The Good, the Bad and the Ugly in Cybersecurity - Week 29
SentinelOne, Friday, July 17th, 2026
SentinelOne's weekly roundup covers Russian cybercrime sanctions, trojanized remote access tools, and 300 fake GitHub repos spreading infostealers.
SentinelOne's weekly roundup opens with international action against Russian cybercrime: the EU and UK sanctioned GRU and FSB-linked entities, the US Treasury sanctioned a VPN provider and ransomware facilitators, and prosecutors indicted three Russians whose bulletproof hosting was tied to roughly $62 million in ransomware damages.
Researchers also found a Russian actor distributing trojanized WebEx and Zoom installers to deploy the Starland remote access trojan, which steals credentials and cryptocurrency and uses blockchain smart contracts and Telegram bots for command-and-control.
Nearly 300 fabricated GitHub repositories spread the BoryptGrab infostealer by impersonating security products and developer tools, harvesting passwords and crypto wallets before removal.