Loading story…
The U.S. Department of Justice said it seized 39 domains and associated servers linked to a Pakistan-based cybercrime marketplace network allegedly operated by Saim Raza, also known as HeartSender. Prosecutors said the sites sold phishing kits, scam pages, email extractors, and other fraud-enabling tools to transnational organized crime groups, with the tooling used largely in business email compromise and credential-theft schemes that caused more than $3 million in victim losses. The takedown was carried out with the Dutch National Police as part of an international disruption effort targeting infrastructure that had allegedly supported criminal activity since at least 2020.
Prior threat intelligence had linked the same ecosystem to the Manipulaters Team, a Pakistani group accused of marketing spam and malware tooling under the Saim Raza persona and advertising products as FUD to suggest evasion of antivirus and anti-spam defenses. Researchers identified recurring infrastructure patterns across the network, including domains using nameservers from blazingfast.io and cloudflare.com, registrations through Internet Domain Service BS Corp., hosting on Netsolutions and Cloudflare, and naming conventions featuring terms such as fud, tool, page, sender, and spam. Authorities also said the marketplaces offered training materials, including YouTube tutorials, lowering the barrier for less technically skilled fraud actors.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The U.S. Attorney's Office for the Southern District of Texas announced the seizure action, saying the marketplaces supplied phishing and business-email-compromise tooling used against U.S. victims and linked to more than $3 million in losses.
On January 29, 2025, U.S. authorities, coordinated with the Dutch National Police, seized 39 domains and associated servers tied to a Pakistan-based cybercrime marketplace network allegedly operated by Saim Raza.
Silent Push published analysis linking the Manipulaters Team, believed to operate behind the Saim Raza persona, to phishing- and spam-tool sales infrastructure and released a list of attributed domains and indicators.
According to a DOJ affidavit, Saim Raza's cybercrime marketplace network had been used since at least 2020 to sell phishing kits, scam pages, email extractors, and related fraud-enabling tools to criminal groups.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 73 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcesilentpush.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. and international law enforcement agencies expanded **Operation PowerOFF** by seizing additional domains tied to DDoS-for-hire, or **booter/stressor**, services used to launch distributed denial-of-service attacks on demand. The U.S. Department of Justice said the FBI took control of 13 more domains linked to prolific platforms, including services that had resurfaced after an earlier disruption of 48 booter sites. Investigators found the platforms had amassed **hundreds of thousands of registered users** and had been used against school districts, government websites, businesses, and other targets; FBI testing on government-controlled systems showed some attacks were strong enough to completely cut off internet connectivity. The takedowns build on years of coordinated enforcement that has included the seizure of 15 booter websites, action against users of major DDoS-for-hire platforms, and prosecutions of operators tied to services such as **RoyalStresser.com**, **SecurityTeam.io**, **Astrostress.com**, and **Booter.sx**. Europol says the long-running campaign targets services that sell attacks for as little as **EUR 10**, lowering the barrier for low-skilled offenders and sometimes supporting broader criminal activity, including ransomware operations. The effort has involved the FBI, Europol, the U.K. National Crime Agency, Dutch police, and other global partners, alongside prevention campaigns aimed at deterring would-be users.
Jun 29, 2026
The U.S. Department of Justice announced the seizure of the domain `web3adspanels[.]org`, which was used as a backend control panel for a sophisticated bank account takeover fraud operation targeting Americans. The criminal group behind the scheme purchased fraudulent advertisements on major search engines such as Google and Bing, which closely mimicked legitimate banking ads. Unsuspecting users who clicked these ads were redirected to counterfeit bank websites, where their login credentials were harvested using malicious code. The attackers then used these credentials to access real bank accounts and steal funds, resulting in at least $14.6 million in confirmed losses and $28 million in attempted thefts from 19 identified victims, including two companies in Georgia. The seized domain stored thousands of stolen credentials and supported the fraud operation as recently as November 2025. The FBI’s Internet Crime Complaint Center (IC3) has received over 5,100 complaints related to similar bank account takeover schemes since January 2025, with reported losses exceeding $262 million. The takedown of the domain is part of a broader law enforcement effort to disrupt the infrastructure enabling these attacks and prevent further exploitation of stolen credentials.
Jun 29, 2026
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026