European and North American authorities have shut down First VPN Service, a criminal anonymization service used by 25 ransomware groups for cyberattacks and data theft; Operation Saffron resulted in the takedown of 33 servers and identified 506 users.

Ghostwriter has conducted phishing campaigns against Ukrainian authorities since spring 2026, using malware components OYSTERFRESH, OYSTERBLUES, and OYSTERSHUCK to deploy Cobalt Strike, while Russia leverages AI tools for target reconnaissance and pro-Kremlin groups hijack Bluesky accounts.

Depending on how intensively users operate the messenger, it can take days before a deleted message is actually removed.