Loading story…
Romanian national Catalin Dragomir, who used the alias inthematrixl, was sentenced to 56 months in prison after pleading guilty to hacking Oregon’s Office of Emergency Management and selling administrative access to the state government network on a cybercriminal forum. U.S. prosecutors said Dragomir repeatedly breached the Oregon network, stole an employee’s personal data — including name, email address, date of birth, and Social Security number — and used that access for criminal resale.
The case followed Dragomir’s arrest in Romania in November 2024, extradition to the United States, and guilty plea to aggravated identity theft and obtaining information from a protected computer. Authorities said he was also tied to intrusions affecting 10 other U.S. organizations, with combined losses of at least $250,000, underscoring how stolen government and enterprise credentials continue to be monetized through underground access markets.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
After his November 2024 arrest in Romania, Catalin Dragomir was extradited to the United States in January 2025 to face charges tied to intrusions affecting an Oregon state government office and other U.S. victims.
Dragomir was sentenced to 56 months in prison for hacking Oregon government systems and additional U.S. organizations, with authorities linking him to 10 other American company intrusions and at least $250,000 in losses. The Record reported the sentencing on May 27, 2026 as a new development.
Catalin Dragomir was arrested in Romania in connection with hacking Oregon government systems and other U.S. organizations. The later sentencing report states this arrest occurred in November 2024 before his extradition to the United States.
Catalin Dragomir pleaded guilty to aggravated identity theft and obtaining information from a protected computer for intrusions involving Oregon’s Office of Emergency Management and other U.S. victims. DOJ announced the plea on February 20, 2026.
A Ukrainian national pleaded guilty to conspiracy related to using Nefilim ransomware to attack companies in the United States and other countries. The plea was announced by DOJ on December 19, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcestatescoop.com
Open sourcejustice.gov
Open sourcetherecord.media
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A 45-year-old Romanian national, **Catalin Dragomir**, pleaded guilty in U.S. court to hacking computers at Oregon’s Department/Office of Emergency Management in June 2021 and then selling the access for about **$3,000 in Bitcoin**. Prosecutors said Dragomir operated as an **initial access broker**, using online monikers including **“inthematrixl”** to advertise and negotiate sales of administrative credentials on cybercriminal platforms; he repeatedly accessed the victim network to prove the access was valid and provided screenshots and login details. Dragomir also admitted to hacking **10 other U.S. companies**, with total losses cited at **at least $250,000**. He was arrested in Romania in **November 2024**, extradited to the U.S. in 2025, and pleaded guilty to **obtaining information from a protected computer** and **aggravated identity theft**; sentencing is expected in **May**, and he faces **up to seven years** in prison. The case highlights a relatively uncommon prosecution outcome for a municipal/government network intrusion tied to the sale of stolen credentials and access.
Jun 29, 2026
Romanian national **Gavril Sandu**, 53, has been extradited to the United States and appeared in federal court in Charlotte, North Carolina, over allegations that he participated in a cyber-enabled bank fraud scheme that ran from 2009 to 2010. U.S. prosecutors say the operation compromised small businesses’ **VoIP** systems and used spoofed, trusted-looking caller IDs to place vishing calls while impersonating banks, tricking victims into disclosing debit card numbers and PINs. Authorities allege the stolen credentials were used to access victim accounts, encode data onto counterfeit magnetic-stripe cards, and withdraw cash from ATMs through money mule activity, with proceeds shared among co-conspirators. Sandu was indicted in 2017, arrested in Romania in January 2026, extradited on 30 April, and now faces charges of **bank fraud** and **conspiracy** that carry a maximum sentence of **30 years in prison** if convicted.
Jun 29, 2026
A Jordanian national, **Feras Khalil Ahmad Albashiti** (aliases including **“r1z,” “Feras/Firas Bashiti”**), pleaded guilty in U.S. federal court to **fraud and related activity in connection with access devices** for acting as an **initial access broker** who sold unauthorized access to victim networks. Prosecutors said Albashiti used the **Russian-language cybercrime forum XSS** (XSS.is / XSS.pro) and, in May 2023, sold an undercover law enforcement officer unauthorized access to the networks of **at least 50 companies** in exchange for cryptocurrency; the charge carries a maximum penalty of **10 years in prison** and significant fines, with sentencing scheduled for **May 2026**. Court reporting adds that Albashiti’s dealings with an undercover FBI agent included selling a **cracked penetration-testing tool**, then offering access to dozens of companies via **two firewall exploitation methods** for about **$5,000**, and later marketing an **“EDR killer”** capability; the FBI paid **$15,000** for a version of malware described in filings as “novel” and effective at disabling multiple EDR products. Investigators attributed an IP address linked to Albashiti to activity associated with a **June 2023 ransomware attack** against a U.S. manufacturing firm that reportedly caused roughly **$50 million** in damage, and they tied the “r1z” account to Albashiti via an email address also used in a prior U.S. visa application; he was residing in **Tbilisi, Georgia**, and was **extradited to the U.S. in July 2024** before reaching a plea deal.
Jun 29, 2026