Suspect Extradited to California in $36.9M Crypto Scam; CERT-UA Warns on Dahua Cameras

A 44-year-old Chinese national, Zhen Zhao (also spelled Zheng Zhao in court filings), has been extradited from the Netherlands and arraigned in federal court in California for allegedly laundering $36.9 million stolen from at least 174 U.S. victims in a Cambodia-linked cryptocurrency investment scheme, while Ukraine’s CERT-UA warned of active attacks on Dahua surveillance cameras and Kali Linux released version 2026.3, according to reports by BleepingComputer and The Record.

$36.9 Million Converted to USDT via Deltec Bank and Sent to Sihanoukville

According to the U.S. Department of Justice, scammers contacted U.S. victims via unsolicited texts, phone calls, social media, and dating apps, directing them to spoofed cryptocurrency trading platforms. Prosecutors allege that Zhao and co-conspirators routed more than $36.9 million from U.S. bank accounts to an account opened under the name Axis Digital Limited at Deltec Bank in the Bahamas, converted the funds into the stablecoin Tether (USDT), and transferred the tokens to digital wallets controlled by scam center leaders in Sihanoukville and Phnom Penh, Cambodia.

Charged in August 2025 with conspiracy to commit money laundering—carrying up to 20 years in prison—Zhao is the ninth defendant charged in the ring after eight co-conspirators pleaded guilty, including ShengSheng He (sentenced to 51 months) and Jingliang Su (sentenced to 46 months). The FBI’s 2025 Internet Crime Report recorded more than $8.6 billion in investment scam losses across 72,984 complaints last year, up from $6.5 billion in 2024.

CERT-UA Warns of Dahua Easy4IP Exploitation and CVE-2021-33044 / CVE-2021-33045

In Eastern Europe, Ukraine’s Computer Emergency Response Team (CERT-UA) warned that hackers are compromising internet-connected Dahua surveillance cameras and video recorders by guessing predictable device serial numbers through Dahua’s Easy4IP cloud remote-access feature—even behind firewalls—and exploiting weak passwords or critical authentication-bypass flaws CVE-2021-33044 and CVE-2021-33045, according to The Record. Hunt.io previously reported in August that more than 14,500 Dahua devices had been compromised in Ukraine and Russia, while Ukraine’s SBU has secured roughly 40,000 surveillance cameras since 2022.

Kali Linux 2026.3 Ships With Kernel 7.1.5, KDE Plasma 6.7, and Six New Tools

Meanwhile, BleepingComputer reported that offensive-security distribution Kali Linux 2026.3 has launched with 126 updated packages, a Linux kernel upgrade from 6.19 to 7.1.5, KDE Plasma 6.7 desktop refinements, unified Docker and Podman container build scripts (build-in-container.sh), and six newly added security utilities:

• dalfox (automated open-source XSS scanner)
• katana (crawling and spidering framework)
• qsreplace (stdin URL query-string replacement utility)
• rustscan (high-speed port scanner)
• sdrangel (Qt-based software-defined radio front-end)
• snaffler-ng (SMB share credential and sensitive data scanner)