The ransomware-as-a-service outfit has gone after a range of critical infrastructure sectors across the globe.

Operation Ramz resulted in 201 arrests and disrupted phishing services, malware and financial scams.

Access Now, Lookout and SMEX joined research forces to find a campaign involving suspected Indian government-connected group Bitter, ProSpy spyware and more.

Proofpoint researchers say the group behind the surge, TA416, had turned away from Europe for a few years.

Phantom Taurus has stolen sensitive data from ministries of foreign affairs, embassies, diplomats and telecom networks in the Middle East, Africa and Asia, researchers said.

ForeScout said one of them warranted rating at the maximum severity level, although DrayTek has issued patches.

A group that appears to support the Houthis in Yemen is targeting organizations working in the region with malicious Android-based apps.

The group allegedly has targeted the defense, local government, oil and natural gas and telecommunications sectors in places including North America.

"We could not find any evidence that these tools were used previously, or attribute them to a specific threat actor," Check Point researchers said.

One disruption at a bank, a long legal battle and the case of a missing $9 million.