Laundry Bear exploited a zero-day vulnerability for five months before it was patched in November 2025, and the group is still actively exploiting vulnerable environments.

Authorities didn’t name the man or file formal charges, but accuse him of participating in attacks linked to Cyber Army of Russia Reborn and NoName.

Tyler Robert Buchanan “was the glue that held this gang together,” a cybercrime researcher said. He faces up to 22 years in federal prison.

Microsoft, which led the effort, said it seized 330 domains that powered the phishing platform’s core infrastructure. The alleged creator was also named in a civil complaint.

The marketplace was one of the world’s largest hubs for cybercrime with more than 142,000 members. Officials identified and arrested multiple suspects after seizing the site’s database.

The criminal organization specialized in business email compromise scams and generated billions of dollars in criminal proceeds annually from many small-scale operations, officials said.

The 35-year-old faces up to 10 years in jail and authorities announced an $11 million reward for information on his alleged co-conspirator who remains at large.

The Chinese government-linked hackers were the subject of an alert from U.S. and international partners.

Europol and eight other agencies launched the bust aimed at a network that targeted people trying to regain access to lost or stolen phones.

The sting also intercepted $27 million in illicit funds.