US Treasury sanctions Iran’s largest crypto exchange, PRC-linked TA4922 expands phishing to Europe and Africa, and attackers exploit a Palo Alto VPN bypass. This week’s roundup covers fraud network disruptions, a crypto exchange sanctioned, and a doxer arrested alongside ongoing threat actor activity.