Ukrainian police have disrupted 94 fraudulent call centers during a nationwide operation that involved more than 400 searches and the seizure of thousands of computers, phones, and SIM cards. Ukrainian police raid at a fraudulent call center (Source: Cyberpolice Ukraine) The call centers were linked to schemes involving callers impersonating bank employees, fraudulent investment services, cryptocu

Ukrainian law enforcement agencies have dismantled 94 fraudulent call centers across the country in a large-scale operation that involved over 400 searches and resulted in the seizure of approximately $2 million in various currencies and assets. The raids targeted operations engaged in a range of scams, including impersonating bank employees, offering fake investment opportunities, and promoting fraudulent cryptocurrency platforms.
The coordinated effort, led by Ukraine's National Police in conjunction with the Security Service of Ukraine and the Office of the Prosecutor General, also uncovered schemes involving the sale of ineffective dietary supplements and attempts to gain remote access to victims' devices. Investigators noted that some groups collected personal data on potential victims, which was then shared or sold to other criminal enterprises.
During the searches, authorities seized 3,336 pieces of computer equipment, 1,346 mobile phones, and over 5,200 SIM cards. Financial assets confiscated included roughly $2 million in US dollars, 64,000 euros, an unspecified amount of Ukrainian hryvnia, a kilogram of bank gold bars, and various pieces of jewelry. Additionally, 90 bank cards, access to 20 cryptocurrency wallets, and 22 vehicles were seized.
The call centers were described as fully equipped offices with administrators, operators, and other participants. They utilized pre-written conversation scripts, databases of potential victims, specialized software, and tools designed to conceal and withdraw illicit funds.
Operators employed several tactics to defraud victims. Some posed as bank representatives, alerting individuals to suspicious transactions or account issues to trick them into revealing card details, verification codes, or transferring money. Others acted as investment brokers, directing victims to fraudulent investment and cryptocurrency platforms, promising high returns or even assistance in recovering funds previously lost to scams. In the dietary supplement scheme, products were marketed as treatments for various illnesses despite lacking any therapeutic properties.
The investigation revealed that some of these networks targeted individuals outside Ukraine. For instance, Ukrainian police are collaborating with German authorities on a case involving a group that defrauded EU citizens through fake brokerage platforms, subsequently moving stolen funds through cryptocurrency exchanges before routing them to accounts controlled by the perpetrators.
In total, authorities checked 867 addresses during the operation. Twenty-six individuals have been notified that they are suspected of criminal offenses, which are being investigated under provisions of Ukraine’s Criminal Code related to fraud and the laundering of criminally obtained property. These offenses carry potential prison sentences of up to 12 years and confiscation of property.
Law enforcement is currently analyzing the seized materials, tracing financial transactions, and working to identify additional participants and individuals involved in the movement of the illicit proceeds. The operation also identified 67 other financial instruments believed to be involved in the schemes, including 40 bank accounts or cards, 12 cryptocurrency wallets, and 15 suspected money mules.
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is publishing early
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews. Arctic Wolf researchers observed

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," JetBrains said.