Year: 2023
Court filings and enforcement actions initiated or unsealed during calendar year 2023.
Key Facts
- 17 major cases opened or unsealed in 2023.
- Cumulative losses identified for 2023 matters exceed $6.7 billion.
- Documented from federal indictments and official government disclosures.
Documented Matters for 2023
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
U.S. v. Anatoly Legkodymov (Bitzlato Cryptocurrency Laundering)
Founder of Hong Kong-registered cryptocurrency exchange Bitzlato charged with laundering over $700 million in ransomware and darknet market illicit proceeds, serving as a primary financial conduit for Hydra Market.
Operation Cookie Monster (Genesis Market Takedown)
Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.
U.S. v. Minh Quoc Nguyen (ChipMixer Cryptocurrency Mixer)
Operator of ChipMixer, one of the dark web's largest unlicensed cryptocurrency mixing services, charged with laundering more than $3 billion in Bitcoin associated with ransomware, North Korean state hackers, and darknet drug markets.
U.S. v. Denis Gennadievich Kulkov (Try2Check Card Checking Service)
Creator of Try2Check, the preeminent criminal card-checking platform that processed tens of millions of card verification requests annually for cybercriminals buying stolen credit cards.
MGM Resorts Cyberattack (Scattered Spider / ALPHV Vishing Ingress)
Sophisticated social engineering and ransomware attack carried out by cybercrime collective Scattered Spider partnering with ALPHV/BlackCat, utilizing a 10-minute phone call to the Okta IT helpdesk to bypass MFA, hijack administrative privileges, and paralyze hotel reservations, digital keys, and casino slot machines.
MOVEit Transfer Mass Zero-Day Extortion Campaign
Mass cyber extortion campaign exploiting a zero-day SQL injection vulnerability (CVE-2023-34362) in Progress Software MOVEit Transfer appliances, exfiltrating personal records of over 90 million individuals across 2,700 organizations without encrypting files.
Boeing Commercial Airplanes Parts Supply Extortion
LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.
Caesars Entertainment Scattered Spider Extortion ($15M Ransom)
Sophisticated vishing and social engineering intrusion by the Scattered Spider syndicate targeting an outsourced IT helpdesk servicing Caesars Entertainment, culminating in loyalty database exfiltration and approximately $15 million in cryptocurrency extortion paid to avert public release, disclosed in SEC Form 8-K Item 1.05.
Hewlett Packard Enterprise M365 Email Breach (Midnight Blizzard)
State-sponsored cyber espionage campaign conducted by Russian Foreign Intelligence Service (SVR) unit Midnight Blizzard (APT29) infiltrating Hewlett Packard Enterprise cloud-hosted Microsoft Office 365 environment, accessing executive leadership and cybersecurity correspondence, disclosed under SEC Form 8-K filings.
First American Financial Title Insurance Cybersecurity Incident
Severe computer intrusion forcing First American Financial Corporation to shut down core title insurance, real estate transaction banking, and closing systems nationwide, causing nationwide mortgage settlement delays, disclosed under SEC Form 8-K Item 1.05.
3CX DesktopApp Cascading Supply Chain Attack (Lazarus Group)
North Korean state-sponsored threat group Lazarus compromised VoIP communications software provider 3CX, injecting malware into digitally signed Windows and macOS builds of 3CXDesktopApp downloaded by over 600,000 corporate customers, in the first documented case of one software supply chain compromise directly enabling a second downstream supply chain breach.
SEC v. SolarWinds Corp. & CISO Timothy G. Brown (Securities Fraud)
Landmark civil enforcement action brought by the SEC charging SolarWinds and its Chief Information Security Officer with securities fraud and internal accounting control failures, alleging company statements to investors overstated cyber defenses while internal executive communications conceded critical password and perimeter vulnerabilities.
U.S. v. Roman Storm & Alexey Pertsev (Tornado Cash $1B Heist)
Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.
Operation Dawnbreaker (Hive Ransomware Syndicate Takedown)
Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.
Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)
Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.