Loading story…
Italian nonprofit privacy and hosting collective Autistici/Inventati (A/I) announced it will cease operations and dissolve after the U.S. State Department designated it an extremist or terrorist organization and added it to the Specially Designated Nationals and Blocked Persons List. U.S. authorities alleged that A/I provided encrypted communications, anonymous hosting, and other digital services to far-left militant groups in the United States and Europe, while not accusing the collective itself of organizing the cited violence.
The sanctions designation immediately disrupted A/I's infrastructure: Public Interest Registry suspended its .org domain, Banca Etica suspended its account, and autistici.org became inaccessible. A/I said the potential legal and financial consequences for users, members, collaborators, and relatives made continued operation untenable. The shutdown threatens email, websites, mailing lists, blogs, and the Noblogs platform used by its activist-oriented community; the collective plans to provide users with instructions for recovering and backing up data but has not announced a final closure date.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Autistici/Inventati announced that it would end its services and dissolve, saying sanctions-related legal and financial risks to members, relatives, collaborators, and associated parties made its mission untenable. It said users would receive instructions to retrieve and back up hosted data, websites, messages, and other content before closure.
Banca Etica suspended the collective's Italian bank account because of sanctions risk. The bank said it strongly condemned the use of OFAC listings for political purposes.
Public Interest Registry, the U.S.-based .org registry operator, suspended Autistici/Inventati's domain, rendering autistici.org inoperative amid the sanctions-related action.
The U.S. State Department labeled Autistici/Inventati an extremist group, alleging it operated communications, hosting, anonymity, and other infrastructure for far-left militant groups. The department warned that parties financially engaging with the collective could face sanctions exposure, while not accusing A/I itself of organizing the cited violent acts.
Autistici/Inventati, a volunteer-run privacy-focused technology collective, was founded in Italy and began providing non-commercial online services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Homeland Security has reportedly used **administrative subpoenas** to pressure tech companies to disclose identifying data about anonymous accounts and individuals critical of the Trump administration, including accounts sharing information about local **ICE immigration raids**. The reporting highlights that administrative subpoenas—unlike judicial subpoenas—do not require a judge’s approval and can seek metadata and account-identifying details (e.g., login times, devices, and associated email addresses), raising concerns about oversight and potential chilling effects on speech. Separately, the anti-ICE alert service **StopICE** reported its app and website were attacked, with users receiving texts claiming their information had been “compromised and sent to the authorities,” alongside disparaging messages about the developer. StopICE administrators and the developer disputed claims that sensitive personal data (names, addresses, GPS/location histories) was stolen, stating the service does not collect/store that information, while also noting the platform faces heavy hostile activity including frequent **DDoS** attempts; the service blamed a **US Customs and Border Protection (CBP)** agent for the attack, though that attribution was not independently confirmed in the reporting.
Jun 29, 2026
**Joker’s Stash**, one of the largest dark web marketplaces for stolen payment card data, announced it would permanently close after allowing users roughly 30 days to withdraw balances and complete partner payouts. The operator said the market would remain online until **February 15, 2021**, then wipe servers and backups. The shutdown followed months of instability, including a reported decline in newly posted card records, customer complaints about poor card validity, and claims by the administrator that illness from COVID-19 had disrupted operations. The closure also came after suspected law enforcement pressure, including reports that blockchain-linked domains briefly displayed **FBI** and **INTERPOL** seizure notices and allegations that proxy servers tied to the marketplace had been seized by the **U.S. Department of Justice** and INTERPOL. Researchers said the broader underground payment-card economy was unlikely to collapse, with displaced vendors and buyers expected to migrate to rival carding markets such as **Brian’s Club**, **Vclub**, **Yale Lodge**, and **UniCC**, which moved quickly to attract former Joker’s Stash users through promotions and other incentives.
Aug 15, 2026
Anonymous Sudan, also tracked as **Storm-1359**, claimed distributed denial-of-service attacks that disrupted parts of **The Associated Press**, **Cloudflare’s website**, and **Archive of Our Own (AO3)**. AP said **APNews.com** and some links suffered technical issues while its mobile apps continued to operate, and Cloudflare confirmed intermittent connectivity problems on `www.cloudflare.com` but said its products and customer-facing services were unaffected because they run on separate infrastructure. AO3 experienced intermittent `503 Service Unavailable` errors as volunteer administrators worked to restore access. The group framed the operations as part of a broader campaign against U.S.-registered organizations and, in AO3’s case, paired ideological messaging about LGBTQ+ and NSFW content with a **$30,000 bitcoin ransom** threat to prolong the outage. The incidents fit a wider pattern of high-profile DDoS activity attributed to Anonymous Sudan against targets including Microsoft, X, PayPal, Reddit, Tumblr, Kenya’s digital government portal, and ChatGPT, while multiple researchers and vendors have assessed that the group is likely **pro-Russian** and shares similarities with **Killnet**, despite presenting itself as a Sudanese Islamist hacktivist collective.
Jun 29, 2026