Loading story…
Romanian national Thomasz Szabo, 27, was sentenced in U.S. District Court to 48 months in prison for leading an online swatting and bomb-threat ring that targeted more than 75 public officials, multiple journalists, and four religious institutions. U.S. prosecutors said Szabo founded and ran an online community beginning in late 2020 that carried out false emergency reports and explosive threats, including a mass-shooting threat against New York City synagogues and a threat involving the U.S. Capitol and then-President-elect Joe Biden. He pleaded guilty in June 2025 to conspiracy and threats involving explosives after being extradited from Romania in November 2024.
Authorities said the campaign escalated into a concentrated swatting spree from Dec. 24, 2023, through early January 2024, hitting at least 25 members of Congress, six senior executive branch officials, 13 senior federal law enforcement officials, federal judges, 27 state officials, and other targets. The Justice Department said the operation drained law enforcement resources, wasted taxpayer funds, and created serious risks for civilians and responding officers. The investigation involved the U.S. Secret Service, FBI, U.S. Capitol Police, Justice Department international offices, and Romanian authorities, while alleged Serbian accomplice Nemanja Radovanovic faces separate proceedings.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced that Szabo was sentenced in U.S. District Court to 48 months in prison and three years of supervised release for conspiracy and threats involving explosives.
Szabo was extradited from Romania in November 2024 to face U.S. charges related to the swatting and bomb-threat ring.
A Serbian accomplice, Nemanja Radovanovic, was separately charged in connection with the swatting campaign in August 2024.
In January 2021, Szabo was tied to a threat involving explosives at the U.S. Capitol and a threat against President-elect Joe Biden.
In December 2020, authorities tied Szabo to a false report of a mass-shooting threat against New York City synagogues as part of the swatting and bomb-threat campaign.
According to court documents, Thomasz Szabo founded and led an online community that began carrying out bomb threats and swatting incidents targeting U.S. public officials, religious institutions, and journalists in late 2020.
On June 2, 2025, Szabo pleaded guilty to conspiracy and threats involving explosives in the U.S. case against him.
Prosecutors said Szabo's followers launched a concentrated swatting spree on December 24, 2023, targeting members of Congress, executive branch officials, federal law enforcement leaders, judges, state officials, religious institutions, and journalists.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Romanian national **Gavril Sandu**, 53, has been extradited to the United States and appeared in federal court in Charlotte, North Carolina, over allegations that he participated in a cyber-enabled bank fraud scheme that ran from 2009 to 2010. U.S. prosecutors say the operation compromised small businesses’ **VoIP** systems and used spoofed, trusted-looking caller IDs to place vishing calls while impersonating banks, tricking victims into disclosing debit card numbers and PINs. Authorities allege the stolen credentials were used to access victim accounts, encode data onto counterfeit magnetic-stripe cards, and withdraw cash from ATMs through money mule activity, with proceeds shared among co-conspirators. Sandu was indicted in 2017, arrested in Romania in January 2026, extradited on 30 April, and now faces charges of **bank fraud** and **conspiracy** that carry a maximum sentence of **30 years in prison** if convicted.
Jun 29, 2026
Multiple law-enforcement actions were reported across Europe and the U.S. targeting **cyber-enabled criminal activity**, including online intimidation, financial malware operations, and crypto/NFT theft. In Hungary, police working with Romanian authorities detained four young suspects accused of **swatting** and **doxing** tied to disputes initiated via *Discord*, including false bomb and violence threats that triggered significant emergency response deployments. Separately, U.S. authorities convicted two Venezuelan nationals for a multi-state **ATM jackpotting** operation in which they physically accessed older ATMs, connected a laptop, and deployed **malware** to force cash dispensing, resulting in hundreds of thousands of dollars in losses and restitution orders. In Romania, two suspects were investigated at the request of UK authorities over an alleged **hitman-for-hire** marketplace designed to conceal identities and payments via **cryptocurrency escrow**, with police seizing storage devices, crypto valued around **$650,000**, and significant cash. In the Netherlands, Zeeland police arrested four suspects linked to the theft of **169 NFTs** valued at roughly **€1.4 million**, seizing data carriers, cash, vehicles, and a house during raids as the investigation continued.
Jun 29, 2026
Callum Dare, a 26-year-old man from Talbot Green, Wales, was sentenced to two years and three months in prison after admitting he encouraged and assisted swatting attacks linked to the dark-web doxing platform **Doxbin**. Investigators said Dare used Doxbin’s `#deadnet` channel to egg on attackers, help identify targets, and circulate edited montage videos showing armed police and emergency responses to hoax incidents in the United Kingdom, United States, and Canada. Authorities tied him to incidents including a nail-bomb hoax in Cardiff and a bomb threat involving a University of California lecture theatre, even though he did not personally place the false emergency calls. The case began after the FBI passed intelligence to South Wales Police and the Tarian Regional Organised Crime Unit, which identified Dare through digital evidence, chat logs, and a PayPal account. Dare pleaded guilty to encouraging or assisting malicious communications and to possessing articles for use in fraud after police found a phishing kit known as **"The Man in the Onion"** on his devices, although investigators said there was no evidence it had been deployed in a real-world attack. The prosecution highlights that people who facilitate or promote swatting online can face criminal penalties even without making the hoax reports themselves.
Jul 15, 2026