Loading story…
U.S. prosecutors indicted Swiss national Till Kottmann, also known as "deletescape" and "tillie crimew," on charges including conspiracy, wire fraud, and aggravated identity theft for allegedly hacking dozens of companies and government entities, stealing confidential data and credentials, and publishing material from more than 100 victims online. The indictment says the activity began in 2019 and included intrusions into source code repositories and other systems at major organizations including Microsoft, Intel, Nintendo, Nissan, Daimler, Disney, a Washington state agency, and a U.S. government contractor; the FBI also seized the git.rip domain that investigators said was used to leak stolen data.
The case also linked Kottmann to the high-profile Verkada intrusion, in which exposed super-admin credentials were allegedly used to access more than 150,000 surveillance cameras at prisons, hospitals, warehouses, schools, and Tesla facilities. U.S. authorities, working with Swiss counterparts, said search warrants were executed in Lucerne and devices were seized, while media reports noted Kottmann had described the attacks as anti-capitalist hacktivism and "easy" acts of anarchism; prosecutors instead characterized the campaign as criminal theft, fraud, and identity abuse affecting both private companies and public-sector targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In March 2021, Swiss authorities executed search warrants tied to the U.S. investigation and raided Kottmann’s premises in Lucerne, seizing devices.
The FBI seized a website domain allegedly used by Kottmann’s group to publish hacked data from more than 100 victim entities online. The seized platform was identified in reporting as git.rip.
According to the indictment, Till Kottmann and co-conspirators engaged in computer intrusion, credential theft, and data theft activities beginning in 2019 and targeting dozens of companies and government entities.
On 2021-03-18, a federal grand jury in the Western District of Washington indicted Swiss national Till Kottmann on charges including conspiracy, wire fraud, and aggravated identity theft related to alleged intrusions and data theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourcethehill.com
Open sourcegizmodo.com
Open sourcewashingtonpost.com
Open sourceforbes.com
Open sourcetheverge.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors charged 19-year-old dual U.S.-Estonian citizen Peter Stokes over an alleged **Scattered Spider** intrusion in which attackers socially engineered a luxury retailer’s IT help desk, reset credentials and MFA, accessed privileged accounts, stole data, and attempted to extort the company for **$8 million** in cryptocurrency. Court filings say the May 2025 attack caused roughly **$2 million** in operational losses even though the victim restored access without paying, and investigators say at least **77 GB** of data was exfiltrated during the breach. Authorities said Microsoft telemetry played a central role in identifying Stokes, with a persistent Windows **Global Device Identifier** (`GDID`) tying activity from the intrusion to his device and online accounts. Investigators also linked infrastructure used in the attack, including **ngrok** tunneling and a **Tzulo**-hosted VPN proxy, before correlating the same identifier with accounts on Apple, Snapchat, Facebook, and Ubisoft/Growtopia across locations including Estonia, New York, and Thailand. Stokes was arrested in Finland while attempting to board a flight to Japan, extradited to the United States, and now faces federal charges including conspiracy, computer intrusion, wire fraud, and violations of the **Computer Fraud and Abuse Act**.
Jul 12, 2026
U.K. police arrested seven people aged 16 to 21 over suspected links to **Lapsus$**, the extortion-focused hacking group tied to intrusions at **Microsoft, Nvidia, Samsung, Ubisoft, Okta,** and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through **limited access**, reinforcing the scale and credibility of the campaign. The activity continued to expand as **Globant** disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked **70GB** of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including **social engineering, SIM swapping, MFA fatigue attacks,** and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.
Jun 29, 2026
U.S. prosecutors said **Peter Williams**, a former executive at *Trenchant* (a hacking and surveillance tools unit of U.S. defense contractor **L3Harris**), stole and sold **eight hacking tools/exploits** to a **Russian company** that counts the Russian government among its customers. The Department of Justice said the sales **directly harmed the U.S. intelligence community** and that the tools could have been used to enable **indiscriminate government surveillance**, **cybercrime**, and **ransomware** at global scale, potentially affecting **millions of computers and devices**, including in the United States. Williams, an Australian national, pleaded guilty in October to trade secret theft tied to the sales, which prosecutors said generated **more than $1.3 million in cryptocurrency** between 2022 and 2025. Ahead of his expected Feb. 24 sentencing in Washington, D.C., prosecutors filed a sentencing memorandum seeking **nine years in prison**, **three years of supervised release**, **$35 million in restitution**, and a **$250,000 fine**; the filing also indicates Williams is expected to be **deported to Australia** after serving his sentence, and notes he submitted a letter expressing regret.
Jun 29, 2026