ReportWire

Tag: Hacking

  • Crypto Exploits Decline Sharply, With Only $76M Stolen in December 2025

    December’s losses were spread across 26 incidents, showing fewer large-scale breaches rather than a total absence of attacks.

    Blockchain security firm Peckshield has shared that December 2025 closed with a surprising decrease in crypto exploit losses.

    On-chain data shows the figures fell by 60% compared with those recorded in November.

    $76 Million Lost Across 26 Incidents

    According to the Peckshield report revealed via X, hacks and cybersecurity exploits in the crypto sector dropped in December 2025, with only $76.2 million stolen across 26 major incidents. This figure represents a 60% decrease from November’s $194.2 million.

    The largest single hack during the period was a $50 million address-poisoning scam, where attackers mimicked wallet addresses to trick a user into misdirecting funds. Another notable incident involved a $27.3M multisig breach on a wallet identified as 0xde5f…e965, which was compromised due to a private key leak.

    Other attacks that made it to the top 5 include the exploit of babur.sol, which resulted in $22 million in losses. The Trust Wallet hack, which occurred around Christmas, involved a trojanized Chrome extension uploaded via a compromised Web Store API key and GitHub secrets, leading to the theft of $8.5 million in user funds.

    Unleash Protocol also suffered a $3.9 million loss in December after a hacker gained control of its multisig governance and executed an unauthorized contract upgrade. Meanwhile, the Flow blockchain experienced a $3.9 million breach caused by an execution layer vulnerability that allowed the attacker to mint and transfer assets across services before the network was halted.

    Crypto Industry Loses Over $2.2 Billion in 2025 Hacks

    Despite the December dip, on-chain data reveals that 2025 was another challenging year for the digital asset sector, with over $2.2 billion lost in the top 10 hacks. Bybit’s $1.4 billion breach in February, which saw attackers drain approximately 401,000 ETH from the exchange’s wallets, remains the year’s most devastating hack.

    You may also like:

    Other major incidents included Cetus, a concentrated-liquidity DEX on Sui, which lost $223 million in May after attackers exploited a protocol flaw to manipulate pricing and drain liquidity.

    Balancer V2 also suffered a $128 million exploit in November linked to a rounding-error bug in its composable stable pools, while Bitget reported roughly $100 million lost in April due to manipulation of its VOXEL market-making infrastructure.

    Centralized exchanges were also targeted, with Phemex experiencing an $85 million hot wallet breach in January and Iran-based Nobitex falling victim to $80–90 million stolen from hot wallets in June. In each case, the platforms froze withdrawals, protected the remaining assets, and worked to resume services, while the amount recovered from the losses differed.

    SPECIAL OFFER (Exclusive)

    SECRET PARTNERSHIP BONUS for CryptoPotato readers: Use this link to register and unlock $1,500 in exclusive BingX Exchange rewards (limited time offer).

    Wayne Jones

    Source link

  • Feds are hunting teenage hacking groups like ‘Scattered Spider’ who have targeted $1 trillion worth of the Fortune 500 since 2022 | Fortune

    The job posts don’t immediately raise alarms, even though they’re clearly not for tutoring or babysitting.

     “Female candidates are a PRIORITY, even if you aren’t from US, if you do not have a clear accent please feel free to inquire,” a public Telegram channel post on Dec. 15 stated. “INEXPERIENCED people are OKAY, we can train you from scratch but we expect you to absorb information and take in what you are learning.” Those who are interested are expected to be available from 12 pm EST to 6 pm EST on weekdays and will earn $300 per “successful call,” paid in crypto.

    Of course, the ad isn’t for a legitimate job at all. It’s a recruiting post to join a criminal underground organization, where the job is undertaking ransomware attacks against big corporations. And the ‘gig’ workers being recruited are largely kids in middle and high schools. The enterprise is called The Com, short for “The Community,” and it includes about 1,000 people involved in numerous ephemeral associations and business partnerships, including those known as Scattered Spider, ShinyHunters, Lapsus$, SLSH, and other iterations. Associations change and reframe frequently in what expert researcher Allison Nixon calls “a huge spaghetti soup.” Since 2022, the pipeline has successfully infiltrated U.S. and UK companies with a collective market cap valuation of more than $1 trillion with data breaches, theft, account compromise, phishing, and extortion campaigns. Some 120 companies have been targeted, including brands such as Chick-fil-A, Instacart, Louis Vuitton, Morningstar, News Corporation, Nike, Tinder, T-Mobile, and Vodafone, according to research from cyber intelligence firm Silent Push and court records. 

    What makes The Com and these groups uniquely dangerous is both their sophistication, and in how they weaponize the youth of their own members. Their tactics exploit teenagers’ greatest strengths, including their technical savvy, cleverness, and ease as native English speakers. But their blindness to consequences, and habit of having conversations in public leaves them vulnerable to law enforcement. Starting in 2024, a series of high-profile arrests and indictments of young men and teenagers ranging in age from 18 to 25 has exposed the significant risk of getting involved in The Com. In August, a 20-year-old in Florida was sentenced to a decade in federal prison and ordered to pay restitution of $13 million for his role in multiple attacks. Unnamed juveniles have also been listed as co-conspirators, and the ages that some are alleged to have begun offending are as young as 13 or 14, according to law enforcement. 

    Zach Edwards, senior threat researcher at Silent Push, said the structure is a classic one, in which young people do most of the dangerous grunt work in a criminal organization. “The people that are conducting the attacks are at dramatically more risk,” said Edwards. “These kids are just throwing themselves to the slaughter.”

    Edwards said the group even tends to slow down during the holidays “because they’re opening presents from Mom under the Christmas tree,” he said. “They’re, you know, 15-year-olds opening stockings.”

    And usually parents only find out their kids are involved when the FBI knocks on the door, noted Cynthia Kaiser, former deputy assistant director of the FBI’s cyber division. 

    “When they’re at a federal felony level is when the parents know because that’s when the FBI comes into play,” she said. Cybercrime lacks all the natural “offramps” that exist with other types of juvenile offenses, explained Kaiser. If a kid defaces a school gym with spray paint, they’re usually caught by a security guard or teacher and they get in trouble. It’s a warning sign for further intervention that doesn’t exist in the online spaces kids frequent.

    “It allows these kids to get to the point where they’re conducting federal crimes that no one’s ever talked to them about,” said Kaiser. She often saw “loving parents, involved parents, kids who really did have a lot of advantages, but they just kind of got swept up into this, which I think is easy to do.”

    Learning from LinkedIn and Slack  

    Silent Push, which has tracked Scattered Spider and other groups for years, found that since March 2025, the group has pivoted back to social engineering as the backbone to its ransomware operations, a feat it is incredibly skilled at pulling off. The group allegedly steals employee lists and job titles by compromising HR software platforms and conducting extensive reconnaissance on LinkedIn, said Nixon. With a full roster in hand, the group will call employees directly, pretending to be a new hire with innocuous-seeming questions about platforms, cloud access, and other tech infrastructure. They’ve also been known to read internal Slack message boards to pick up on corporate lingo and acronyms and to find out who to target for permissions to systems. Edwards said the group leans hard on A/B testing to determine which types of calls are most successful and then doesn’t stray far from that path.

    Charles Carmakal, chief technology officer of Google Cloud’s Mandiant Consulting, said group members also learn from each other as they work through more intrusions and they share their insights in chat rooms. They often abuse legitimate software in a way that gets them to their ultimate objective without having to create malware or malicious software, he said. 

    “They’re resourceful,” said Carmakal. “They read the blogs, they understand what the red teams are finding, what the blue teams are finding, what other adversaries are doing, and they’ll replicate some of those techniques as well. They’re smart folks.”

    Nixon has seen phishing lures in which attackers claim to be running an internal HR investigation into something a person allegedly said that was racist or another type of complaint. “They’re really upsetting false accusations, so the employee is going to be quite upset, quite motivated to shut this down,” said Nixon. “If they can get the employee emotional, they’ve got them on the hook.”

    Once the employee gets rattled, the attackers will direct them to a fake helpdesk or HR website to input their login credentials. In more sophisticated companies that use multi-factor authentication or physical security keys, the attackers use the company’s remote software like AnyDesk or TeamViewer to eventually get inside internal networks. “They are very savvy as to how these companies defend themselves and authenticate their own employee users, and they’ve developed these techniques over a long period of time,” said Nixon.

    Plus, Scattered Spider has picked up on a key asymmetry in authentication, said Sherri Davidoff, founder of LMG Security. When help desks call employees, they rarely have to identify themselves or prove they work for a company. Whereas when employees contact help desks, they have to verify who they are.

    “Many organizations, either intentionally or unintentionally, condition their staff to comply with help desk requests,” said Davidoff. “[Threat actors] will then mimic the urgency, they’ll mimic any stress, and they’ll mimic the sense of authority that these callers have.”

    Kids Today 

    One of Scattered Spider’s signatures is that the group is incredibly chaotic, noted Greg Linares, a former hacker who is now a cybersecurity researcher at Eeye Digital Security. Unlike more established ransomware operators, Scattered Spider members communicate directly with victims’ C-level executives without formal negotiators. “They don’t have a professional person in the middle, so it’s just them being young adults and having fun,” said Linares. “That unpredictability among the group makes them charismatic and dangerous at the same time.”

    The Scattered Spider attacks have featured brazen and audacious behaviors, like renaming the CEO to something profane in the company email address book, or calling customers directly and demanding ransom payments—general troll behavior “for the lols,” said Edwards. Serious criminal actors involved in ransomware money-making schemes, usually working for nation states like Russia or North Korea, use Signal or encrypted services, he added. The younger Scattered Spider members often create new channels on Telegram and Discord if they get banned and announce the new channel and make it public again. 

    Experienced criminals “don’t run out there and create another Telegram, like, ‘Come on, everybody, back in the pool, the water’s fine,’” said Edwards. “It is absolutely what kids do.”

    CrowdStrike senior vice president of counter adversary Adam Meyers told Fortune these techniques have been honed after years of escalating pranks in video game spaces. Kids will start by stealing items or destroying other kids’ worlds in video games like Minecraft, mostly to troll and bully each other, said Meyers. From there, they progress to conducting identity takeovers, usually because they want account names that have been claimed by users long ago, said Meyers. The account takeovers then evolve into targeting crypto holders. 

    “Many of these teen offenders have been recruited and groomed from gaming sites, first with the offer of teaching then how to acquire in-game currency, and moving on to targeting girls for sextortion,” said Katie Moussouris, founder of startup Luta Security. “From there, they are encouraged to shift to other hacking crimes. There’s a well-established criminal pipeline that grooms young offenders to avoid adult prosecutions.”

    A complaint unsealed in September in New Jersey alleged that UK teenager, Thalha Jubair, 19, was part of Scattered Spider starting from when he was 15 or 16. Jubair is facing a maximum of 95 years in prison in a scheme that U.S. authorities allege infiltrated 47 unnamed companies including airlines, manufacturers, retailers, tech, and financial services firms, and raked in more than $115 million in ransom payments. 

    Owen Flowers, 18, was charged along with Jubair in the UK, according to the UK’s National Crime Agency. Both are accused in attacks on Transport for London and for allegedly conspiring to damage two U.S. healthcare companies. Flowers and Jubair have pleaded not guilty and a trial is set for next year.

    Those charges came after another alleged Scattered Spider ringleader, Noah Michael Urban, 20,  pleaded guilty to wire fraud, identity theft, and conspiracy charges and was sentenced to 10 years in federal prison in August. He was ordered to pay $13 million in restitution. 

    Four others, all under the age of 25, were charged alongside Urban in 2024 for allegedly being part of Scattered Spider’s cyber intrusion and crypto theft scheme, including an unnamed minor. In another alleged Scattered Spider attack, at least one unnamed juvenile turned himself in to police in Las Vegas for taking part in attacks on gaming companies in Las Vegas, according to police. 

    ‘Female candidates are a PRIORITY’ 

    The field of cybercrime is almost exclusively dominated by male actors, but Scattered Spider has effectively recruited teenage and young adult women who have become a strategic asset. Nixon of Unit 221B said the number of girls in The Com is “exploding.”

    Arda Büyükkaya, a senior threat intelligence analyst at EclecticIQ based in the EU, said he’s also found that some callers are using AI systems that will alter their voices to mimic a regional accent or other features, such as a woman “with a neutral tone” who offers pleasantries, such as “take your time,” that also downplay suspicions. 

    Social engineering is rife with gender presumptions, said Karl Sigler, senior security manager at Trustwave SpiderLabs. Men tend to lean on their positions of authority as a senior executive or even a CFO or CEO, while women take the tactic of being in distress. 

    “Women tend to be more successful at social engineering because, frankly, we’re underestimated,” said Moussouris of Luta Security. “This holds true whether trying to talk our way in by voice or in person. Women aren’t viewed as a threat by most and we’ve seen this play out in testing organizations where women may succeed in getting in and men don’t.”

    In Nixon’s observation, The Com finds young women are useful “for social engineering purposes, and they’re also useful to them for just straight-up sexual purposes.” Some of the girls respond to ads in gaming spaces that specify “girls only” and others are victims of online sexual violence, said Nixon. 

    “The people running these groups are still almost all male, and very sexist,” said Nixon. “The girls might be doing the low-level work, but they’re not going to be taught anything more than the bare minimum that they need to know. Knowledge is power in these groups, and mentorship is not given to girls.”

    Many involved seem to be seeking money, notoriety among the group, a sense of belonging, and the rush and thrill of a successful attack, experts said.

    Linares, who is known as the youngest ever hacker arrested in Arizona at age 14, said the hacking community he joined as a teen became closer to him than his actual family members at the time. If he were born in this era, Linares said he “absolutely” could see himself alerted to this type of crime and the money-making potential. Since sharing his story on a podcast over this summer, he’s heard from kids who are involved in cyber crime and he urges them to participate in legal bug bounty programs. Many have told him they are also autistic—a diagnosis Linares himself didn’t get until he was well in his 30s.

    “A lot of these kids come from broken households, alcoholic parents, and they’re on the path of doing drugs as well,” said Linares. “Life is hard and they’re just looking for a way through.”

    However, there is more to the picture. Marcus Hutchins, a cybersecurity researcher who famously stopped the global WannaCry ransomware attack and who previously faced federal charges related to malware he created as a teenager, said he’s learned that a lot of kids involved come from stable backgrounds with supportive parental figures. 

    “A lot of these are privileged kids who come from loving families and they still somehow end up doing this,” Hutchins said. “How does someone who has everything going for them decide that they’re going to go after a company that is just absolutely going to insist that they go to jail?”

    According to Kaiser, who after leaving the FBI joined cybersecurity firm Halcyon, the complexity lies in that the crimes are happening online and in secret. And in the grand tradition of parents not understanding kids’ slang, parents often find messages incomprehensible, which isn’t unusual, noted Nixon.  

    Despite the natural tendency to underestimate kids’ abilities or always see the best in them as parents, Kaiser said parents have to protect kids—and it might mean getting uncomfortable about monitoring their online behavior. Even with her background as a top FBI cyber official, Kaiser said she still struggles as a parent. 

    “I was the deputy director of the FBI’s Cyber Division, and I still don’t think I know how to fully secure my kids’ devices,” she said. “If my kid was acting foolish on the street, I’ll get a text. We’re not getting those alerts as parents, and that makes it really hard.”

    Fortune contacted all the companies named in this article for comment. Some declined to comment and some could not comment directly due to ongoing investigations. Others noted their commitment to strong cybersecurity and that they had quickly neutralized threats to their systems.

    Amanda Gerut

    Source link

  • These are the cybersecurity stories we were jealous of in 2025 | TechCrunch

    It’s the end of the year. That means it’s time for us to celebrate the best cybersecurity stories we didn’t publish. Since 2023, TechCrunch has looked back at the best stories across the board from the year in cybersecurity.

    If you’re not familiar, the idea is simple. There are now dozens of journalists who cover cybersecurity in the English language. There are a lot of stories about cybersecurity, privacy, and surveillance that are published every week. And a lot of them are great, and you should read them. We’re here to recommend the ones we liked the most, so keep in mind that it’s a very subjective and, at the end of the day, incomplete list. 

    Anyway, let’s get into it. — Lorenzo Franceschi-Bicchierai

    Shane Harris described how he cultivated a senior Iranian hacker as a source, who was then killed

    Every once in a while, there’s a hacker story that as soon as you start reading, you think it could be a movie or a TV show. This is the case with Shane Harris’ very personal tale of his months-long correspondence with a top Iranian hacker. 

    In 2016, The Atlantic’s journalist made contact with a person claiming to work as a hacker for Iran’s intelligence, where he claimed to have worked on major operations, such as the downing of an American drone and the now-infamous hack against oil giant Saudi Aramco, where Iranian hackers wiped the company’s computers. Harris was rightly skeptical, but as he kept talking to the hacker, who eventually revealed his real name to him, Harris started to believe him. When the hacker died, Harris was able to piece together the real story, which somehow turned out to be more incredible than the hacker had led Harris to believe. 

    The gripping story is also a great behind-the-scenes look at the challenges cybersecurity reporters face when dealing with sources claiming to have great stories to share.

    The Washington Post revealed a secret order demanding Apple let U.K. officials spy on users’ encrypted data

    In January, the U.K. government secretly issued Apple with a court order demanding that the company build a back door so police can access the iCloud data of any customer in the world. Due to a worldwide gag order, it was only because The Washington Post broke the news that we learned the order existed to begin with. The demand was the first of its kind, and — if successful — would be a major defeat for tech giants who have spent the past decade locking themselves out of their users’ own data so they can’t be compelled to provide it to governments.

    Apple subsequently stopped offering its opt-in end-to-end encrypted cloud storage to its customers in the U.K. in response to the demand. But by breaking the news, the secret order was thrust into the public eye and allowed both Apple and critics to scrutinize U.K. surveillance powers in a way that hasn’t been tested in public before. The story sparked a months-long diplomatic row between the U.K. and the United States, prompting Downing Street to drop the request — only to try again several months later.

    “The Trump administration accidentally texted me its war plans” by The Atlantic is this year’s best headline

    This story was the sort of fly-on-the-wall access that some reporters would dream of, but The Atlantic’s editor-in-chief got to play out in real time after he was unwittingly added to a Signal group of senior U.S. government officials by a senior U.S. government official discussing war plans on their cell phones. 

    “We are currently clean on OPSEC,” said Secretary of Defense Pete Hegseth. they were not. Image Credits:The Atlantic (screenshot)

    Reading the discussion about where U.S. military forces should drop bombs — and then seeing news reports of missiles hitting the ground on the other side of the world — was confirmation that Jeffrey Goldberg needed to know that he was, as he suspected, in a real chat with real Trump administration officials, and this was all on-the-record and reportable.

    And so he did, paving the way for a months-long investigation (and critique) of the government’s operational security practices, in what was called the biggest government opsec mistake in history. The unraveling of the situation ultimately exposed security lapses involving the use of a knock-off Signal clone that further jeopardized the government’s ostensibly secure communications.

    Brian Krebs tracked down a prolific hacker group admin as a Jordanian teenager

    Brian Krebs is one of the more veteran cybersecurity reporters out there, and for years he has specialized in following online breadcrumbs that lead to him revealing the identity of notorious cybercriminals. In this case, Krebs was able to find the real identity behind a hacker’s online handle Rey, who is part of the notorious advanced persistent teenagers‘ cybercrime group that calls itself Scattered LAPSUS$ Hunters.

    Krebs’ quest was so successful that he was able to talk to a person very close to the hacker — we won’t spoil the whole article here — and then the hacker himself, who confessed to his crimes and claimed he was trying to escape the cybercriminal life. 

    Independent media outlet 404 Media has accomplished more impact journalism this year than most mainstream outlets with vastly more resources. One of its biggest wins was exposing and effectively shuttering a massive air travel surveillance system tapped by federal agencies and operating in plain sight.

    404 Media reported that a little-known data broker set up by the airline industry called the Airlines Reporting Corporation was selling access to 5 billion plane tickets and travel itineraries, including names and financial details of ordinary Americans, allowing government agencies like ICE, the State Department, and the IRS to track people without a warrant.

    ARC, owned by United, American, Delta, Southwest, JetBlue, and other airlines, said it would shut down the warrantless data program following 404 Media’s months-long reporting and intense pressure from lawmakers.

    Wired made the 3D-printed gun that Luigi Mangione allegedly used to kill a healthcare executive to test the legalities of “ghost guns”

    The killing of UnitedHealthcare CEO Brian Thompson in December 2024 was one of the biggest stories of the year. Luigi Mangione, the chief suspect in the killing, was soon after arrested and indicted on charges of using a “ghost gun,” a 3D-printed firearm that had no serial numbers and built in private without a background check — effectively a gun that the government has no idea exists.

    Wired, using its past reporting experience on 3D-printed weaponry, sought to test how easy it would be to build a 3D-printed gun, while navigating the patchwork legal (and ethical) landscape. The reporting process was exquisitely told, and the video that goes along with the story is both excellent and chilling.

    NPR detailed a federal whistleblower’s account of how DOGE took sensitive government data, and the threats he faced

    DOGE, or the Department of Government Efficiency, was one of the biggest running stories of the year, as the gang of Elon Musk’s lackeys ripped through the federal government, tearing down security protocols and red tape, as part of the mass-grab of citizens’ data. NPR had some of the best investigative reporting uncovering the resistance movement of federal workers trying to prevent the pilfering of the government’s most sensitive data.

    In one story detailing a whistleblower’s official disclosure as shared with members of Congress, a senior IT employee in the National Labor Relations Board told lawmakers that as he was seeking help investigating DOGE’s activity, he “found a printed letter in an envelope taped to his door, which included threatening language, sensitive personal information and overhead pictures of him walking his dog, according to the cover letter attached to his official disclosure.”

    Mother Jones found an exposed dataset of tracked surveillance victims, including world leaders, a Vatican enemy, and maybe you

    Any story that starts with a journalist saying they found something that made them “feel like shitting my pants,” you know it’s going to be a fun read. Gabriel Geiger found a dataset from a mysterious surveillance company called First Wap, which contained records on thousands of people from around the world whose phone locations had been tracked. 

    The dataset, spanning 2007 through 2015, allowed Geiger to identify dozens of high-profile people whose phones were tracked, including a former Syrian first lady, the head of a private military contractor, a Hollywood actor, and an enemy of the Vatican. This story explored the shadowy world of phone surveillance by exploiting Signaling System No. 7, or SS7, an obscurely named protocol long known to allow malicious tracking.

    Wired reported on the investigation behind a string of “swatting” attacks on hundreds of schools nationwide

    Swatting has been a problem for years. What started as a bad joke has become a real threat, which has resulted in at least one death. Swatting is a type of hoax where someone — often a hacker — calls the emergency services and tricks the authorities into sending an armed SWAT team to the home of the hoaxer’s target, often pretending to be the target themselves and pretending they are about to commit a violent crime. 

    In this feature, Wired’s Andy Greenberg put a face on the many characters who are part of these stories, such as the call operators who have to deal with this problem. And he also profiled a prolific swatter, known as Torswats, who for months tormented the operators and schools all over the country with fake — but extremely believable — threats of violence, as well as a hacker who took it upon himself to track Torswats down. 

    Zack Whittaker, Lorenzo Franceschi-Bicchierai

    Source link

  • Flaw in photo booth maker’s website exposes customers’ pictures | TechCrunch

    A company that makes photo booths is exposing pictures and videos of its customers online thanks to a simple flaw in its website where the files are stored, according to a security researcher.  

    The researcher, who goes by Zeacer, alerted TechCrunch to the security issue in late November after reporting the vulnerability in October to Hama Film, the photo booth maker that has franchise presence in Australia, the United Arab Emirates, and the United States, but did not hear back.

    Zeacer shared with TechCrunch a sample of pictures taken from Hama Film’s servers, which showed groups of clearly young people posing in photo booths. Hama Film’s booths not only print out the photos like a typical photo booth, but booths also upload the customers’ photos to the company’s servers.

    Vibecast, which owns Hama Film, has yet to respond to his messages alerting the company of the issues. Vibecast also hasn’t responded to several requests for comment from TechCrunch, nor did Vibecast’s co-founder Joel Park respond to a message we sent via Linkedin.

    As of Friday, the researcher said the company has still not fully resolved the security flaw and continues to expose customers’ data. As such, TechCrunch is withholding specific details of the vulnerability from publication.

    When Zeacer first found this flaw, he noted that it appeared that photos were deleted from the photo booth maker’s servers every two to three weeks. 

    Now, he said, the pictures stored on the servers appear to get deleted after 24 hours, which limits the number of pictures exposed at any given time. But a hacker could still exploit the vulnerability he discovered each day and download the contents of every photo and video on the server. 

    Techcrunch event

    San Francisco
    |
    October 13-15, 2026

    Before this week, Zeacer said at one point he saw more than 1,000 pictures online for the Hama Film booths in Melbourne. 

    This incident is the latest example of a company that, at least for a time, was not implementing certain basic and widely accepted security practices, such as rate-limiting. Last month, TechCrunch reported that government contractor giant Tyler Technologies was not rate-limiting its websites used for allowing courts to manage their jurors’ personal information. This meant anyone could break into any juror’s profile by running a computer script capable of mass-guessing their date of birth and their easy-to-guess numerical identifier. 

    Lorenzo Franceschi-Bicchierai

    Source link

  • The WIRED Guide to Digital Opsec for Teens

    Expand your mind, man. Opsec is really all about time travel—taking small, protective steps now before you have a disaster on your hands later. If you’re not on auto-delete, then an explosive, emotional text exchange with the person you’re currently dating—or, ahem, photos you sent to each other—will hang around forever. It’s normal for things to change and for relationships of all types to come and go. You may trust someone and be close to them now but grow apart in a year or two.

    If you imagine an even more extreme scenario where you’re being investigated by the police, they could obtain warrants to search your digital accounts or devices. People have to go to great lengths to maintain their opsec if they’re trying to hide activity from law enforcement. To be clear, this guide is definitely not encouraging you to do crimes. Don’t do crimes! The goal is just to understand the value of keeping basic opsec principles in mind, because if some of your digital information is revealed haphazardly or out of context, it could, theoretically, appear incriminating.

    You probably intuitively understand a lot of this. Don’t give your password to friends, duh.) So this guide is going to largely skip the obvious and emphasize more subtle, unintended consequences of failing to practice good opsec.

    Memorable Opsec Fails

    “Signalgate,” 2025: US officials discussed war plans in a group chat on the mainstream, secure messaging app Signal. Then they accidentally added a journalist to the chat. Subsequently, US defense secretary Pete Hegseth famously (embarrassingly) messaged the chat, “we are currently clean on OPSEC.” At least some members of the chat were also potentially using a modified, insecure version of Signal. All extremely not clean on opsec.

    Gmail Drafts Exposed, 2012: Then-CIA director David Petraeus and his paramour shared a Gmail account to hide their communications by leaving them for each other to see as draft messages. Kind of ingenious given that this was before most texting or messaging apps offered timed disappearing/ephemeral messages, but the FBI figured out the strategy.

    Identities

    Opsec is all about compartmentalizing, and that’s the hardest part. Failure to compartmentalize is often how criminals get caught or how information that was meant to stay secret gets exposed. Think of your online life like rooms in a house. Each room has a separate key. If someone breaks into one room, they can grab everything there, but you don’t want them to be able to run wild beyond that room.

    You can have multiple identities online and compartmentalize the activities of each, but it takes forethought to maintain the separation. There’s the real you who uses your main Gmail or Apple ID for personal and family stuff and social accounts where you use your real name, plus school and maybe work. Another compartment is your school email and school file storage. Then there’s your more adaptable, online personas who may have semi-anonymous handles, like jnd03 for Jane Doe. Friends know that these accounts are yours and classmates can probably guess them. Finally, there may be a pseudonymous you: alt accounts with no obvious link to real you—like Jane Doe using the handles “_aksdi0_0” or “peter_mayfield01.”

    Rules of Separation

    You have accounts under your real name, but you probably also need pseudonymous accounts. Tight compartmentalization will prevent people from doxing your pseudonymous accounts. But that’s easier said than done.

    Obviously, don’t recycle usernames across platforms. If JaneD03 is your Instagram handle, don’t use it or a similar name for your anonymous Reddit account. Don’t even reuse passwords—but especially don’t reuse passwords between real and pseudonymous accounts. To prevent a compromised pseudonymous account from revealing your name, don’t use your main email address; instead, use a unique, pseudonymous one. Gmail “dot tricks” (jane.doe@, j.ane.doe@) don’t count, because they all equally reveal your master account.

    JP Aumasson, Lily Hay Newman

    Source link

  • Russian hackers target US engineering firm because of work done for Ukraine

    WASHINGTON — Hackers working for Russian intelligence attacked an American engineering company this fall, investigators at a U.S. cybersecurity company said Tuesday — seemingly because that firm had worked for a U.S. municipality with a sister city in Ukraine.

    The findings reflect the evolving tools and tactics of Russia’s cyber war and demonstrate Moscow’s willingness to attack a growing list of targets, including governments, organizations and private companies that have supported Ukraine, even in a tenuous way.

    Arctic Wolf, the U.S. cybersecurity firm that identified the Russian campaign, wouldn’t identify its customer or the city it worked with to protect their security, but said the company had no direct connection to Russia’s invasion of Ukraine. However, the group behind the attack, known to cybersecurity experts as RomCom, has consistently targeted groups with links to Ukraine and its defense against Russia.

    “They routinely go after organizations that support Ukrainian institutions directly, provide services to Ukrainian municipalities, and assist organizations tied to Ukrainian civil society, defense, or government functions,” said Ismael Valenzuela, Arctic Wolf’s vice president of labs, threat research and intelligence.

    The attack on the engineering firm was identified by Arctic Wolf in September before it could disrupt the engineering company’s operations or spread further.

    A message left with officials at the Russian Embassy in Washington seeking comment was not immediately returned.

    Many towns and cities around the world enjoy sister-city relationships with other communities, using the program to offer social and economic exchanges. Several U.S. cities, including Chicago, Baltimore, Albany, N.Y. and Cincinnati, have sister-city relationships with communities in Ukraine.

    The campaign in September came just a few weeks after the FBI warned that hackers linked to Russia were seeking to break into U.S. networks as a way to burrow into important systems or disrupt critical infrastructure. According to the latest bulletin from the U.S. Cybersecurity and Infrastructure Security Agency, the Russia-aligned hackers have multiple motives: disrupting aid and military supplies to Ukraine, punishing businesses with ties to Ukraine, or stealing military or technical secrets.

    Last month, the Digital Security Lab of Ukraine and investigators at SentinelOne, a U.S. cybersecurity firm, exposed a speedy and sprawling cyberattack on relief groups supporting Ukraine, including the International Red Cross and UNICEF. That hacking campaign used fake emails impersonating Ukrainian officials that sought to fool users into infecting their own computers by clicking on malicious links.

    The investigators at SentinelOne stopped short of attributing the attack to the Russian government but noted that the operation targeted groups working on Ukrainian assistance and required six months to plan. The “highly capable adversary” behind the campaign, the investigators determined, is “an operator well-versed in both offensive tradecraft and defensive detection evasion.”

    Source link

  • Cyberattack on CodeRED forces Douglas County Sheriff’s Office to seek new alert network

    The Douglas County Sheriff’s Office has stopped using its CodeRED system to alert residents of orders to evacuate or shelter in place or of other emergencies after learning of a cyberattack on the network and a data breach.

    Sheriff’s Deputy Daniel Carlin said Monday that the county stopped using CodeRED Nov. 21 when it learned of the data breach. Two weeks before that, the sheriff’s office started getting notifications that the system was down, but couldn’t get confirmation.

    Carlin said CodeRED, accessed through an app, lost a lot of customers’ information. “We don’t trust continuing to use them.”

    Although the data haven’t been published online, the sheriff’s office is encouraging all CodeRED users to contact credit bureaus to ensure their personal information has not been compromised. The sheriff’s office was among hundreds of agencies affected by the nationwide cybersecurity attack.

    Douglas County is talking to representatives of similar alert systems and hopes to have a new network locked in within the next week or two, Carlin said. Until then, the sheriff’s department will go door-to-door in cases of a need to evacuate or shelter in place and use social media and other means to alert people, he added.

    Douglas County is one of several counties that use CodeRED to alert residents of evacuation orders and other emergencies. Weld County also is looking for a new alert provider since CodeRED went down. The Park County Sheriff’s Office decommissioned the platform as well.

    It’s unclear how many other Colorado counties use CodeRED. A message left with the company seeking more information went unreturned as of 5 p.m.

    Some counties also use the state-run Integrated Public Alert and Warning System, or IPAWS, to notify people of wildfires and other emergencies.

    “CodeRED was a great system for us to alert the public very fast,” Carlin said. “Easy access is of concern, but we 100% believe we can mitigate it via door-to-door knocks and social media posts.”

    He said that residents will likely have to sign up for the system because their information won’t automatically be transferred.

    Sign up to get crime news sent straight to your inbox each day.

    Source link

  • Amazon Is Using Specialized AI Agents for Deep Bug Hunting

    As generative AI pushes the speed of software development, it is also enhancing the ability of digital attackers to carry out financially motivated or state-backed hacks. This means that security teams at tech companies have more code than ever to review while dealing with even more pressure from bad actors. On Monday, Amazon will publish details for the first time of an internal system known as Autonomous Threat Analysis (ATA), which the company has been using to help its security teams proactively identify weaknesses in its platforms, perform variant analysis to quickly search for other, similar flaws, and then develop remediations and detection capabilities to plug holes before attackers find them.

    ATA was born out of an internal Amazon hackathon in August 2024, and security team members say that it has grown into a crucial tool since then. The key concept underlying ATA is that it isn’t a single AI agent developed to comprehensively conduct security testing and threat analysis. Instead, Amazon developed multiple specialized AI agents that compete against each other in two teams to rapidly investigate real attack techniques and different ways they could be used against Amazon’s systems—and then propose security controls for human review.

    “The initial concept was aimed to address a critical limitation in security testing—limited coverage and the challenge of keeping detection capabilities current in a rapidly evolving threat landscape,” Steve Schmidt, Amazon’s chief security officer, tells WIRED. “Limited coverage means you can’t get through all of the software or you can’t get to all of the applications because you just don’t have enough humans. And then it’s great to do an analysis of a set of software, but if you don’t keep the detection systems themselves up to date with the changes in the threat landscape, you’re missing half of the picture.”

    As part of scaling its use of ATA, Amazon developed special “high-fidelity” testing environments that are deeply realistic reflections of Amazon’s production systems, so ATA can both ingest and produce real telemetry for analysis.

    The company’s security teams also made a point to design ATA so every technique it employs, and detection capability it produces, is validated with real, automatic testing and system data. Red team agents that are working on finding attacks that could be used against Amazon’s systems execute actual commands in ATA’s special test environments that produce verifiable logs. Blue team, or defense-focused agents, use real telemetry to confirm whether the protections they are proposing are effective. And anytime an agent develops a novel technique, it also pulls time-stamped logs to prove that its claims are accurate.

    This verifiability reduces false positives, Schmidt says, and acts as “hallucination management.” Because the system is built to demand certain standards of observable evidence, Schmidt claims that “hallucinations are architecturally impossible.”

    Lily Hay Newman

    Source link

  • US Border Patrol Is Spying on Millions of American Drivers

    Eight years after a researcher warned WhatsApp that it was possible to extract user phone numbers en masse from the Meta-owned app, another team of researchers found that they could still do exactly that using a similar technique. The issue stems from WhatsApp’s discovery feature, which allows someone to enter a person’s phone number to see if they’re on the app. By doing this billions of times—which WhatsApp did not prevent—researchers from the University of Vienna uncovered what they’re calling “the most extensive exposure of phone numbers” ever.

    Vaping is a major problem in US high schools. But is the solution to spy on students in the bathroom? An investigation by The 74, copublished with WIRED, found that schools around the country are turning to vape detectors in an effort to crack down on nicotine and cannabis consumption on school grounds. Some of the vape detectors go far beyond detecting vapor by including microphones that are surprisingly accurate and revealing. While few defend addiction and drug use, even non-vapers say the added surveillance and the punishments that result go too far.

    Don’t look now, but that old networking equipment your company hasn’t thought about in years may jump out and bite you. Tech giant Cisco this week launched a new initiative, warning companies that AI tools are making it increasingly simple for attackers to find vulnerabilities in outdated and unpatched networking infrastructure. The message: Upgrade or else.

    If you’ve ever attended a conference, you probably worried about getting sick in the cesspools that are a conference center. But one hacker conference in New Zealand, Kawaiicon, invented a novel way to keep attendees a little bit safer. By tracking the CO2 levels in each conference room, Kawaiicon’s organizers were able to create a real-time air-quality monitoring system, which would tell people which rooms were safe and which seemed … gross. The project brings new meaning to antivirus monitoring.

    And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    The US Border Patrol is operating a predictive-intelligence program that monitors millions of American drivers far beyond the border, according to a detailed investigation by the Associated Press. A network of covert license-plate readers—often hidden inside traffic cones, barrels, and roadside equipment—feeds data into an algorithm that flags “suspicious” routes, quick turnarounds, and travel to and from border regions. Local police are then alerted, resulting in traffic stops for minor infractions like window-tint violations, air fresheners, or marginal speeding. AP reviewed police records showing that drivers were questioned, searched, and sometimes arrested despite no contraband being found.

    Internal group chats obtained through public-records requests show Border Patrol agents and Texas deputies sharing hotel records, rental car status, home addresses, and social media details of US citizens in real time while coordinating what officers call “whisper stops” to obscure federal involvement. The AP identified plate-reader sites more than 120 miles from the Mexican border in the Phoenix area, as well as locations in metropolitan Detroit and near the Michigan-Indiana line that capture traffic headed toward Chicago and Gary. Border Patrol also taps DEA plate-reader networks and has, at various times, accessed systems run by Rekor, Vigilant Solutions, and Flock Safety.

    CBP says the program is governed by “stringent” policies and constitutional safeguards, but legal experts told AP that its scale raises new Fourth Amendment concerns. A UC Law San Francisco official said the system amounts to a “dragnet” tracking Americans’ movements, associations, and daily routines.

    Microsoft claims to have mitigated the largest distributed denial-of-service (DDoS) attack ever recorded in a cloud environment—a 15.72 Tbps, 3.64-billion-pps barrage launched on October 24 against a single Azure endpoint in Australia. Microsoft says The attack “originated from the Aisuru botnet,” a Turbo-Mirai–class IoT network of compromised home routers, cameras, and other consumer devices. More than 500,000 IP addresses are said to have participated, generating a massive DDoS attack with little spoofing. Microsoft says its global Azure DDoS Protection network absorbed the traffic without service disruption. Microsoft described the attack as the “the largest DDoS ever observed in the cloud,” emphasizing the single endpoint; however, Cloudflare also recently reported a 22.2 Tbps flood, naming it the largest DDoS attack ever seen.

    Researchers note that Aisuru has recently launched multiple attacks exceeding 20 Tbps and is expanding its capabilities to include credential stuffing, AI-driven scraping, and HTTPS floods via residential proxies.

    The US Securities and Exchange Commission has dropped its remaining claims against SolarWinds and its CISO, Tim Brown, ending a long-running case over the company’s 2020 supply-chain hack, in which Russian SVR operatives allegedly compromised SolarWinds’ Orion software and triggered widespread breaches across government and industry. The agency’s lawsuit—filed in 2023 and centered on alleged fraud and internal-control failures—had already been mostly dismantled by a federal judge in 2024. SolarWinds called the full dismissal a vindication of its argument that its disclosures and conduct were appropriate and said it hopes the outcome eases concerns among CISOs about the case’s potential chilling effect.

    Law enforcement records show that the FBI accessed messages from a private Signal group used by New York immigration court-watch activists—a network that coordinates volunteers monitoring public hearings at three federal immigration courts. According to a two-page FBI/NYPD “joint situational information report” dated August 28, 2025, agents quoted chat messages, labeled the nonviolent court watchers as “anarchist violent extremist actors,” and circulated the assessment nationwide. The report did not explain how the FBI penetrated an encrypted Signal group, but it claimed the information came from a “sensitive source with excellent access.”

    The documents, first reported by the Guardian, were original obtained by the government-transparency group Property of the People. They describe activists discussing how to enter courtrooms, film officers, and gather identifying details of federal personnel, but provide no evidence to support the FBI’s allegation that a member previously advocated violence. A separate set of records—also obtained by the group—shows the bureau framed ordinary observation of public immigration hearings as a potential threat, even as Immigration and Customs Enforcement has escalated courthouse arrests and set what advocates call “deportation traps.” Civil liberties experts told the paper that the surveillance mirrors earlier FBI campaigns targeting lawful dissent and risks chilling protected political activity.

    Dell Cameron, Andrew Couts

    Source link

  • Russian hacking suspect wanted by the FBI arrested on Thai resort island

    BANGKOK — Police have arrested a suspected Russian hacker on the Thai resort island of Phuket who was wanted by the FBI on allegations he was behind cyberattacks on U.S. and European government agencies, officials said.

    The 35-year-old, who entered Thailand on Oct. 30 at Phuket Airport, was taken into custody earlier this month at his hotel and is now being held pending possible extradition, Thai police said.

    The suspect’s name was not released but Russian state-run news agency Russia Today identified him as Denis Obrezko, a native of Stavropol. It reported that his relatives confirmed the Nov. 6 arrest and were planning to fight his extradition to the United States.

    In an e-mail Thursday, the U.S. Department of Justice refused to comment on the possible extradition or give other details. The U.S. State Department and American officials in Thailand also refused to comment.

    The Russian Foreign Ministry and the Russian embassy in Thailand also did not respond to requests for comment, but Russia’s consul general in Phuket, Yegor Ivanov, told Russian state news agency Tass that the consulate had “received notification of the arrest of a Russian citizen on charges of committing an information technology crime.”

    “He was arrested on November 6 and transferred to Bangkok that same day,” Ivanov said, without providing further details.

    Ilya Ilyin, head of the consular section of the Russian embassy in Thailand, told Tass on Monday that Russian diplomats had visited the suspect in prison in Bangkok.

    “Embassy staff conducted a consular visit to the Russian citizen detained at the request of the United States,” Ilyin said, adding that the embassy was arranging for him to be able to meet with his relatives.

    Thailand’s Cyber Crime Investigation Bureau said in a Nov. 12 statement that it was an FBI tip that the “world-class hacker” was traveling to Thailand that led to his arrest in Phuket on an international warrant.

    In the raid on his hotel, police seized laptop computers, mobile phones, and digital wallets, the police’s statement said, adding that FBI officials were on hand for the arrest.

    Several media outlets reported a second Russian hacking suspect wanted by the FBI, who has ties to Russian military intelligence, had been arrested in Phuket the following day, but Thai police said there had only been one arrest.

    The formal request for the suspect’s extradition has been made but it was not clear how long the process would take.

    Source link

  • Anthropic warns of AI-driven hacking campaign linked to China

    WASHINGTON (AP) — A team of researchers has uncovered what they say is the first reported use of artificial intelligence to direct a hacking campaign in a largely automated fashion.

    The AI company Anthropic said this week that it disrupted a cyber operation that its researchers linked to the Chinese government. The operation involved the use of an artificial intelligence system to direct the hacking campaigns, which researchers called a disturbing development that could greatly expand the reach of AI-equipped hackers.

    While concerns about the use of AI to drive cyber operations are not new, what is concerning about the new operation is the degree to which AI was able to automate some of the work, the researchers said.

    “While we predicted these capabilities would continue to evolve, what has stood out to us is how quickly they have done so at scale,” they wrote in their report.

    The operation targeted tech companies, financial institutions, chemical companies and government agencies. The researchers wrote that the hackers attacked “roughly thirty global targets and succeeded in a small number of cases.” Anthropic detected the operation in September and took steps to shut it down and notify the affected parties.

    Anthropic noted that while AI systems are increasingly being used in a variety of settings for work and leisure, they can also be weaponized by hacking groups working for foreign adversaries. The San Francisco-based company, maker of the generative AI chatbot Claude, is one of many tech developers pitching AI “agents” that go beyond a chatbot’s capability to access computer tools and take actions on a person’s behalf.

    “Agents are valuable for everyday work and productivity — but in the wrong hands, they can substantially increase the viability of large-scale cyberattacks,” the researchers concluded. “These attacks are likely to only grow in their effectiveness.”

    A spokesperson for China’s embassy in Washington did not immediately return a message seeking comment on the report.

    Microsoft warned earlier this year that foreign adversaries were increasingly embracing AI to make their cyber campaigns more efficient and less labor-intensive. The head of OpenAI’s safety panel, which has the authority to halt the ChatGPT maker’s AI development, recently told The Associated Press he’s watching out for new AI systems that give malicious hackers “much higher capabilities.”

    America’s adversaries, as well as criminal gangs and hacking companies, have exploited AI’s potential, using it to automate and improve cyberattacks, to spread inflammatory disinformation and to penetrate sensitive systems. AI can translate poorly worded phishing emails into fluent English, for example, as well as generate digital clones of senior government officials.

    Anthropic said the hackers were able to manipulate Claude, using “jailbreaking” techniques that involve tricking an AI system to bypass its guardrails against harmful behavior, in this case by claiming they were employees of a legitimate cybersecurity firm.

    “This points to a big challenge with AI models, and it’s not limited to Claude, which is that the models have to be able to distinguish between what’s actually going on with the ethics of a situation and the kinds of role-play scenarios that hackers and others may want to cook up,” said John Scott-Railton, senior researcher at Citizen Lab.

    The use of AI to automate or direct cyberattacks will also appeal to smaller hacking groups and lone wolf hackers, who could use AI to expand the scale of their attacks, according to Adam Arellano, field CTO at Harness, a tech company that uses AI to help customers automate software development.

    “The speed and automation provided by the AI is what is a bit scary,” Arellano said. “Instead of a human with well-honed skills attempting to hack into hardened systems, the AI is speeding those processes and more consistently getting past obstacles.”

    AI programs will also play an increasingly important role in defending against these kinds of attacks, Arellano said, demonstrating how AI and the automation it allows will benefit both sides.

    Reaction to Anthropic’s disclosure was mixed, with some seeing it as a marketing ploy for Anthropic’s approach to defending cybersecurity and others who welcomed its wake-up call.

    “This is going to destroy us – sooner than we think – if we don’t make AI regulation a national priority tomorrow,” wrote U.S. Sen. Chris Murphy, a Connecticut Democrat, on social media.

    That led to criticism from Meta’s chief AI scientist Yann LeCun, an advocate of the Facebook parent company’s open-source AI systems that, unlike Anthropic’s, make their key components publicly accessible in a way that some AI safety advocates deem too risky.

    “You’re being played by people who want regulatory capture,” LeCun wrote in a reply to Murphy. “They are scaring everyone with dubious studies so that open source models are regulated out of existence.”

    __

    O’Brien reported from Providence, Rhode Island.

    Source link

  • A Major Leak Spills a Chinese Hacking Contractor’s Tools and Targets

    The United States issued a seizure warrant to Starlink this week related to satellite internet infrastructure used in a scam compound in Myanmar. The action is part of a larger US law enforcement interagency initiative announced this week called the District of Columbia Scam Center Strike Force.

    Meanwhile, Google moved this week to sue 25 people that it alleges are behind a “staggering” and “relentless” scam text operation that uses a notorious phishing-as-a-service platform called Lighthouse.

    WIRED reported this week that the US Department of Homeland Security collected data on Chicago residents accused of gang ties to test if police files could feed an FBI watchlist—and then, crucially, kept the records for months in violation of domestic espionage rules.

    And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    China’s massive intelligence apparatus has never quite had its Edward Snowden moment. So any peak inside its surveillance and hacking capabilities represents a rare find. One such glimpse has now arrived in the form of about 12,000 documents leaked from the Chinese hacking contractor firm KnownSec, first revealed on the Chinese-language blog Mxrn.net and then picked up by Western news outlets this week. The leak includes hacking tools such as remote-access Trojans, as well as data extraction and analysis programs. More interesting, perhaps, is a target list of more than 80 organizations from which the hackers claim to have stolen information. The listed stolen data, according to Mrxn, includes 95 GB of Indian immigration data, three TB of call records from South Korean telecom operator LG U Plus, and a mention of 459 GB of road-planning data obtained from Taiwan, for instance. If there were any doubts as to whom KnownSec was carrying out this hacking for, the leak also reportedly includes details of its contracts with the Chinese government.

    The cybersecurity community has been warning for years that state-sponsored hackers would soon start using AI tools to supercharge their intrusion campaigns. Now the first known AI-run hacking campaign has surfaced, according to Anthropic, which says it discovered a group of China-backed hackers using its Claude tool set extensively in every step of the hacking spree. According to Anthropic, the hackers used Claude to write malware and extract and analyze stolen data with “minimal human interaction.” Although the hackers bypassed Claude’s guardrails by couching the malicious use of its tools in terms of defensive and whitehat hacking, Anthropic says it nonetheless detected and stopped them. By that time, however, the spy campaign had successfully breached four organizations.

    Even so, fully AI-based hacking still isn’t necessarily ready for prime time, points out Ars Technica. The hackers had a relatively low intrusion rate, given that they targeted 30 organizations, according to Anthropic. The AI startup also notes that the tools hallucinated some stolen data that didn’t exist. For now, state-sponsored spies still have some job security.

    The North Koreans raising money for the regime of Kim Jong Un by getting jobs as remote IT workers with false identities aren’t working alone. Four Americans pleaded guilty this week to letting North Koreans pay to use their identities, as well as receiving and setting up corporate laptops for the North Korean workers to remotely control. Another man, Ukrainian national Oleksandr Didenko, pleaded guilty to stealing the identities of 40 Americans to sell to North Koreans for use in setting up IT worker profiles.

    A report from 404 Media shows that a Customs and Border Protection app that uses face recognition to identify immigrants is being hosted by Google. The app can be used by local law enforcement to determine whether a person is of potential interest to Immigration and Customs Enforcement. While platforming the CBP app, Google has meanwhile recently taken down some apps in the Google Play Store used for community discussion about ICE activity and ICE agent sightings. Google justified these app takedowns as necessary under its terms of service, because the company says that ICE agents are a “vulnerable group.”

    Andy Greenberg, Lily Hay Newman

    Source link

  • Anthropic warns of AI-driven hacking campaign linked to China

    WASHINGTON — A team of researchers has uncovered what they say is the first reported use of artificial intelligence to direct a hacking campaign in a largely automated fashion.

    The AI company Anthropic said this week that it disrupted a cyber operation that its researchers linked to the Chinese government. The operation involved the use of an artificial intelligence system to direct the hacking campaigns, which researchers called a disturbing development that could greatly expand the reach of AI-equipped hackers.

    While concerns about the use of AI to drive cyber operations are not new, what is concerning about the new operation is the degree to which AI was able to automate some of the work, the researchers said.

    “While we predicted these capabilities would continue to evolve, what has stood out to us is how quickly they have done so at scale,” they wrote in their report.

    The operation was modest in scope and only targeted about 30 individuals who worked at tech companies, financial institutions, chemical companies and government agencies. Anthropic noticed the operation in September and took steps to shut it down and notify the affected parties.

    The hackers only “succeeded in a small number of cases,” according to Anthropic, which noted that while AI systems are increasingly being used in a variety of settings for work and leisure, they can also be weaponized by hacking groups working for foreign adversaries. Anthropic, maker of the generative AI chatbot Claude, is one of many tech companies pitching AI “agents” that go beyond a chatbot’s capability to access computer tools and take actions on a person’s behalf.

    “Agents are valuable for everyday work and productivity — but in the wrong hands, they can substantially increase the viability of large-scale cyberattacks,” the researchers concluded. “These attacks are likely to only grow in their effectiveness.”

    A spokesperson for China’s embassy in Washington did not immediately return a message seeking comment on the report.

    Microsoft warned earlier this year that foreign adversaries were increasingly embracing AI to make their cyber campaigns more efficient and less labor-intensive.

    America’s adversaries, as well as criminal gangs and hacking companies, have exploited AI’s potential, using it to automate and improve cyberattacks, to spread inflammatory disinformation and to penetrate sensitive systems. AI can translate poorly worded phishing emails into fluent English, for example, as well as generate digital clones of senior government officials.

    Source link

  • The Government Shutdown Is a Ticking Cybersecurity Time Bomb

    Amid a government shutdown that has dragged on for more than five weeks, the United States Congressional Budget Office said on Thursday that it recently suffered a hack and moved to contain the breach. CBO provides nonpartisan financial and economic data to lawmakers, and The Washington Post reported that the agency was infiltrated by a “suspected foreign actor.”

    CBO spokesperson Caitlin Emma told WIRED in a statement that it has “implemented additional monitoring and new security controls to further protect the agency’s systems” and that “CBO occasionally faces threats to its network and continually monitors to address those threats.” Emma did not address questions from WIRED about whether the government shutdown has impacted technical personnel or cybersecurity-related work at CBO.

    With increasing instability in the Supplemental Nutrition Assistance Program (SNAP) leaving Americans hungry, air traffic control personnel shortages disrupting flights, financial devastation for federal workers, and mounting operational shortages at the Social Security Administration, the shutdown is increasingly impacting every corner of the US. But researchers, former and current government workers, and federal technology experts warn that gaps in foundational activities during the shutdown—things like system patching, activity monitoring, and device management—could have real effects on federal defenses, both now and for years to come.

    “A lot of federal digital systems are still just running in the cloud throughout the shutdown, even if the office is empty,” says Safi Mojidi, a longtime cybersecurity researcher who previously worked for NASA and as a federal security contractor. “If everything was set up properly, then the cloud offers an important baseline of security, but it’s hard to rest easy during a shutdown knowing that even in the best of times there are problems getting security right.”

    Even before the shutdown, federal cybersecurity workers were being impacted by reductions in force at agencies like the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency—potentially hindering digital defense guidance and coordination across the government. And CISA has continued cutting staff during the shutdown as well.

    In a statement, spokesperson Marci McCarthy said “CISA continues to execute on its mission” but did not answer WIRED’s specific questions about how its work and digital defenses at other agencies have been impacted by the government shutdown, which she blamed on Democrats.

    The government’s transition to the cloud over the last decade, as well as increased attention to cybersecurity in recent years, does provide an important backstop for a disruption like a shutdown. Experts emphasize, though, that the federal landscape is not homogenous, and some agencies have made more progress and are better equipped than others. Additionally, missed and overlooked digital security work that accumulates during the shutdown will create a backlog when workers return that could be difficult to surmount.

    Lily Hay Newman

    Source link

  • Congressional Budget Office implements new security measures after getting hacked

    WASHINGTON — The Congressional Budget Office on Thursday confirmed it had been hacked, potentially disclosing important government data to malicious actors.

    The small government office, with some 275 employees, provides objective, impartial analysis to support lawmakers during the budget process. It is required to produce a cost estimate for nearly every bill approved by a House or Senate committee and will weigh in earlier when asked to do so by lawmakers.

    Caitlin Emma, a spokeswoman for the CBO said in a written statement that the agency “has identified the security incident, has taken immediate action to contain it, and has implemented additional monitoring and new security controls to further protect the agency’s systems going forward.”

    The Washington Post first wrote the story on the CBO hack, stating that the intrusion was done by a suspected foreign actor, citing four anonymous people familiar with the situation.

    The CBO did not confirm whether the data breach was done by a foreign actor.

    “The incident is being investigated and work for the Congress continues,” Emma said. “Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats.”

    The CBO manages a variety of massive data sources that relate to a multitude of policy issues — from the Trump administration’s mass deportation plans, to the unprecedented implementation of sweeping tariffs on countries around the world, to massive tax and spending cuts passed into law this summer.

    Source link

  • How to Hack a Poker Game

    Michael Calore: Yeah. My favorite indiscreet product placement was in the show Entourage from HBO. It was on TV, I don’t know, 15 years ago.

    Lauren Goode: Oh, I remember it.

    Michael Calore: And the characters used to say to each other, “I’ll BBM it to you.”

    Lauren Goode: No. Time capsule.

    Michael Calore: Yeah. Which is like, even if you had a Blackberry—

    Lauren Goode: Yeah, you never said that.

    Michael Calore: Nobody ever said that.

    Lauren Goode: No, it’s so true.

    Michael Calore: They would text it to you.

    Lauren Goode: Incredible.

    Michael Calore: But no, I’m going to BBM it to you.

    Andy Greenberg: Just the fact that we even know what BBM-ing is just kind of means it worked.

    Lauren Goode: Or maybe it’s more, “What is that, guys? I don’t remember that. I’m too young.” All right, Andy, give us your WIRED, TIRED.

    Andy Greenberg: Well, I am not a video game reporter, but I did buy the—everybody has been talking about this game Silksong. It was $20 on the Switch. I bought it for my 9-year-old son, and I thought that I would play this cute little game and I just cannot believe how fricking hard it is. Nobody is talking about the fact that this incredibly popular game—it makes you want to cry. Like me, not my son, like me, the adult. I cannot stop playing it.

    But I have been more frustrated playing this game than I have been maybe in anything else in my life or work for years. This is my extremely amateur video game trend watching observation that for a while all these games got really easy like Candy Crush and Farmville and Angry Bird stuff where you just basically can’t lose. And people seem to love that and games got incredibly easy. And now it feels like we’re in this era where games are just absurdly hard, including these—what look like casual games for kids are in fact some of the most challenging things you will do in your life. And actually I think it’s great. So yeah, I would say TIRED are easy games and WIRED is games that are ridiculously hard and making me want to cry.

    Lauren Goode, Michael Calore, Andy Greenberg

    Source link

  • North Korea’s Crypto Theft Reaches $2.83B Since 2024


    Chinese, Russian, and Cambodian intermediaries reportedly played key roles in moving and cashing the stolen funds.

    A new report by the Multilateral Sanctions Monitoring Team (MSMT) shows that North Korean hackers stole $2.83 billion in cryptocurrency between January 2024 and September 2025.

    This figure accounts for nearly one-third of the country’s total foreign currency income in 2024.

    Bybit Exploit Was the Largest Contributor

    The MSMT, a coalition of 11 countries formed in October 2024, was created to track how North Korea evades international sanctions through cybercrime. Its latest findings reveal that the scale of crypto theft rose in 2025, with hackers stealing $1.64 billion in the first nine months alone, marking a 50% increase from the $1.19 billion stolen last year.

    Most of this year’s total came from a February attack on Bybit, which was linked to the TraderTraitor group, also known as Jade Sleet or UNC4899. The hackers targeted SafeWallet, a multi-signature wallet provider for Bybit, using phishing emails and malware to gain access to internal systems. They then disguised external transfers to appear as internal ones, allowing them to take control of the cold wallet’s smart contract and move the funds undetected.

    According to the MSMT, North Korean hackers often avoid attacking exchanges directly, instead targeting third-party service providers. Groups such as TraderTraitor, CryptoCore, and Citrine Sleet have used fake developer profiles, stolen identities, and detailed knowledge of software supply chains to carry out their attacks. In one notable case, the Web3 project Munchables lost $63 million in a hack, although the funds were later returned after they reportedly faced problems during laundering.

    How the Laundering Works

    The analysis reveals a nine-step process used to clean and convert stolen crypto into cash. Hackers begin by swapping stolen assets for Ethereum (ETH) on decentralized exchanges, then use mixing services such as Tornado Cash and Wasabi Wallet to hide transaction trails. The ETH is then converted to Bitcoin (BTC) through bridge platforms, mixed again, stored in cold wallets, and then traded for Tron (TRX) before being converted to USDT. The final step involves sending USDT to over-the-counter brokers who exchange it for cash.

    Brokers and companies in China, Russia, and Cambodia were identified as key players in this process. In China, nationals Ye Dinrong and Tan Yongzhi of Shenzhen Chain Element Network Technology, along with trader Wang Yicong, helped move funds and create fake IDs. Russian intermediaries converted about $60 million from the Bybit hack through OTC brokers, while Cambodia’s Huione Pay was used to transfer stolen funds despite its license not being renewed by the central bank.

    You may also like:

    The MSMT also said that North Korean hackers have worked with Russian-speaking cybercriminals since the 2010s. In 2025, actors linked to Moonstone Sleet leased ransomware tools from the Russia-based group Qilin.

    In response, the 11 jurisdictions making up the MSMT issued a joint statement urging UN member countries to raise awareness on these cyber activities and called on the UN Security Council to restore its Panel of Experts “in the same strength and structure it had prior to its disbandment.”

    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER for CryptoPotato readers at Bybit: Use this link to register and open a $500 FREE position on any coin!

    Wayne Jones

    Source link

  • Amazon Explains How Its AWS Outage Took Down the Web

    The cloud giant Amazon Web Services experienced DNS resolution issues on Monday leading to cascading outages that took down wide swaths of the web. Monday’s meltdown illustrated the world’s fundamental reliance on so-called hyperscalers like AWS and the challenges for major cloud providers and their customers alike when things go awry. See below for more about how the outage occurred.

    US Justice Department indictments in a mob-fueled gambling scam reverberated through the NBA on Thursday. The case includes allegations that a group backed by the mob was using hacked card shufflers to con victims out of millions of dollars—an approach that WIRED recently demonstrated in an investigation into hacking Deckmate 2 card shufflers used in casinos.

    We broke down the details of the shocking Louvre jewelry heist and found in an investigation that US Immigration and Customs Enforcement likely did not buy guided missile warheads as part of its procurements. The transaction appears to have been an accounting coding error.

    Meanwhile, Anthropic has partnered with the US government to develop mechanisms meant to keep its AI platform, Claude, from guiding someone through building a nuclear weapon. Experts have mixed reactions, though, about whether this project is necessary—and whether it will be successful. And new research this week indicates that a browser seemingly downloaded millions of times—known as the Universe Browser—behaves like malware and has links to Asia’s booming cybercrime and illegal gambling networks.

    And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    AWS confirmed in a “post-event summary” on Thursday that its major outage on Monday was caused by Domain System Registry failures in its DynamoDB service. The company also explained, though, that these issues tipped off other problems as well, expanding the complexity and impact of the outage. One main component of the meltdown involved issues with the Network Load Balancer service, which is critical for dynamically managing the processing and flow of data across the cloud to prevent choke points. The other was disruptions to launching new “EC2 Instances,” the virtual machine configuration mechanism at the core of AWS. Without being able to bring up new instances, the system was straining under the weight of a backlog of requests. All of these elements combined to make recovery a difficult and time-consuming process. The entire incident—from detection to remediation—took about 15 hours to play out within AWS. “We know this event impacted many customers in significant ways,” the company wrote in its post mortem. “We will do everything we can to learn from this event and use it to improve our availability even further.”

    The cyberattack that shut down production at global car giant Jaguar Land Rover (JLR) and its sweeping supply chain for five weeks is likely to be the most financially costly hack in British history, a new analysis said this week. According to the Cyber Monitoring Centre (CMC), the fallout from the attack is likely to be in the region of £1.9 billion ($2.5 billion). Researchers at the CMC estimated that around 5,000 companies may have been impacted by the hack, which saw JLR stop manufacturing, with the knock-on impact of its just-in-time supply chain also forcing firms supplying parts to halt operations as well. JLR restored production in early October and said its yearly production was down around 25 percent after a “challenging quarter.”

    ChatGPT maker OpenAI released its first web browser this week—a direct shot at Google’s dominant Chrome browser. Atlas puts OpenAI’s chatbot at the heart of the browser, with the ability to search using the LLM and have it analyze, summarize, and ask questions of the web pages you’re viewing. However, as with other AI-enabled web browsers, experts and security researchers are concerned about the potential for indirect prompt injection attacks.

    These sneaky, almost unsolvable, attacks involve hiding a set of instructions to an LLM in text or an image that the chatbot will then “read” and act upon; for instance, malicious instructions could appear on a web page that a chatbot is asked to summarize. Security researchers have previously demonstrated how these attacks could leak secret data.

    Almost like clockwork, AI security researchers have demonstrated how Atlas can be tricked via prompt injection attacks. In one instance, independent researcher Johann Rehberger showed how the browser could automatically turn itself from dark mode to light mode by reading instructions in a Google Document. “For this launch, we’ve performed extensive red-teaming, implemented novel model training techniques to reward the model for ignoring malicious instructions, implemented overlapping guardrails and safety measures, and added new systems to detect and block such attacks,” OpenAI CISO Dane Stuckey wrote on X. “However, prompt injection remains a frontier, unsolved security problem, and our adversaries will spend significant time and resources to find ways to make ChatGPT agent[s] fall for these attacks.”

    Researchers from the cloud security firm Edera publicly disclosed findings on Tuesday about a significant vulnerability impacting open source libraries for a file archiving feature often used for distributing software updates or creating backups. Known as “async-tar,” numerous “forks” or adapted versions of the library contain the vulnerability and have released patches as part of a coordinated disclosure process. The researchers emphasize, though, that one widely used library, “tokio-tar,” is no longer maintained—sometimes called “abandonware.” As a result, there is no patch for tokio-tar users to apply. The vulnerability is tracked as CVE-2025-62518.

    “In the worst-case scenario, this vulnerability … can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends,” the researchers wrote. “Our suggested remediation is to immediately upgrade to one of the patched versions or remove this dependency. If you depend on tokio-tar, consider migrating to an actively maintained fork like astral-tokio-tar.”

    Over the last decade, hundreds of thousands of people have been trafficked to forced labor compounds in Southeast Asia. In these compounds—mostly in Myanmar, Laos, and Cambodia—these trafficking victims have been compelled to run online scams and steal billions for organized crime groups.

    When law enforcement agencies have shut off internet connections to the compounds, the criminal gangs have often turned to Elon Musk’s Starlink satellite system to stay online. In February, a WIRED investigation found thousands of phones connecting to the Starlink network at eight compounds based around the Myanmar-Thailand border. At the time, the company did not respond to queries about the use of its systems. This week, multiple Starlink devices were seized in a raid at a Myanmar compound.

    Matt Burgess, Lily Hay Newman

    Source link

  • The Obscure Tech at the Heart of the Bombshell NBA Gambling Scandal

    Since the invention of the card game, players have been looking for ways to stack the deck. Now, with the development of automated card shufflers, it would appear that a group well practiced in such illicit activities—the Costa Nostra mafia—may have found a new way to rig games for easy money. And, weirdly enough, those games are alleged to have involved a bunch of current and former NBA officials and players, who are now in quite a bit of trouble.

    A new federal indictment claims that members of organized crime families hosted games that used hacked card shufflers. Those shufflers allowed the players who were in on the ruse to play accordingly and win big time, the indictment claims. The story was originally picked up by Wired, which says it managed to reproduce a hack of one particular brand of card shuffler, the Deckmate 2.

    The indictment doesn’t mention the brand of deck shuffler relevant to the case, although Wired has reported the following:

    In their games…several alleged defendants are said to have used pre-rigged Deckmate 2 shufflers under their own control rather than hack machines owned by others via their USB port [the machines can also be hacked, the outlet notes].

    However, the accused schemers at the heart of the case are also said to have used a whole assortment of other bizarre technologies to keep the odds in their favor. According to the indictment, those technologies included “electronic poker chip trays” that could “secretly read cards placed on the poker table.” They also allegedly used card analyzers that were “loaded onto decoy cellular telephones.” Finally, they are also accused of using cards that were outfitted with hidden “markers,” the likes of which were only visible to “individuals wearing specially designed contact lenses or sunglasses.” The whole thing is less The Godfather, more James Bond.

    The defendants listed in the case include a member of the Bonanno crime family, multiple associates and members of the Gambino crime family, and a former member of the Genovese crime family, among many other conspirators. The games were allegedly hosted in New York City, and the indictment says that the organizers would invite wealthy players and try to encourage their participation by involving “well known former professional athletes” in the games. Indeed, several NBA members have been arrested as part of the probe into the scheme, including Portland Trail Blazers coach Chauncey Billups, former Cleveland Cavaliers player and assistant coach Damon Jones. Miami Heat guard Terry Rozier was also arrested as part of a separate probe into an illegal sports betting scheme that used insider information, ESPN writes.

    Even outside of the alleged cheating, the games in question were illegal, the indictment says (it is illegal to gamble for money in New York without the appropriate licenses). Humorously, the indictment claims that many of the participants still thought they were participating in “straight” illegal games—ostensibly illegal games that were being played fairly. Instead, the indictment alleges:

    …the defendants and their co-conspirators…worked together on cheating teams (collectively, the “Cheating Teams”) that used advanced wireless technologies to read the cards dealt in each poker hand and relay that information to the defendants and coconspirators participating in the illegal poker games (collectively, the “Rigged Games”). The defendants and their co-conspirators then bet accordingly to ensure that the unsuspecting Victims lost money.

    The indictment says that the games in question were “on record” with, and operated with the express permission and approval of, members and associates of certain organized crime families of La Cosa Nostra, who provided support and protection for the games and collected owed debts from the games in exchange for a portion of the illegal gambling proceeds.” The indictment adds that the defendants made “millions” through the scheme.

    This also isn’t the first time we’ve heard about the hacking of shuffling machines. Back in 2023, Wired reported on the work of security researchers at Blackhat who showed it was quite easy to penetrate the defenses of devices like the Deckmate. Gizmodo reached out to Deckmate’s parent company, Light & Magic, for comment. The company provided the following statement: “We are aware of the news reports regarding the indictment against the named defendants, who are not affiliated with our company. We sell and lease our automatic card shufflers and other gaming products and services only to licensed casinos and other licensed gaming establishments. We will cooperate in any law enforcement investigation related to this indictment.”

    Lucas Ropek

    Source link

  • How Hacked Card Shufflers Allegedly Enabled a Mob-Fueled Poker Scam That Rocked the NBA

    “If there’s a camera that knows the cards, there is always some kind of underlying threat. Customers are gonna be essentially at the mercy of the person setting up the machine,” poker player and card house owner Doug Polk previously told WIRED. “If you’re showing up in a private game and there’s a shuffler, I would say you should run for the hills.”

    Hacking the Deckmate 2, according to prosecutors, was only one of several cheating techniques the mobsters allegedly used, albeit the one that’s described in the most detail in the indictment. The charging document also claims that they used invisibly marked cards, electronic poker chip trays, phones that could secretly read cards’ markings, and even specially designed glasses and contact lenses.

    While the details of those schemes weren’t spelled out by prosecutors, they’re all well known in the casino security world, says Sal Piacente, a professional cheating consultant and the president of UniverSal Game Protection. Cards can, for instance, have hidden bar codes on their edges—printed invisibly, such as with infrared ink—that can be deciphered by a reader hidden in a chip tray or in a phone case laid on the table. In other cases, cards are similarly marked on their backs with ink that’s only visible with special glasses or contacts.

    “This kind of equipment is being used more than you would think,” Piacente says. “When you go to a private game, there’s no regulation, no commission, no rules. Anything goes.”

    Andy Greenberg

    Source link