Threat IntelligenceEmerging Threats

FBI, North Macedonia Authorities Crack Down on OLVX Cybercrime Ring Operator

Analyst 207||Source: CyberScoop
“The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use,” the FBI Cyber Division said in a LinkedIn post Wednesday.

Charges unsealed against “E.A.” in North Macedonia

Authorities in the Republic of North Macedonia filed criminal charges against a 20-year-old citizen identified only as “E.A.” in a news release. Officials accuse the suspect of computer fraud, misuse of personal data, and production and distribution of child sexual abuse material. The filing follows an arrest that, according to European authorities, came six months after law enforcement dismantled the OLVX platform and searched the suspect’s home in April.

Local prosecutors charged the suspect in the village of Golema Rečica, near Tetovo, where authorities allege the defendant administered domains and sites tied to the OLVX marketplace.

Scale of OLVX’s operations and seizure of assets

European authorities said OLVX sold stolen personal data, credentials and malicious tools starting in 2023. At the time officials dismantled the platform they reported that sales exceeded $500,000 and that a seized server contained a database with more than 2,600 customer accounts. Investigators also said evidence gathered during the probe indicated the suspect offered more than 1,500 sets of stolen credentials for sale.

How the platform functioned: domains, Telegram and illicit services

According to the charges and investigative findings shared by authorities, the suspect administered domains and sites used to sell stolen data and malicious tools and services between 2023 and 2025. More recently, investigators allege, the individual ran an online group on Telegram where illegal services and software were traded to facilitate cybercrime, including fraudulent refund schemes.

U.S. involvement: FBI intelligence and a joint operation

The FBI provided intelligence to North Macedonian authorities and aided the joint investigation into OLVX, the agencies said. In its LinkedIn post the FBI Cyber Division described the disruption of OLVX as “the first-ever cyber operation coordinated between the FBI and North Macedonia,” framing the action as part of the FBI’s international partnerships to protect American citizens in cyberspace.

What this means for technologists, American citizens, and law enforcement partners

  • Technologists and security teams: The seizure of a server with more than 2,600 customer accounts and the sale of over 1,500 credential sets reinforces the operational risk posed by marketplaces that aggregate stolen data and commercialize access. Security teams will be watching for credential reuse and the downstream effects of fraud schemes tied to the platform’s offerings.
  • American citizens and affected enterprises: The FBI’s statement that thousands of U.S. citizens were directly endangered underscores that data sold on foreign marketplaces can translate into cross-border account compromise and fraud for individual consumers and businesses that rely on account integrity.
  • Law enforcement partners: Investigators in North Macedonia and the FBI demonstrated a joint capability—sharing intelligence and executing a coordinated disruption. The case is presented by the FBI as a precedent for bilateral cyber operations with North Macedonia.

The charges against “E.A.” and the particulars disclosed by investigators — $500,000 in reported sales, a seized database of more than 2,600 customer accounts, and the alleged sale of over 1,500 credential sets — provide a clear ledger of the marketplace’s reach. What remains to be resolved in public records are the identities and number of consumers directly victimized by those offerings, and how many downstream incidents can be linked to data traded on OLVX.

For now, prosecutors in North Macedonia have lodged formal accusations that could trigger prosecution; investigators have flagged the cross-border consequences of marketplaces that launder stolen data into cash and illicit services. The operation also leaves an open question for other countries and companies that track credential abuse: how many active accounts and fraud campaigns originated with marketplaces like OLVX, and how quickly those chains can be interrupted once a platform is dismantled?

Original reporting: https://cyberscoop.com/olvx-cybercrime-marketplace-operator-charged-north-macedonia/

CybercrimeDigital SecurityEmerging ThreatsFbiLaw EnforcementChild ExploitationOLVXNorth MacedoniaCybercrime RingRepublic Of North Macedonia
Related Intelligence

Continue Reading

Rows of dusty filing cabinets and paper records in a dimly lit archive room with a slightly ajar file drawer in the…

UK Legal Aid Agency Breach Exposes Decades of Sensitive Records

A massive breach at the UK's Legal Aid Agency has exposed sensitive records spanning nearly five decades, with stolen data dating as far back as 1978 and affecting around 250,000 records from before 2007. The breach, which occurred in April 2025, compromised a vast trove of applicant, recipient, and provider data.

Analyst 207
Rows of network equipment and security appliances in a well-lit data center room.

Palo Alto Networks Fixes Authenticated RCE Flaw Under Active Exploitation

Palo Alto Networks has patched a critical vulnerability, CVE-2026-0322, that allowed hackers to execute malicious code with root privileges on its firewalls - and it was under active attack. This authenticated remote code execution flaw, scoring 8.6 in severity, could be exploited by anyone with network access to the PAN-OS management interface.

Analyst 207
Network equipment and security appliances in a brightly-lit operations room with a management interface on a laptop screen.

Palo Alto Networks Discloses Exploited PAN-OS Zero-Day Flaw

Palo Alto Networks has patched a high-severity zero-day flaw, CVE-2026-0322, that lets hackers execute code as root on vulnerable firewalls and appliances. The company says only limited exploitation has been observed so far, but urges users to update their PAN-OS management interface ASAP.

Analyst 207
Empty server room with rows of computer servers and networking equipment.

Cisco Email Flaw Exploited in Zero-Day Attacks

Cisco is urging customers to upgrade to a fixed software release after a critical vulnerability in its Secure Email Gateway was exploited in active zero-day attacks, allowing hackers to gain root access with just a malicious email. The flaw, scored 9.8 out of 10 on the CVSS scale, enables remote attackers to write files and execute commands with root privileges on the appliance operating system.

Analyst 207