Podcast Summary: Cybersecurity Today — Arrests In O365 Scheme With David Shipley
Host: David Shipley
Episode Date: December 22, 2025
Overview
In this episode of Cybersecurity Today, David Shipley explores four major cybersecurity developments with global impact: a crackdown on a Nigerian Microsoft 365 phishing platform, a massive ATM jackpotting scheme linked to terrorist financing, a shocking case of insider ransomware attacks, and Denmark’s formal attribution of a destructive cyberattack on its water utilities to Russian state-linked actors. Shipley breaks down the international coordination behind cybercrime enforcement and the emerging threats businesses must monitor, all flavored with his journalistic insight and urgent, no-nonsense delivery.
Key Discussion Points & Insights
1. Nigerian Microsoft 365 Phishing Platform Bust
[00:21–03:40]
- Three suspects arrested: Nigerian National Cybercrime Centre, acting on intelligence shared by Microsoft and the FBI, arrested three individuals tied to “Raccoon O365,” a phishing-as-a-service toolkit.
- Raccoon O365 details:
- Automated the creation of fake Microsoft login pages.
- At least 5,000 compromised Microsoft 365 accounts across 94 countries.
- Used for widespread business email compromise, data theft, and fraud.
- Key suspect: Okatipi Samuel, who used aliases “Raccoon0365” and “Moses Felix,” is believed to have created and operated the platform, marketing it via a Telegram group with over 800 members.
- Subscription model: Access sold for $350 a month or $1,000 for three months, with payments typically in cryptocurrency.
- Law enforcement collaboration: Raccoon O365’s infrastructure was disrupted in September by Microsoft and Cloudflare.
- “The arrests were carried out by Nigeria’s police force National Cybercrime center, following intelligence shared by Microsoft through the FBI, underscoring the increasing international nature of cybercrime investigations.” — David Shipley [00:46]
- Missing figure: Notably, Joshua Ogundbip, previously identified as a leader, was not mentioned among those arrested.
2. ATM Jackpotting Scheme Linked to Terrorism
[03:41–06:50]
- Scale of the scheme: U.S. prosecutors charged 54 individuals with running a multi-year ATM malware scam using the “Plotus” malware.
- Operation details:
- Physical installation of malware onto ATMs to force machine payout (“jackpotting”).
- Losses exceeded $40 million in more than 1,500 incidents since 2021.
- Criminal organization: Linked to “Trend Agua,” a Venezuelan group designated as a foreign terrorist organization by the U.S. State Department.
- Sophisticated approach:
- Recruited individuals to scout and test ATM security before deploying malware.
- Plotus could be launched via removable devices or hard drive swaps.
- Designed to erase forensic evidence.
- Money flow:
- “Prosecutors allege those funds were funneled back to Trend Agua leadership to support broader criminal and terrorist activities.” — David Shipley [06:10]
- Severe consequences: Some defendants face up to three centuries in prison.
3. Insider Ransomware: Trusted Responders Turned Attackers
[06:51–09:30]
- Who: Two incident response professionals, Ryan Clifford Goldberg (Signia) and Kevin Tyler Martin (Digital Mint).
- What: Pleaded guilty to conspiring to deploy ALF V/Black Cat ransomware against five organizations while in roles meant to help, not harm, victims.
- Victims: Included health, pharmaceutical, engineering, and drone manufacturing firms.
- Financial impact: Over $9.5 million in losses, with $1.3 million successfully extorted from a Florida medical company.
- Sentence status: Guilt reduced potential maximum from 50 to 20 years; both to forfeit over $340,000; further reductions likely for cooperation.
- “The Justice Department says the pair abused positions of trust and specialized skills to carry out and conceal the attacks.” — David Shipley [08:56]
- Technique: Used insider knowledge and an affiliate account with the ransomware group to maximize effectiveness.
4. Denmark Attributes Utility Hack to Russian State Actors
[09:31–11:25]
- Incident: Denmark formally blames Russia for a 2024 cyberattack on a water utility that resulted in physical damage (altered pump pressure, burst pipes in Koge).
- Attackers: Group Z Pen Test, linked directly to Russian state; linked to broader hybrid warfare alongside DDoS election attacks by Noname 057.
- Assessment: Attacks seen as part of an orchestrated campaign to destabilize Western critical infrastructure in response to support for Ukraine.
- “Denmark’s defense minister called the attacks unacceptable and said that they demonstrate that hybrid warfare is not theoretical but actively underway in Europe.” — David Shipley [10:29]
- Broader warning: Russian hacktivist groups are targeting water, energy, food, and agriculture systems across Europe and North America.
- Vulnerability: Highlighted serious flaws in national resilience and prompted Denmark to raise its national cyber threat level for telecommunications.
- Cross-border pattern: Reference to Canadian pipeline attacks underscores that these risks are growing, persistent, and global.
Notable Quotes & Memorable Moments
- International Cooperation:
“The arrests were carried out by Nigeria’s police force National Cybercrime center, following intelligence shared by Microsoft through the FBI, underscoring the increasing international nature of cybercrime investigations.” (David Shipley, [00:46]) - Phishing-as-a-Service:
“Investigators say the service was linked to at least 5,000 compromised Microsoft 365 accounts across 94 countries, enabling business, email compromise, data theft and financial fraud worldwide.” (David Shipley, [01:21]) - ATM Malware and Terror Financing:
“Prosecutors allege those funds were funneled back to Trend Agua leadership to support broader criminal and terrorist activities.” (David Shipley, [06:10]) - Betrayal of Trust:
“The Justice Department says the pair abused positions of trust and specialized skills to carry out and conceal the attacks.” (David Shipley, [08:56]) - Hybrid Warfare Reality Check:
“Denmark’s defense minister called the attacks unacceptable and said that they demonstrate that hybrid warfare is not theoretical but actively underway in Europe.” (David Shipley, [10:29])
Important Timestamps
- Microsoft 365 Phishing Arrests: [00:21–03:40]
- ATM Jackpotting/Terrorist Financing: [03:41–06:50]
- Incident Responders Turned Ransomware Attackers: [06:51–09:30]
- Denmark Utility Hack Attributed to Russia: [09:31–11:25]
- Closing Remarks and Year-End Thanks: [11:26–12:18]
Final Remark
David Shipley closes the episode with gratitude to co-host Jim and the audience, a festive cybersecurity-themed jingle, and a call to heightened vigilance for the coming year—echoing the urgent, personal, and pragmatic tone that makes Cybersecurity Today a trusted guide for business leaders and IT professionals alike.
For further details and full context, listen to the full episode of Cybersecurity Today: Arrests In O365 Scheme, Dec 22, 2025.
