Loading story…
U.S. authorities charged Kim Anh Vo, a 20-year-old from Hephzibah, Georgia, with conspiring to provide material support to the Islamic State through her alleged role in the United Cyber Caliphate (UCC), an ISIS-linked hacking and propaganda network. Federal prosecutors said Vo used multiple online aliases, translated and edited extremist messages, recruited members, and helped coordinate cyber activity for the group and its affiliated Kalachnikv E-Security Team. Court filings said she also recruited a 14-year-old in Norway into the organization’s media and hacking efforts.
Investigators linked the UCC to the publication of online kill lists that exposed personal information for thousands of Americans, including U.S. military personnel and State Department employees, and urged supporters to carry out lone-wolf attacks. The case cites a 2016 release of data for 3,602 people in the New York City area and a 2017 list containing more than 8,000 names, allegedly stolen from a U.S. company’s website. Prosecutors also said Vo praised the Westminster Bridge attack as a model for inspiring violence, later contacted the FBI in 2017 and provided information about her past activities, and now faces up to 20 years in prison if convicted.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
U.S. authorities arrested Vo in Georgia, and she appeared in federal court in Augusta pending prosecution in the Southern District of New York, where she faced up to 20 years in prison if convicted.
A federal indictment was unsealed charging Kim Anh Vo with conspiring to provide material support to ISIS through her alleged role in the United Cyber Caliphate, including propaganda, recruitment, and hacking-related support.
Prosecutors allege the United Cyber Caliphate disseminated a 2017 kill list containing data on more than 8,000 people, including U.S. military personnel and State Department employees, stolen from a U.S. company's website.
According to the criminal complaint, the Islamic State-linked United Cyber Caliphate released personal data for 3,602 people in the New York City area and urged supporters to target those named.
The indictment says Vo contacted the FBI in July 2017 and voluntarily provided information about her earlier involvement with ISIS-linked online activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcewashingtonpost.com
Open sourceaugustachronicle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities have indicted Ukrainian national Victoria Eduardovna Dubranova for her alleged involvement in cyberattacks targeting critical infrastructure worldwide, including water systems, food supply chains, election systems, and nuclear facilities. Dubranova, also known as Vika, Tory, and SovaSonya, is accused of supporting two Russian state-backed hacktivist groups: NoName057(16) and CyberArmyofRussia_Reborn (CARR). She was extradited to the United States and has pleaded not guilty to charges in two separate cases, with trials scheduled for 2026. The Justice Department asserts that these attacks were not financially motivated but were designed to disrupt essential services and cause widespread damage. CARR has claimed responsibility for hacking drinking water systems in multiple U.S. states, resulting in major spills and system failures, as well as attacking a Los Angeles meat processing facility, which led to an ammonia leak and food spoilage. NoName057(16) is known for deploying its custom DDoS tool, DDoSia, to knock government and critical infrastructure websites offline, recruiting global volunteers and offering cryptocurrency rewards. Both groups are believed to have direct ties to Russian state entities, with CARR reportedly founded and directed by the Russian GRU and NoName057(16) partially administered by a Kremlin-established IT organization. The indictments highlight the increasing use of state-backed hacktivist groups to target Western critical infrastructure.
Jun 29, 2026
U.S. authorities moved against **Global Hell**, a hacking group tied to intrusions, website defacements, and service disruptions affecting government, academic, telecom, and private-sector systems. Federal prosecutors charged Chad Davis, known as `Mindphasr`, with breaking into a protected U.S. Army computer at the Pentagon, altering the Army homepage, and modifying files on an unclassified Army network to evade detection. Investigators and court records linked the group to attacks on the White House, FBI, Interior Department, Senate, Virginia state systems, and other sites, while one retaliatory campaign reportedly included a denial-of-service attack that temporarily knocked the FBI website offline. The crackdown widened as investigators pursued suspects across multiple cities and connected other members to additional crimes. Patrick Gregory, known as `MostHateD`, agreed to plead guilty to conspiracy involving telecommunications fraud and computer trespass, with prosecutors alleging Global Hell caused **$1.5 million to $2.5 million** in losses across roughly 115 websites and used stolen conference-calling codes to support its operations. Separately, authorities linked a 16-year-old associate of the group to the theft of thousands of Pacific Bell Internet account passwords, forcing resets for **63,000 subscribers** and exposing how the crew’s activity extended beyond headline-grabbing defacements into credential theft and broader network compromise.
Jun 29, 2026
An Illinois man, **Kyle Svara**, pleaded guilty in federal court to charges tied to a campaign targeting roughly **570–600 women** whose *Snapchat* accounts were accessed to steal nude or semi-nude images. Reporting indicates Svara used **social engineering**—impersonating Snapchat/Snap representatives and soliciting **security access codes** via text—to harvest credentials at scale (including outreach to thousands of targets), then unlawfully accessed at least **59 accounts** to download private photos that he **kept, sold, or traded** online. He also advertised paid account-compromise “services” on online platforms and directed prospective clients to contact him via the encrypted messaging app **Kik**. Court reporting also links Svara’s activity to **Steve Waithe**, a former Northeastern University track and field coach who hired Svara to compromise accounts of students and athletes; Waithe was previously convicted and sentenced to prison for related cyber-enabled abuse. Svara additionally targeted victims in **Plainfield, Illinois**, and at **Colby College** in Maine, and he faces charges including **aggravated identity theft, wire fraud, computer fraud, and false statements** tied to a child pornography-related investigation; U.S. authorities have encouraged potential victims to come forward. Separately, an unrelated case in New York described the arrest of an alleged **764** affiliate on **CSAM** charges, reflecting broader law-enforcement activity against that violent extremist network but not connected to the Snapchat hacking case.
Jun 29, 2026