other evidence; the suspects were placed in pretrial detention and could face up to 15 years in prison as forensic work continues to identify additional victims and accomplices.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Police publicly said the suspects face Ukrainian charges related to theft and unauthorized interference with IT systems, with penalties of up to 15 years in prison if convicted. Investigators also said the case remains open to identify additional victims and accomplices.
Ukrainian law enforcement conducted 10 searches in the Lviv and western Ukraine area, detaining three suspects and seizing digital devices, bank cards, notes, cash, and other evidence. The suspects were placed in pretrial detention as authorities continued forensic analysis.
According to investigators, the group's Roblox account hijacking activity ran until January 2026. By that point, at least 357 of the stolen accounts were identified as high-value elite accounts.
Between October 2025 and January 2026, the suspects allegedly sorted stolen accounts by value, rarity, and Robux balance and resold them for cryptocurrency via a Russian website and closed online communities. Authorities estimate the scheme compromised more than 610,000 accounts and generated about 10 million hryvnias, roughly $225,000-$227,000.
Ukrainian investigators said a group led by a 19-year-old began operating in October 2025, using information-stealing malware disguised as game-enhancer or bonus software to compromise Roblox accounts. The operation targeted Ukrainian and foreign players, especially accounts with valuable items or Robux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourceghacks.net
Open sourcehelpnetsecurity.com
Open sourcedarkwebinformer.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcegp.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian cyberpolice, working with U.S. law enforcement, identified an 18-year-old suspect from Odesa as a key operator in an international cybercrime scheme that targeted customers of a California-based online retailer. Investigators said the operation used **info-stealing malware** to harvest browser session data and account credentials, leading to the compromise of roughly 28,000 to 30,000 customer accounts during 2024 and 2025. Authorities said at least 5,800 of the stolen accounts were used to place unauthorized orders worth about **$721,000**, causing more than **$250,000** in losses including chargebacks. The stolen data was allegedly processed and sold through online platforms, specialized resources, and Telegram channels or bots, while the suspect is believed to have managed infrastructure used to process and monetize the data. Ukrainian investigators searched two residences linked to the suspect and seized phones, computers, bank cards, storage media, server logs, account credentials, and cryptocurrency exchange information; officials have not named the retailer, the malware family, or any hacker group, and no arrest was announced.
Jun 29, 2026
Ukrainian authorities dismantled **94 fraudulent call centers** in a nationwide operation involving the National Police of Ukraine, the Cyber Police Department, the Security Service of Ukraine, the Prosecutor General’s Office, and German law enforcement. Investigators carried out **more than 400 searches**—reported as **411 raids**—and formally identified **26 suspects** tied to schemes that targeted victims through fake banking, investment, and law-enforcement impersonation scams. According to investigators, operators persuaded victims to hand over money, disclose banking access, or install remote-access software, while some operations also marketed bogus medical products. Police seized large quantities of computer equipment, phones, SIM cards, bank cards, cash, vehicles, gold, and tools used to access cryptocurrency wallets, and authorities are now conducting forensic analysis to identify victims, calculate losses, and build cases against organizers, money mules, and laundering networks.
Aug 16, 2026
Multiple law-enforcement actions were reported across Europe and the U.S. targeting **cyber-enabled criminal activity**, including online intimidation, financial malware operations, and crypto/NFT theft. In Hungary, police working with Romanian authorities detained four young suspects accused of **swatting** and **doxing** tied to disputes initiated via *Discord*, including false bomb and violence threats that triggered significant emergency response deployments. Separately, U.S. authorities convicted two Venezuelan nationals for a multi-state **ATM jackpotting** operation in which they physically accessed older ATMs, connected a laptop, and deployed **malware** to force cash dispensing, resulting in hundreds of thousands of dollars in losses and restitution orders. In Romania, two suspects were investigated at the request of UK authorities over an alleged **hitman-for-hire** marketplace designed to conceal identities and payments via **cryptocurrency escrow**, with police seizing storage devices, crypto valued around **$650,000**, and significant cash. In the Netherlands, Zeeland police arrested four suspects linked to the theft of **169 NFTs** valued at roughly **€1.4 million**, seizing data carriers, cash, vehicles, and a house during raids as the investigation continued.
Jun 29, 2026