Loading story…
Finnish authorities have issued a wanted notice for convicted hacker Aleksanteri Kivimäki after the Supreme Court declined to hear his appeal, making his conviction in the Vastaamo cybercrime case final. Police said Kivimäki should be arrested and transferred to Vantaa Prison if found, while his lawyer said he is believed to be outside Finland after having been released while the case was under appeal.
Kivimäki was sentenced by the Court of Appeal to nearly seven years in prison for the 2018 intrusion into psychotherapy provider Vastaamo and the subsequent extortion of both the company and its patients. The breach exposed highly sensitive therapy records belonging to about 33,000 patients, and more than 24,000 people reportedly received extortion demands, making the case one of Finland’s largest criminal matters by number of victims, including children and trauma patients.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Finnish authorities issued a wanted notice for convicted hacker Aleksanteri Kivimäki after his conviction became final. Police said he should be arrested and transferred to Vantaa Prison if found, and his lawyer said he is believed to be outside Finland.
Finland's Supreme Court declined to hear Kivimäki's appeal, making his conviction in the Vastaamo cybercrime case final.
In February, Finland's Court of Appeal sentenced Aleksanteri Kivimäki to nearly seven years in prison for the Vastaamo hack and the subsequent extortion of both the company and its patients.
Aleksanteri Kivimäki was convicted for hacking Finnish psychotherapy provider Vastaamo in 2018, leading to the exposure of highly sensitive therapy records affecting about 33,000 patients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Finland’s National Cyber Security Centre reported that February saw a continued surge in **fraud and social engineering**, including bank- and authority-impersonation scam calls, robocalls, high-quality phishing, and investment/crypto scams. The agency also noted that **Microsoft 365 (M365) account compromises increased further**, warning that stolen user accounts can enable follow-on abuse such as invoice fraud, CEO fraud (BEC), and large-scale secondary phishing sent from trusted, compromised mailboxes; it also cited multiple critical vulnerabilities in widely used software/services during the month, though impacts in Finland were described as limited. Separately, Finland’s Security and Intelligence Service (**SUPO**) assessed that **Russia and China** continue extensive **cyber-espionage and influence operations** targeting Finland’s technology sector, research institutions, and government, describing cyber-espionage as the country’s most significant digital threat with no expectation of abatement. SUPO said foreign intelligence activity combines cyber intrusions with traditional espionage and political influence to collect sensitive information and shape decision-making, and pointed to prior high-profile incidents (e.g., the Vastaamo psychotherapy data breach and related extortion cases) as illustrative of the broader risk environment.
Jun 29, 2026
U.S. prosecutors indicted Swiss national Till Kottmann, also known as **"deletescape"** and **"tillie crimew,"** on charges including conspiracy, wire fraud, and aggravated identity theft for allegedly hacking dozens of companies and government entities, stealing confidential data and credentials, and publishing material from more than 100 victims online. The indictment says the activity began in 2019 and included intrusions into source code repositories and other systems at major organizations including **Microsoft, Intel, Nintendo, Nissan, Daimler, Disney**, a Washington state agency, and a U.S. government contractor; the FBI also seized the **`git.rip`** domain that investigators said was used to leak stolen data. The case also linked Kottmann to the high-profile **Verkada** intrusion, in which exposed super-admin credentials were allegedly used to access more than **150,000 surveillance cameras** at prisons, hospitals, warehouses, schools, and Tesla facilities. U.S. authorities, working with Swiss counterparts, said search warrants were executed in Lucerne and devices were seized, while media reports noted Kottmann had described the attacks as anti-capitalist hacktivism and "easy" acts of anarchism; prosecutors instead characterized the campaign as criminal theft, fraud, and identity abuse affecting both private companies and public-sector targets.
Jun 29, 2026
A U.S. federal court sentenced Russian national **Aleksei Volkov**, 26, to **81 months in prison** for acting as an initial access broker who helped major cybercrime groups, including the **Yanluowang** ransomware operation, compromise U.S. companies and other organizations. Prosecutors said Volkov gained unauthorized access to victim networks and sold that access to ransomware operators, who then deployed malware, encrypted systems, stole data, and extorted victims through cryptocurrency ransom demands. The U.S. Department of Justice said the campaign caused more than **$9 million in actual losses** and more than **$24 million in intended losses**. Volkov was indicted in Indiana and Pennsylvania, arrested in Rome, extradited from Italy to the United States, and later pleaded guilty after the cases were consolidated. As part of the plea, he admitted hacking victim networks, stealing data, helping co-conspirators deploy ransomware, and sharing in ransom proceeds; he was also ordered to pay at least **$9,167,198.19** in restitution and forfeit equipment used in the crimes.
Jun 29, 2026