Law Enforcement Disruption Rolling Intelligence Card

Secret Service Operation Heat Check Skimming-Device Disruption — The Secret Service announced that Operation Heat Check removed 13 illegal skimming devices during a Miami-area outreach and inspection operation targeting payment-card skimming and EBT fraud. The official release says law-enforcement personnel visited 378 businesses, conducted 2,842 inspections of point-of-sale terminals, gas pumps, and ATMs, removed 13 illegal skimming devices, distributed educational materials, and estimated $13.5 million in potential fraud losses prevented. Why it matters: Local fraud-infrastructure disruption and prevention row; do not treat as a cybercrime ecosystem takedown, arrest, indictment, sanctions action, full skimming-network dismantlement, victim remediation, credential/payment-card containment guarantee, or proof that all successor skimming activity stopped.[29]Evidence dated Aug 2026

Mabna Institute Cyber-Theft Superseding Indictment — DOJ announced a superseding indictment charging 17 alleged Mabna Institute members with conducting a long-running cyber-theft campaign on behalf of the IRGC and other Iranian government, university, and private clients. The official release ties the alleged campaign to more than 100,000 targeted professor accounts, about 8,000 compromised professor email accounts, 31.5 terabytes of stolen academic data and intellectual property, private-sector and government email-account compromises, sale of stolen academic resources through Megapaper.ir and Gigapaper.ir, and a State Department Rewards for Justice offer for information on selected defendants. Why it matters: Superseding-indictment and legal/operator-pressure row only; do not treat as a takedown, infrastructure seizure, sanctions designation, arrest, victim remediation, credential containment, disruption of Megapaper or Gigapaper availability, or proof that all Mabna Institute-linked hacking-for-hire activity stopped.[30]Evidence dated Aug 2026

Cloud Storage / SaaS Customer Extortion Guilty Plea — DOJ announced that Connor Riley Moucka pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy after an international investigation, arrest, and July 2025 extradition from Canada. The official release ties the conspiracy to stolen login credentials, compromise of cloud-hosted data belonging to at least 165 customers of a U.S.-based SaaS company, billions of sensitive customer records, terabytes of stolen data, extortion, re-extortion, cybercrime forum and Telegram data-sale activity, more than $2.5 million in ransom payments, and Operation Riptide. Why it matters: Guilty-plea and legal/operator-pressure row; do not treat as a full takedown, infrastructure seizure, victim remediation, SaaS-provider compromise finding, sentencing outcome, eradication of data-sale channels, or proof that all co-conspirators, stolen records, credentials, or successor extortion workflows were neutralized.[24]Evidence dated Aug 2026

Ransom Cartel Creator Sentencing and Prior Arrest Disruption — DOJ announced that Belarusian national Maksim Silnikau, described as creator and administrator of the Ransom Cartel ransomware strain, was sentenced to 16 years in prison after extradition and prosecution. The official release ties Silnikau to a Ransom Cartel hidden website used to monitor and control ransomware attacks, communicate with victims and co-conspirators, and manage fund distribution; DOJ said Ransom Cartel conspirators attacked at least 18 companies from 2021 to 2023 and that the operation's growth was disrupted by Silnikau's July 2023 arrest. Why it matters: Sentencing, legal/operator-pressure, and prior arrest-disruption row; do not treat as a fresh 2026 infrastructure seizure, full ransomware-operation takedown, decryptor release, victim remediation, recovery distribution, conviction of all co-conspirators, or proof that all Ransom Cartel tooling, stolen data, credentials, affiliates, or successor workflows were neutralized.[25]Evidence dated Aug 2026

Outsider Enterprise PhaaS / Smishing Infrastructure Disruption — Google announced a civil lawsuit to dismantle Outsider Enterprise infrastructure and coordination with the FBI on law-enforcement action; specialist cyber reporting documented FBI-linked seizure and rerouting activity under Operation Ghost Hook / Operation Riptide. The public source set ties Outsider Enterprise to phishing kits, Telegram coordination, 9,000 fake websites, more than 1 million fraudulent URLs, 2.5 million Android-targeting messages over a two-week May 2026 window, and reported seizure or redirection of administrative, storefront, wallet, bot, and phishing-domain infrastructure. Why it matters: PhaaS/smishing infrastructure disruption and civil/legal pressure row; do not treat as proof that every phishing customer, stolen credential, payment-card exposure, SMS route, AI-enabled scam workflow, or successor kit was identified, remediated, or permanently disrupted.[26]Evidence dated Jun 2026

Secret Service WFO Cryptocurrency Scam Seizures and Civil Forfeiture — The Secret Service announced that Washington Field Office investigations resulted in more than $25 million in seized cryptocurrency and five civil forfeiture complaints filed on July 21, 2026. The official release ties the action to more than 270 suspected fraudulent transactions in one complaint, more than 200 romance-scam victims in another, frozen cryptocurrency addresses, hundreds of intermediary addresses, and launderers predominantly located in Southeast Asia with IP addresses in China, Malaysia, and Cambodia. Why it matters: Financial seizure/freezing and civil-forfeiture row; do not treat as a full scam-network takedown, arrest, conviction, victim reimbursement guarantee, complete laundering-route dismantlement, or proof that all fake investment platforms, recovery scams, or successor wallet clusters were remediated.[27]Evidence dated Jul 2026

Europol The Com Referral Action Days Online Ecosystem Disruption — Europol announced a multi-week Referral Action Days effort in June and July 2026 that referred 4,340 URLs tied to The Com for platform review and removal. The action targeted online content across social media, messaging, and gaming platforms that Europol associated with recruitment, grooming, self-harm encouragement, child sexual abuse material, violent-attack content, extortion, doxing, and swatting-related material. Why it matters: Online ecosystem disruption and referral/removal row only; do not treat as a full cybercrime infrastructure takedown, ransomware action, actor eradication, platform-wide remediation, or proof that all The Com-linked subgroups, victims, accounts, or successor channels were identified or removed.[6]Evidence dated Jul 2026

BKA / ZIT Kratos Phishing-as-a-Service Infrastructure Dismantlement — BKA and ZIT announced that German and U.S. authorities dismantled Kratos central infrastructure and that Indonesian authorities arrested the alleged developer and technical administrator. The official release said more than 200 Kratos infrastructure servers were made inoperable, the platform had more than 1,800 alleged criminal franchisees, and it supported approximately 15,000 phishing campaigns per month using Microsoft-themed credential-theft pages. Why it matters: PhaaS infrastructure dismantlement and administrator-arrest row; do not treat as proof that every Kratos customer, stolen credential, downstream account takeover, or successor phishing kit was identified, remediated, or permanently disrupted.[7]Evidence dated Jul 2026

Scattered Spider TfL Sentencing and Activity-Degradation Assessment — NCA announced sentencing for two people it identified as leading Scattered Spider members and said the earlier arrests materially degraded the group's ability to continue cybercriminal operations. Legal/operator pressure tied to the August-September 2024 TfL network intrusion, UK Computer Misuse Act convictions, arrests in September 2025, and NCA/Microsoft activity-degradation assessment. Why it matters: Sentencing and activity-degradation row only; do not treat as a full actor takedown, infrastructure seizure, decryptor release, or proof that all actors using the Scattered Spider brand or tradecraft stopped.[8]Evidence dated Jul 2026

NCA / Nigeria / Meta Scam Centre Arrests — NCA reported six suspected scammers arrested in Nigeria after NCA, Nigerian Police Force, and Meta cooperation located suspects allegedly operating an online scam centre. Authorities reported seizure of 11 mobile phones, a laptop, a tablet, and a vehicle allegedly used during celebrity-impersonation fraud activity from an Asaba, Delta State compound. Why it matters: Scam-centre arrest and device-seizure row only; do not treat as full fraud-network dismantlement, victim remediation, platform-wide scam removal, or proof that related laundering routes were eliminated.[9]Evidence dated Jul 2026