Put a digital lock on your most important data.

You never know when one of your files might reach someone it wasn't intended to reach—perhaps through an email forward, a USB stick left behind on a desk, or maybe even an unauthorized user accessing your computer.

Should that happen, password protection is all that stands between your data and the people whom you don't want to see it. It's an extra layer of security you can add to your most sensitive files without too much trouble.

How you go about this will depend on the software you're using to create the file in the first place. Some applications have password protection features built in, while in other cases you'll need to lock up your files using a different method.

Microsoft Word, Excel, and PowerPoint

Adding a password to a document in Word.

Microsoft Word via David Nield

In Word, Excel, or PowerPoint for Windows, open the file you want to protect with a password, then select **File** and **Info**. You should see a Protect option at the top of the next list: Click this button, choose **Encrypt with Password**, and type out your password.

Passwords can be up to 15 characters long and are case-sensitive, so double-check what you're typing in. If you forget the password for a document, spreadsheet, or presentation, you won't be able to get back into it—you'll have to start again from scratch.

If you're using Office on macOS, the process is slightly different: Open the **Review** tab in the ribbon menu at the top, then click the **Protect** button to enter a password. (The button will be labeled slightly differently depending on which program you're in.)

Google Docs, Sheets, and Slides

Sharing a document in Google Docs.

Google Docs via David Nield

There's no password protection feature as such in Google Drive, because your files are already protected by a password: The password linked to your Google account that you use to log in and view your documents, spreadsheets, and presentations.

If you choose to share a file from Google Docs, Sheets, or Slides—via the big **Share** button in the top-right corner when you're working on something—you can either invite specific users to see it (via their email addresses) or generate a link that anyone can use.

We'd recommend the former option (inviting individual users) for maximum security. This means they'll need to log in with their own Google account password—another layer of password protection—before being able to view the file you've shared.

Apple Pages, Numbers, and Keynote

Setting a password on a document in Apple Pages.

Apple Pages via David Nield

If it's the Apple office applications that you're using, the process of adding a password couldn't be much easier. With the file open in Pages, Numbers, or Keynote, select **File** and then **Set Password** to choose and apply your password.

The same warning applies as it does with Microsoft Office—if you can't remember your password then you're not going to be able to get back into your document, spreadsheet, or presentation (otherwise hackers would be able to get in as well).

Note the **Open with Touch ID** checkbox on the password dialog. This gives you the option of using a Touch ID–enabled keyboard on macOS to open your own protected files, saving you the trouble of typing out a password each time.

Protecting Other Files

Adding password protection to a folder on Dropbox.

Dropbox via David Nield

We can't cover every application out there in terms of password protection, but if you dig around in the programs that you're using you might find that they offer this form of additional security while saving files.

If not, you've still got a few options. Keeping files in cloud storage lockers (like Google Drive) is one option: The act of sharing files on these services usually requires a username and password to log in, so your files are kept safe in that way.

Sometimes there are extra features. In the case of Dropbox, for example, on the folder-sharing pane on the web, you can click **Settings** and then change **Who has access** to **People with password**—so both a unique URL and a password are required for access.

If you need another option, create a password-protected archive containing the file or files that you need to keep safe. 7-Zip is a free tool for Windows that is able to build password-protected archives, for example.

Should your files be on an external hard drive, you can encrypt the entire drive and add a password to guard against unwanted access: In Windows, right-click on the drive in File Explorer and choose **Turn on BitLocker**; on macOS, go through the Disk Utility.

Third-party applications such as VeraCrypt (free for both Windows and macOS) are also able to encrypt drives for you, adding password protection at the same time. It's a sensible choice if you're putting sensitive data on a portable storage device.

How to Password Protect Any File

Plus: Firefox adds new privacy protections, a big Intel and AMD chip flaw, and more of the week’s top security news.

This week, WIRED revealed new details that link an Indian police force to a hacking campaign against human rights defenders and activists. Researchers at SentinelOne uncovered connections between the city of Pune’s police agency and evidence planted on the devices of activists, as part of a hacking campaign dubbed Modified Elephant. It is alleged that evidence was planted on the computers of activists Rona Wilson and Varvara Rao and then used to arrest the two men. Among other details, an unnamed security analyst at an email provider revealed to SentinelOne and WIRED that the email address and phone number of a Pune police official was set as the recovery email on hacked accounts.

Elsewhere, a new front is emerging in Russia’s war against Ukraine. In the occupied city of Kherson and other nearby regions, Russian forces are routing internet connections from Ukrainian internet service providers to Russian companies. Ukrainian officials tell WIRED the shifts are happening at a large scale and could result in people being subjected to Vladimir Putin’s surveillance and censorship machine.

Robocalls aren’t going away. There’s been progress in tackling the nuisance calls in recent years but the spammy calls are still prevalent. This week we looked into the roots of the problem and what can still be done in the fight against robocalls. We also looked at a new way for cops to collect your fingerprints. How censors in Shanghai haven’t been able to hide stories of the city’s dead during an aggressive Covid-19 lockdown. And the dwindling options facing WikiLeaks founder Julian Assange after the UK Home Office approved his extradition to the US, where he faces espionage and hacking charges.

But that's not all, folks. Each week we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there.

Viktor Muller Ferreira had a traumatic childhood. Growing up, his father and mother—who had adopted him—split up. His mother later died of pneumonia, and his aunt, who raised him, also passed away. The family didn’t have much money. At school, children bullied Ferreira for his looks and his weird accent. As a result, he didn’t have many friends.

One day when his aunt was out, a neighborhood boy came round and told Ferreira that he was the fairy tale character Grey Shadow and he was going to “devour” him. “This scared me so much that I spent the entire day in a small box out on the balcony, praying until my aunt came home.” As he grew older he worked in a garage, took an interest in journalism, and moved to Brazil to reunite with his estranged father and “restore my citizenship.”

Except, according to authorities in the Netherlands, none of that is true.

Dutch intelligence agency AVID claimed this week that “Viktor Muller Ferreira” is just a cover story and false identity for Sergey Vladimirovich Cherkasov, an alleged Russian intelligence officer belonging to the GRU military unit. AVID said it caught Cherkasov applying to be an intern at the International Criminal Court at The Hague, which is investigating potential war crimes in Russia’s wars against Ukraine and Georgia.

As well as stopping Cherkasov from obtaining the position at the ICC and sending him back to Brazil, the Dutch intelligence agency also published his long and detailed cover story. The four-page story, often known as a covert intelligence officer’s “legend,” details the background of the “Ferreira” identity. “The threat posed by this intelligence officer is deemed potentially very high,” AVID said in a statement.

Since outing “Ferreira,” more clues about his undercover life have emerged. Social media profiles belonging to “Ferreira” have been discovered by the investigative unit Bellingcat, as well as a blog and online CV. He also studied at Trinity College Dublin and Johns Hopkins University. Eugene Finkel, an associate professor at Johns Hopkins, who says he taught “Ferreira,” tweeted: “I wrote him a letter. A strong one, in fact. Yes, me. I wrote a reference letter for a GRU officer. I will never get over this fact. I hate everything about GRU, him, this story. I am so glad he was exposed.”

For years it’s been impossible to move backups of WhatsApp chats between Android and iOS, and vice versa. In August last year, WhatsApp announced it was starting to roll out the ability for people to move their data between iPhones and Android devices. Now, this week, the Meta-owned company says backups will work in the other direction too—from Android to iOS.

Processors from Intel and AMD are vulnerable to a new side-channel attack called Hertzbleed. The attack could allow the theft of cryptographic keys and data, as reported by BleepingComputer and DarkReading. Hertzbleed works by exploiting a common power-saving feature in chips—called dynamic frequency scaling (DVFS)—that could allow an attacker to steal data. Frequency changes in DVFS may be correlated with information being processed by chips, Intel says in a blog post. Despite this, neither Intel nor AMD appear to have plans to address the issue. However, the risk to end users seems low at the moment. The team of researchers who found Hertzbleed say ordinary users probably shouldn’t be worried.

Ever since Covid-19 started spreading in early 2020, technological systems have been developed to try to control its spread. In China, a mandatory health code system was created to monitor people’s health status—people with a red code are required to self-isolate, those with a green code are allowed to move freely. These health codes are tied to people’s phones. Now, according to multiple reports, people in the Chinese province of Henan claim their plans to protest have been blocked as their health code has been turned red. Several people impacted claim they have not been around anyone positive with Covid-19 and the change is an abuse of power by officials.

Mozilla’s web browser may have been struggling in recent years, but it is still one of the most privacy-friendly browsers. This week the company said Firefox is turning on its Total Cookie Protection feature by default for everyone using the browser. Any cookies saved to your computer will be available only to the website that placed them there, Mozilla explains in a blog post. “Instead of allowing trackers to link up your behavior on multiple sites, they just get to see behavior on individual sites,” the company says, adding it is “Firefox’s strongest privacy protection to date.”

In November 2021, the US sanctioned notorious Israeli spyware firm NSO Group. The company’s Pegasus hacking tool has been used around the world to spy on journalists and activists. This week it emerged that US defense firm L3Harris is interested in purchasing the technology behind Pegasus, as the _Financial Times_ reports. Any purchase of the technology by a US company would potentially put it at odds with the Biden administration, which blacklisted NSO. Talk of the potential deal, which was said to be in early stages, has prompted criticism from the White House. “We are deeply concerned,” a senior official told the _Washington Post_. They said the deal could cause security and counterintelligence issues for the US.

An Alleged Russian Spy Was Busted Trying to Intern at The Hague

The WikiLeaks founder will appeal the UK Home Office's decision to extradite him to the US.

WikiLeaks founder Julian Assange faces a dwindling number of options after the UK government approved his extradition to the United States on Friday. The decision is the latest chapter in a prolonged legal battle that started when former military intelligence analyst Chelsea Manning leaked classified government documents about the wars in Afghanistan and Iraq, which Assange published on WikiLeaks in 2010.

Friday’s decision, approved by UK home secretary Priti Patel, is the latest in a series of legal battles Assange has lost in his effort to remain in the UK. It’s a blow to Assange, who has spent the last decade either in hiding in Ecuador’s London embassy or in a UK prison. And his increasingly likely prosecution in US courts creates a precarious moment for First Amendment rights and the ability of news outlets to publish material deemed a threat to national security.

“This is a dark day for Press freedom and for British democracy,” WikiLeaks said in a statement shared on Twitter. “Julian did nothing wrong. He has committed no crime and is not a criminal. He is a journalist and a publisher.” Wikileaks said Assange intends to appeal.

“Assange may have at least one more avenue of appeal, so he may not be on a flight to the United States just yet,” Trevor Timm, executive director of the group Freedom of Press, said in a statement. “But this is one more troubling development in a case that could upend journalists’ rights in the 21st century.” The charges against Assange include 17 under the Espionage Act and one under the Computer Fraud and Abuse Act.

Friday’s ruling overturns a December 2021 decision that declared Assange could not be extradited because subjecting him to US incarceration could increase the risk of suicide. The judge has accepted US assurances that Assange won’t face solitary confinement and will have access to psychological treatment.

“The UK courts have not found that it would be oppressive, unjust, or an abuse of process to extradite Mr. Assange,” a spokesperson for the British Home Office told WIRED. “Nor have they found that extradition would be incompatible with his human rights, including his right to a fair trial and to freedom of expression, and that whilst in the US he will be treated appropriately, including in relation to his health.”

Assange’s legal team has 14 days to appeal, according to the Home Office. His next step, now that the defense’s argument based on Assange’s suicide risk has been rejected, would likely be to focus on the other arguments his team has made against extradition, such as the threat it poses to press freedom and the political bias against Assange from United States law enforcement, given that Assange has been a thorn in the side of the US executive branch for over a decade.

“I think there’s a lot of roads to run here,” says Naomi Colvin, UK/ Ireland director at the advocacy group Blueprint for Free Speech. She points out that even if these additional arguments fail to sway the UK judicial system, Assange can also appeal to the European Court of Human Rights in Strasbourg, France, arguing that extradition would violate the UK’s commitment to human rights treaties. In yet another option, Assange’s team could demand a judicial review that would challenge the political side of Patel’s decision specifically, Colvin adds.

Assange has faced charges in the United States since April of 2019, when the US Department of Justice indicted him for hacking crimes: He was accused of conspiring with Manning to steal Department of Defense secrets. That initial indictment centered on accusations that Assange had actively helped the young private crack a password in order to gain access to a restricted part of a military network—a carefully crafted charge that seemed designed to distinguish Assange from traditional journalists and brand him instead as a cybercriminal.

Just a month later, however, the Justice Department veered into a more aggressive strategy, unsealing a superseding indictment against Assange that accused him of violating the Espionage Act, a 100-year-old law against publishing classified information. That new charge had already been levied against leakers like Manning and Edward Snowden, but using it against a journalist like Assange—a recipient and publisher of classified leaks rather than a source of them—represented a new and highly controversial move for US law enforcement.

​​“For the first time in the history of our country, the government has brought criminal charges against a publisher for the publication of truthful information,” Ben Wizner, director of the American Civil Liberties Union’s Speech, Privacy, and Technology Project, told WIRED at the time. “This is an extraordinary escalation of the Trump administration’s attacks on journalism and a direct assault on the First Amendment.”

Manning did not immediately respond to WIRED’s request for comment.

As it has evolved, Assange’s case has been buffeted by politics. His case was dropped by former US president Barack Obama’s administration before being resurrected under Donald Trump. The administration of President Joe Biden has continued the case against Assange, but Blue Print for Free Speech’s Colvin hopes that the Biden White House may be less committed than Trump’s to extradition. “It may well be that within the Biden administration, there are people who would quite like this to go away,” says Colvin. “I don’t think that’s impossible by any stretch of the imagination.”

In the meantime, Assange’s avenues of escape from an American jail are narrowing. Unless the UK government or the US Department of Justice reverses course, his case may soon be moving across the Atlantic. And if it does, a journalistic publisher of information—however radical or controversial of a publisher Assange may be—will for the first time face spying charges in a US court.

UK Approves WikiLeaks Chief Julian Assange's Extradition to the US

Despite major progress fighting spam and scams, the roots of the problem go far deeper than your phone company’s defenses.

There's a good reason you're still afraid to answer your phone when an unknown number pops up.

For years, the telecommunications industry has been trying to curb robocalls, the frustrating and potentially dangerous spam calls that try to scam anyone who picks up the phone. But even after significant milestones in defense—including the introduction of two telecom protocols that cryptographically authenticate the source of calls—you're probably still getting spammy calls that drive you nuts. In spite of the setbacks, though, researchers say they've seen real progress on reducing spam calls in the United States, and there's potential for even more improvement. 

At the RSA Conference in San Francisco last week, Josh Bercu of the trade association USTelecom and Gary Warner, director of intelligence at the security firm DarkTower, presented findings on progress squashing robocalls and the illegal call centers they emanate from, which are predominantly located in India. And they dug into the frustrating reality that the issue is far from solved.

“I think it’s not going well at all!” Warner tells WIRED. “And people understandably wonder why the carriers don’t just block spam calls. But if you're AT&T or Verizon or T-Mobile or whoever, it’s not in your purview to decide which conversations people are allowed to have. I don’t think people want to be in that surveillance state where carriers are in a position of deciding what is an acceptable conversation for Americans to have.”

That doesn't mean the carriers haven't stepped up their blocking when they see enough evidence that a call has a suspicious provenance. But USTelecom's Bercu notes that deciding how bold to be about blocking is a delicate issue that each phone company handles differently.

“As providers have gotten more aggressive blocking or labeling suspicious calls, they've taken on more risk that they'll mis-block or mislabel a legitimate call,” he says. “Maybe it really was a call from the bank or the pharmacy. There is some delicate balancing that providers have to do, and some are more aggressive than others.”

Bercu adds, too, that different carriers work with different analytics services to identify suspicious call activity. This can create situations where, as trends in robocalling techniques evolve and spammers use different strategies to bounce calls around international networks, some analytics services may be better at catching certain behavior than others.

Bercu is also executive director of the Industry Traceback Group, a neutral entity under USTelecom designated by the Federal Communications Commission to promote intelligence-sharing to trace the source of illegal robocalls and promote collaboration between carriers. The idea is to look at how robocalls circumvent existing technical defenses, identify networks where these protections haven't been fully implemented, and work with providers to adopt stronger safeguards.

Ultimately, though, DarkTower's Warner says that as with other digital criminal industries like email spam, business email compromise, and even ransomware, the key to limiting robocalling is to make it more difficult for scammers to operate at every level of their business. This means making it harder for them to route their calls, but also harder to recruit call agents and purchase lead lists—curated collections that claim to contain the phone numbers of targets like elderly people or people with medical issues. 

It also means targeting spammers' methods for laundering money. The financial sector has already done work in this area by putting flags on potentially suspicious gift cards, but scammers have found ways around this simply by requiring that victims send them a photo of their receipt for the gift card along with the card number itself. This way they can file claims that seem to show that they legitimately purchased and own the gift card. This takes time, though, and scammers have also developed laundering techniques in which they lean on money mule networks in the US or wherever they are operating and have mules open checking accounts where victims can wire money. They then quickly move the money out of the accounts using apps like Zelle, Venmo, or Cash App.

“The key is getting more people to understand the problem who can deny infrastructure to these actors, like communication platforms, financial institutions, telecoms, everyone together,” Warner says. "Denying the ability for criminals to communicate and coordinate—I think that is probably our most actionable path forward.”

He adds, too, that while the Indian government has struggled to meaningfully address the issue, Indian law enforcement has significantly ramped up arrests related to illegal call centers. But even arresting more than a dozen people a week won't curb the problem when there are estimated to be tens of thousands of people working on illegal robocalling scams in India alone.

YouMail, the blocking company that has reported estimated robocall volumes in the US for years, found that Americans received just under 4 billion robocalls in May, down from 4.74 billion in May 2019. In general, the company's stats underscore both improvement in the total volume of robocalls and the reality that numbers are still extremely high.

“The only way we could ensure that we never get any robocalls ever would be that we don’t have phone calls at all,” USTelecom's Bercu says. “When you can receive calls, you're opening up your network to someone else. So that's why I increasingly like to think about the problem the same way you would think about other cybersecurity issues. Every provider needs to do due diligence,  and we need accountability—but also collaboration.”

Here’s Why You’re Still Stuck in Robocall Hell

Contactless fingerprinting uses a smartphone camera to capture your prints—and opens up a whole new set of privacy concerns.

For more than 100 years, recording people’s fingerprints has involved them pressing their fingertips against a surface. Originally this involved ink but has since moved to sensors embedded in scanners at airports and phone screens. The next stage of fingerprinting doesn’t involve touching anything at all.

So-called contactless fingerprinting technology uses your phone’s camera and image processing algorithms to capture people’s fingerprints. Hold your hand in front of the camera lens and the software can identify and record all the lines and swirls on your fingertips. The technology, which has been in development for years, is ready to be more widely used in the real world. This includes use by police—a move that worries civil liberty and privacy groups.

Contactless fingerprinting works using several processes, says Chace Hatcher, vice president of technology at Telos, a fingerprinting technology company. “The underlying component of this is an image processing algorithm that works with computer vision principles to transform the photograph of fingers into a machine-matchable fingerprint,” Hatcher says.

To accurately collect someone’s fingerprints, a person’s hand should be around five centimeters away from a phone’s camera, Hatcher says. From here, the company’s machine learning algorithms identify your fingertips and process the image. The system, Hatcher says, is able to detect the ridges that define your fingerprint by identifying shadows and lighter areas. “We need a camera that has autofocus on it,” Hatcher says. It’s possible to pick out fingerprints using a phone camera with a resolution as low as two megapixels. The result is a traditional fingerprint image, which can then be matched against existing databases.

Last week, Telos was announced as a joint winner of a US National Institute of Standards and Technology (NIST) competition, which looked at the performance of contactless fingerprinting systems and how they can be used by law enforcement. According to a report by the industry title _Biometric Update_, the results indicate the technology is ready for a wider rollout.

Contactless fingerprints are just one part of a rapidly expanding biometrics industry, which sells ways to gather and process the data created by our bodies. Biometrics can include face recognition, the way you walk, the patterns of veins in your wrist, and the way you sound. Among other things, the technologies are being used to replace passwords and help with proving your identity when opening a new bank account. Biometrics is a big business, with some estimates saying the market could be worth $127 billion by 2030.

Despite the increase in biometric technology, it can prove controversial. Theft or spoofing of fingerprints and other biometric information can lead to fraud and identity theft. Some lawmakers in Europe are pushing for bans on the use of biometric technology to identify people in public spaces—saying such surveillance technology could be “the end of anonymity.”

Shweta Mohandas, a lawyer working on privacy issues at the nonprofit Centre for Internet and Society, in India, says any new technologies should face privacy- and harm-impact assessments before they’re widely used. “More worrying issues would be when these technologies will be imported into developing economies, which neither have standards in place nor a robust data protection legislation to protect the individuals from harms that might arise,” Mohandas says.

Despite recent advancements, research around contactless fingerprints isn’t new. Multiple companies are developing the technology—around half a dozen were listed as winners of different categories in the NIST competition. One recent study from researchers in Germany found that contactless fingerprinting could be as accurate as more traditional fingerprinting. “The presented usability study shows that the majority of users prefer a contactless recognition system over a contact-based one for hygienic reasons,” the researchers write. “In addition, the usability of the contactless capturing device was seen as slightly better.”

Law enforcement agencies have also taken a keen interest in the new fingerprinting method for several years. (The FBI has a database holding more than 160 million people’s fingerprints). One 2017 biometrics review by the FBI and other US government staff says contactless fingerprinting would potentially allow people’s prints to be collected faster and more efficiently than by existing methods. By using smartphone cameras, police wouldn’t need mobile fingerprint readers nor would they need to take people to stations to collect their prints. “But by and large, what we're allowing to happen is use cases that are already in effect to be leveraged more efficiently and more cost-effectively,” Hatcher says.

The FBI-linked review also highlights some of the risks. It says people may not properly understand that their fingerprints are being gathered. “An impersonal collection method does not necessarily trigger the owner’s recognition of a biometric record creation,” it says.

“As the technology evolves, we'll see increasing possibilities for people to be 'fingerprinted' remotely and without their knowledge,” says Daniel Leufer, a senior policy analyst at the European NGO Access Now. “When technologies like this become more accessible and easier to use, they'll be used more often, increasing the risk.” At the extreme end of the scale there have already been several examples of police forces identifying suspects by pulling fingerprint data from photos they’ve shared online.

There’s also the potential that easier fingerprint collection results in more people’s data being recorded. For instance, police in the UK have been using fingerprint scanning devices that clip onto smartphones since 2018. The tests involve scanning one finger using a device that plugs into a smartphone’s charging port, providing potential matches against a database in under a minute. A WIRED investigation in late 2020 found the devices were being disproportionately used to target ethnic minorities—in some areas Black Britons were between three and 18 times more likely to be stopped and scanned than white people.

“There is a lot of evidence showing intent in countries such as Greece and Italy to use 'handheld' biometric devices to identify migrants,” says Ella Jakubowska, a policy adviser at the civil rights NGO European Digital Rights. The technologies have the “capacity to exacerbate discrimination,” Jakubowska says.

The biometrics industry at large is pushing toward “seamless” biometrics, Jakubowska says. “We're seeing this idea across many different use cases, with providers trying to remove manual steps in biometric processing,” Jakubowska adds. “The problem is that when we talk about meaningful, informed consent, this becomes a lot harder when people are no longer as conscious and conscientious about the data that they are providing.”

Cops Will Be Able to Scan Your Fingerprints With a Phone

New details connect police in India to a plot to plant evidence on victims' computers that led to their arrest.

police forces around the world have increasingly used hacking tools to identify and track protesters, expose political dissidents’ secrets, and turn activists’ computers and phones into inescapable eavesdropping bugs. Now, new clues in a case in India connect law enforcement to a hacking campaign that used those tools to go an appalling step further: planting false incriminating files on targets’ computers that the same police then used as grounds to arrest and jail them. 

More than a year ago, forensic analysts revealed that unidentified hackers fabricated evidence on the computers of at least two activists arrested in Pune, India, in 2018, both of whom have languished in jail and, along with 13 others, face terrorism charges. Researchers at security firm Sentinel One and nonprofits Citizen Lab and Amnesty International have since linked that evidence fabrication to a broader hacking operation that targeted hundreds of individuals over nearly a decade, using phishing emails to infect targeted computers with spyware, as well as smartphone hacking tools sold by the Israeli hacking contractor NSO Group. But only now have Sentinel One’s researchers revealed ties between the hackers and a government entity: none other than the very same Indian police agency in the city of Pune that arrested multiple activists based on the fabricated evidence.

“There’s a provable connection between the individuals who arrested these folks and the individuals who planted the evidence,” says Juan Andres Guerrero-Saade, a security researcher at Sentinel One who, along with fellow researcher Tom Hegel, will present findings at the Black Hat security conference in August. “This is beyond ethically compromised. It is beyond callous. So we’re trying to put as much data forward as we can in the hopes of helping these victims.”

Sentinel One’s new findings that link the Pune City Police to the long-running hacking campaign, which the company has called Modified Elephant, center on two particular targets of the campaign: Rona Wilson and Varvara Rao. Both men are activists and human rights defenders who were jailed in 2018 as part of a group called the Bhima Koregaon 16, named for the village where violence between Hindus and Dalits—the group once known as “untouchables”—broke out earlier that year. (One of those 16 defendants, 84-year-old Jesuit priest Stan Swamy, died in jail last year after contracting Covid-19. Rao, who is 81 years old and in poor health, has been released on medical bail, which expires next month. Of the other 14, only one has been granted bail.)

Early last year, Arsenal Consulting, a digital forensics firm working on behalf of the defendants, analyzed the contents of Wilson’s laptop, along with that of another defendant, human rights lawyer Surendra Gadling. Arsenal analysts found that evidence had clearly been fabricated on both machines. In Wilson’s case, a piece of malware known as NetWire had added 32 files to a folder of the computer’s hard drive, including a letter in which Wilson appeared to be conspiring with a banned Maoist group to assassinate Indian prime minister Narendra Modi. The letter was, in fact, created with a version of Microsoft Word that Wilson had never used, and that had never even been installed on his computer. Arsenal also found that Wilson’s computer had been hacked to install the NetWire malware after he opened an attachment sent from Varvara Rao’s email account, which had itself been compromised by the same hackers. “This is one of the most serious cases involving evidence-tampering that Arsenal has ever encountered,” Arsenal’s president, Mark Spencer, wrote in his report to the Indian court.

In February, Sentinel One published a detailed report on Modified Elephant, analyzing the malware and server infrastructure used in the hacking campaign to show that the two cases of evidence fabrication Arsenal had analyzed were part of a much larger pattern: The hackers had targeted hundreds of activists, journalists, academics, and lawyers with phishing emails and malware since as early as 2012. But in that report, Sentinel One stopped short of identifying any individual or organization behind the Modified Elephant hackers, writing only that the “activity aligns sharply with Indian state interests.”

Now the researchers have gone further in nailing down the group’s affiliations. Working with a security analyst at a certain email provider—who also spoke to WIRED but asked that neither they nor their employer be named—Sentinel One learned that three of the victim email accounts compromised by the hackers in 2018 and 2019 had a recovery email address and phone number added as a backup mechanism. For those accounts, which belonged to Wilson, Rao, and an activist and professor at Delhi University named Hany Babu, the addition of a new recovery email and phone number appears to have been intended to allow the hacker to easily regain control of the accounts if their passwords were changed. To the researchers’ surprise, that recovery email on all three accounts included the full name of a police official in Pune who was closely involved in the Bhima Koregaon 16 case.

The three hacked accounts have other fingerprints that link them—and thus the Pune police—to the larger Modified Elephant hacking campaign: The email provider found that the hacked accounts were accessed from IP addresses that Sentinel One and Amnesty International had previously identified as those of Modified Elephant. In the case of Rona Wilson, the email provider security analyst says that Wilson’s email account received a phishing email in April 2018 and then appeared to be compromised by the hackers using those IPs, and at the same time the email and phone number linked to the Pune City Police were added as recovery contacts to the account. The analyst says Wilson’s email account was then itself used to send out other phishing emails to targets in the Bhima Koregaon case for at least two months before Wilson was arrested in June of 2018.

“We generally don’t tell people who targeted them, but I’m kind of tired of watching shit burn,” the security analyst at the email provider told WIRED of their decision to reveal the identifying evidence from the hacked accounts. “These guys are not going after terrorists. They’re going after human rights defenders and journalists. And it’s not right.”

To further confirm the link between the recovery email and phone number on the hacked accounts and the Pune City Police, WIRED turned to Citizen Lab security researcher John Scott-Railton, who along with researchers at Amnesty International had earlier revealed the extent of the hacking campaign against the Bhima Koregaon 16 and shown that the NSO hacking tool Pegasus had been used to target some of their smartphones. To prove that the Pune City Police controlled the recovery contacts on the hacked accounts, Scott-Railton dug up entries in open source databases of Indian mobile phone numbers and emails for the recovery phone number that linked it to an email address ending in pune@ic.in, a suffix for other email addresses used by police in Pune. Scott-Railton found that the number is also linked in the database to the recovery email address connected to the hacked accounts for the same Pune police official.

Separately, security researcher Zeshan Aziz found the recovery email address and phone number tied to the Pune police official’s name in the leaked database of TrueCaller, a caller ID and call-blocking app, and found the phone number linked to his name in the leaked database of iimjobs.com, an Indian job recruitment website. Finally, Aziz found the recovery phone number listed with the official’s name on multiple archived web directories for Indian police, including on the website of the Pune City Police. (WIRED also verified that at the time the accounts were compromised, the email provider would have sent a confirmation link or text message to any recovery contact information added to an email account, which suggests that the police did, in fact, control that email address and phone number.)

Scott-Railton further found that the WhatsApp profile photo for the recovery phone number added to the hacked accounts displays a selfie photo of the police official—a man who appears to be the same officer at police press conferences and even in one news photograph taken at the arrest of Varvara Rao.

WIRED reached out in multiple emails and phone calls to the Pune City Police and the Pune police official whose personal details were linked to the hacked accounts and received no reply.

One Mumbai-based defense attorney representing several of the Bhima Koregaon 16, Mihir Desai, says he would need to independently corroborate the new evidence of the Pune police’s links to the hacking campaign. But taken at face value, he says, it appears “very damning.” He adds that he is hopeful it could help his clients, including Anand Teltumbde, who has been accused of terrorist connections based in part on an apparently fabricated document found on Rona Wilson’s computer. “We’ve known things have been planted, but the police could have always said, ‘we are not involved in all this,’” says Desai. “By showing the police did this, it would mean there was a conspiracy to arrest these people. It would show the police have acted in a vicious and deliberate manner knowing fully well this was false evidence.”

The conclusion that Pune police are tied to a hacking campaign that appears to have framed and jailed human rights activists presents a disturbing new example of the dangers of hacking tools in the hands of law enforcement—even in an ostensible democracy like India. Sentinel One’s Guerrero-Saade argues that it also raises questions about the validity of any evidence pulled from a computer that’s been hacked by a law enforcement surveillance operation. “This should invite a conversation about whether we can trust law enforcement with these sorts of malware operations at all,” says Guerrero-Saade. “What does it mean to have evidentiary integrity when you have a compromised device? What does it mean for somebody to hack a device for fact-finding in a law enforcement operation when they can also alter the contents of the device in question?”

Beyond any larger questions, Guerrero-Saade and his fellow Sentinel One researcher Tom Hegel say they’re focused on the fate of the victims in the Bhima Koregaon case, almost all of whom have remained in jail even as the evidence against them proves to be more corrupt with every year. Ultimately, the researchers hope their findings can not only demonstrate police wrongdoing in the case, but win those activists and human rights defenders their freedom. “The real concern here is the folks languishing in prison,” says Guerrero-Saade. “We’re hoping this leads to some form of justice.”

Police Linked to Hacking Campaign to Frame Indian Activists

In occupied Ukraine, people’s internet is being routed to Russia—and subjected to its powerful censorship and surveillance machine.

Web pages in the city of Kherson in south Ukraine stopped loading on people’s devices at 2:43 pm on May 30. For the next 59 minutes, anyone connecting to the internet with KhersonTelecom, known locally as SkyNet, couldn’t call loved ones, find out the latest news, or upload images to Instagram. They were stuck in a communications blackout. When web pages started stuttering back to life at 3:42 pm, everything appeared to be normal. But behind the scenes everything had changed: Now all internet traffic was passing through a Russian provider and Vladimir Putin’s powerful online censorship machine.

Since the end of May, the 280,000 people living in the occupied port city and its surrounding areas have faced constant online disruptions as internet service providers are forced to reroute their connections through Russian infrastructure. Multiple Ukrainian ISPs are now forced to switch their services to Russian providers and expose their customers to the country’s vast surveillance and censorship network, according to senior Ukrainian officials and technical analysis viewed by WIRED.

The internet companies have been told to reroute connections under the watchful eye of Russian occupying forces or shut down their connections entirely, officials say. In addition, new unbranded mobile phone SIM cards using Russian numbers are being circulated in the region, further pushing people towards Russian networks. Grabbing control of the servers, cables, and cell phone towers—all classed as critical infrastructure—which allow people to freely access the web is considered one of the first steps in the “Russification” of occupied areas.

“We understand this is a gross violation of human rights,” Victor Zohora, the deputy head of Ukraine’s cybersecurity agency, known as the State Services for Special Communication and Information Protection (SSSCIP), tells WIRED. “Since all traffic will be controlled by Russian special services, it will be monitored, and Russian invaders will restrict the access to information resources that share true information.”

KhersonTelecom first switched its internet traffic to a Russian network on April 30, before flipping back to Ukrainian connections for the majority of May. However, things appear to have shifted permanently since May 30. All of KhersonTelecom’s traffic is now being routed through Miranda Media, a Crimea-based company that’s itself connected to Russian national telecom provider Rostelecom. (Miranda Media was set up after Putin annexed Crimea in 2014). The day after KhersonTelecom made its latest switch, state-controlled Russian media outlet RIA Novosti claimed the Kherson and Zaporizhzhia areas were officially being moved to Russian internet connections—days earlier, the outlet said the regions were also going to start using the Russian telephone code +7.

Zohora says that across occupied regions of Ukraine—including Kherson, Luhansk, Donetsk, and Zaporizhzhia—there is a patchwork of around 1,200 different ISPs. “We understand that most of them are forced to connect to Russian telecom infrastructure and reroute traffic,” Zohora tells WIRED. “Unfortunately, there are cases of massive routing of traffic of Ukrainian operators across Russian channels,” says Liliia Malon, the commissioner of Ukraine’s telecom regulator, the National Commission for the State Regulation of Electronic Communications. “Ukrainian networks are partially blocked or completely disconnected.”

Technical analysis confirms that the connections are switching. Internet monitoring company Cloudflare has observed KhersonTelecom’s traffic passing through Miranda Media for more than two weeks in June. Doug Madory, director of internet analysis at monitoring firm Kentik, has observed around half a dozen networks in Kherson connecting to the provider. “It's not a one-time thing,” Madory says. “Every couple of days, there's another company getting switched over to Russian transit from Ukraine.”

Since the start of Putin’s war in February, disrupting or disabling internet infrastructure has been a common tactic—controlling the flow of information is a powerful weapon. Russian missiles have destroyed TV towers, a cyberattack against a satellite system had knock-on impacts across Europe, and disinformation has tried to break Ukrainian spirits. Despite frequent internet blackouts, Ukraine’s rich ecosystem of internet companies has rallied to keep people online. While Ukrainian troops are successfully launching counterattacks against Russian occupation in the south of the country, Kherson remains controlled by invading forces. (In March, it became the first major city to fall into Russian hands, and its residents have lived under occupation for around 100 days, reporting numerous incidents of torture.)

“It's one thing to take over a city and to control the supply lines into the city, the flow of food or fuel,” says David Belson, head of data insight at Cloudflare, who has written about internet control in Kherson. But, he says, “controlling internet access and being able to manipulate the internet access into an occupied area” is a “new front” in the conflict.

There are multiple ways Russian forces are taking over internet systems. First, there is physical access—troops are seizing equipment. Spokespeople for two of Ukraine’s biggest internet providers, Kyivstar and Lifecell, say their equipment in Kherson was switched off by Russian occupying forces, and they don’t have any access to restore or repair equipment. (Throughout the war, internet engineers have been working amid shelling and attacks to repair damaged equipment). The SSSCIP says 20 percent of telecommunications infrastructure across the whole of Ukraine has been damaged or destroyed, and tens of thousands of kilometers of fiber networks are not functioning.

Once Russian forces have control of the equipment, they tell Ukrainian staff to reconfigure the networks to Miranda Media, Zohora says. “In case the local employees of these ISPs are not willing to help them with the reconfiguration, they are able to do it by themselves,” Zohora says. The SSSCIP, he adds, has advised staff not to risk their own lives or the lives of their families. “We hope that we are able to liberate these lands soon and this temporary period of blackmailing of these operators will pass off,” Zohora says, adding it is unlikely that communications in the region can be restored before the areas are liberated.

For the time being, at the very least, this means connections will be routed through Russia. When Gudz Dmitry Alexandrovich, the owner of KhersonTelecom, switched his connection to Miranda Media for the first time at the start of May, he claims some customers thanked him because he was getting people online, while others chastised him for connecting to the Russian service. “On May 30 again, like on April 30, everything absolutely everything fell and only Miranda's channels work,” Alexandrovich says in a translated online chat. In a long Facebook post published on the company’s page at the start of May, he claimed he wanted to help people and shared photos of crowds gathering outside KhersonTelecom’s office to connect to the Wi-Fi.

Russia is also trying to control mobile connections. In recent weeks, a mysterious new mobile company has popped up in Kherson. Images show blank SIM cards—totally white with no branding—being sold. Little is known about the SIM cards; however, the mobile network appears to use the Russian +7 prefix at the start of a number. Videos reportedly show crowds of citizens gathering to collect the SIM cards. “The Russian forces realize they're at a disadvantage if they keep using Ukrainian mobile networks,” says Cathal Mc Daid, the chief technology officer at mobile security company AdaptiveMobile. The company has seen two separatist mobile operators in Donetsk and Luhansk expanding the territory they are covering to newly occupied areas.

Who controls the internet matters. While most countries place only limited restrictions on the websites people can view, a handful of authoritarian nations—including China, North Korea, and Russia, severely limit what people can access.

Russia has a vast system of internet censorship and surveillance, which has been growing in recent years as the country tries to implement a sovereign internet project that cuts it off from the rest of the world. The country’s System for Operative Investigative Activities, or SORM, can be used to read people’s emails, intercept text messages, and surveil other communications.

“Russian networks are fully controlled by the Russian authorities,” Malon, the Ukrainian telecom regulator, says. The rerouting of the internet in occupied Ukrainian areas, Malon says, has the goal of spreading “Kremlin propaganda” and making people believe Ukrainian forces have abandoned them. “They are afraid that the news about the progress of the Ukrainian army will encourage resistance in the Kherson region and facilitate real activities,” Zohora says.

At the heart of the rerouting is Miranda Media, the operator in Crimea that appeared following the region’s annexation in 2014. Among “partners” listed on its website are the Russian security service known as the FSB and the Russian Ministry of Defense. The company did not respond to a request for comment.

In many ways, Crimea may act as an example of what happens next in newly occupied areas. “Only in 2017, Crimea was completely disconnected from Ukrainian traffic. And now, as far as I know, it's only Russian traffic there,” says Ksenia Ermoshina, an assistant research professor at the Center for Internet and Society and an affiliated researcher at the Citizen Lab. In January last year, Ermoshina and colleagues published research on how Russia has taken control of Crimea’s internet infrastructure.

After it annexed Crimea in 2014, Russian authorities created two new internet cables running along the Kerch Strait, where they connect with Russia. This process took three years to complete—something Ermoshina calls a “soft substitution model,” with connections transferring slowly over time. Since then, Russia has developed more advanced internet control systems. “The power of the Russian censorship machine changed in between \[2014 and 2022\],” Ermoshina says. “What I'm afraid of is the strength of Russian propaganda.”

It’s likely that rerouting the internet in Kherson and the surrounding areas is seen by Russian authorities as a key step in trying to legitimize the occupation, says Olena Lennon, a Ukrainian political science and national security adjunct professor at the University of New Haven. The moves could also be a blueprint for future conflicts.

Alongside internet rerouting in Kherson and other regions, Russian officials have started handing out Russian passports. Officials claim a Russian bank will soon open in Kherson. And the region has been moved to Moscow’s time zone by occupying forces. Many of the steps echo what previously happened in Crimea, Donetsk, and Luhansk. “Russia is making it clear that they're there for a long haul,” Lennon says, and controlling the internet is core to that. “They're making plans for a long-term occupation.”

Russia Is Taking Over Ukraine’s Internet

Many people reportedly died after struggling to access medical care during a brutal lockdown. The families want to make sure these deaths are counted.

ZHOU SHENGNI NEEDED a doctor, and fast. The 49-year-old, who was having an asthma attack, was being driven by her family to Shanghai East Hospital, where she worked as a nurse, for urgent treatment. It was March 23, and the Chinese city was under a strict Covid lockdown.

However, when they arrived at the emergency department, Zhou’s family found that it was closed for disinfection under Shanghai’s rules to contain the spread of Covid. In urgent need of medical care, they had no choice but to drive to another hospital about 9 kilometers away. Zhou later died.

Zhou’s death caused outrage on Chinese social media, but it was not an isolated incident. Shanghai’s citywide lockdown lasted two months, with most restrictions removed on June 1. But, for those two months, almost nothing moved—including the city’s hospitals, which were hit by sudden closures, with many restricting their services to emergencies only. Patients in need of medical help were told to present a negative PCR test to access care.

From February to May, health authorities in Shanghai had reported 588 deaths related to Covid-19, the majority elderly residents. But officials didn’t count people like Zhou, who may have died as a result of the city’s lockdown restrictions.

Discussions about the collateral damage of China’s zero-Covid policy are heavily restricted in the country. Censors have blocked comments from people opposing the pandemic strategy, including remarks made by World Health Organization director-general Tedros Adhanom Ghebreyesus. But, as ever in China, censorship has not stopped people from finding technical workarounds to express dissent.

On April 14, a WeChat account called Shi You shared an article entitled “Shanghai Deceased,” which reported on people in the city who had seemingly died as a result of harsh lockdown restrictions. The article’s comment section was quickly flooded with messages from people saying they had also heard of or knew someone who had died during the lockdown.

Capser Yu immediately realized that both the article and its comments were important. A Shanghai native now working in Singapore, Yu had heard stories of people back home who had lost loved ones during lockdown. One of those lost was Chen Xiangru, a 3-year-old girl who was reportedly unable to receive timely treatment when she developed a serious fever in late March. Chen died in hospital while waiting for the result of a PCR test doctors required to provide treatment.

Worried that censors would hide crucial evidence, Yu started taking screenshots of the WeChat article. A few hours later, WeChat scrubbed the article. When people in China tried to open the article again, all that was left was a message saying it “violates regulations.”

Yu reposted the content on a blog he created, called Real China, to help keep his parents in Shanghai informed about how news in China was being reported overseas. Within hours, Chinese censors blocked the reposted content. Yu says the article, which is still accessible outside China, was read by more than 20,000 people before it was censored. The link has since started working again for unknown reasons and, by the end of June, had become the most-read post on Yu’s blog.

During the past two months, several projects trying to document deaths linked to Shanghai’s recent lockdown have appeared online. One of the largest, on the collaboration service Airtable, has been live since April. The page is a mix of basic descriptions, images of dead bodies, location information, scans of documents, and photos of the smiling faces of the loved ones who have now passed away. The database went viral but was swiftly blocked on WeChat and Weibo for containing “non-compliant content.” Though users in China can still access it, discussions of the database have been restricted on social media.

By early June, the database contained 210 entries, each representing a life reportedly lost. It’s unclear how many of these deaths might be directly linked to Shanghai’s lockdown, but a separate tally, conducted by Singapore-based news outlet Initium Media, claimed that at least 170 people had died as a result of lockdown measures by early May. Many of the deaths were linked to difficulties accessing urgent medical treatment, the report claimed.

A Shanghai-based recruiter, who asks not to be named for security reasons, says he felt “hopeless” when he found out about the death of an industry colleague’s mother, who had skin cancer and was reportedly denied treatment because she had Covid. Though he didn’t know the woman personally, the recruiter decided not to let her death go unreported. On Reddit, he found a shared Google Sheet that, like the Airtable database, kept a record of the deceased.

The recruiter added details he knew about the woman to the spreadsheet for fact-checking. Volunteers working on the document are required to list their sources, and each link is archived by the Wayback Machine in case the post disappears. The shared document has stricter sourcing rules and fewer entries than the Airtable database—just 60 cases—and was last updated in early May.

The recruiter says he has no idea who created the document or who he was working with, but he feels safer this way. “I would be a bit afraid if we talk to each other in private,” he says, adding that he is still haunted by an experience of being reprimanded at school for speaking out on Twitter against an influential official.

It’s almost impossible to grasp the scale of the suffering caused by Shanghai’s recent lockdown. But Daohouer, a volunteer-run mutual aid network created to help people access food, treatment, and medication during the lockdown, hints at the level of desperation. The site worked by encouraging residents in urgent need of supplies or health care to leave a message, with volunteers then contacting them to help. A visualization of requests submitted to the network shows that over half of the requests dealt with medical accessibility.

The page has kept a record of 1,297 requests in Shanghai involving seriously ill people since April 11, when the data became available. The number of such requests peaked in mid-April, when the site reported a surge in messages from people seeking help accessing medical care.

The cases from Daohouer were visualized by two Chinese people living in Canada who form part of a tech collective called O3O. The pair plan to archive the data submitted to the platform in case it is somehow scrubbed by censors. “The older generation has a habit of hoarding food,” says one of O3O’s cofounders, who asks to remain anonymous. “But the younger generation has the habit of taking screenshots of all things that might be considered sensitive.” The duo also maintains a website called Our Pandemic Memory that invites people to record stories of their lockdown lives. The site, preempting likely censorship in China, automatically submits every story to the Wayback Machine.

Despite efforts to record deaths in the city, the Shanghai-based recruiter remains skeptical that the government will launch an official investigation into the number of people who reportedly died as a result of the recent lockdown. No such efforts have been announced following similar citywide lockdowns in cities such as Xi’an, where deaths related to difficulties in accessing health care have also been reported.

Still, the recruiter hopes that projects to remember and record the dead could, one day, help people learn what life, and death, was really like in Shanghai during the harshest of lockdowns. “Maybe one day in the future, when we can discuss the outbreak and learn lessons, these materials will be used for reference.”

Shanghai’s Censors Can’t Hide Stories of the Dead

A pair of ransomware attacks crippled parts of the country—and rewrote the rules of cybercrime.

But the attack against the finance ministry was just the beginning. A timeline shared by Mora claims Conti attempted to breach different government organizations almost every day between April 18 and May 2. Local authorities, such as the Municipality of Buenos Aires, were targeted, as well as central government organizations, including the Ministry of Labor and Social Security. In some cases, Conti was successful; in others, it failed. Mora says the US, Spain, and private companies helped defend against Conti attacks, providing software and indicators of compromises related to the group. “That blocked Conti a lot,” he says. (In early May, the US posted a $10 million reward for information about Conti’s leadership.)

On May 8, Chaves started his four-year term as president and immediately declared a “national emergency” due to the ransomware attacks, calling the attackers “cyberterrorists.” Nine of the 27 targeted bodies were “very affected,” Chaves said on May 16. The MICIT, which is overseeing the response to the attacks, did not respond to questions about the progress of the recovery, despite originally offering to set up an interview.

“All the national institutions, they don’t have enough resources,” Robles says. During the recovery, he says, he has seen organizations running on legacy software, making it much harder to enable the services they provide. Some bodies, Robles says, “don’t even have a person working on cybersecurity.” Mora adds that the attacks show Latin American countries need to improve their cybersecurity resilience, introduce laws to make cyberattack reporting mandatory, and allocate more resources to protect public institutions.

But just as Costa Rica started getting a grip on the Conti attacks, another hammer blow struck. On May 31, the second attack started. The systems of the Costa Rican Social Security Fund (CCSS), which organizes health care, were taken offline, plunging the country into a new kind of disarray. This time the HIVE ransomware, which has some links to Conti, was blamed.

The attack had an immediate effect on people’s lives. Health care systems went offline and printers spewed out garbage, as first reported by security journalist Brian Krebs. Since then patients have complained of delays in getting treatment and the CCSS has warned parents whose children were undergoing surgery that they may have trouble locating their kids. The health service has also begun printing discontinued paper forms.

By June 3, CCSS had declared an “institutional emergency,” with local reports claiming that 759 of the 1,500 servers and 10,400 computers have been impacted. A spokesperson for CCSS says hospital and emergency services are now running normally and the efforts of its staff have maintained care. However, those seeking medical care have faced significant disruptions: 34,677 appointments have been rescheduled, as of June 6. (The figure is 7 percent of total appointments; the CCSS says 484,215 appointments have gone ahead.) Medical imaging, pharmacies, testing laboratories, and operating theaters are all facing some disruption.

The Death of Conti

There are questions about whether the two separate ransomware attacks against Costa Rica are linked. However, they come as the face of ransomware may be changing. In recent weeks, Russian-linked ransomware gangs have changed their tactics to avoid US sanctions and are fighting over their territory more than usual.

Conti first announced its attack on the finance ministry on its blog, where it publishes the names of its victims and, if they fail to pay its ransom, the files it has stolen from them. A person or group dubbing themselves unc1756—the “UNC” abbreviation is used by some security firms to indicate “uncategorized” attackers—used the blog to claim responsibility for the attack. The attacker demanded $10 million as a ransom payment, later upping the figure to $20 million. When no payment was made, they started uploading 672 GB of files to Conti’s website.

Conti's Attack Against Costa Rica Sparks a New Ransomware Era

Plus: Russia rattles its cyber sword, a huge Facebook phishing operation is uncovered, feds take down the SSNDOB marketplace, and more.

How do you smuggle information into the USSR right under the nose of the KGB? Create your own encryption system, of course. That’s exactly what saxophonist and music professor Merryl Goldberg did during the 1980s. This week Goldberg revealed that she used musical notation to hide the names and addresses of activists and details of meetings on a rare trip to the Soviet Union. To do so, she cooked up her own encryption system. Each musical note and marking represented letters of the alphabet and helped disguise the sensitive information. When Soviet officers inspected the documents, no suspicions were raised.

Goldberg’s story was retold at the RSA Conference in San Francisco this week, where WIRED’s Lily Newman has been digging up stories. Also coming out of RSA: a warning that as ransomware becomes less profitable, attackers may turn to business email compromise (BEC) scams to make money—BEC attacks are already highly profitable.

Also this week, dark-web marketplace AlphaBay is about to complete its journey back to the top of the online underworld. The original AlphaBay site—home to more than 350,000 product listings, ranging from drugs to cybercrime services—was purged from the dark web in July 2017 as part of a huge law enforcement operation. However, AlphaBay’s second-in-command, an actor going by the name of DeSnake, survived the law enforcement operation and relaunched the site last year. Now AlphaBay is growing quickly and is on the verge of resuming its dominant dark-web market position.

Elsewhere, Apple held its annual Worldwide Developers Conference this week and revealed iOS 16, macOS Ventura and some new MacBooks—WIRED’s Gear team has you covered on everything Apple announced at WWDC. However, there are two standout new security features worth mentioning: Apple is replacing passwords with new cryptographic passkeys, and it’s introducing a safety check feature to help people in abusive relationships. Database firm MongoDB also held its own event this week, and while it might not have been as high-profile as WWDC, MongoDB’s new Queryable Encryption tool may be a key defense against preventing data leaks.

Also this week we’ve reported on a Tesla flaw that lets anyone create their own NFC car key. New research from the ​​Mozilla Foundation has found that disinformation and hate speech are flooding TikTok ahead of Kenya’s elections, which take place at the start of August. Elon Musk reportedly gained access to Twitter’s “fire hose,” raising privacy concerns. And we dove into the shocking new evidence televised by the House January 6 committee.

But that's not all, folks. Each week we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there.

For the past two years, state-sponsored hackers working on behalf of the Chinese government have targeted scores of communications technologies, ranging from home routers to large telecom networks. That’s according to the NSA, FBI, and the Cybersecurity and Infrastructure Security Agency (CISA), which published a security advisory this week detailing the “widespread” hacking.

Since 2020, Chinese-backed actors have been exploiting publicly known software flaws in hardware and incorporating compromised devices into their own attack infrastructure. According to the US agencies, the attacks typically contained five steps. China’s hackers would use publicly available tools to scan for vulnerabilities in networks. They would then gain initial access through online services, access login details from the systems, get access to routers and copy network traffic, before finally “exfiltrating” victim data.

“Exploiting these vulnerabilities has allowed them to establish broad infrastructure networks to exploit a wide range of public- and private-sector targets,” the agencies say in their joint advisory.

Since the start of the war in Ukraine, Russia has been hacked at an unprecedented scale. Now, more than 100 days into the war, tensions around cyber activity are rising. On June 9, Russia’s Foreign Ministry said that its critical infrastructure and government bodies were being hit by cyberattacks and warned that it could lead to military confrontation with the West. “The militarization of the information space by the West, and attempts to turn it into an arena of interstate confrontation, have greatly increased the threat of a direct military clash with unpredictable consequences,” the Foreign Ministry said in a statement. From the moment Russian troops entered Ukraine, questions have been raised about the potential for escalation if people outside of Ukraine are involved in cyberattacks against Russia. Last week, the head of US Cyber Command told _Sky News_ that its military hackers have been involved in offensive operations that support Ukraine.

Phishing remains one of the most successful ways for criminals to break into people’s accounts and make money—and there’s no better example of this than a newly uncovered Facebook and Facebook Messenger phishing campaign. This week, security researchers at US firm PIXM revealed a huge network of at least 400 phishing pages that are raking in millions of views and have made its creators an estimated $59 million. The scam, which has been running since at least September 2021, directs people to false Facebook login pages where their credentials are hoovered up. What stands out, as noted by the Register, is that the phishing campaign has managed to avoid Facebook’s phishing detection methods more effectively than others.

So far in 2022, police and tech companies have been cracking down on cybercriminals with some success: Raidforums, ZLoader, and the dark-web market Hydra have all been shut down in recent months. That list got a little bit longer this week as the FBI and its international law enforcement took down a marketplace selling the personal information of around 24 million Americans, according to authorities. The SSNDOB marketplace, which was made up of four individual domains, was selling people’s names, dates of birth, and Social Security numbers. SSNDOB has existed for around a decade, and in 2013, details obtained from the organization were used in the takeover of Xbox Live accounts. It’s believed the website has made its unknown owners around $22 million since 2015.

Source

Wired