Daily Briefing for 11.20.25

Top stories.

1. US and allies sanction bulletproof hosting providers.
2. New Android infostealer spreads via WhatsApp.
3. Former Philippine mayor sentenced to life in prison for scam center human trafficking.

US and allies sanction bulletproof hosting providers.

The US, UK, and Australia have sanctioned two Russian bulletproof hosting providers (BHPs), Media Land and Hypercore, for their alleged roles in supporting ransomware attacks and other types of cybercrime. The US Treasury Department's Office of Foreign Assets Control (OFAC) says St. Petersburg-based Media Land provided infrastructure for ransomware groups, including Lockbit, BlackSuit, and Play, as well as supporting DDoS attacks against US critical infrastructure. OFAC also sanctioned two of Media Land's subsidiaries and three of its employees, including the hosting provider's general director, Aleksandr Volosovik.

OFAC and the United Kingdom also sanctioned Hypercore, a UK-incorporated front company for the Russian BHP Aeza Group. OFAC sanctioned Aeza earlier this year, and Treasury says the group has since attempted to rebrand using front companies.

New Android infostealer spreads via WhatsApp.

Trustwave has published a report on a new strain of Android malware dubbed "Eternidade" that's targeting Brazil, although most of its infections are in other countries around the world. The malware spreads via WhatsApp using a Python-based worm, extracting victims' contact lists and delivering malicious files.

Trustwave has observed Eternidade implants across thirty-eight countries, with the highest activity in the United States. The researchers note that "although the malware family and delivery vectors are primarily Brazilian, the possible operational footprint and victim exposure are far more global."

Former Philippine mayor sentenced to life in prison for scam center human trafficking.

A Philippine court has sentenced a former mayor of the town of Bamban, Alice Guo, to life in prison after finding her guilty of human trafficking offenses, Reuters reports. The Philippine Senate launched an investigation into Guo last year after police raided a scam center built on land partially owned by Guo. This scam center, like many others across Southeast Asia, was known for using forced labor from trafficked victims.

Philippine law enforcement has identified Guo as a Chinese national, though Guo maintains that she is a natural-born Philippine citizen. Reuters notes that the case has intensified national scrutiny of China-linked criminal activity in the region.