Polish authorities arrested four individuals for conducting SIM-swapping attacks, where they breached telecom partners and hijacked email accounts to gain control of victims' phone numbers and intercept communications, ultimately stealing millions in cryptocurrency from exchange accounts. The operation was a collaboration between Poland's Cybercrime Bureau and U.S. agencies, and the suspects face charges including hacking and money laundering. This incident highlights the ongoing threat of SIM-swapping as a vector for account takeover and financial theft.
Threat Intelligence 4 arrested in Poland for SIM-swapping and cryptocurrency theft June 26, 2026 Share By SC Staff As detailed in Bleeping Computer, Polish authorities have arrested four individuals suspected of being part of an organized cybercrime group responsible for SIM-swapping attacks and significant cryptocurrency theft. The operation, a collaboration between Poland's Cybercrime Bureau (CBZC) and U.S. agencies including the FBI and Homeland Security Investigations, targeted a group accused of breaching telecommunications partners and hijacking email accounts. These actions allowed the suspects to gain control of victims' phone numbers, intercept communications, and ultimately access cryptocurrency exchange accounts. Investigators estimate that millions of U.S. dollars were stolen and laundered through a complex financial network. The arrested individuals face charges including participation in an organized criminal group, hacking, and money laundering, with potential penalties of up to 25 years in prison. One of the identified suspects, according to blockchain investigator ZachXBT, is Wojtek Kulisz, also known as "Merry." Source: Bleeping Computer SC Staff Related Threat Intelligence Chinese APT CL-STA-1062 targets Southeast Asia with new TinyRCT backdoor SC Staff June 26, 2026 CL-STA-1062 employs a hybrid toolkit, combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a newly discovered custom backdoor named TinyRCT. Threat Intelligence Turla group deploys new STOCKSTAY backdoor against Ukraine and Italy SC Staff June 26, 2026 STOCKSTAY, written in .NET and utilizing the Windows Forms framework, communicates with its command-and-control (C2) server via a secure WebSocket connection. Threat Intelligence Russian hackers suspected in Jaguar Land Rover cyberattack SC Staff June 26, 2026 The cyberattack on Jaguar Land Rover (JLR), a major UK employer, caused production to halt for months, resulting in an estimated $2.5 billion loss to the British economy and necessitating a £1.5 billion government bailout. Related Events Cybercast Better Threat Intelligence Between Public and Private Sectors On-Demand Event Virtual Conference Nationwide Cybersecurity Summit 2025: Safeguarding America’s Digital Future On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Account Harvesting Backdoor Deauthentication Attack Denial of Service Dictionary Attack Disruption Distributed Scans Hybrid Attack Password Cracking Reconnaissance You can skip this ad in 5 seconds