Romanian Man Extradited to US for Role in Hacking Scheme 17 Years Ago
Gavril Sandu, 53, was indicted in 2017, but was arrested and extradited to the United States only in 2026.
Grace Ops
triage-ready iocs + detections
fresh
1
IOC Workbench
typed indicators with fast copy and export actions
2 total
uhttps://www.securityweek.com/romanian-extradited-to-us-for-role-in-hacking-scheme-17-years-ago/
dwww.securityweek.com
2 indicators staged for handoff.
2
Rule Studio
starter detections generated from this IOC set
2 formats
!Draft output: validate and tune before production rollout.
sigmadraft
title: AHackaday IOC starter detection
id: ahackaday-2026-05-06-romanian-man-extradited-to-us-for-role-in-hacking-scheme-17-years-ago-3fc6a39c
description: IOC starter rule for Romanian Man Extradited to US for Role in Hacking Scheme 17 Years Ago
status: experimental
author: ahackaday
logsource:
product: network
detection:
selection_iocs:
- "https://www.securityweek.com/romanian-extradited-to-us-for-role-in-hacking-scheme-17-years-ago/"
- "www.securityweek.com"
condition: selection_iocs
falsepositives:
- unknown
level: high
coverage
yaradraft
rule ahackaday_2026_05_06_romanian_man_extradited_to_us_for_role_in_hacking_scheme_17_years_ago_3fc6a39c
{
meta:
description = "IOC starter for Romanian Man Extradited to US for Role in Hacking Scheme 17 Years Ago"
author = "ahackaday"
strings:
$ioc1 = "https://www.securityweek.com/romanian-extradited-to-us-for-role-in-hacking-scheme-17-years-ago/" nocase
$ioc2 = "www.securityweek.com" nocase
condition:
any of them
}
coverage
3
Response Tracks
fast operational tracks from this incident snapshot
4 tracks
source-backed 1 refs
audit trail / provenance3
Provenance
Claims tie surfaced fields back to sources, models, or heuristics.
- severity.upliftheuristicn/aActive exploitation / in-the-wild language detected — floor raised to at least high.
- severity.upliftheuristicn/aRansomware campaign indicators detected — floor raised to at least high.
- severity.upliftheuristicn/aCombined zero-day/exploit + ransomware/mass-impact signals → critical.
What changed
Append-only revisions when ingest or analysts evolve the record.
No revision rows stored yet.
Sources
Curated May 06, 2026 by the ahackaday team./Sources verified./Brief grounded in 1 source.
discussion
Sign in to join the thread and vote on comments.
Loading comments…