Telecom giant AT&T says a major data breach has exposed the call and text records of “nearly all” of its customers, epitomizing the dire state of data security.

From targeted wiretaps to bulk surveillance dragnets, phone companies have been at the center of privacy concerns for decades—and their time in the limelight isn't over yet. On Friday, telecom giant AT&T announced that it recently suffered a data breach impacting call and text messaging records of “nearly all” its customers. The company is in the process of notifying about 110 million people that they were affected.

AT&T said in a US Securities and Exchange Commission filing that it learned about the data breach on April 19. Attackers exfiltrated data between April 14 and April 25. The company said in its SEC submission that the US Justice Department authorized delayed disclosure of the breach on May 9 and again on June 5, pending investigation. AT&T added that it is “working with law enforcement in its efforts to arrest those involved in the incident.” So far, “at least one person has been apprehended.”

“Yeah, this is really bad,” says Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy. “What the threat actors stole here are essentially call data records. These are a gold mine in intelligence analysis because they allow someone to understand networks—who is talking to whom and when. And threat actors have data from previous compromises to map phone numbers to identities. But even without identifying data for a phone number, closed networks—where numbers _only_ communicate with others in the same network—are almost always interesting.”

The incident is significant not only because of its sheer scale and reach but because AT&T says it is the latest in a staggering spate of data thefts that resulted from attackers compromising organizations’ Snowflake cloud accounts. Snowflake is a data warehousing platform, and attackers collected its customers’ account credentials in recent months to steal hundreds of millions of records from about 165 Snowflake clients, including Ticketmaster, Santander bank, and LendingTree’s QuoteWizard.

The AT&T data is from both landline and cellular accounts and spans May 1, 2022, to October 31, 2022. A smaller, undisclosed number of people also had records from January 2, 2023, stolen in the breach. The company said on Friday that the data trove “does not contain the content of calls or texts” and does not include the date and time of communications. But attackers did make off with phone numbers and a massive amount of so-called “metadata” about calls and texts, including who contacted whom, call durations, and tallies of a customer’s total calls and texts. The trove also includes some cell site identification numbers—essentially cell tower data that can be used to approximate a cellphone's location when it made or received a call or text.

The data includes some records of people who are customers of phone carriers—known as “mobile virtual network operators”—that contract with AT&T to use the larger company's networks and infrastructure for their service. And, crucially, the stolen trove exposes people who have no relationship with AT&T when they communicated with an AT&T customer during the relevant time spans.

Though the breach is not a worst-case scenario in every possible way—the data does not, for example, include identifying customer information like Social Security numbers—it could be a gold mine for attackers looking to construct compelling phishing attacks and other scams to target individuals or specific communities of people. And the breach underscores that even without the contents of communications, leaked metadata still has major implications for people's privacy and security. This is why privacy advocates have long made a distinction between communication platforms—namely, the secure messaging app Signal—that are designed to generate the absolute bare minimum of metadata, versus other communication platforms that don't curtail metadata use to the same degree. This even includes other end-to-end encrypted services like WhatsApp.

The Google-owned cybersecurity firm Mandiant investigated the string of Snowflake account intrusions and said in June that financially motivated criminal hackers, tracked under the name UNC5537, are behind the attacks. The group used info-stealing malware to grab credentials for companies’ Snowflake accounts and then easily logged into any accounts that didn't have two-factor authentication enabled. The security feature was turned off by default on Snowflake accounts. Snowflake has since put new multifactor authentication policies in place.

AT&T emphasizes that it “does not believe” the data stolen in the breach is publicly available. But that doesn't mean that it poses no threat from the actor that stole it. On Friday, the US Cybersecurity and Infrastructure Security Agency released an alert about the situation. And, though only a handful of victims of the Snowflake rampage have come forward, hackers have already been advertising, trying to sell, and demanding ransoms from impacted companies over data stolen from their Snowflake accounts. Actors including ShinyHunters and another account going by the handle Sp1d3rHunters have been advertising the data on the cybercrime marketplace BreachForums, which was recently resurrected after being taken down by law enforcement, and demanding companies pay millions for the data to be removed.

_Additional reporting by Matt Burgess._

The Sweeping Danger of the AT&T Phone Records Breach

A new resolution echoes what 16 members of Congress have already said to the White House: It must do more to free one of the most storied crypto-focused federal agents in history.

When Tigran Gambaryan was first invited in February to meet with the Nigerian government in order to settle a dispute with his employer, the cryptocurrency exchange Binance, Nigerian officials detained him against his will, stripped him of his passport, and told him he was a “guest” of the state. He's since been charged with financial crimes and jailed for months as a criminal suspect.

Pressure is now mounting within the US Congress for the Biden administration to treat him as what his supporters argue he has been all along: a hostage, held illegally by an unaccountable foreign country.

On Wednesday, US congressman Rich McCormick, who represents Gambaryan's district in his home state of Georgia, submitted a resolution to the House Committee on Foreign Affairs that both urges the Nigerian government to release Gambaryan and calls on the US government to recognize that Gambaryan is being illegally detained as a hostage in an effort to extort his employer, Binance. That resolution represents the latest in a series of growing calls from Congress for the White House to step up its pressure on Nigeria to release Gambaryan, a former federal agent who led many of the most significant cryptocurrency-related criminal cases of the last decade during his time as an IRS criminal investigator.

“The continued detention of Tigran Gambaryan in Nigeria is a clear violation of his rights, and he is simply being used as a means of extortion by the Nigerian government,” McCormick wrote in a statement. “We urge Nigeria to immediately release Tigran and provide him with the necessary medical care and due process. The United States Government must do everything in its power to secure the release of Tigran Gambaryan, and all of our citizens wrongfully detained abroad.”

McCormick's resolution to push for Gambaryan's release follows an earlier open letter from 16 members of Congress calling on the White House to transfer Gambaryan's case to the Office of the Special Presidential Envoy for Hostage affairs. That letter noted that Gambaryan has suffered from malaria and pneumonia, collapsing in court during one day of his trial, yet has been denied proper care in a hospital. “Gambaryan's health and wellbeing are in danger, and we fear for his life,” the letter read. “Immediate action is essential to ensure his safety and preserve his life. We must act swiftly before it is too late.” Two House members, French Hill and Chrissy Houlahan, visited Gambaryan in jail last month and have also called for his release.

Gambaryan and another Binance staffer, Nadeem Anjarwalla, flew to Abuja in late February at the invitation of the Nigerian government after the country's officials accused Binance, where Gambaryan works as head of its investigations and financial crime compliance, of money laundering and contributing to the devaluation of the country's national currency, the naira. But just days into that negotiation, the two men were detained in a government-run “guest house” against their will.

The situation escalated further when Anjarwalla, who is based in Kenya, escaped during a visit to a mosque for Ramadan prayers. Gambaryan was then criminally charged with tax evasion and money laundering—all signs suggest those charges relate to the behavior of Binance, not Gambaryan personally—and moved to Kuje prison, where he has since been held.

Tigran Gambaryan

Photograph: Binance

The charges against Gambaryan are particularly ironic given his track record as a federal agent. Prior to being hired by Binance, which was widely seen as part of the exchange's efforts to clean up its operations' lax compliance and years of alleged money laundering documented in a $4.3 billion settlement with the US government last year, Gambaryan spent a decade leading many of the most significant crypto crime investigations in history. From 2014 to 2017 alone, for instance, Gambaryan identified two corrupt federal agents who had enriched themselves with cryptocurrency from the Silk Road dark-web drug market, helped to track down half a billion dollars worth of bitcoins stolen from early crypto exchange Mt. Gox, helped develop a secret crypto tracing method that located the server hosting the massive AlphaBay dark web crime market, and helped to achieve the takedown of the Welcome to Video crypto-funded child sexual abuse video network.

Gambaryan's supporters point out that his work for the IRS led to the seizure of more than $4 billion dollars, including several of the largest monetary seizures in the history of US criminal justice. “He’s done so much good for this country throughout his career,” Gambaryan's wife Yuki told WIRED in March. “I believe it’s his turn to get the same amount of support from his country.”

When WIRED reached out to Binance about the new resolution seeking Gambaryan's freedom, a company spokesperson responded in a statement: “Tigran is a hero and we are pleased to see that’s recognised by so many people around the world. We are hopeful he’ll be sent home to his family soon.”

Yet the Biden administration has been criticized for reacting slowly and ineffectually to free Gambaryan. In a House Foreign Affairs Committee hearing last month, McCormick laid into Roger Carstens, the White House's special presidential envoy for hostage affairs, and Rena Bitter, the State Department's assistant secretary for consular affairs, asking why Gambaryan's case had not been elevated to that of an urgent hostage situation. “If he was your parent or your son, I would make the case this would already have been elevated. If it was someone of interest to the president or the secretary, this would have already been elevated. He is a US citizen,” McCormick told the hearing. “This guy deserves better.”

Bitter noted in response to McCormick's questioning that her colleagues had visited Gambaryan nine times but remained noncommittal about elevating his case to that of an urgent hostage situation. “We are watching this case closely, and we talk about this case quite frequently,” she told McCormick, adding that the State Department had “asked for humanitarian release” due to Gambaryan's medical issues.

On Thursday, neither the US nor Nigerian Departments of State immediately responded to WIRED's request for further comment on Gambaryan's case.

In his resolution and statements in last month's hearing, McCormick has argued that every aspect of Gambaryan's situation, from the illegality of his detention to Nigeria's record of human rights abuses, qualifies him for treatment as a hostage of a foreign government. One of the two Nigerian government bodies making allegations against Gambaryan dropped all charges against him last month. Yet he remains in Kuje jail, a facility that also houses convicted members of terrorist groups including Boko Haram. Even when he collapsed in court due to symptoms of malaria and pneumonia, the resolution notes, he was only admitted to a hospital for five hours before being returned to jail.

In a statement sent to WIRED Thursday, Gambaryan's wife, Yuki, expressed her concern again for her husband's health, thanked McCormick for his resolution, and emphasized her husband's lack of influence over Binance's actions.

“I hope the US government’s involvement will expedite the process of getting him released. My husband is innocent, he is not a decision maker at Binance and I hope the Nigerian authorities release him,” Gambaryan wrote. “He needs to be freed right now."

Pressure Grows in Congress to Treat Crypto Investigator Tigran Gambaryan, Jailed in Nigeria, as a Hostage

The cybercrime boss, who helped lead the prolific Zeus malware gang and was on the FBI’s “most wanted” list for years, has been sentenced to 18 years and ordered to pay more than $73 million.

For more than a decade, Vyacheslav Igorevich Penchukov—a Ukrainian who used the online hacker name “Tank”—managed to evade cops. When FBI and Ukrainian officials raided his Donetsk apartment in 2010, the place was deserted and Penchukov had vanished. But the criminal spree came to a juddering halt at the end of 2022, when he traveled to Switzerland, was arrested, then was extradited to the United States.

Today, at a US federal court in Lincoln, Nebraska, a judge sentenced Penchukov to two concurrent nine-year sentences, after he pleaded guilty to two charges of conspiracy to participate in racketeering and a conspiracy to commit wire fraud. United States District Judge John M. Gerrard also ordered Penchukov to pay more than $73 million, according to court records. The court also ordered three years of supervised release for each count and said they should run concurrently.

Both charges carried a maximum sentence of up to 20 years each. According to court documents, however, the US government and Penchukov’s lawyers both requested a less severe sentence following him signing a plea agreement in February. It is unclear what the terms of the plea deal include. At the time, documents show, Penchukov could also face having to repay up to $70 million—less than the combined amount he's ordered to pay in restitution and forfeited funds. “I understand this, but I don’t have such amounts of money,” he said in court earlier this year.

The US prosecution of Penchukov—who has been on the FBI's “most wanted” cyber list for more than a decade—is a rare blow against one of the most well-connected leaders of a prolific 2010s cybercrime gang. It also highlights the ongoing challenges Western law enforcement officials face when taking action against Eastern European cybercriminals—particularly those based in Russia or Ukraine, which do not have extradition agreements with the US.

Ahead of the sentencing, the Department of Justice refused to comment on the case, and the FBI and Penchukov’s lawyers did not respond to WIRED’s requests for comment.

When the Ukrainian pleaded guilty in February—a number of charges were dropped following him signing the plea agreement—he admitted to being one of the leaders of the Jabber Zeus hacking group, starting in 2009, that used the Zeus malware to infect computers and steal people’s bank account information. The group used the details to log in to accounts, withdraw money, and then send it to various money mules—stealing tens of millions from small US and European businesses.

“The defendant played a crucial role, a leadership role, in this scheme by directing and coordinating the exchange of stolen banking credentials and money mules,” prosecutors said in court earlier this year. They would steal thousands from victim companies, often draining their accounts.

Penchukov, who was also a well-known DJ in Ukraine, also admitted to a key role organizing the IcedID (also known Bokbot) malware, which collected the victim’s financial details and allowed ransomware to be deployed on systems. He was involved from November 2018 to at least February 2021, officials say. Investigators found he kept a spreadsheet detailing the $19.9 million income IcedID made in 2021.

“I never thought that we would ever see any of Jabber Zeus crew” face justice in the US, says Jim Craig, a senior director at cybersecurity firm Intel 471, who was previously a special agent in the FBI and helped lead the investigation into the Zeus cybercriminals and Penchukov, who is in his late thirties, starting in July 2009. Craig, who attended the sentencing, said he was happy with the result. Penchukov has aged since US investigators originally published photos of him, Craig says, and the criminal boss spoke during the sentencing hearing to apologize for his actions.

The Zeus malware, linked to FBI-wanted Russian Evgeniy Bogachev, first appeared online around the end of 2006 and in part used keyloggers to steal people’s banking information when they entered it online. The cybercriminals would log into accounts and send money to people acting as mules, who would cash out the funds. “It was just a really big jump in capabilities,” Keith Jarvis, a senior researcher at cybersecurity company Secureworks, says of the Zeus malware. “The volume of it was so out of control, and the banks didn't have a really good handle on it.”

By 2009, when the FBI’s investigations were starting, the Zeus gang had developed Jabber Zeus, adding the Jabber instant messenger into the setup. “When there was a compromise, they would get notified, and they could immediately have an operator jump on and start conducting the fraud automatically,” Jarvis says. They later developed Gameover Zeus and the group’s members—including Bogachev and, according to US prosecutors, an FBI-wanted Maksim Yakubets—eventually morphed into building some of the most disruptive ransomware of the past decade. (Bogachev and Yakubets, respectively, have $3 million and $5 million rewards on their heads from the US government).

In 2010, as detailed by WIRED’s 2017 cover story chronicling the hunt for the Zeus creators, the FBI and other law enforcement agencies had identified Penchukov and other members by analyzing their Jabber chat messages seized from a US-based server. “Ultimately we ran across a message where Tank had talked about his daughter,” Craig says. Penchukov disclosed her date of birth, name, and birth weight, which were used in cooperation with Ukraine’s security service to determine there was only one girl born that day with those details, and Penchukov was her father. The FBI investigators traveled to Donetsk, Ukraine, to arrest members of the gang.

Operation Trident Breach collared more than 50 people around the world in September 2010—with some members later being sentenced—but Penchukov wasn’t one of them. “It was quite obvious that Tank was tipped off,” Craig says. “There was no sign of him, and it was quite clean. You could definitely tell no one had been there a few days,” Craig recounts of the raid on Penchukov’s apartment. As detailed by MIT Technology Review, officials suspected corruption and family connections to high-level Ukrainian officials. Plus Russian investigators involved in the case “ghosted” other officials on the day the arrest was due to take place.

Penchukov was first publicly named in a February 2012 indictment, detailing his and other Zeus members’ alleged crimes. In 2015 he changed his name to Vyacheslav Igoravich Andreev. Jarvis, from Secureworks, says Penchukov can be considered one of the “elder statesmen” of this era of cybercrime, and everything has always indicated he was in charge of “running” the money mules the groups used and organizing the finances.

In November 2022 it was reported that Penchukov had been arrested in Geneva when he was “traveling to meet up with his wife.” The circumstances of his arrest are unclear, and Swiss authorities declined to comment on the case.

Since the Zeus gang were at their height, their particular brand of bank fraud—directly accessing victims accounts and moving money from them—has declined in prominence. Ransomware and data extortion, using cryptocurrency to launder money, has become the primary tactic of Russia-linked cybercriminals, earning them more than $1.1 billion in 2023.

Craig, the former FBI investigator, says one outstanding question will be how much Penchukov cooperated with officials and if he revealed anything about other criminals. “The significance of him being caught is important to show that law enforcement is not going to stop—wherever they go, there's going to be a chance and opportunity for them to get caught,” Craig says.

_Update 7/11/2024, 12:40 pm ET: Updated to clarify the amount of money Penchukov will be forced to turn over to authorities._

Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison

Google is bringing the password-killing “passkey” tech to its Advanced Protection Program users more than a year after rolling them out broadly.

The password killers known as “passkeys” are now available to users of Google's Advanced Protection Program, which works to add an additional layer of account protection for people who fear that they could face targeted digital attacks. The company is more than a year into supporting passkeys for all regular individual accounts and made them the default login option in October. But Google waited to offer passkeys to APP users until it was sure the community was ready to take the step.

APP users typically have a public-facing position or do controversial work. Anyone can enroll for free, but enabling Advanced Protection involves strict requirements for adding multi-factor authentication to an account, which previously involved hardware tokens. With the addition of passkeys, though, APP project manager Shuvo Chatterjee points out that APP's defensive benefits will now be more usable and accessible to people around the world.

“Security keys are super-duper strong. They are an un-phishable factor,” Chatterjee told WIRED ahead of today's announcement. “And yet it is still a thing that people have to carry around. They lose it, they cost a lot. So a request that we keep getting from the field is, are there other ways by which we can get the same level of security, but from something that’s more convenient and something we already have? Passkeys are something \[that\] works with the threat profile that our high-risk users deal with.”

With digital crime and online fraud exploding around the web, tech giants have stepped up their push in recent years to secure accounts and promote passkeys, a cryptographic authentication system, as a more-secure replacement for the scourge of passwords. Passkeys are stored locally on your devices (or can be stored on hardware tokens that support the protocol known as FIDO2) and are guarded by a fingerprint, face scan, or pin. Advanced Protection will also still offer users the option of enabling the service with traditional two-factor authentication where the hardware token is the second factor.

Courtesy of Google

If you wish to join, use the Advanced Protection Program enrollment page, click “Get started,” and walk through the process to enroll with a passkey or a physical security key. While APP is meant to keep everyone out of your account, Chatterjee also emphasizes that the program offers recovery options that users should set up so they can regain access if they are ever locked out of their own account.

The passkey rollout hasn't always been straightforward, but they are gradually proliferating around the world. Google said in April that passkeys were used for authentication more than a billion times across more than 400 million Google accounts in their first year of deployment. And the company says that each day, users authenticate with passkeys more often than SMS one-time codes or one-time codes generated on apps like Google Authenticator.

For Advanced Protection Program users who want the highest level of protection, though, the option to start using passkeys will mean less overhead and more possibilities.

“We’ve encountered many people who just don’t have access to security keys,” Chatterjee says. “They can’t get them in their country, they’re a journalist traveling in a war zone, they’re a campaign worker hopping from town to town. They don’t have security keys with them, but they have their phone with them. There are many situations where having the flexibility and security of passkeys is really important to this population.”

Google Is Adding Passkey Support for Its Most Vulnerable Users

Deepfake scam services. Victim data. Electrified shackles for human trafficking. Crypto tracing firm Elliptic found all were available for sale on an online marketplace linked to Cambodia’s ruling family.

As the crypto scam commonly known as “pig butchering” has exploded into a full-blown criminal industry that steals tens of billions of dollars a year, an entire ecosystem has formed around it. That sub-industry offers tools and data for finding and tricking targets, money laundering services to help liquidate stolen funds—even detention tools to imprison and coerce the human trafficking victims enslaved to work in scam operations.

New research now shows how all of those secondary services enabling the global scourge of pig butchering can be found on a single Cambodian online platform—part of a company linked to the Cambodian ruling family—known as Huione Guarantee.

On Wednesday, crypto-tracing firm Elliptic published a report that delves into crypto scammers’ extensive use of Huione Guarantee, a deposit and escrow service for peer-to-peer transactions that lets users buy and sell over the Telegram messaging service with the cryptocurrency Tether while preventing them from defrauding each other. By analyzing listings on the platform, engaging with sellers—sometimes undercover—and following funds across Tether’s blockchain sent to those sellers’ addresses, Elliptic was able to trace $11 billion in total transactions in just the three years since Huione Guarantee launched, including $3.4 billion so far this year.

Total transactions in the cryptocurrency Tether made via Huione Guarantee’s platform since its founding.

Courtesy of Elliptic

Elliptic estimates, based largely on public Chinese-language advertisements for the products and services available on Huione Guarantee, that the majority of those transactions were in service of pig butchering. “I’m not sure whether Huione Guarantee was originally established with this in mind, but it’s certainly become primarily a marketplace for online scammers,” says Tom Robinson, Elliptic’s cofounder and chief scientist. Robinson says Elliptic knows of around 10 platforms like Huione Guarantee that are used by crypto scammers, but none that are nearly so big. “This is the largest public guarantee platform for illicit crypto transactions that we’re aware of,” he says.

By some estimates, pig butchering scams have netted a whopping $75 billion from the start of 2020 to February of this year. The FBI said in April that reported crypto-investment fraud losses for the US hit $3.94 billion in 2023. In addition to scam victims, who are tricked into buying cryptocurrency and transferring it to criminals, the scammers on the other end are often victims of elaborate forced-labor schemes. Compounds where people are forced to live and work generating content to target scam victims have been reported in Myanmar, the Philippines, Cambodia, and other countries in Southeast Asia.

A listing on Huione Guaranteed for a scam-focused deepfake face-alteration tool.

Courtesy of Elliptic

Huione Guarantee’s crypto scam offerings span the entire food chain of the pig butchering industry: The researchers found shock-enabled GPS tracking shackles and electric batons for sale, used in the human trafficking operations that force enslaved victims to work on scam operations day in and day out in compounds across Southeast Asia. Other listings offered data on potential scam targets, fake investment websites to persuade targets to transfer funds, and deepfake face-altering services advertised for tricking scam victims. Finally, money laundering services advertised on Huione Guarantee offered to liquidate and obfuscate the source of the scammers’ stolen Tether, which accounted for the majority of the platform’s money flows.

“I would hypothesize that this is one of the drivers behind the increasing scale of these scams,” says Robinson. “Scammers no longer need to acquire victims' contact details, build telecoms infrastructure, or launder the scam proceeds themselves. They can outsource each of these to this community of service providers.”

WIRED reached out to the public email address listed on Huione Group’s website and several of its executives for comment but didn’t yet receive a response.

A listing on Huione Guaranteed for an electric baton, intended to be used to coerce enslaved laborers inside scam compounds.

Courtesy of Elliptic

Beyond Huione Guarantee, crypto scamming researchers say they’ve seen signs of code and toolkits being circulated and re-used between pig butchering operations. For example, Sean Gallagher, a senior threat researcher at Sophos, says he's recognized the same code underlying multiple fake crypto investment platforms and exchanges meant to trick victims into depositing their funds. “There are a number of identical kits I was seeing being run on different infrastructure with different domain names,” Gallagher says

Robinson notes that Elliptic wasn’t able to penetrate some “VIP” Telegram channels that appeared to be selling scam-related offerings on Huione Guarantee’s platform. That means, in fact, that the $11 billion in total revenue since 2021 is a lower bound for the marketplace’s total business, since Elliptic couldn’t identify some sellers’ Tether addresses. But otherwise, the platform’s bustling business in crypto scam products and services is largely conducted in public, albeit using Chinese-language jargon that can be difficult to penetrate: a “quick kill,” for instance, refers to a financial scam, while “runaway dogs” refers to trafficked prisoners who might try to escape, and “dog pushers” refers to those working in the scammer compounds.

That public nature of the criminal transactions is all the more shocking given that Huione Guarantee is operated by Huione Group, a Cambodian financial conglomerate that includes a company linked to the family of Cambodia’s prime minister, Hun Manet. One of the companies' directors, in fact, is Hun To, the prime minister’s cousin, who has been linked in an Al Jazeera investigation to an alleged scam compound reportedly owned by Heng He, a Cambodian conglomerate owned by two Chinese nationals.

Crypto scam researchers say that Huione Guarantee, despite its size, is just one of many money laundering methods that pig butcherers use. Given that much of the pig butchering ecosystem has ties to Chinese organized crime, pig butchering revenue is often laundered in a decentralized way by convincing individual Chinese citizens to accept and hand off cryptocurrency through their personal Alipay accounts for a small fee, notes Gary Warner, director of intelligence at cybersecurity firm DarkTower. Markets like Huione Guarantee, however, offer a path for scammers who don’t already have a laundering network they can rely on or who need to diversify their options for liquidating funds.

A listing on Huione Guaranteed for electrified GPS-tracking shackles for detaining enslaved scam laborers.

Courtesy of Elliptic

It’s perhaps no surprise that Huione Guarantee began operating in 2021, given that crypto scams surged during the Covid-19 pandemic. Sophos’ Gallagher notes that in Cambodia, pig butchering operations are largely run out of hotels and resorts that struggled with plummeting tourism in 2020 and 2021. “They were financed heavily or outright owned by Chinese companies in connection with special economic zones and other development tied to Belt and Road,” he says. Gallagher’s research indicates that laborers working on pig butchering in Cambodia—often against their will—are typically not citizens but have come from the surrounding region. “These facilities follow the same playbook as far as taking people’s passports and then using electrical shocks, cattle prods, and other physical punishment for not following the rules.”

As disturbing as it may be that a service enabling billions of dollars annually in crypto scam industry transactions is being run in the open—and with links to one of Cambodia’s most powerful families—Elliptic’s Robinson suggests that brazenness offers an opportunity to disrupt a keystone of that criminal industry: He proposes international sanctions targeting Huione’s leadership.

“This has the hallmarks of a darknet marketplace, but it's run by a large Cambodian conglomerate, which has documented links to the ruling family there,” Robinson argues. “There is surely scope to impose sanctions on a business such as this, to hinder this type of marketplace from operating.”

The $11 Billion Marketplace Enabling the Crypto Scam Economy

The US military has abandoned its half-century dream of a suit of powered armor in favor of a “hyper enabled operator,” a tactical AI assistant for special operations forces.

The day is slowly turning into night, and the American special operators are growing concerned. They are deployed to a densely populated urban center in a politically volatile region, and local activity has grown increasingly frenetic in recent days, the roads and markets overflowing with more than the normal bustle of city life. Intelligence suggests the threat level in the city is high, but the specifics are vague, and the team needs to maintain a low profile—a firefight could bring known hostile elements down upon them. To assess potential threats, the Americans decide to take a more cautious approach. Eschewing conspicuous tactical gear in favor of blending in with potential crowds, an operator steps out into the neighborhood's main thoroughfare to see what he can see.

With a click of a button, the operator sees … everything. A complex suite of sensors affixed to his head-up display start vacuuming up information from the world around him. Body language, heart rates, facial expressions, and even ambient snatches of conversation in local dialects are rapidly collected and routed through his backpack supercomputers for processing with the help of an onboard artificial intelligence engine. The information is instantly analyzed, streamlined, and regurgitated back into the head-up display. The assessment from the operators’ tactical AI sidekick comes back clear: There are a series of seasonal events coming into town, and most passersby are excited and exuberant, presenting a minimal threat to the team. Crisis averted—for now.

This is one of many potential scenarios repeatedly presented by Defense Department officials in recent years when discussing the future of US special operations forces, those elite troops tasked with facing the world’s most complex threats head-on as the “tip of the spear” of the US military. Both defense officials and science-fiction scribes may have envisioned a future of warfare shaped by brain implants and performing enhancing drugs, or a suit of powered armor straight out of _Starship Troopers_, but according to US Special Operations Command, the next generation of armed conflict will be fought (and, hopefully, won) with a relatively simple concept: the “hyper enabled operator.”

**More Brains, Less Brawn**

First introduced to the public in 2019 in an essay by officials from SOCOM’s Joint Acquisition Task Force (JATF) for Small Wars Journal, the hyper-enabled operator (HEO) concept is the successor program to the Tactical Assault Light Operator Suit (TALOS) effort that, initiated in 2013, sought to outfit US special operations forces with a so-called “Iron Man” suit. Inspired by the 2012 death of a Navy SEAL during a hostage rescue operation in Afghanistan, TALOS was intended to improve operators’ survivability in combat by making them virtually resistant to small-arms fire through additional layers of sophisticated armor, the latest installment of the Pentagon’s decades-long effort to build a powered exoskeleton for infantry troops. While the TALOS effort was declared dead in 2019 due to challenges integrating its disparate systems into one cohesive unit, the lessons learned from the program gave rise to the HEO as a natural successor.

The core objective of the HEO concept is straightforward: to give warfighters “cognitive overmatch” on the battlefield, or “the ability to dominate the situation by making informed decisions faster than the opponent,” as SOCOM officials put it. Rather than bestowing US special operations forces with physical advantages through next-generation body armor and exotic weaponry, the future operator will head into battle with technologies designed to boost their situational awareness and relevant decisionmaking to superior levels compared to the adversary. Former fighter pilot and Air Force colonel John Boyd proposed the “OODA loop” (observe, orient, decide, act) as the core military decisionmaking model of the 21st century; the HEO concept seeks to use technology to “tighten” that loop so far that operators are quite literally making smarter and faster decisions than the enemy.

“The goal of HEO,” as SOCOM officials put it in 2019, “is to get the right information to the right person at the right time.”

To achieve this goal, the HEO concept calls for swapping the powered armor at the heart of the TALOS effort for sophisticated communications equipment and a robust sensor suite built on advanced computing architecture, allowing the operator to vacuum up relevant data and distill it into actionable information through a simple interface like a head-up display—and do so “at the edge,” in places where traditional communications networks may not be available. If TALOS was envisioned as an “Iron Man'' suit, as I previously observed, then HEO is essentially Jarvis, Tony Stark’s built-in AI assistant that’s constantly feeding him information through his helmet’s head-up display.

“\[JATF\] is targeting technologies to deliver cognitive overmatch to SOF operators working at the edge in austere and contested environments in coordination with and working through partners and allies,” SOCOM spokesperson James O. Gregory tells WIRED, invoking a general description of the program from the command’s website. “Such technologies will enable tactical teams of SOF operators to intuitively use information made available by next-generation sensors, networks, computing, and communication systems to rapidly build situation awareness. It will also help make timely, well-informed decisions, and take actions inside an adversary's ability to react.”

**Enter the Gray Zone**

So what does the HEO actually look like today, five years after its introduction into the US military’s tactical lexicon? Given the sensitive (and somewhat notional) nature of the effort, details remain scarce, and SOCOM officials have remained relatively tight-lipped about its progress. But according to SOCOM’s Gregory, the scenario and concept the HEO seeks to address has “evolved” from what officials previously described to reporters at the program’s inception. Indeed, rather than augmenting warfighters deployed to active combat zones, SOCOM officials envision something more like a casually dressed operator vacuuming up information on a busy urban avenue through a Google Glass-like eyepiece and sizing up the situation—in other words, more James Bond than Tony Stark.

“The operational environment for the JATF’s current efforts is in the competition phase of warfare, in permissive or semi-permissive locations,” Gregory says. (A permissive environment is generally defined as an operational environment where US forces have the backing of a host country’s security apparatus, according to the US Army, while a “semi-permissive” environment is potentially hostile and local support is often not reliable.) No longer just another tool for a kinetic assault, the HEO will help elite troops operating in the “gray zone” between peace and conflict.

A SOCOM broad agency announcement—a general request for research and development proposals from the defense industry—published in 2020 and updated as recently as November 2023 details the JATF’s push for advanced technologies designed to boost situational awareness. Those technologies include: intelligence, surveillance, and reconnaissance capabilities “without substantial manning or networking resources” (the aforementioned “at the edge”); sophisticated sensors capable of “iris, facial, anatomical measures, gestures, gait, heartbeat, electromagnetic signals, deoxyribonucleic acid \[DNA\], and microbiome recognition”; low-visibility communications systems; and “data visualizations” that “permit \[operators\] to receive and intuitively understand networked information from communication, computing, and sensor systems,” among others. In short, the HEO envisions systems that enable the constant, real-time collection and distillation of data into actionable intel that could potentially mean the difference between life and death in an uncertain situation.

**Edge Case**

Envisioning a suite of aspirational capabilities is one thing; actually building them is another thing entirely. In terms of developing new products, Gregory says that the HEO effort has remained focused on three major experimental technology areas for the last several years: sensing and edge computing, architecture and analysis, and language translation.

“Sensing and edge computing” generally refers to the collection and processing of data from a variety of sources, but it also refers to the specialized computing power that operators need not only to function “at the edge,” but to actually run the AI-enabled software that will form the foundation of the HEO.

“Emerging technologies and solutions in artificial intelligence/machine learning require specialized ‘compute’ hardware, as traditional CPU-based devices are insufficient,” Gregory says. “We aim to feature a manpack device with a graphics processing unit, neural processing engine, and/or tensor processing unit capabilities. This will provide the necessary platform to leverage advanced technologies like language translation and other solutions at the edge, even when disconnected from the cloud.”

That computing power forms the basis for the “architecture and analysis” element focused on the rapid assessment and presentation of data to operators in the field. Gregory tells WIRED that, to support this element, the command has developed “a flexible \[system\] architecture that fuses data from various sources and media types” into an easily digestible format for operators to assess and act upon.

As for language translation, that’s self-explanatory. SOCOM believes that “prior to any hostilities ever occurring, clear communication can greatly enhance development of our long-term relationships,” Gregory says. “Voice-to-voice translation enables operators to communicate more effectively than relying on often scarce interpreters in the field. Even though many SOF personnel are multilingual, they are frequently deployed to regions with different languages or dialects.”

In line with these experimental technology areas, SOCOM has reportedly concentrated on six immediate lines of product development, per C4ISRNet: the “operator-worn kit” that includes both sensors and onboard computer processing power; application development resources; a unique, mission-agnostic system architecture; the “human-machine interface” that’s generally envisioned as a digital head-up display; a product called “information realization” that likely involves the clear presentation of data; and beyond-line-of-sight (BLoS) communications designed to keep troops in contact with their commanders (and each other) in satellite-denied environments.

According to Gregory, the command has gradually rolled out a handful of fresh capabilities from the HEO effort in recent years. In 2021, SOCOM announced that two products—a BLoS communications system and an unspecified “integrated situational awareness tool”—were transitioning into official programs of record, as Janes reported at the time. Gregory confirmed to WIRED that the BLoS system consists of “a steerable gimble antenna system that enhances the functionality” of the command’s SOF deployable nodes, a family of advanced satellite communications systems. The spokesperson also confirmed that the situational awareness tool, known as SEEKER, is an app that “enables advisers to build advanced situational awareness, thereby allowing them to select actions with an eye toward the broader situation rather than just the immediately apparent problem.” It’s unclear if the latter is related to the “automate the analyst” effort the command kicked off in 2020 to provide operators with an autonomous AI assistant.

Then there’s the “visual environment translation” system that’s designed to convert foreign language inputs into clear English in real time. Known overarchingly as the Versatile Intelligent Translation Assistant (VITA), the system encompasses both a visual environment translation effort and voice-to-voice translation capabilities and is “the most mature” of the JATF’s experimental technology areas, according to SOCOM. VITA is essentially “a voice-to-voice translation engine that functions offline on GPU-enabled devices,” Gregory says, small enough to be carried in the field on a laptop-tethered smartphone or wearable device and “engage in effective conversations where it was previously impossible.” And not only has VITA successfully demonstrated Russian, Chinese Mandarin, and Ukrainian language translation capabilities during testing, but the system has even been deployed to two undisclosed theaters of operations already.

“The visual translation component enhances situational awareness by translating video images, such as street signs, graffiti, and other written texts, in real time,” Gregory says. “Operators can use their phone cameras to scan their surroundings and understand foreign languages instantly.”

VITA provides US special operations forces with “a high-quality translation capability that is not reliant on the cloud or local interpreters, thus significantly reducing risk and logistical costs while increasing operational range and effectiveness for USSOF and our partners,” Gregory says. “The JATF is currently working with industry partners to reduce the size of the hardware and transition it into a SOF Program Executive Office for eventual fielding.” (And that language translation may not be restricted to a mobile device for long: According to SOCOM’s fiscal year 2025 budget request published in March, the command is still plowing ahead with head-mounted sensors and an augmented-reality HUD to present these functions right before operators’ eyes.)

**Field Work**

To US military planners, the HEO concept is promising: According to one Army assessment, the successful adoption of the system could potentially increase operator survivability far beyond that provided by the additional body armor of the TALOS program. But like other potentially revolutionary technology ventures, there’s certainly the possibility that HEO could end up a science fiction dream that collapses under the weight of its own technical complexity. And there’s no guarantee that operators will embrace the new technology seamlessly in the first place: Although VITA has shown operational promise, it’s unclear if other HEO products will prove intuitive enough to actually augment operators in the field rather than burden them with some complicated newfangled system. As Heinlein put it so aptly in _Starship Troopers_: “If you load a mud foot down with a lot of gadgets that he has to watch, somebody a lot more simply equipped—say with a stone ax—will sneak up and bash his head in while he is trying to read a vernier.”

Perhaps, like TALOS, the promise of a tactical AI assistant like Tony Stark’s Jarvis sidekick may prove simply too ambitious for military engineers to realize in a fully formed product. But even if the HEO effort ends up only fielding, say, the VITA language translation tool, it will still represent a major boost in capabilities for US special operators deployed abroad. The day is slowly turning into night, but American commandos own the night and, with the help of the HEO, will do so well into the next conflict.

AI-Powered Super Soldiers Are More Than Just a Pipe Dream

Plus: Researchers uncover a new way to expose CSAM peddlers, OpenAI suffered a secret cyberattack, cryptocurrency thefts jump in 2024, and Twilio confirms hackers stole 33 million phone numbers.

Proton, the company behind Proton Mail, launched an end-to-end encrypted alternative to Google Docs, seeking to compete with the cloud giant on privacy. We broke down how Apple is taking a similar approach with its implementation of AI, using a system it calls Private Cloud Compute in its new Apple Intelligence features.

In other news, we dug into how the US bans on TikTok and Kaspersky software, despite their national security justifications, pose a threat to internet freedom. We went inside a crash course for US diplomats on cybersecurity, privacy, surveillance, and other digital threats. And we published an in-depth investigation into the origins of the world’s most popular 3D-printed gun, which revealed that its creator was a self-described “incel” with fantasies of right-wing terror.

But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The giant hack against Ticketmaster may have taken another twist. In June, criminal hackers claimed they had stolen 560 million people’s information from the ticketing company owned by Live Nation. The company has since confirmed a breach, saying its information was taken from its Snowflake account. (More than 165 Snowflake customers were impacted by attacks on the cloud storage company that exploited a lack of multi-factor authentication and stolen login details).

Now in a post on cybercrime marketplace BreachForums, a hacker going by the name of Sp1d3rHunters is threatening to publish more data from Ticketmaster. The account claims to be sharing 170,000 ticket barcodes for upcoming Taylor Swift gigs in the US during October and November. The hacker demanded Ticketmaster “pay us $2million USD” or it will leak “680 million” users’ information and publish millions more event barcodes, including for concerts by artists such as Pink and Sting, and sporting events such as NFL games and F1 races.

The claims appear to be dubious, however, as Ticketmaster's barcodes aren't static, according to the company. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” a Ticketmaster spokesperson tells WIRED in a statement. The spokesperson adds that the company has not paid any ransom or engaged with the hackers’ demands.

Hacker groups are known to lie, exaggerate, and overinflate their claims as they try to get victims to pay. The 680 million customers that Sp1d3rHunters claimed to have data on is higher than the original figure provided when the Ticketmaster breach was first claimed, and neither number has been confirmed. Even if victims do decide to pay, hackers can still keep the data and try to extort companies for a second time.

Despite the breach at Ticketmaster originally being publicized in June, the company has only recently begun emailing customers alerting them to the incident, which happened between April 2 and May 18 this year. The company says the database accessed may include emails, phone numbers, encrypted credit card information, and other personal information.

**Stolen Login Details Can Unmask Child Abuse Viewers, Researchers Say**

In recent years, there’s been a sharp uptick in cybercriminals deploying infostealers. This malware can grab all of the login and financial details that someone enters on their machine, which hackers then sell to others who want to exploit the information.

Cybersecurity researchers at Recorded Future have now published proof-of-concept findings showing these stolen login details can be used to potentially track down people visiting dark-web child sexual abuse material (CSAM) sites. Within infostealer logs, the researchers say they were able to find thousands of login details for known CSAM websites, which they could then cross-reference with other details and identify the potential real-world names connected to the abusive website logins. The researchers reported details of individuals to law enforcement.

Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

Growing numbers of insurgents and extremists use the FGC-9. Forensic analysis of online platforms reveals the dark world of the man who created it—a self-described incel who supported the German far right.

The World’s Most Popular 3D-Printed Gun Was Designed by an Aspiring Terrorist

Generative AI is seeping into the core of your phone, but what does that mean for privacy? Here’s how Apple’s unique AI architecture compares to the “hybrid” approach adopted by Samsung and Google.

Yet Google and its hardware partners argue privacy and security are a major focus of the Android AI approach. VP Justin Choi, head of the security team, mobile eXperience business at Samsung Electronics, says its hybrid AI offers users “control over their data and uncompromising privacy.”

Choi describes how features processed in the cloud are protected by servers governed by strict policies. “Our on-device AI features provide another element of security by performing tasks locally on the device with no reliance on cloud servers, neither storing data on the device nor uploading it to the cloud,” Choi says.

Google says its data centers are designed with robust security measures, including physical security, access controls, and data encryption. When processing AI requests in the cloud, the company says, data stays within secure Google data center architecture and the firm is not sending your information to third parties.

Meanwhile, Galaxy’s AI engines are not trained with user data from on-device features, says Choi. Samsung “clearly indicates” which AI functions run on the device with its Galaxy AI symbol, and the smartphone maker adds a watermark to show when content has used generative AI.

The firm has also introduced a new security and privacy option called Advanced Intelligence settings to give users the choice to disable cloud-based AI capabilities.

Google says it “has a long history of protecting user data privacy,” adding that this applies to its AI features powered on-device and in the cloud. “We utilize on-device models, where data never leaves the phone, for sensitive cases such as screening phone calls,” Suzanne Frey, vice president of product trust at Google, tells WIRED.

Frey describes how Google products rely on its cloud-based models, which she says ensures “consumer's information, like sensitive information that you want to summarize, is never sent to a third party for processing.”

“We’ve remained committed to building AI-powered features that people can trust because they are secure by default and private by design, and most importantly, follow Google’s responsible AI principles that were first to be championed in the industry,” Frey says.

**Apple Changes the Conversation**

Rather than simply matching the “hybrid” approach to data processing, experts say Apple’s AI strategy has changed the nature of the conversation. “Everyone expected this on-device, privacy-first push, but what Apple actually did was say, it doesn’t matter what you do in AI—or where—it’s how you do it,” Doffman says. He thinks this “will likely define best practice across the smartphone AI space.”

Even so, Apple hasn’t won the AI privacy battle just yet: The deal with OpenAI—which sees Apple uncharacteristically opening up its iOS ecosystem to an outside vendor—could put a dent in its privacy claims.

Apple refutes Musk’s claims that the OpenAI partnership compromises iPhone security, with “privacy protections built in for users who access ChatGPT.” The company says you will be asked permission before your query is shared with ChatGPT, while IP addresses are obscured and OpenAI will not store requests—but ChatGPT’s data use policies still apply.

Partnering with another company is a “strange move” for Apple, but the decision “would not have been taken lightly,” says Jake Moore, global cybersecurity adviser at security firm ESET. While the exact privacy implications are not yet clear, he concedes that “some personal data may be collected on both sides and potentially analyzed by OpenAI.”

How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

Proton is adding an end-to-end encrypted documents editor to its privacy tools, boosting its competition with Google’s suite of productivity apps.

When particle physicist Andy Yen launched the privacy-focused email service Proton Mail as an ambitious crowdfunding campaign in 2014, the ultimate goal was to make it easier for people to be private online. Now, more than a decade on, his Switzerland-based company, Proton, is in the process of taking one of its biggest potential steps to reduce Google’s online dominance.

Today, Proton is launching the ability to create, edit, and collaborate on end-to-end encrypted documents within its online file storage systems. This means that only the creator of a document, and anyone they have shared it with, can view the contents of the file. Nobody else, including Proton, can see what has been written in the documents, according to the company.

The move to add encrypted documents to Proton is a shot at the data-hungry approaches of Google and Microsoft, which both host individual and business cloud services but don’t encrypt files and can also collect vast amounts of data about people. It also makes Proton one of only a handful of businesses providing encrypted documents and editing online.

“One thing that we’ve heard a lot from both businesses and also consumers is that they need a document product, because Google Docs is the reason they stay on Google,” Proton founder and CEO Yen tells WIRED. “It will look and feel a bit like Google Docs, because in fact, it's supposed to be easy for people to adopt. The biggest barrier to privacy has always been user experience.”

Courtesy of Proton

Documents in Proton Drive, which will start rolling out to people today, does look like Google Docs. In screenshots shared by Proton, it appears to be a clean document editor, with many of the standard options you would expect: font and text changes, formatting, adding links, images, and more. The document editor is initially only available on the web and not in app form.

Yen says Proton has been internally using the system for the last month and is now ready to roll it out to consumers. “I feel it is relatively polished,” Yen says. To compete with other online document editors, he says, the team also built in collaboration functionality from the beginning. This includes real-time editing by multiple people, commenting, and showing when someone else is viewing the document.

In April, Proton acquired encrypted note-taking app Standard Notes, which is a separate product from Docs. “It's actually not ‘take Standard Notes and stick it into Proton,’” Yen says, adding that the encryption architecture of the two were different, and Proton Docs is “more or less a ground-up, clean build in Proton’s ecosystem on our software stack.” (WIRED was unable to test the Docs before it was launched).

The big difference Proton is adding when compared to Google Docs is the encryption—something that is challenging to do at scale and also harder when a document has multiple people editing it at the same time. Yen says it's not just the contents of documents that are being encrypted, so are other elements like keystrokes, mouse movements, and file names and paths.

The company, which last month announced it is moving toward a nonprofit status, uses open source encryption, and Yen says building the Docs system required encryption key exchange and synchronization to happen across multiple users. Part of this was possible, Yen says, because last year the company added version history for documents stored in its Drive system, which the Docs are built on top of.

There are relatively few—if any—major end-to-end encrypted document editors online. Other existing services, which WIRED has not tried, include CryptPad and various note-taking or notepad-style apps. There are also apps that encrypt files locally on your machine, such as Cryptee and Anytype.

Recently, Proton has been moving quickly to launch new encrypted products—adding cloud storage, a VPN, a password manager, and calendar alongside its original ProtonMail email service. The company has also faced scrutiny over some information it has provided to law enforcement, such as recovery emails that have been added to accounts. It changed some of its policies in 2021 after being ordered to collect some user metadata. While the company is based outside of the US and EU, it still responds to thousands of Swiss law enforcement requests.

Ultimately, Yen says, the company is trying to offer as many private alternatives to Big Tech services, particularly Google, as it can. “Everything Google’s got, we’ve got to build as well. That's the road map. But the challenge, of course, is the order in which you do it,” Yen says. “In some sense, taking privacy to a more mainstream audience also requires going further afield, trying different things, and being a bit more adventurous in the things that we build and things that we launch.”

Source

Wired