Google disrupts major residential proxy network.

Summary

By the CyberWire staff

Google disrupts major residential proxy network.

Google and its industry partners have disrupted a major residential proxy network that was used by a wide range of criminal and nation-state threat actors. The network, called "IPIDEA," allowed threat actors to route malicious activity through IP addresses owned by legitimate ISPs and used for small businesses and residential customers.

Google took legal action to seize domains used by the network, and has shared intelligence on IPIDEA software development kits with platform providers, law enforcement, and researchers. The company stated, "We believe our actions have caused significant degradation of IPIDEA’s proxy network and business operations, reducing the available pool of devices for the proxy operators by millions. Because proxy operators share pools of devices using reseller agreements, we believe these actions may have downstream impact across affiliated entities."

Experience the Power of Community at RSAC 2026 Conference

RSAC™ 2026 Conference returns to San Francisco March 23–26, bringing together the global cybersecurity community for four days of expert insights, hands-on learning, and breakthrough innovation. Join thousands of practitioners, executives, and innovators as they tackle today’s toughest challenges and explore solutions shaping tomorrow. From cutting-edge ideas to immersive programs and vibrant networking, this is where meaningful progress happens. Register today and be part of the conversations driving cybersecurity forward.

RAMP cybercrime forum may have been shuttered by law enforcement.

The Russia-based RAMP cybercrime forum has had its websites replaced with a splash page claiming the forum has been seized by the FBI, the Record reports. The splash page states, "This action has been taken in coordination with the United States Attorney’s Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice."

The US Justice Department hasn't made a public announcement about the action, and it's worth taking the shutdown with a grain of salt until the seizure is confirmed. Cybercriminal operations sometimes claim to have been shut down by law enforcement as a cover for restructuring or scamming their customers. The Record notes that in 2024 the AlphV/BlackCat group falsely claimed to have been shuttered by the FBI as part of an exit scam to defraud its affiliates.

North Korea's LABYRINTH CHOLLIMA splinters into three separate groups.

CrowdStrike says the North Korean threat actor LABYRINTH CHOLLIMA has split into three distinct adversaries, with two groups tracked as "GOLDEN CHOLLIMA" and "PRESSURE CHOLLIMA" operating separately from the core LABYRINTH group. The two splinter groups are targeting cryptocurrency entities, while LABYRINTH CHOLLIMA continues to conduct espionage against industrial, logistics, and defense companies.

CrowdStrike notes, "Despite operating independently, these three adversaries share tools and infrastructure, indicating centralized coordination and resource allocation within the DPRK cyber ecosystem."

Notes.

Today's issue includes events affecting the Democratic People's Republic of Korea, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Initial access hackers switch to Tsundere Bot for ransomware attacks (BleepingComputer) A prolific initial access broker tracked as TA584 has been observed using the Tsundere Bot alongside XWorm remote access trojan to gain network access that could lead to ransomware attacks.

CVE-2025-40551: SolarWinds WHD RCE (Horizon3.ai) Horizon3.ai discovered multiple vulnerabilities in SolarWinds Web Help Desk that enable unauthenticated remote code execution.

Security Patches, Mitigations, and Software Updates

SolarWinds Patches Critical Web Help Desk Vulnerabilities (SecurityWeek) The four critical flaws could be exploited without authentication for remote code execution or authentication bypass.

Trends

Shadow AI Threat Grows Inside Enterprises as BlackFog Research Finds 60% of Employees Would Take Risks to Meet Deadlines (BusinessWire) Productivity pressure is pushing senior leaders to bypass AI safeguards, increasing exposure to data leakage.

Technologies, Techniques, and Standards

Signal president warns AI agents are making encryption irrelevant (CyberInsider) Signal president Meredith Whittaker said AI agents embedded within operating systems are eroding the practical security guarantees of E2EE.

Litigation, Investigation, and Law Enforcement

China Executes 11 People Linked to Cyberscam Centers in Myanmar (Bloomberg) China has executed 11 people linked to scam centers in Myanmar, including “core members” involved in the operation, according to state media.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Wicked6 Cyber Games (Virtual, Mar 27 - 29, 2026) The premier global event spotlighting WOMEN in Cyber and Tech through exciting, team-based cyber competitions, mentorship, and community engagement. Our virtual, global "Hack and Chat" inspires and empowers women in cybersecurity from over 40 countries across six continents and there's lots of excitement building behind this year's theme. Your investment will enable women from across the globe to meet, learn from each other, play cyber games together and compete in a quality Attack and Defend competition.

Events

SpaceCom | Space Congress: The Global Conference & Expo for the Commercial Space Industry (Orlando, Florida, USA, Jan 28 - 30, 2026) SpaceCom | Space Congress is where the business of space gets done. As the flagship event of Commercial Space Week—co-located with the Space Mobility Conference and the GSA Spaceport Summit—this event unites aerospace, defense, and commercial leaders for three days of deal-making, partnership building, and technology discovery on the expo floor, in the conference program, and through curated networking that drives real results.

HIP Europe 26 (Frankfurt, Germany, Feb 10, 2026) Get ready to elevate your identity security skills at HIP Europe — your gateway to becoming a Hybrid Identity Protection (HIP) Hero. With the departure of original Active Directory experts and the rise of identity as the primary attack surface, the need for identity threat detection and response (ITDR) talent has never been greater. This event is the perfect opportunity to enhance your (or your team's) ITDR strategy and strengthen your organization's operational resilience.

Wild West Hackin’ Fest @ Mile High 2026 (Denver, Colorado, USA, Feb 11 - 13, 2026) More than just a conference, Wild West Hackin’ Fest (WWHF) is committed to offering high quality information security education to beginners and seasoned professionals alike. With reasonably priced training, conferences, hands-on labs, and workshops, WWHF lowers the barrier to entry for those seeking to enter into the world of information security. WWHF also offers a venue for those already established in the industry to share ideas, give back, and continue learning.

AI SOC Summit (Tysons, Virginia, USA, Mar 3, 2026) For Security Teams who use AI and defend AI deployments: There is a lot of AI hype for Sec Ops. Come hang out as early adopters of AI dive into the good, the bad and the ugly . No vendor pitches, no AI theory. If you are trying out AI products for Sec Ops or building them in house, this is the place for you.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.29.26

Top stories.

Google disrupts major residential proxy network.

RAMP cybercrime forum may have been shuttered by law enforcement.

North Korea's LABYRINTH CHOLLIMA splinters into three separate groups.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Trends

Technologies, Techniques, and Standards

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events