Amid a rising tide of adversary drones and missile attacks, laser weapons are finally poised to enter the battlefield.

The age of the laser weapon is finally upon us.

The United States Army has officially sent a pair of high-energy laser weapons overseas to defend American troops and US allies against enemy drones, the service recently revealed, marking the first publicly known deployment of a directed-energy system for air defense in military history. And, according to a top official, those weapons are actively blasting threats out of the sky.

The weapon, known as the Palletized High Energy Laser (P-HEL) and developed by the American defense contractor BlueHalo based on the company’s 20-kilowatt Locust Laser Weapon System, first arrived in an unspecified location overseas and “commenced operational employment” in November 2022, according to an April press release from the company. A second system arrived overseas “earlier this year.”

While the Army initially declined to indicate where the P-HEL systems were sent and whether they had achieved a “kill” against an adversary drone, citing operational security concerns, the service’s top acquisition official recently confirmed that the new laser weapons had in fact succeeded in neutralizing incoming threats in the Middle East.

“They've worked in some cases,” Doug Bush, the Army’s assistant secretary for acquisition, logistics, and technology, told _Forbes_ this month. “In the right conditions, they're highly effective against certain threats.”

News of the P-HEL’s deployment comes as the US military seeks to aggressively bolster its air defense capabilities amid a dramatic increase in drone and missile attacks against US troops by Iran-backed militias in the Middle East, as well as against US Navy warships operating in the Red Sea by Houthi rebels in Yemen following the October 7 attack in Israel by Hamas.

Since the beginning of the Israel-Hamas conflict, the US Defense Department has been slowly but surely hinting at the use of laser weapons downrange. But the arrival of the P-HEL in the Middle East for operational use is a technological victory for the US military, which has actively pursued research related to directed-energy weapons since the 1970s. Even more significantly, it may also represent a tipping point for the development and use of laser weapons more broadly by militaries around the world.

BlueHalo’s LOCUST Laser Weapon System (LWS) combines precision optical and laser hardware with advanced software, artificial intelligence (AI), and processing to enable and enhance the directed energy “kill chain”.Photograph: BlueHalo

**Light at the End of the Tunnel**

Following its creation in 1960 by American engineer and physicist Theodore Maiman, the laser—technically an acronym for “light amplification by stimulated emission of radiation”—almost immediately became a futuristic weapon of choice among both science fiction writers and military planners. This wasn’t surprising: While Maiman touted the potential scientific applications of his discovery when he first unveiled it to the country later that year, the laser immediately conjured up visions in the public consciousness of the Martian “heat ray” from H. G. Wells’ _War of the Worlds_, so much so that many of the contemporary headlines from its debut were variations of the _Los Angeles Herald_’s “L.A. Man Discovers Science Fiction Death Ray,” according to Jeff Hecht’s book _Beam: The Race to Make the Laser_. “In reality, the laser was more of a Life Ray than a Death Ray,” Maiman would later recall thinking of his invention’s medical applications, according to his memoir.

The Pentagon began exploring the military applications of lasers almost immediately, from relatively practical uses like designators for laser-guided bombs to more far-fetched concepts like the Strategic Defense Initiative of the 1980s, also known as “Star Wars.” But only in the past few decades has the underlying technology advanced to the point where laser weapons are effective against their intended targets.

In the mid-2000s, the Air Force successfully used its Boeing 747-based YAL-1 airborne laser to defeat ballistic missiles in flight during tests, while the Army’s Humvee-mounted Zeus-HMMWV Laser Ordnance Neutralization System system deployed to Afghanistan and Iraq to zap landmines, improvised explosive devices, and unexploded ordnance. By 2014, the Navy’s AN/SEQ-3 Laser Weapon System (LaWS) was successfully disabling drones and small boats during testing from the bow of the Austin-class amphibious transport dock USS _Ponce_ in what the service billed at the time as the world’s first “active laser weapon.” (When the _Ponce_ was decommissioned in 2017, the LaWS’s successor system, the Technology Maturation Laser Weapon System Demonstrator, was installed on the San Antonio-class amphibious transport dock USS _Portland_, which successfully tested it in 2020 and 2021).

Apart from intermittent attempts at developing a non-lethal “laser rifle” over the decades, the Pentagon has generally envisioned employing modern directed-energy weapons primarily for defensive purposes. If successfully developed, high-energy lasers in particular could prove highly effective at short-range air defense missions against helicopters and low-flying attack aircraft, as well as blasting incoming rockets, artillery, and mortars out of the sky, according to a 2023 Congressional Research Service report on the US military’s directed-energy weapons programs. With enough power, a sustained laser beam could neutralize fast-moving hardened threats like cruise missiles and, eventually, even ballistic missiles.

After decades of technological progress, the US military is finally making the dream of laser weapons an operational reality: Not only has the Pentagon increasingly poured money into research and development, spending roughly $1 billion a year on at least 31 directed-energy programs since 2020, but the department has also finally deployed several mature laser weapons alongside US forces abroad in recent years for testing.

Those laser weapons include the Air Force’s High-Energy Laser Weapon System, a Raytheon-developed dune-buggy-mounted system developed for air base defense that saw testing overseas in 2021; the Marine Corps’ Compact Laser Weapon System, which Marines have been training on in the Middle East since 2021; Lockheed Martin’s 60-kilowatt High Energy Laser with Integrated Optical-dazzler and Surveillance (HELIOS), which currently adorns the bow of the Navy’s Arleigh Burke-class destroyer USS _Preble_; and the Army’s 50-kilowatt Stryker-mounted Directed Energy Maneuver-Short Range Air Defense (DE M-SHORAD) system, or “Guardian,” which consists of a laser turret mounted on a Stryker infantry carrier, a platoon of which arrived in the Middle East in February for “real world testing.” The Army also recently took receipt of a 300-kilowatt “Valkyrie” laser system designed explicitly to deal with incoming cruise missiles.

The adoption of BlueHalo’s Locust laser weapon system in particular likely won’t stop with the P-HEL. In 2023, the company received contracts not just to develop the new 20-kilowatt Army Multi-Purpose High Energy Laser (AMP-HEL) system that’s designed to integrate with the service’s next-generation Infantry Squad Vehicle light utility vehicle, but also a potential laser system for the Marine Corps’ Joint Light Tactical Vehicle that’s set to replace the service’s aging Humvee fleet.

The US military isn’t the only conventional fighting force pushing for a directed-energy element of its air defenses. The UK Royal Navy in April announced that it planned to fast-track the installation of its new 50-kilowatt “DragonFire” high-powered laser onto a warship by 2027 instead of 2032 as originally planned “as the need for weapons to counter drone and missile threats—like those fired by Houthi rebels—grows,” the service said in a statement. Less than a week later, US House Republicans unveiled their long-delayed security assistance package for Israel that included $1.2 billion for the development of the Israeli military’s “Iron Beam” laser air defense system “to counter short-range rocket threats” amid attacks from Hamas militants. Meanwhile, countries like Russia, China, France, India, and Turkey, among others, have all invested heavily in the development of laser systems in recent years, according to the Rand Corporation.

During a trial at the MOD’s Hebrides Range, the DragonFire laser directed energy weapon (LDEW) system achieved the UK’s first high-power firing of a laser weapon against aerial targets. The range of DragonFire is classified, but it is a line-of-sight weapon and can engage with any visible target.Photograph: UK.gov

**Cheap Threats**

The development and fielding of directed-energy weapons like lasers has taken on such new urgency among world governments in recent years due to the rapid proliferation of relatively cheap one-way attack drones among both professional militaries (see: the 2020 conflict between Armenia and Azerbaijan and Russia’s ongoing invasion of Ukraine) and irregular forces like Yemen’s Houthis in the Red Sea, ISIS cells in Iraq and Syria, and Iran-backed militias across the Middle East. In 2021, then-Central Command chief Marine General Frank McKenzie Jr. warned US lawmakers that weaponized commercial off-the-shelf drones have become the greatest threat to US forces in the region since the advent of the improvised explosive device during the early years of the Global War on Terror.

That threat is very real. In January, three US service members were killed and more than 40 others were injured in a drone attack conducted by an Iran-backed militia on a military outpost in Jordan near the Syrian border. As of mid-February, more than 140 additional service members had been injured in attacks launched against American forces in Iraq and Syria since mid-October, according to the Pentagon, 130 of whom were suffering from traumatic brain injuries. That more American troops weren’t killed in these attacks was essentially a matter of luck, according to Army General Michael "Erik" Kurilla, the current head of Central Command.

"There are several incidents where \[drones\] coming into a base hit another object, got caught up in a netting or other incidents where, had they hit the appropriate target that they were targeting, it would have injured or killed service members," Kurilla told lawmakers during a Senate Armed Services Committee hearing in March.

This rising tide of adversary drones has prompted US military commanders to clamor for more directed-energy options, as has the increased threat of missile attacks. As the rate of Houthi potshots at American warships and merchant vessels in the Red Sea began to spike in January, the Navy’s current surface warfare boss publicly emphasized that the service needed to rapidly accelerate the rate of development and fielding of its directed-energy assets not just to deal with drones but also incoming cruise and ballistic missiles.

“What we’re facing in the Red Sea is more than just drones. We’re looking at land-attack cruise missiles, we’re looking at anti-ship ballistic missiles that are getting shot in the Red Sea by the Houthis. And our ships are dealing with all of those,” the Naval Surface Forces commander, vice admiral Brendan McLane, told reporters in early January. “One of the things that I think we really need to get after quicker is we need to accelerate the development of directed-energy weapons, whether it’s a laser, whether it’s a microwave.” Navy Secretary Carlos Del Toro echoed McClane’s comments the next day, telling reporters that he was “very, very excited” to boost investments in laser weapon research and development for the service.

Developing and fielding laser weapons isn’t just a matter of practicality, but price tag. Rather than force warships and ground troops to expend costly munitions like the $2.1 million-a-shot Standard Missile-2 naval missile and $480,000-a-shot FIM-92 Stinger missile on comparatively inexpensive drones, a laser weapon can defeat incoming threats with a basically negligible cost-per-shot ($1 to $10, per an April 2023 Government Accountability Office assessment) and, with a suitable power source, a near-infinite magazine. Given the fact that the US military has already expended nearly $1 billion in munitions since October to defend against Iran-backed attacks in the Red Sea and elsewhere (at an average of $100,000 per shot, per officials), lasers and other directed-energy weapons may prove far more cost-effective in the long run for a Pentagon explicitly looking to keep counter-drone costs down.

“I would love to have the Navy produce more directed energy that can shoot down a drone, so I don't have to use an expensive missile to shoot it down,” as Kurilla put it in his testimony before lawmakers in March.

The confluence of technological advancements and the urgent need posed by the rise of weaponized drones has created circumstances that may induce the US and its allies to even more rapidly develop and employ laser weapons around the world.

But challenges remain. Chief among them is ensuring that laser weapons systems actually produce a coherent laser beam as expected outside the controlled setting of a lab in the real world, where "substances in the atmosphere—particularly water vapor, but also sand, dust, salt particles, smoke, and other air pollution—absorb and scatter light, and atmospheric turbulence can defocus a laser beam," according to the Congressional Research Service. While atmospheric problems are particularly pronounced for shipboard lasers, the CRS report notes that these systems can be engineered to hit a “sweet spot” in the electromagnetic spectrum to overcome the atmospheric absorption inherent to maritime operations. Time will tell with the operational deployment of the P-HEL and testing of the DE M-SHORAD in the Middle East whether those systems can adjust to more inhospitable conditions.

Beyond functional issues, there’s also the question of teaching service members to operate a laser effectively in a combat setting. The CRS report notes that “thermal blooming”—where a sustained laser beam heats up the air it’s passing through, which in turn defocuses the beam—makes head-on (or “down-the-throat”) shots against incoming targets less effective, a problem that will require a training and doctrinal fix in order to compensate. And while many of the US military laser weapons in development require minimal training to use (the BlueHalo Locust on which the P-HEL is based runs on an Xbox controller), the 2023 GAO assessment indicated that the US military will need to develop brand new “tactics, techniques, and procedures” for operating the novel systems in complex combat environments. The laser may work, but it’s up to service members to get the most out of it.

“What we don’t know yet for directed-energy systems necessarily is how to fight \[with\] them,” said Army lieutenant general Robert Rasch, head of the service’s Rapid Capabilities and Critical Technologies Office, which manages its directed-energy portfolio, in August. “How to fight lasers on the battlefield, how to integrate kinetic and non-kinetic effectors, like directed energy, and our traditional air-defense missiles into the battle space.”

**A Problem in Search of a Solution**

Even with additional training, evolving threats like rapidly moving drones or cruise missiles hardened against interception will require a significant boost in power that most existing systems simply can’t generate yet. Take the Navy’s shipborne 60-kilowatt HELIOS laser weapon: While the service wants to scale the system to 300 kilowatts to burn through the nose cones of incoming cruise missiles, the Navy’s surface warfare boss at the time, Rear Admiral Ron Boxall, previously stated in 2019 that the fleet’s new Flight III Arleigh Burke-class destroyers are already maxed out on juice (or “out of Schlitz,” as Boxall put it) due to the requirements of operating the warships’ brand-new AN/SPY-6 Air and Missile Defense Radar. As laser weapons become more robust to counter increasingly complex threats, those power requirements are only going to increase.

And even if laser weapons actually do end up operating effectively downrange with the right technology and training, US service members are then faced with complicated logistics considerations when it comes to keeping them up and running. Laser weapons are extremely complex machines, which makes their repair and maintenance in austere environments a significant challenge for deployed service members who may not have the right tool or facilities on hand. Indeed, the GAO assessment noted that many of the internal mechanisms critical to directed-energy weapons are so sensitive that they typically require a specialized “clean room” for repairs; in one recent case, a laser weapon sent to an operational environment for testing “had to be returned to the manufacturer in the United States” for maintenance after encountering battery and cooling challenges.

“Lasers are complicated. This is not a Humvee that’s sitting in the motor pool,” as Lieutenant General Daniel Karbler, the head of the Army’s Space and Missile Defense Command, reportedly said in August 2023. “Many of the some of the main \[laser\] components … you’re not going to have a supply room or maintenance office full of repair parts.”

Taken together, all of these challenges could pose a serious potential roadblock to the widespread proliferation of laser weapons across the US military. As the GAO report notes, many promising military technologies too often fall into the so-called “valley of death”—a limbo between ongoing R&D and the actual acquisition and operational use of a new system—because the various military branches “may require a higher level of technology maturity than the science and technology community is able to fund and develop.” While military commanders may clamor for laser technology today, challenges like beam coherence and thermal blooming may prove insurmountable regardless of how much time and patience the Pentagon pours into development, a prospect that could relegate laser weapons to an R&D graveyard alongside other ambitious projects like the Navy’s electromagnetic railgun. The P-HEL may represent a new beginning for laser weapons, but it could also end up as an exception that proves they aren’t ready for prime time yet.

Maiman, the physicist who invented the laser, once famously derided his creation as “a solution in search of a problem,” an idiom often used to describe innovations that don’t address any real issue and, in turn, don’t offer any real value. But more than a half-century after the laser’s introduction into America’s modern technological vocabulary, the rise of deadly drones and missile threats has presented the laser weapon with a pressing issue worth solving. And while the laser is still far from becoming a ubiquitous piece of military technology, it holds the potential to revolutionize how US troops counter airborne threats overseas—and, in time, change the face of modern warfare as we know it.

Welcome to the Laser Wars

Plus: China is suspected in a hack targeting the UK’s military, the US Marines are testing gun-toting robotic dogs, and Dell suffers a data breach impacting 49 million customers.

Law enforcement in the United States, United Kingdom, and Australia this week named a Russian national as the person behind LockBitSupp, the pseudonym of the leader of the LockBit ransomware gang that the US says is responsible for extracting $500 million from its victims. Dmitry Yuryevich Khoroshev has been sanctioned and charged with 26 criminal counts in the US, which combined could result in a prison sentence of 185 years. That is, if he’s ever arrested and successfully prosecuted—an extremely rare event for suspects who live in Russia.

Elsewhere in the world of cybercrime, WIRED’s Andy Greenberg interviewed a representative of Cyber Army of Russia, a group of hackers who have targeted water utilities in the US and Europe and are said to have ties to the notorious Russian military hacking unit known as Sandworm. The responses from Cyber Army of Russia were littered with pro-Kremlin talking points—and some curious admissions.

A deputy director of the FBI has urged the agency’s employees to continue to use a massive foreign surveillance database to search for the communications of “US persons,” sparking the ire of privacy and civil liberty advocates who unsuccessfully fought for such searches to require a warrant. Section 702 of the Foreign Intelligence Surveillance Act requires that “targets” of the surveillance program be based outside the US, but the texts, emails, and phone call of people in the US can be included in the 702 database if one of the parties involved in the communication is foreign. An amendment that would have required the FBI to obtain a warrant for 702 searches of US persons failed in a tie vote earlier this year.

Security researchers this week revealed an attack on VPNs that forces some or all of a user’s web traffic to be routed outside the encrypted tunnel, thus negating the entire reason for using a VPN. Dubbed “TunnelVision,” the attack impacts nearly all VPN applications, and the researchers say the attack has been possible since 2022, meaning it’s possible that it’s already been used by malicious actors.

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Microsoft has developed an offline generative AI model designed specifically to handle top-secret information for US intelligence agencies, according to _Bloomberg_. This system, based on GPT-4, is isolated from the internet and only accessible through a network exclusive to the US government. William Chappell, Microsoft's chief technology officer for strategic missions and technology, told _Bloomberg_ that, theoretically, around 10,000 individuals could access the system.

Although spy agencies are eager to leverage the capabilities of generative AI, concerns have been raised about the potential unintended leakage of classified information, as these systems typically rely on online cloud services for data processing. However, Microsoft claims that the model it created for the US government is “clean,” meaning it can read files without learning from them, preventing secret information from being integrated into the platform. Bloomberg noted that this marks the first time a major large language model has operated entirely offline.

Sky News reported this week that Britain's Ministry of Defence was the target of a significant cyberattack on its third-party payroll system. On Tuesday, Grant Shapps, the UK defence secretary, informed members of Parliament that payroll records of approximately 270,000 current and former military personnel, including their home addresses, had been accessed in the cyberattack. “State involvement” could not be ruled out, he said.

While the government has not publicly identified a specific country involved, Sky News has reported that the Chinese government is suspected. China’s foreign ministry has denied the allegations, saying in a statement that it “firmly opposes and fights all forms of cyber attacks” and “rejects the use of this issue politically to smear other countries.”

The payroll company, Shared Services Connected, had known about the breach for months before reporting it to the government, according to _The Guardian_.

The United States Marine Forces Special Operations Command (MARSOC) is testing robotic dogs that can be armed with artificial-intelligence-enabled gun systems. According to reporting from The War Zone, the manufacturer of the AI gun system, Onyx Industries, confirmed to reporters at a defense conference this week that as many as two of MARSOC’s robot dogs, developed by Ghost Robotics, are equipped with its weapons systems.

In a statement to The War Zone, MARSOC clarified that the robot dogs are “under evaluation” and are not yet being deployed in the field. They noted that weapons are just one possible application for the technology, which could also be used for surveillance and reconnaissance. MARSOC emphasized that they are fully compliant with US Department of Defense policies on autonomous weapons.

The US Marine Corps has previously tested robotic dogs armed with rocket launchers.

Days after a hacker posted to BreachForums offering to sell data from nearly 50 million Dell customers, the company began notifying its customers of a data breach in a company portal. According to the email sent to the people impacted, the leaked data contains names, addresses, and information about purchased hardware. “The information involved does not include financial or payment information, email address, telephone number or any highly sensitive customer information,” the email to affected customers states.

Microsoft Deploys Generative AI for US Spies

TunnelVision is an attack developed by researchers that can expose VPN traffic to snooping or tampering.

Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering.

TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user's VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then.

**Reading, Dropping, or Modifying VPN Traffic**

The effect of TunnelVision is that “the victim's traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the internet.”

The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself. Researchers from Leviathan Security explained:

> Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway. When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.
> 
> We use DHCP option 121 to set a route on the VPN user’s routing table. The route we set is arbitrary and we can also set multiple routes if needed. By pushing routes that are more specific than a /0 CIDR range that most VPNs use, we can make routing rules that have a higher priority than the routes for the virtual interface the VPN creates. We can set multiple /1 routes to recreate the 0.0.0.0/0 all traffic rule set by most VPNs.
> 
> Pushing a route also means that the network traffic will be sent over the same interface as the DHCP server instead of the virtual network interface. This is intended functionality that isn’t clearly stated in the RFC. Therefore, for the routes we push, it is never encrypted by the VPN’s virtual interface but instead transmitted by the network interface that is talking to the DHCP server. As an attacker, we can select which IP addresses go over the tunnel and which addresses go over the network interface talking to our DHCP server.
> 
> We now have traffic being transmitted outside the VPN’s encrypted tunnel. This technique can also be used against an already established VPN connection once the VPN user’s host needs to renew a lease from our DHCP server. We can artificially create that scenario by setting a short lease time in the DHCP lease, so the user updates their routing table more frequently. In addition, the VPN control channel is still intact because it already uses the physical interface for its communication. In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.

The attack can most effectively be carried out by a person who has administrative control over the network the target is connecting to. In that scenario, the attacker configures the DHCP server to use option 121. It’s also possible for people who can connect to the network as an unprivileged user to perform the attack by setting up their own rogue DHCP server.

The attack allows some or all traffic to be routed through the unencrypted tunnel. In either case, the VPN application will report that all data is being sent through the protected connection. Any traffic that’s diverted away from this tunnel will not be encrypted by the VPN and the internet IP address viewable by the remote user will belong to the network the VPN user is connected to, rather than one designated by the VPN app.

Interestingly, Android is the only operating system that fully immunizes VPN apps from the attack because it doesn't implement option 121. For all other OSes, there are no complete fixes. When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks. Network firewalls can also be configured to deny inbound and outbound traffic to and from the physical interface. This remedy is problematic for two reasons: (1) A VPN user connecting to an untrusted network has no ability to control the firewall, and (2) it opens the same side channel present with the Linux mitigation.

The most effective fixes are to run the VPN inside of a virtual machine whose network adapter isn’t in bridged mode or to connect the VPN to the internet through the Wi-Fi network of a cellular device. The research, from Leviathan Security researchers Lizzie Moratti and Dani Cronce, is available here.

_This story originally appeared on_ _Ars Technica._

‘TunnelVision’ Attack Leaves Nearly All VPNs Vulnerable to Spying

An internal email from FBI deputy director Paul Abbate, obtained by WIRED, tells employees to search for “US persons” in a controversial spy program's database that investigators have repeatedly misused.

House Intelligence Committee chair Mike Turner and ranking member Jim Himes blasted out invitations announcing a “bipartisan celebration” of the 702 program’s continuation last week. The event, which the lawmakers have dubbed FISA Fest, is being held in a reception room in the US Capitol building Wednesday night.

A House Intelligence Committee spokesperson did not respond to a request for comment.

Turner and Himes were instrumental in preserving the FBI’s warrantless access to 702 data. In countless “briefings” since October, the pair urged members of their respective parties to avoid reining in the FBI’s authority too greatly. Instead, the new procedures designed by the bureau itself were touted by both lawmakers as a sufficient bulwark against further abuse.

Narrowly winning that battle last month, Himes and Turner worked to kill an amendment that would have forced FBI employees to get search warrants before reviewing the communications of Americans swept up by the program. (The amendment, opposed by the Biden White House, failed in a tie vote, 212-212.) Instead, the FBI’s procedures, now part of the 702 statute, require employees to affirmatively “opt in” before accessing the wiretaps. They must also seek permission from an FBI attorney before conducting “batch queries” of the database. And queries for communications of elected officials, reporters, academics, and religious figures are now all deemed “sensitive” and require approval from higher up the chain of command.

Congress established Section 702 in 2008 to legitimize an existing surveillance program run by the National Security Agency (NSA) without congressional oversight or approval. The program, more narrowly defined at the time, intercepted communications that were at least partly domestic but included a target the government believed was a known terrorist. While bringing the surveillance under its authority, Congress has helped to steadily expand the scope of the surveillance to encompass a new slate of threats, from cybercrime and drug trafficking to arms proliferation.

While advocates for 702 surveillance often imply that Americans who are wiretapped are communicating with terrorists—a concoction that Turner himself repeatedly lent credence to this year—the allegation is dubious. Officially, it is the US government’s position that it is impossible to know which US citizens are being surveilled or even how many of them there are. The chief aim of the 702 program is to acquire “foreign intelligence information,” a term that encompasses not only terrorism and acts of sabotage but information necessary for the government to conduct its own “foreign affairs.”

Surveillance critics worry that the array of possible targets extends far beyond what is being characterized in unclassified settings. It is uncontroversial to suggest that the US government—like all governments with the power to spy—finds reasons to spy on foreign allies, businesses, even news publications. So long as the target is foreign, they have no privacy rights.

The limits of the 702 program remain murky, even to congressional members insisting that it should not be curbed further. The Senate Intelligence Committee chair, Mark Warner, acknowledged to reporters this week that language in Section 702 needs to be “fixed,” even though he voted last month to make the current language law.

FISA experts had warned for months that new language introduced by the House Intelligence Committee is far too vague in the way it describes the categories of businesses the US government can compel, fearing that the government would obtain the power to force anyone with access to a target’s online communications into snooping on the NSA’s behalf—IT workers and data center staff among them.

A trade group representing Google, Amazon, IBM, and Microsoft, among some of the world's other largest technology companies, concurred last month, arguing that the new version of the surveillance program threatens to “dramatically expand the scope of entities and individuals” subject to Section 702 orders.

“We are working on it,” Warner told The Record on Monday. “I am absolutely committed to getting that fixed,” he said, suggesting the best time to do so would be “in the next intelligence bill.”

_Updated at 6:18 pm ET, May 8, 2024: Added comments from the FBI._

Top FBI Official Urges Agents to Use Warrantless Wiretaps on US Soil

Despite Cyber Army of Russia’s claims of swaying US “minds and hearts,” experts say the cyber sabotage group appears to be hyping its hacking for a domestic audience.

When the activities of Russian hacker groups are exposed in a major public report and tied to a government agency—such as the Russian military's Sandworm unit, which has targeted Ukrainian electrical utilities to trigger three blackouts over the past decade, or the Russian foreign intelligence service's APT29, which is believed to have carried out the notorious SolarWinds supply chain attack—they tend to slink into the shadows and lay low until their next operation.

When the cybersecurity firm Mandiant last month highlighted the Cyber Army of Russia, by contrast, noting its haphazard attacks on Western critical infrastructure and the group's loose ties to the Russian military, the hackers took a very different approach. “Comrades, today the collective rotten West recognized us as the most reckless hacker group 🏆, on which I actually congratulate all of us 🎉," the group posted in Russian to its Telegram channel, along with a screenshot of WIRED's article about the hackers, in which we had described them with that “most reckless” superlative. “As long as they are afraid of us, let them hate us as much as they want.”

After that initial, less-than-friendly exchange of ideas, WIRED reached out to Cyber Army of Russia's Telegram account to continue the conversation. So began a strange, two-week-long interview with the group's spokesperson, “Julia," represented by an apparently AI-generated image of a woman standing in front of Red Square's St. Basil's Cathedral. Over days of intermittent Telegram messages, often interspersed with unsolicited Russian nationalist political talking points, Julia answered WIRED's questions—or at least some of them—laid out the group's ethos and motivations, and explained the rationale for the hackers' months-long cyber sabotage rampage, which initially focused on Ukrainian networks but has more recently included an unprecedented string of attacks hitting US and European water and wastewater systems.

An apparently AI-generated profile photo for “Julia,” the spokesperson for the Cyber Army of Russia on Telegram, whom WIRED interviewed.

Courtesy of RUSSIAN CYBER ARMY TEAM via Telegram

“We have united with the goal and mission of protecting our country in the information space against the background of unprecedented pressure from the United States, the European Union and Ukraine,” Julia wrote in a long opening statement in response to WIRED's questions.

“Our movement finds and hits the vulnerabilities of the Internet resources of both Ukraine and the countries that openly support the gang of terrorists and extremists, led by Zelensky, who are entrenched in power in Kiev,” Julia continued, using a typical Russian government description of the Ukrainian regime that has, in fact, led the defense against a brutal and unprovoked Russian invasion since 2022 that has led to close to 500,000 dead or wounded. “The most important battle is going on here and now for the minds and hearts of people, both living in Russia and Ukraine, and outside the warring countries. And the main weapon in this battle is information technology.”

**Sending a Message to … Muleshoe?**

Whether or not it's winning hearts and minds, Cyber Army of Russia—which also at times calls itself the Cyber Army of Russia Reborn or People's Cyber Army of Russia—seems to at least be getting some of the attention it seeks. Last week, a group of government bodies including the US National Security Agency, the FBI, the Cybersecurity and Infrastructure Security Agency, the UK's National Cybersecurity Center, and several others issued a joint report warning of “Russian hacktivists” targeting so-called operational technology targets like control systems for water and wastewater utilities. The report warned that victims had “experienced minor tank overflow events” and other disruptions—although it noted the effects were temporary, and the hacktivists had historically exaggerated their hacking's impact.

Those agencies didn't name Cyber Army of Russia. But their warning followed another report from Mandiant that had highlighted the group by name, as well as its attacks on civilian critical infrastructure targets including multiple US-based water utilities and a Polish wastewater utility. In the case of the small West Texas town of Muleshoe, _The Washington Post_ subsequently reported that the group's manipulation of control systems had gone so far as to cause a leak of tens of thousands of gallons of water. In that case and several others, Cyber Army of Russia even posted to the group's Telegram account a screen-capture video of the hacking. In their attack on the Polish wastewater facility, for instance, they set the video to a _Super Mario Bros_. soundtrack.

So what is the endgame of the group's trollish acts of sabotage? “Our actions on attacks and hacks of websites and computer systems for remote control of mechanisms … is a really powerful and in some cases very effective method of influencing (and not only psychological) the authorities of the countries of Europe and the USA, as well as their regional authorities,” Cyber Army of Russia's representative Julia told WIRED. “With these attacks we are trying to send the following message to the US authorities: If you continue to supply military equipment and make financial injections into the leadership of Ukraine … be prepared for the fact that in any of your settlements, in any industrial system or at a critical infrastructure facility, something may suddenly fail.”

Yet as unprecedented and disturbing as it may be for a Russian hacker group to trigger a significant water leak at a US utility, Cyber Army of Russia still seems at times to comically overestimate the clarity of its threat against Ukraine's allies. In response to a question about the Muleshoe water utility attack specifically, Julia noted that the group's operation is intended to persuade “mainly representatives of the Democratic Party \[because\] their support for Ukraine is the most significant"—a head-scratching statement given that Muleshoe is in a Texas congressional district that hasn't elected a Democratic representative since 1982.

In other hacking operations like its targeting of a Polish wastewater utility, cybersecurity researchers who watched the video of the attack told WIRED that Cyber Army of Russia appeared to be arbitrarily changing values in the utility's control system software, with no actual disruptive effect. In another case, the hackers posted a video to their Telegram channel claiming that, in response to French president Emmanuel Macron's threat of sending French military personnel to Ukraine, it had hacked a French hydroelectric dam and caused it to stop generating power. In fact, French newspaper _Le Monde_ reported, the group had actually hacked a water mill in a small village and caused its water level to drop by 20 centimeters.

When WIRED pointed out this mistake to Julia, she acknowledged the error but wrote that the group was undeterred by the setback. “It would be correct to consider it experimental,” she wrote of the attempted dam-hacking operation. “In other words, as it often happens in life, the real result did not match the expectation at all. However, we are not very saddened by this fact, there are many hydroelectric power plants in France, so we will still have the opportunity to gain more experience to commit more large-scale sabotage.”

Despite this relatively amateurish track record, Mandiant pointed in its report to evidence linking Cyber Army of Russia to the hacker group known as Sandworm, a cyberwarfare unit of Russia's military intelligence agency the GRU tied to many of Russia's most disruptive cyberattacks of the last decade. Cyber Army of Russia's short-lived YouTube channel, for instance, was created from a computer with an IP address that Mandiant—itself a subsidiary of YouTube's owner Google—had previously tied to Sandworm. Over the last year, Cyber Army of Russia also repeatedly dumped data to its Telegram channel that appeared to have been stolen from Ukrainian hacking targets breached by Sandworm not long before.

When WIRED asked about those ties to Sandworm and the GRU, Julia denied them without directly addressing Mandiant's evidence. “Hundreds of people of different ages, different nationalities, different professions (not related to IT), different levels of computer literacy, different levels of financial wealth and political beliefs joined the ranks of the Cyber Army,” Julia wrote. “We emphasize that despite the fact that there are individual representatives of the Russian security forces in our ranks and some of our participants are professionals in the field of information security, we are a completely people's project that has nothing to do with the GRU, or with any other military special forces, or with hacker groups like Sandworm.”

She later added, somewhat confusingly, that “the Sandworm hacker group does have something in common \[with us\] … This is the commander-in-chief of our Cyber Army.” It wasn't clear, however, whether that comment was referring to a shared leader overseeing the two groups—or even a kind of imagined ideological leader such as Russian president Vladimir Putin—or whether Julia meant that Sandworm itself gives the Cyber Army its orders, in contradiction to her previous statements. Julia didn't respond to WIRED's requests for clarification on that question or, in fact, to any questions following that comment.

**A Hacktivist Hype Machine**

Russian information warfare and influence operations experts with whom WIRED shared the full text of the interview noted that, despite Cyber Army of Russia's claims of acting as an independent grassroots organization, it closely adheres to both Russian government talking points as well the Russian military's published information warfare doctrine. The group's rhetoric about changing “minds and hearts” beyond the front lines of a conflict through attacks targeting civilian infrastructure mirrors a well-known paper on “information confrontation” by Russian military general Valery Gerasimov, for instance. Other portions of Julia's comments—an unprompted polemic against “non-traditional sexual relations” and a description of Russia as a conservative cultural “Noah's Ark of the 21st century”—echo similar statements made by Russian leaders and Russian state media.

None of that proves that Cyber Army of Russia has anything more than the thin ties to the GRU that Mandiant uncovered, says Gavin Wilde, a Russia-focused senior fellow at the Carnegie Endowment for International Peace. He argues instead that the group's comments appear to be an attempt to score points with a potential government sponsor, perhaps in the hopes of gaining a more official relationship. “They're really trying to hone their messaging, but not for a Western audience, necessarily, so much as to try to put points on the board domestically and with potential political or financial benefactors in Moscow,” he says.

At one point in the interview with WIRED, in fact, Julia explicitly voiced that request for more official government support. “I really hope that the People's Cyber Army of Russia will have great prospects, that our government agencies will not just pay attention to us, but support our actions, both financially and through the formation of full-fledged cyber troops as part of the Russian Armed Forces,” she wrote.

Outside of the conversation with WIRED, Cyber Army of Russia posts to its Telegram channel in Russian, not English—a strange move for a group that claims to be trying to influence Western politics in its favor. Other Russian influence operations created by the GRU itself, such as the Guccifer 2.0 and DCLeaks fronts created to influence the 2016 presidential election, wrote in English. Even other “hacktivist” groups targeting civilian critical infrastructure, such as Israel-linked Predatory Sparrow, take credit for their attacks in the language of their targets—in Predatory Sparrow's case, posting to Telegram in Persian in an apparent attempt to influence Iranians.

All of that suggests that, despite its claims, Cyber Army of Russia may be currently functioning more as a cheerleading campaign for Russians domestically than a real influence operation targeting the West, says Olga Belogolova, a Russia-focused influence operations researcher at the Johns Hopkins School of Advanced International Studies. If the group is as grassroots and decentralized as it claims to be, it may not even be aware of that disconnect. “These patriotic keyboard warrior types are going to try to curry favor with the government, but they also might be true believers of these talking points,” says Belogolova, adding that the group's Telegram account “feels like a marketing exercise or a tech bro hype machine.”

She points out, though, that the group's exposure by Mandiant and an alert from a half-dozen government agencies suggests that, regardless of the group's intended audience, it's now on Americans' radar, too. As it gains the West's attention, she notes, we shouldn't overblow the threat it represents—and in doing so succumb to its hit-and-miss attempts at instilling fear through its disruptive hacking.

“The more time I spend working on Russia and Russian influence operations,” Belogolova says, "the more I've become a believer that they're very into just hyping themselves up. And then we sometimes fall for the hype, too.”

A (Strange) Interview the Russian-Military-Linked Hackers Targeting US Water Utilities

Law enforcement officials say they’ve identified, sanctioned, and indicted the person behind LockBitSupp, the administrator at the heart of LockBit’s $500 million hacking rampage.

“He did not simply take money for himself, but he reinvested it into developing his operation and making it more desirable to criminals,” DiMaggio says. Throughout the lifecycle of the LockBit group, two major updates and releases of its malware happened, with each more capable and easier to use than the last. Analysis from the law enforcement operation by security company Trend Micro shows it was working on a new version too.

DiMaggio says the person he was speaking to privately using the LockBitSupp moniker was “arrogant” but “all business and very serious”—aside from sending cat stickers as part of chats. Publicly, on Russian language cybercrime forums where hackers trade data and discuss hacking politics and news, LockBitSupp was entirely different, DiMaggio says.

“The persona he amplified on the Russian hacking forums was a mix of a supervillain and Tony Montana from _Scarface_,” DiMaggio says. “He flaunted his success and money, and it rubbed people the wrong way at times.”

In addition to setting a bounty on their own identity, LockBitSupp’s more innovative and erratic side also organized an essay-writing competition on the hacking forums, offered a “bug bounty” if people found flaws in LockBit’s code, and said they would pay $1,000 to anyone who got the LockBit logo as a tattoo. Around 20 people posted pictures and videos of their tattoos.

Soon after law enforcement claimed to have revealed LockBitSupp’s identity, DiMaggio published new research about Khoroshev. Using a tip he received, plus open source intelligence and leaked information on the dark web, DiMaggio found social media profiles and extra personal information believed to be linked to the Russian national.

“He owns several legitimate businesses, also based out of Voronezh, drives a Mercedes, and previously owned a Mazda 6, not a lambo as he often boasts,” DiMaggio writes in the research. One of the email addresses included in the sanctions has links to a Russia-based e-commerce business registered in the name of Khoroshev, he writes. Several other emails and phone numbers were connected to these details, DiMaggio's research says.

LockBitSupp was banned from two prominent Russian-language cybercrime forums in January after a complaint was made about their behavior. “They’ve made partners, supporters, haters, and fans over the years,” says Victoria Kivilevich, director of threat research at security firm KELA.

Analysis of cybercrime forums by Kivilevich shows the Russian-language ecosystems had mixed responses, including surprise when LockBit was first compromised by law enforcement. “Users gloating that LockBit finally failed and got what he deserved, making references to his statements where he bragged how \[about how\] LockBit ‘RaaS’ is secure and better than any other operations,” Kivilevich says.

Other forum users questioned the technical decisions of LockBitSupp and whether they had collaborated with law enforcement, the researcher says. There were forum users who reacted neutrally, “mostly saying the operation won’t affect LockBit much and the operation will continue to exist,” Kivilevich says.

**Downfall**

After Operation Cronos took LockBit offline in February, it took LockBitSupp only five days to create replica versions of the group’s leak site. The website then started to be filled with apparent victims; it seemed like the LockBit group hadn’t been impacted by having all of its internal secrets accessed by police around the world.

These recently posted victims aren’t what they seem, though, multiple experts say. “The actual law enforcement intervention has been significant,” says Matt Hull, the global head of threat intelligence at cybersecurity firm NCC Group. The NCA says the number of LockBit affiliates has dropped to 69 since its February takedown, while the DOJ indictment says LockBit’s victim count has “greatly diminished” since then.

The Alleged LockBit Ransomware Mastermind Has Been Identified

The iPhone maker has detected spyware attacks against people in more than 150 countries. Knowing if your device is infected can be tricky—but there are a few steps you can take to protect yourself.

All that needs to happen is, the victim receives an iMessage with an attachment containing a zero-click exploit. “Without any further interaction, the message triggers a vulnerability, leading to code execution for privilege escalation and providing full control over the infected device,” says Boris Larin, principal security researcher at Kaspersky's Global Research & Analysis Team.

Once the attacker establishes their presence on the device, he says, the message is automatically deleted.

**Rise of Pegasus**

The most prominent and well-known spyware is Pegasus, made by Israeli firm NSO Group to target vulnerabilities in iOS and Android software.

Spyware only exists because of vendors such as NSO Group, which claims it sells exploits to governments only to hunt criminals and terrorists. “Any customers, including governments in Europe and North America, agree not to disclose those vulnerabilities,” says Richard Werner, cybersecurity advisor at Trend Micro.

Despite NSO Group’s claims, spyware has continued to target journalists, dissidents, and protesters. Saudi journalist and dissident Jamal Khashoggi’s wife, Hanan Elatr, was allegedly targeted with Pegasus before his death. In 2021, _New York Times_ reporter Ben Hubbard learned his phone had been targeted twice with Pegasus.

Pegasus was silently implanted onto the iPhone of Claude Magnin, the wife of the political activist Naama Asfari, who was jailed and allegedly tortured in Morocco. Pegasus has also been used to target pro-democracy protesters in Thailand, Russian journalist Galina Timchenko, and UK government officials.

In 2021, Apple filed a lawsuit against NSO Group and its parent company to hold it accountable for “the surveillance and targeting of Apple users.”

The case is still ongoing, with NSO Group attempting to dismiss the lawsuit, but experts say the problem is not going to go away as long as spyware vendors are able to operate.

David Ruiz, senior privacy advocate at security firm Malwarebytes, blames “the obsessive and oppressive operators behind spyware, who compound its danger to society.”

**The Spyware Drain**

If you think you may be targeted by spyware, there are only a few useful things you can do. First, enable Apple's Lockdown Mode, which disables certain features but is surprisingly usable and can protect your iPhone from getting infected in the first place. Second, if you suspect your device is already infected, helplines are available to aid you in removing spyware, such as Access Now’s Digital Security Helpline and Amnesty International’s Security Lab.

Detecting spyware can be extremely challenging—and for sophisticated spyware like Pegasus, discovering an infection on your own is all but impossible. There are less-sophisticated types of spyware that can cause unusual behavior, such as your battery draining quickly, unexpected shutdowns, or high data usage could be indicative of some types of infections, says Javvad Malik, lead security awareness advocate at security training organization KnowBe4. While specific apps claim to spot spyware, their effectiveness can vary, and professional assistance is often necessary for reliable detection, he says.

Apple’s iPhone Spyware Problem Is Getting Worse. Here’s What You Should Know

Plus: An assassination plot, an AI security bill, a Project Nimbus revelation, and more of the week’s top security news.

This week, WIRED reported that a group of prolific scammers known as the Yahoo Boys are openly operating on major platforms like Facebook, WhatsApp, TikTok, and Telegram. Evading content moderation systems, the group organizes and engages in criminal activities that range from scams to sextortion schemes.

On Wednesday, researchers published a paper detailing a new AI-based methodology to detect the “shape” of suspected money laundering activity on a blockchain. The researchers—composed of scientists from the cryptocurrency tracing firm Elliptic, MIT, and IBM—collected patterns of bitcoin transactions from known scammers to an exchange where dirty crypto could get turned into cash. They used this data to train an AI model to detect similar patterns.

Governments and industry experts are sounding the alarm about the potential for major airline disasters due to increasing attacks against GPS systems in the Baltic region since the start of the war in Ukraine. The attacks can jam or spoof GPS signals, and can result in serious navigation issues. Officials in Estonia, Latvia, and Lithuania blame Russia for the GPS issues in the Baltics. Meanwhile, WIRED went inside Ukraine’s scrappy and burgeoning drone industry, where about 200 companies are racing to build deadlier and more efficient autonomous weapons.

An Australian firm that provided facial recognition kiosks for bars and clubs appears to have exposed the data of more than 1 million records of patrons. The episode highlights the dangers of giving companies your biometric data. In the United States, the Biden administration is asking tech companies to sign a voluntary pledge to make “good-faith” efforts to implement critical cybersecurity improvements. This week we also reported that the administration is updating its plan for protecting the country’s critical infrastructure from hackers, terrorists, and natural disasters.

And there’s more. Each week, we highlight the news we didn’t cover in depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

**How Israeli Weapons Firms Use Amazon and Google**

A government procurement document unearthed by The Intercept reveals that two major Israeli weapons manufacturers are required to use Google and Amazon if they need any cloud-based services. The reporting calls into question repeated claims from Google that the technology it sells to Israel is not used for military purposes—including the ongoing bombardment of Gaza that has killed more than 34,000 Palestinians. The document contains a list of Israeli companies and government offices “required to purchase” any cloud services from Amazon and Google. The list includes Israel Aerospace Industries and Rafael Advanced Defense Systems, the latter being the manufacturer of the infamous “Spike” missile, reportedly used in the April drone strike that killed seven World Central Kitchen aid workers.

In 2021, Amazon and Google entered into a contract with the Israeli government in a joint venture known as Project Nimbus. Under the arrangement, the tech giants provide the Israeli government, including its Israel Defense Forces, with cloud services. In April, Google employees protested Project Nimbus by staging sit-ins at offices in Silicon Valley, New York City, and Seattle. The company fired nearly 30 employees in response.

A mass surveillance tool that eavesdrops on wireless signals emitted from smartwatches, earbuds, and cars is currently being deployed at the border to track people’s location in real time, a report from Notus revealed on Monday. According to its manufacturer, the tool, TraffiCatch, associates wireless signals broadcast by commonly used devices with vehicles identified by license plate readers in the area. A captain from the sheriff’s office in Webb County, Texas—whose jurisdiction includes the border city of Laredo—told the publication that the agency uses TraffiCatch to detect devices in areas where they shouldn’t be, for instance, to find trespassers.

Several states require law enforcement agencies to obtain warrants before deploying devices that mimic cell towers to obtain data from the devices tricked into connecting to it. But in the case of TraffiCatch, a technology that passively siphons ambient wireless signals out of the air, the courts haven’t yet weighed in. The report highlights how signals intelligence technology, once exclusive to the military, is now available for purchase by both local governments and the general public.

**An Indian Assassination Plot in America**

_The Washington Post_ reports that an officer in India's intelligence service, the Research and Analysis Wing, was allegedly involved in a botched plan to assassinate one of Indian prime minister Narendra Modi's top critics in the United States. The White House said Monday that it was taking the matter "very, very seriously," while India's foreign ministry blasted the _Post_ report as "unwarranted" and "not helpful." The alleged plot to murder the Sikh separatist, Gurpatwant Singh Pannun, a dual citizen of the United States and Canada, was first disclosed by US authorities in November.

Canadian authorities previously announced having obtained "credible" intel allegedly linking the Indian government to the death of another separatist leader, Hardeep Singh Nijjar, who was shot to death outside a Sikh temple in a Vancouver suburb last summer.

**An AI Security Bill Emerges**

US lawmakers have introduced a bill aimed at establishing a new wing of the National Security Agency dedicated to investigating threats aimed at AI systems—or "counter-AI." The bipartisan bill, introduced by Mark Warner and Thom Tillis, a Senate Democrat and Republican, respectively, would further require agencies including the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) to track breaches of AI systems, whether successful or not. (The NIST currently maintains the National Vulnerability Database, a repository for vulnerability data, while the CISA oversees the Common Vulnerabilities and Exposures Program, which similarly identifies and catalogues publicly disclosed malware and other threats.)

The Senate bill, known as the Secure Artificial Intelligence Act, aims to expand the government's threat monitoring to include "adversarial machine learning"—a term that is essentially synonymous with "counter-AI"—which serves to subvert AI systems and “poison” their data using techniques vastly dissimilar to traditional modes of cyberwarfare.

A New Surveillance Tool Invades Border Towns

“Yahoo Boy” cybercriminals are openly running dozens of scams across Facebook, WhatsApp, Telegram, TikTok, YouTube, and more.

Most scammers and cybercriminals operate in the digital shadows and don’t want you to know how they make money. But that’s not the case for the Yahoo Boys, a loose collective of young men in West Africa who are some of the web’s most prolific—and increasingly dangerous—scammers.

Thousands of people are members of dozens of Yahoo Boy groups operating across Facebook, WhatsApp, and Telegram, a WIRED analysis has found. The scammers, who deal in types of fraud that total hundreds of millions of dollars each year, also have dozens of accounts on TikTok, YouTube, and the document-sharing service Scribd that are getting thousands of views.

Inside the groups, there’s a hive of fraudulent activity with the cybercriminals often showing their faces and sharing ways to scam people with other members. They openly distribute scripts detailing how to blackmail people and how to run sextortion scams—that have driven people to take their own lives—sell albums with hundreds of photographs, and advertise fake social media accounts. Among the scams, they’re also using AI to create fake “nude” images of people and real-time deepfake video calls.

The Yahoo Boys don’t disguise their activity. Many groups use “Yahoo Boys” in their name as well as other related terms. WIRED’s analysis found 16 Yahoo Boys Facebook groups with almost 200,000 total members, a dozen WhatsApp channels, around 10 Telegram channels, 20 TikTok accounts, a dozen YouTube accounts, and more than 80 scripts on Scribd. And that’s just the tip of the iceberg.

Broadly, the companies do not allow content on their platforms that encourages or promotes criminal behavior. The majority of the Yahoo Boys accounts and groups WIRED identified were removed after we contacted the companies about the groups’ overt existence. Despite these removals, dozens more Yahoo Boys groups and accounts remain online.

“They’re not hiding under different names,” says Kathy Waters, the cofounder and executive director of the nonprofit Advocating Against Romance Scammers, which has tracked the Yahoo Boys for years. Waters says the social media companies are essentially providing the Yahoo Boys with “free office space” to organize and conduct their activities. “They’re selling scripts, selling photos, identifications of people, all online, all on the social media platforms,” she says. “Why these accounts still remain is beyond me.”

The Yahoo Boys aren’t a single, organized group. Instead, they’re a collection of thousands of scammers who work individually or in clusters. Often based in Nigeria, their name comes from formerly targeting users of Yahoo services, with links back to the Nigerian Prince email scams of old. Groups in West Africa can be often organized in various confraternities, which are cultish gangs.

“Yahoo is a set of knowledge that allows you to conduct scams,” says Gary Warner, the director of intelligence at DarkTower and director of the University of Alabama at Birmingham’s Computer Forensics Research Laboratory. While there are different levels of sophistication of Yahoo Boys, Warner says, many simply operate from their phones. “Most of these threat actors are only using one device,” he says.

The Yahoo Boys run dozens of scams—from romance fraud to business email compromise. When making contact with potential victims, they’ll often “bomb” people by sending hundreds of messages to dating app accounts or Facebook profiles. “They will say anything they can in order to get the next dime in their pocket,” Waters says.

Searching for the Yahoo Boys on Facebook brings up two warnings: Both say the results may be linked to fraudulent activity, which isn’t allowed on the website. Clicking through the warnings reveals Yahoo Boy groups with thousands of members—one had more than 70,000.

Within the groups—alongside posts selling SIM cards and albums with hundreds of pictures—many of the scammers push people toward other messaging platforms such as Meta’s WhatsApp or Telegram. Here, the Yahoo Boys are at their most bold. Some groups and channels on the two platforms receive hundreds of posts per day and are part of their wider web of operations.

After WIRED asked Facebook about the 16 groups we identified, the company removed them, and some WhatsApp groups were deactivated. “Scammers use every platform available to them to defraud people and constantly adapt to avoid getting caught,” says Al Tolan, a Meta spokesperson. They did not directly address the accounts that were removed or that they were easy to find. “Purposefully exploiting others for money is against our policies, and we take action when we become aware of it,” Tolan says. “We continue to invest in technology and cooperate with law enforcement so they can prosecute scammers. We also actively share tips on how people can protect themselves, their accounts, and avoid scams.”

Groups on Telegram were removed after WIRED messaged the company’s press office; however, the platform did not respond about why it had removed them.

Across all types of social media, Yahoo Boys scammers share “scripts” that they use to socially manipulate people—these can run to thousands of words long and can be copied and pasted to different victims. Many have been online for years. “I’ve seen some scripts that are 30 and 60 layers deep, before the scammer actually would have to go and think of something else to say,” says Ronnie Tokazowski, the chief fraud fighter at Intelligence for Good, which works with cybercrime victims. “It’s 100 percent how they'll manipulate the people,” Tokazowski says.

Among the many scams, they pretend to be military officers, people offering “hookups,” the FBI, doctors, and people looking for love. One “good morning” script includes around a dozen messages the scammers can send to their targets. “In a world full of deceit and lies, I feel lucky when see the love in your eyes. Good morning,” one says. But things get much darker.

The Yahoo Boys have been behind a recent wave of sextortion across the United States and elsewhere, says Paul Raffile, an intelligence analyst at the Network Contagion Research Institute who is closely tracking the criminals. Broadly speaking, during sextortion, a scammer will use intimate or explicit images to try to get someone to pay them money. “The Yahoo Boys are the principal threat actor behind the surge of sextortion that we’re seeing over the past 18 months,” Raffile says. “They are responsible for forcing dozens of teens to suicide.”

In a series of posts in one Telegram channel, highlighted by Warner, who is also involved in Intelligence for Good, one cybercriminal can be seen walking others through how to run a sextortion scam. They say they tricked people into sharing nude images—posting screenshots of the conversation—and explained ways other people can replicate it. “Hey I am posting your naked pictures on social media and Facebook,” says a sample message cybercriminals could use. “Am not just posting it am sending copies of it to your area,” the message says, before demanding $700.

While the scripts like these are shared on all social media channels, WIRED found at least 80 on the document-sharing service Scribd. The company removed them after WIRED got in touch, with a spokesperson saying there are limits on what people can upload and that the company has automated and manual reviews to remove content. “We’re actively building out new capabilities to broaden the scope of content moderation coverage to include a wider range of concerning text and image violations,” the spokesperson says. Some of the scripts had been online since 2020, and on pages where they were removed a “reading suggestions” section recommended other scam scripts.

Raffile says the Yahoo Boys have been able to “thrive” online “due to lack of moderation around all the illicit material” that they’re sharing. “They’re acting with impunity because they feel they will never get caught,” Raffile says.

Beyond the messaging platforms, the Yahoo Boys have a presence on TikTok and YouTube. “We design our app to be inhospitable to those who seek to exploit our community and we’ve removed this content for violating our policies,” a TikTok spokesperson says.

“Our policies prohibit spam, scams, or other deceptive practices that take advantage of the YouTube community,” a YouTube spokesperson says. “We also prohibit videos that encourage illegal or dangerous activities. As such, we have terminated the flagged channels for violating our policies and our terms of service.” They add that the company removed accounts for breaching policies about harmful content, spam, and generally violating its terms of service.

The accounts posted tutorials about how to scam people, link to groups on messaging apps, and promote technology for fake video calls. On TikTok, multiple accounts include carousels of images that the scammers can use in their efforts to create believable personas. Some of these include posts of elderly women for scammers who are in “need of grandma pictures for proof” of their fake identities and others for scammers who “need kids pics” for their victims.

As well as being a threat to thousands of people around the world, the Yahoo Boys can be quick to adopt new technologies. David Maimon, a professor at Georgia State University and the head of fraud insights at the identity-verification firm SentiLink, has monitored Yahoo Boys for years and says their techniques have evolved alongside new technologies.

“To build rapport with victims, the fraudsters first used text messages, then started sending recorded audio messages, to now using deepfake tools to communicate with victims live,” Maimon says. “On some of the markets we now also see the use of cloned voices. It is now accompanied with sending physical items to victims such as presents, food deliveries, and flowers.” Within some groups, they use “nudification” tools to turn photos of people clothed into nude photos, and deepfake video calls.

While the Yahoo Boys have been active for years, all the experts spoken to for this piece say they should be treated more seriously by social media companies and law enforcement. “It’s time that we start looking at Yahoo Boys as a dangerous organization, transnational organized crime, and start giving it some of those labels,” Raffile says.

These Dangerous Scammers Don’t Even Bother to Hide Their Crimes

Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data.

Police and federal agencies are responding to a massive breach of personal data linked to a facial recognition scheme that was implemented in bars and clubs across Australia. The incident highlights emerging privacy concerns as AI-powered facial recognition becomes more widely used everywhere from shopping malls to sporting events.

The affected company is Australia-based Outabox, which also has offices in the United States and the Philippines. In response to the Covid-19 pandemic, Outabox debuted a facial recognition kiosk that scans visitors and checks their temperature. The kiosks can also be used to identify problem gamblers who enrolled in a self-exclusion initiative. This week, a website called “Have I Been Outaboxed” emerged, claiming to be set up by former Outabox developers in the Philippines. The website asks visitors to enter their name to check whether their information had been included in a database of Outabox data, which the site alleges had lax internal controls and was shared in an unsecured spreadsheet. It claims to have more than 1 million records.

The incident has rankled privacy experts who have long set off alarm bells over the creep of facial recognition systems in public spaces such as clubs and casinos.

“Sadly, this is a horrible example of what can happen as a result of implementing privacy-invasive facial recognition systems,” Samantha Floreani, head of policy for Australia-based privacy and security nonprofit Digital Rights Watch, tells WIRED. “When privacy advocates warn of the risks associated with surveillance-based systems like this, data breaches are one of them.”

According to the Have I Been Outaboxed website, the data includes “facial recognition biometric, driver licence \[sic\] scan, signature, club membership data, address, birthday, phone number, club visit timestamps, slot machine usage.” It claims Outabox exported the “entire membership data” of IGT, a supplier of gambling machines. IGT vice president of global communications Phil O’Shaughnessy tells WIRED that “the data affected by this incident has not been obtained from IGT,” and that the firm would work with Outabox and law enforcement.

The website’s owners posted a photo, signature, and redacted driver license belonging to one of Outabox’s founders, as well as a redacted screenshot of the alleged internal spreadsheet. WIRED was unable to independently verify the identity of the website’s owners or the authenticity of the data they claimed to have. An email sent to an address on the website was not returned.

"Outabox is aware and responding to a cyber incident potentially involving some personal information,” an Outabox spokesperson tells WIRED. “We have been in communication with a group of our clients to inform them and outline our strategy to respond. Due to the ongoing Australian police investigation, we are not able to provide further information at this time.”

The New South Wales police force confirmed to WIRED that it was investigating a data breach on Wednesday, but a spokesperson declined to share further details. On Thursday, the force announced that it, working alongside federal and state agencies, had arrested an unnamed 46-year-old man in a Sydney suburb. He is expected to be charged with blackmail.

Clubs that used Outabox’s technology posted announcements about the incident and notified clients this week. One person who posted a breach notification from a club they visited recounted their experience with the facial recognition system. “My fondest memory of this system is visiting a club and having it confidently match my face to a member that was clearly 20+ years older than me, and looked nothing like me,” they wrote in a post on X. The club did not respond to a request for comment.

The Have I Been Outaboxed website, which is still online at the time of writing, alleges that Outabox stopped paying its developers in the Philippines. AI companies frequently employ low-cost overseas labor, including in the Philippines, to power their systems. The website encourages anybody whose data is included in the breach to contact venues and ask that they remove Outabox’s system. The site, which was set up last week according to online records, lists 19 venues. WIRED searched the database for prominent Australians including politicians, and it returned redacted results listing their name and the venues they allegedly attended.

“We are aware of a malicious website carrying a number of false statements designed to harm our business and defame our senior staff,” the Outabox spokesperson says. “We believe this is linked and urge people not to repeat false and reputationally damaging misinformation.” Outabox declined to specify which statements are false, citing the police investigation.

It’s unclear how much of the story told on the website is true, or whether the perpetrators even have the claimed biometric data. Australian cybersecurity expert Troy Hunt, founder of the breach notification website Have I Been Pwned, tells WIRED that there is little reason to doubt it at this time.

“I haven’t seen any reason not to take this at face value, which means they have exactly what they say they have,” he says. In posts on X, Hunt speculated that the website’s posting may have been preceded by demands that were not met, and that the perpetrators’ actions now “clearly land” in the realm of criminality.

“Offshoring is a messy discussion between the legalities of data sovereignty, perceived shortcomings of foreign labor, and frankly, a big dose of xenophobia,” Hunt says. “It’s not like Aussie developers doing exactly the same thing would have made this OK.”

Floreani of Digital Rights Watch says that the incident illustrates the “significant negative consequences” that can arise from collecting sensitive biometric data. “We need bold privacy reform and strict limitations on facial recognition technology,” she says. “As always, surveillance isn’t safety.”

Source

Wired