Posts praising the Wagner Group boss following his death in a mysterious plane crash last month indicate he was still in control of his "troll farm," researchers claim.

Yveneny Prigozhin’s wartime atrocities propelled the brutal mercenary into the limelight. But Prigozhin—who was once Russian president Vladimir Putin’s chef and a small-time criminal—also held a title as one of the world’s biggest disinformation peddlers. For years, Prigozhin operated the notorious Internet Research Agency, a Russian troll farm that meddled in US elections and beyond.

When Prigozhin suddenly died in a mysterious plane crash on August 23, around two months after he led his Wagner Group mercenaries in a failed mutiny against Putin, the trolls didn’t stop posting. Instead, according to a new analysis shared with WIRED, some continued to show their support for him.

In the days immediately after his death, a coordinated network of pro-Prigozhin accounts on X (formerly known as Twitter) pushed messages saying that the warlord was a hero and good for Russia, despite the Wagner Group’s failed rebellion against Putin in June. These messages also blamed the West for the plane crash and said that the Wagner Group would continue operating in Africa.

“It was not profitable for Putin to kill Prigozhin. PMC \[private military company\] carry a lot of weight in Africa, and Prigozhin skillfully managed it, despite his ‘character quirks,’” one account posted on X. “Prigozhin served for the good of Russia, remained faithful to his military oath, and was killed by saboteurs, or terrorists mined the plane,” another speculated. “In short, he just ditched his phone and disappeared into the sunset, just like in a typical action movie,” a third posted.

The organized accounts were all identified and shared with WIRED by Antibot4Navalny, an anonymous group of volunteers who track Russian-language influence operations on X. A person behind the group, whom WIRED granted anonymity due to safety concerns, says they started inspecting the posts of suspected X accounts after the crash when they “noticed that Prigozhin is surprisingly covered in an exclusively positive light.” The group found 30 accounts pushing pro-Prigozhin narratives, they say.

The activity could be a sign that Prigozhin remained in control of the Internet Research Agency troll factory until he died, the group claims, adding that it echoes similar activity they previously saw. Reports have said that after the attempted June uprising, Prigozhin-owned news websites and the troll factory were being shut down or looking for new owners. “Domestically, there was a lot of debate whether or not Prigozhin lost his control over the troll factory as one of the immediate aftermaths of the mutiny,” the Antibot4Navalny member says.

While the posts on X are only a tiny snapshot of social media activity, they highlight how Russian-linked propaganda has changed since the Internet Research Agency interfered in US politics in 2016, experts say. The Russian misinformation and disinformation industry has evolved into a rich ecosystem of state-backed media, massive Telegram channels, and more conventional social media posts. Millions of people follow so-called military bloggers and war journalists on Telegram—some of these channels are linked to the Russian state, while others are aligned with Pirgozhin and the Wagner Group. But all can muddy the waters or repeat set lines.

“Confusion in the information space is one of the aims of the Kremlin information operations—to make everything equally unbelievable so people’s trust in all kinds of sources is undermined,” says Eto Buziashvili, a disinformation and influence operations researcher with a focus on Russia at the Atlantic Council’s Digital Forensic Research Lab. Since the start of its full-scale war in Ukraine in February 2022, Russia has blocked and censored social media websites, banned independent news media, and pushed reams of disinformation.

Kyle Walter, head of research at misinformation and disinformation research company Logically, reviewed the posts shared by Antibot4Navalny and says they show “signs of being inauthentic.” The X accounts were largely created earlier this year, have low volumes of original posts, and mostly retweet or reply to accounts, and some of them also follow each other, Walter says. The themes the accounts posted about around the plane crash also match what Logically has seen from monitoring Telegram channels linked to the Wagner Group, he says. Walter adds, however, that linking them directly to the Internet Research Agency is harder to do.

The Antibot4Navalny researcher says that based on their previous research, they believe that the pro-Prigozhin trolls operate in similar ways. They “primarily serve” the interests of Putin, but they also push pro-Prigozhin narratives when it doesn’t “hurt” the Russian president, the researcher says. The approach “still worked in the plane-crash episode: Cover Putin as strongly as possible, but also, it is a nice opportunity to praise Prigozhin,” they say. The researcher says they are reporting the accounts to X.

As well as the posts around the plane crash, the Antibot4Navalny group also shared previous research and analysis with WIRED. In one instance, the group reported more than 7,000 suspected accounts to X. We tested dozens of these accounts and found that they have all been removed from the Elon Musk-owned social media company. Antibot4Navalny says the “troll” accounts are often active in groups, pushing the “same set of talking points” and mostly replying to tweets about news related to Russia and Ukraine or pro-Ukrainian channels. X did not immediately respond to WIRED’s request for comment.

On July 14, the Antibot4Navalny researcher says, some of the accounts they have tracked replied to posts discussing comments from Putin, who said that the Wagner Group “does not exist” and that there is no legal basis for the group. The accounts, the researcher says, sent messages saying that Wagner operated legally and referenced Concord, the catering company owned by Prigozhin. The Antibot4Navalny researcher claims that the points were not included in any Kremlin-controlled media and that mentions of the company “served interests of the troll factory/its owner—rather than interests of the Kremlin.”

Buziashvili, the Atlantic Council researcher, says she believes the troll factory is still operating. “Part of them might be still supporting Prigozhin,” she says. “For most of the people who were working there, they would just continue their work regardless of who is their current boss.”

Following the plane crash, Buziashvili says, Russian officials and state media pushed multiple “theories” simultaneously. On one TV show, both the UK and NATO were blamed for the plane crash, she says. Other instances blame Ukraine and claim that Prigozhin was not killed in the crash. Pro-Wagner Telegram channels were also pushing claims that the plane was shot down by Russian aviation, Buziashvili says, and that they wanted “revenge.” Nobody has formally claimed responsibility for the explosion—both Putin and Ukraine have denied involvement.

Despite the changing information ecosystem, the amount of Russian disinformation on social media is colossal. During the first year after it launched the war in Ukraine, Russia’s disinformation reached an audience of “at least” 165 million and generated 16 billion views across Facebook, Instagram, Twitter/X, YouTube, TikTok, and Telegram, according to a European Commission study of Russia-linked activity published last week. Subscribers to pro-Kremlin Telegram channels have “more than tripled” since the start of the war, the report says. “Preliminary analysis suggests that the reach and influence of Kremlin-backed accounts has grown further in the first half of 2023, driven in particular by the dismantling of Twitter’s safety standards.”

“What we typically see these days is narratives formulated on Telegram,” says Logically’s Walter. The company has recently found pro-Russian channels pushing disinformation about Niger’s military coup, and it has also linked a Russian fact-checking website and Telegram account to a presenter on Russia’s “biggest” propaganda TV show. “You have Western influencers who are sympathetic to Russian causes that will translate those narratives and then share them on mainstream platforms. And they circulate more broadly,” he says.

Walter says that over time, and largely because of the war, it has become easier for Russian propaganda and disinformation to attack the West. “From a tactics perspective, there’s a lot less direct involvement that we can attribute from the Russian state itself, and it is more these proxies,” he says. “Russian disinformation efforts are gradually adapting to any sort of Western countering that gets put in place.”

The Strange Afterlife of Wagner’s Yevgeny Prigozhin

If you want the highest possible level of protection, this is it.

There's a constant battle going on between software developers trying to keep their apps and platforms secure, and hackers and malware writers eager to break through those digital defenses. In its quest to offer a more secure and private suite of web apps, security-focused service provider Proton is rolling out a new feature called Proton Sentinel.

If you're new to Proton, the Switzerland-based company offers email, VPN, cloud storage, and various other digital services, with a clear emphasis on security and privacy. It's a bit like Google without the tracking or the ads, and the newly unveiled Proton Sentinel is a “high-security program” for keeping users and their data safe.

It's worth emphasizing that Proton accounts already come with a bunch of security features and protections to keep out bad actors. There's end-to-end, zero-access encryption for user data, there's two-factor authentication to help you prove you are who you say you are when you log in, there's a custom-built spam filtering system, there are real-time notifications of logins, and more.

However, Sentinel goes further. Proton describes the additional feature as offering more protection than most people will need, aimed at “users who need the most security”: Journalists, government officials, religious leaders, and leaders of international peace organizations are mentioned as some of those who are particularly at risk from hacking attempts.

You can enable Sentinel from inside your Proton account.

Proton via David Nield

"Accounts such as these have a high risk of being attacked by criminals or state-backed hackers," writes Proton's Dingchao Lu. “We are now ready to provide the same level of advanced protection and support that we reserved for these VIPs to any Proton user that wants it through the Proton Sentinel program.”

You don't have to fall into one of those categories to use Proton Sentinel, but you do have to be a paying Proton user: a Visionary, Lifetime, Family, Unlimited, or Business plan is required, and you can see details of all the plans here.

A lot of the work that Proton Sentinel does goes on behind the scenes, and you'll find that Proton itself doesn't go into too much detail about how it functions—which is sensible if you want to minimize the chances of someone else getting around it.

The advanced security protection it offers includes strict challenges for “suspicious” login attempts, typically those from devices that you don't normally use and parts of the world that you're not normally in. You might find yourself asked to confirm more of your logins to Proton services with Sentinel enabled, but it's worth it for the extra peace of mind.

Proton says that suspicious logins are flagged by automated systems and then escalated to human security analysts, around the clock. Any support requests you file related to account security will also get escalated to trained security specialists, meaning that if there is a security problem, it's going to be dealt with more quickly.

Related to this stricter policy on logins, Proton Sentinel also gives you access to detailed security logs inside your account, listing attempts to log in using your credentials, as well as other key actions you need to be aware of (such as password changes.)

More detailed security logs are available with Proton Sentinel.

Proton via David Nield

If you're on board with Proton Sentinel and everything that it offers, log into your Proton account on the web. Click the **settings** cogwheel, then **Go to settings**, and then **Security and privacy**: At the top of the screen there should be an **Enable Proton Sentinel** toggle switch that you can turn on. That's all there is to it: You're now protected.

Farther down the same screen is the security logs panel: Turn on both **Enable authentication logs** and **Enable advanced logs** to get all of the information possible about when and where your account is being used. All successful and unsuccessful login attempts are listed here, since the very first day you opened your Proton account—and if security actions were taken on a login attempt, this will be recorded next to it.

If you see something you don't recognize, you can click the **Revoke** button next to an existing session: The device in question will be remotely logged out, and a fresh sign-in will be required to use Proton's apps on that device. It's better to err on the side of caution here, and log out from any sessions that you don't immediately recognize. If you do notice anything suspicious, you should contact Proton Support too.

Proton Sentinel is simple to set up, takes very little effort to maintain, and keeps your Proton account as well protected as possible—so it makes a lot of sense to enable the feature. Like the Enhanced Safety Mode that Google offers as part of Chrome's feature set, Sentinel goes above and beyond the norms to make sure that there's no unauthorized access to your account.

How to Use Proton Sentinel to Keep Your Accounts Safe

Plus: A major FBI botnet takedown, new Sandworm malware, a cyberattack on two major scientific telescopes—and more.

A monthslong WIRED investigation published this week revealed the inner workings of the Trickbot ransomware gang, which has targeted hospitals, businesses, and government agencies around the world. 

The investigation stemmed from a mysterious leak publish on X (formerly Twitter) last year by an anonymous account called Trickleaks. The document trove contained dossiers on 35 alleged Trickbot members, including names, dates of birth, and much more. It also listed thousands of IP addresses, cryptocurrency wallets, email addresses, and Trickbot chat logs. Armed with this information, we enlisted the help of multiple cybersecurity and Russian cybercrime experts to paint a vivid picture of Trickbot’s organizational structure and corroborate the real-world identity of one of its key members. 

Last weekend, someone (more on that later) successfully disrupted more than 20 trains in Poland. The incidents were originally described as a “cyberattack,” but it was actually something much simpler: a radio hack. Using equipment that can cost as little as $30, the attack exploited the trains’ unencrypted radio system to cause them to perform an emergency stop. 

Over on the dark web, cybercriminals are making money in an unexpected way: writing contests. With total prizes reaching as high as $80,000, the competitions enlist hacking forum members to craft the best essays, many of which explain how to carry out cyberattacks and scams. 

Last December, Apple officially killed its controversial photo-scanning tool for detecting child sexual abuse material (CSAM) on iCloud, a tool the company launched in August 2021 before un-launching it a month later after backlash from cybersecurity experts, civil liberties advocates, and others who argued that the tool would violate users’ security and privacy. But the issue is far from resolved. This week, a new child safety group called Heat Initiative demanded that Apple reinstate the tool. Apple responded with a letter, which it shared with WIRED, detailing for the first time its full reasoning behind terminating the tool. Heat Initiative’s push comes amid international pressure to weaken encryption for law enforcement purposes.

Elsewhere, we detailed the big security patches you need to install to keep your devices safe (looking at you, Google Chrome and Android users). And we dove into the supremely nerdy world of a code-cracking competition that had contestants racing to decode a German U-boat cipher from World War II. One team had a secret weapon.

But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

When more than 20 trains in Poland were bought to a halt last weekend in what was described as a “cyberattack,” all eyes turned to Russia. After all, Poland’s rails serve as a key piece of infrastructure for supporting Ukraine’s war effort. But as we reported a day later, the disruption had been caused not through any sophisticated cyber intrusion but through a simple radio hack that sent a “radio stop” command to the Polish trains over an unencrypted and unauthenticated system. “The frequencies are known. The tones are known. The equipment is cheap,” Polish-speaking cybersecurity researcher Lukasz Olejnik told WIRED. “Everybody could do this. Even teenagers trolling.”

Well, not teenagers exactly, but twentysomethings. This week, Polish police arrested a 24-year-old man and a 29-year-old man, both Polish citizens, who allegedly carried out the radio train hack. One of the two men, based in the city of Bialystok near the border with Belarus, was a police officer. Amateur radio equipment was found in one of their apartments, according to Poland’s RMF Radio, where the younger man was found (reportedly in a drunken state).

2 Polish Men Arrested for Radio Hack That Disrupted Trains

Child safety group Heat Initiative plans to launch a campaign pressing Apple on child sexual abuse material scanning and user reporting. The company issued a rare, detailed response on Thursday.

In December, Apple said that it was killing an effort to design a privacy-preserving iCloud photo-scanning tool for detecting child sexual abuse material (CSAM) on the platform. Originally announced in August 2021, the project had been controversial since its inception. Apple had first paused it that September in response to concerns from digital rights groups and researchers that such a tool would inevitably be abused and exploited to compromise the privacy and security of all iCloud users. This week, a new child safety group known as Heat Initiative told Apple that it is organizing a campaign to demand that the company “detect, report, and remove” child sexual abuse material from iCloud and offer more tools for users to report CSAM to the company. 

Today, in a rare move, Apple responded to Heat Initiative, outlining its reasons for abandoning the development of its iCloud CSAM scanning feature and instead focusing on a set of on-device tools and resources for users known collectively as Communication Safety features. The company's response to Heat Initiative, which Apple shared with WIRED this morning, offers a rare look not just at its rationale for pivoting to Communication Safety, but at its broader views on creating mechanisms to circumvent user privacy protections, such as encryption, to monitor data. This stance is relevant to the encryption debate more broadly, especially as countries like the United Kingdom weigh passing laws that would require tech companies to be able to access user data to comply with law enforcement requests.

“Child sexual abuse material is abhorrent and we are committed to breaking the chain of coercion and influence that makes children susceptible to it,” Erik Neuenschwander, Apple's director of user privacy and child safety, wrote in the company's response to Heat Initiative. He added, though, that after collaborating with an array of privacy and security researchers, digital rights groups, and child safety advocates, the company concluded that it could not proceed with development of a CSAM-scanning mechanism, even one built specifically to preserve privacy.

“Scanning every user’s privately stored iCloud data would create new threat vectors for data thieves to find and exploit," Neuenschwander wrote. "It would also inject the potential for a slippery slope of unintended consequences. Scanning for one type of content, for instance, opens the door for bulk surveillance and could create a desire to search other encrypted messaging systems across content types.”

WIRED could not immediately reach Heat Initiative for comment about Apple's response. The group is led by Sarah Gardner, former vice president of external affairs for the nonprofit Thorn, which works to use new technologies to combat child exploitation online and sex trafficking. In 2021, Thorn lauded Apple's plan to develop an iCloud CSAM scanning feature. Gardner said in an email to CEO Tim Cook on Wednesday, August 30, which Apple also shared with WIRED, that Heat Initiative found Apple's decision to kill the feature “disappointing.”

“We firmly believe that the solution you unveiled not only positioned Apple as a global leader in user privacy but also promised to eradicate millions of child sexual abuse images and videos from iCloud,” Gardner wrote to Cook. “I am a part of a developing initiative involving concerned child safety experts and advocates who intend to engage with you and your company, Apple, on your continued delay in implementing critical technology … Child sexual abuse is a difficult issue that no one wants to talk about, which is why it gets silenced and left behind. We are here to make sure that doesn’t happen.”

Apple maintains that, ultimately, even its own well-intentioned design could not be adequately safeguarded in practice, and that on-device nudity detections for features like Messages, FaceTime, AirDrop, and the Photo picker are safer alternatives. Apple has also begun offering an application programming interface (API) for its Communication Safety features so third-party developers can incorporate them into their apps. Apple says that the communication platform Discord is integrating the features and that appmakers broadly have been enthusiastic about adopting them.

“We decided to not proceed with the proposal for a hybrid client-server approach to CSAM detection for iCloud Photos from a few years ago,” Neuenschwander wrote to Heat Initiative. “We concluded it was not practically possible to implement without ultimately imperiling the security and privacy of our users.”

On Heat Initiative's request that Apple create a CSAM reporting mechanism for users, the company told WIRED that its focus is on connecting its vulnerable or victimized users directly with local resources and law enforcement in their region that can assist them rather than Apple positioning itself as an intermediary for processing reports. The company says that offering this intermediary service may make sense for interactive platforms like social networks.

The need to protect children from online sexual abuse is urgent, though, and as these concerns intersect with the broader encryption debate, Apple's resolve on refusing to implement data scanning will continue to be tested.

Read the full exchange between Heat Initiative and Apple below. WIRED has redacted sensitive personal information for the privacy of senders and recipients:

Apple's Decision to Kill Its CSAM Photo-Scanning Tool Sparks Fresh Controversy

Plus: Mozilla patches more than a dozen vulnerabilities in Firefox, and enterprise companies Ivanti, Cisco, and SAP roll out a slew of updates to get rid of some high-severity bugs.

August has ended the summer in style with multiple patches issued by Microsoft, Google Chrome, and its competitor Firefox to fix serious issues, some of which are being used in attacks.

While there was no Apple iPhone update at the time of writing, some major enterprise fixes were released during the month. These include patches for exploited flaws in Ivanti products, as well as fixes for vulnerabilities in SAP and Cisco software.

Read on for everything you need to know about the patches issued in August.

Microsoft

Microsoft’s August Patch Tuesday saw the software giant fixing dozens of vulnerabilities, including two already being used in real-world attacks. The first is a Defense in Depth update to CVE-2023-36884, a remote code execution (RCE) flaw in Windows Search that could allow attackers to bypass Microsoft’s Mark of the Web security feature. If it sounds familiar, that’s because Microsoft already fixed the vulnerability in July. But installing the latest update “stops the attack chain” leading to the issue, Microsoft said.

The second flaw, CVE-2023-38180 is an issue in .NET and Visual Studio that could allow an adversary to perform denial of service.

Six of the issues fixed in August’s Patch Tuesday are rated as critical, including CVE-2023-36895—an RCE flaw in the Outlook email client. Meanwhile, CVE-2023-35385, CVE-2023-36910, and CVE-2023-36911 are RCE issues in the Microsoft Message Queuing service, according to the Security Update Guide.

The fifth and sixth critical issues fixed by Microsoft in August are CVE-2023-29328 and CVE-2023-29330, both of which are RCE flaws in Teams.

Google Chrome

August kicked off with a slew of updates for Chrome 115 including nine rated as having a high impact. The 17 patches include three type-confusion flaws in V8: CVE-2023-4068, CVE-2023-4069, and CVE-2023-4070. And CVE-2023-4071 is a heap buffer overflow issue in Visuals and CVE-2023-4076 is a use-after-free flaw in WebRTC.

A couple of weeks later, Google issued Chrome 116 to patch 26 vulnerabilities, eight of which are rated as having a high impact. The most serious issues include CVE-2023-2312—a use-after-free bug in Offline—and CVE-2023-4349, a use-after-free flaw in Device Trust Connectors. A third, CVE-2023-4350, is an inappropriate implementation bug in Fullscreen.

Then, on August 23, Google released the first of its more regular weekly security updates, patching five flaws. The four vulnerabilities rated as having a high impact include two use-after-free bugs and two out-of-bounds memory access issues.

Firefox

Google Chrome’s privacy-focused competitor Firefox also had a hectic August, fixing more than a dozen vulnerabilities in Firefox 116. The issues patched by Firefox owner Mozilla include CVE-2023-4045, an issue in Offscreen Canvas rated as high, and CVE-2023-4047, a bug in popup notifications delay calculation that could allow an attacker to trick a user into granting permissions.

The update also patches memory safety bugs tracked as CVE-2023-4056, CVE-2023-4057, and CVE-2023-4058. The flaws fixed in the latest update “showed evidence of memory corruption,” Mozilla said. “We presume that with enough effort, some of these could have been exploited to run arbitrary code.”

Google Android

Google has issued 40 updates for its Android operating system including patches for serious flaws in the Framework, System, and Kernel. Tracked as CVE-2023-21273, the most severe bug fixed in August is a critical security vulnerability in the System component that could lead to RCE with no additional execution privileges needed. User interaction is not required for exploitation, Google said in its Android Security Bulletin.

Meanwhile, CVE-2023-21282 is an RCE flaw in the Media Framework also marked as having a critical impact. Another critical issue in the Kernel, tracked as CVE-2023-21264, could lead to local escalation of privilege, although System execution privileges are needed.

Google Fixes Serious Security Flaws in Chrome and Android

A WIRED investigation into a cache of documents posted by an unknown figure lays bare the Trickbot ransomware gang’s secrets, including the identity of a central member.

Unmasking Trickbot, One of the World’s Top Cybercrime Gangs

The competitions, which are held on Russian-language cybercrime forums, offer prize money of up to $80,000 for the winners.

The criminal contests have their own rules to reduce the chance of cheating, Budd says. On Exploit, the rules say the entries “must not have been published elsewhere,” should be “meaningful and voluminous,” they should include technical details such as code or algorithms, and be “at least 5,000 characters (excluding spaces).” That equals out to around 1,000 words, or the rough length of this WIRED article. The rules on XSS are similar—“copy-paste = expulsion from the contest, in disgrace”—but they require articles to be longer (at least 7,000 characters) and say there should be “proper formatting, spelling, and punctuation.”

However, scammers are going to scam. In their most recent contests, Exploit had 35 entries and XSS had 38 entries. But XSS disqualified 10 of them. The winners of the competitions are decided by forum members voting on the entries, but the sites’ admins can also pick the winners, and there have been complaints of vote rigging, according to Sophos.

These competitions have evolved and grown over time, Budd says. Previous research from cybersecurity firm Digital Shadows, which has since been acquired by ReliaQuest, shows that contests on cybercrime forums started around 2006. Roman Faithfull, a cyber-threat intelligence analyst at ReliaQuest, says these earliest competitions were very simple. “At the start, they were quite low-key,” Faithfull says. “They weren't always organized by forum administrators.”

Some of the earliest competitions, he says, asked forum members to design logos or even offered a small monetary prize to the commenter on a forum thread who had the longest account history on the site. “As forums became more sophisticated, the contests in general became more sophisticated,” Faithfull says.

Since around 2015, the contests, most of which are held annually, have focused on writing and submitting articles and code, the ReliaQuest researcher says. “There's a lot of focus on stuff that will make people money,” he adds. As this has happened, the prize pots have increased too: On XSS, the total prize pot was $1,000 in 2018 and rose to $40,000 with $14,000 for the winner in 2021. “No one is going to put out their absolute best stuff into this unless they're in a really hard spot and need some quick cash,” Faithfull says. “You're unlikely to see a ransomware group, or really, someone really high up.”

The content of the entries to the most recent two contests is reasonably broad, the Sophos research found. Some were more innovative, while others were essentially repeating information found elsewhere. The winning entry in Exploit’s 2021 crypto competition was the creation of the cloned blockchain.com website, with Sophos saying it is “relatively simplistic” overall. “A cloned site like this would typically be used like any other phishing or credential-harvesting site,” the research says.

Other winning entries or those getting honorable mentions in the Exploit competition focused on targeting initial coin offerings, a guide to creating a phishing site to steal people’s cryptocurrency account details, and a tutorial on creating a cryptocurrency from scratch. However, it is worth noting that there have been free and publicly available tutorials on how to do this for several years,” the Sophos research says.

The Weird, Big-Money World of Cybercrime Writing Contests

The sabotage of more than 20 trains in Poland by apparent supporters of Russia was carried out with a simple “radio-stop” command anyone could broadcast with $30 in equipment.

Since war first broke out between Ukraine and Russia in 2014, Russian hackers have at times used some of the most sophisticated hacking techniques ever seen in the wild to destroy Ukrainian networks, disrupt the country's satellite communications, and even trigger blackouts for hundreds of thousands of Ukrainian citizens. But the mysterious saboteurs who have, over the last two days, disrupted Poland's railway system—a major piece of transit infrastructure for NATO's support of Ukraine—appear to have used a far less impressive form of technical mischief: Spoof a simple radio command to the trains that triggers their emergency stop function.

On Friday and Saturday, more than 20 of Poland's trains carrying both freight and passengers were brought to a halt across the country through what Polish media and the BBC have described as a “cyberattack.” Polish intelligence services are investigating the sabotage incidents, which appear to have been carried out in support of Russia. The saboteurs reportedly interspersed the commands they used to stop the trains with the Russian national anthem and parts of a speech by Russian president Vladimir Putin.

Poland's railway system, after all, has served as a key source of Western weapons and other aid flowing into Ukraine as NATO attempts to bolster the country's defense against Russia's invasion. “We know that for some months there have been attempts to destabilize the Polish state,” Stanislaw Zaryn, a senior security official, told the Polish Press Agency. “For the moment, we are ruling nothing out.”

But as disruptive as the railway sabotage has been, on closer inspection, the “cyberattack” doesn't seem to have involved any “cyber” at all, according to Lukasz Olejnik, a Polish-speaking independent cybersecurity researcher and consultant and author of the forthcoming book _Philosophy of Cybersecurity_. In fact, the saboteurs appear to have sent simple so-called “radio-stop” commands via radio frequency to the trains they targeted. Because the trains use a radio system that lacks encryption or authentication for those commands, Olejnik says, anyone with as little as $30 of off-the-shelf radio equipment can broadcast the command to a Polish train—sending a series of three acoustic tones at a 150.100 megahertz frequency—and trigger their emergency stop function.

“It is three tonal messages sent consecutively. Once the radio equipment receives it, the locomotive goes to a halt,” Olejnik says, pointing to a document outlining trains' different technical standards in the European Union that describes the “radio-stop” command used in the Polish system. In fact, Olejnik says that the ability to send the command has been described in Polish radio and train forums and on YouTube for years. “Everybody could do this. Even teenagers trolling. The frequencies are known. The tones are known. The equipment is cheap.”

Poland's national transportation agency has stated its intention to upgrade Poland's railway systems by 2025 to use almost exclusively GSM cellular radios, which do have encryption and authentication. But until then, it will continue to use the relatively unprotected VHF 150 MHz system that allows the “radio-stop” commands to be spoofed.

The only real limitation of the train-paralyzing radio attack, Olejnik says, would be that the saboteurs would have to be relatively close to the target trains—somewhere from hundreds of feet to miles, depending on the power of the radio equipment used in their disruption operation. (Olejnik was careful to note that he hasn't tested the attack himself.) Given that the disruptions appear to have occurred in three different Polish administrative regions across the country, getting that equipment close enough to all the target trains would likely have been the biggest challenge for the saboteurs. “It is really a cheap operation,” Olejnik says. “The biggest risk is the need of being in proximity.”

Polish State Railways didn't immediately respond to WIRED's request for comment. But a statement from the railways agency notes that the train disruptions were due to “unauthorized broadcasting of the radio-stop signal” sent “by means of a radiotelephone by an unknown perpetrator.” The statement adds that “receiving a radio-stop signal results in an immediate stop of all trains whose radios operate on a given frequency.”

Despite those automated emergency stops, the railway agency wrote that “there is no threat to rail passengers. The result of this event is only difficulties in the running of trains.” The Polish Press Agency reported no injuries or damage as a result of the radio sabotage operation.

If Russia or its supporters have in fact sabotaged the railway system of Ukraine's ally, the operation wouldn't be without precedent. In fact, Belarusian dissident hackers known as the Cyber Partisans protested Belarus's support of the Russian military by launching their own rare political ransomware attack against Belarus's Railways' IT network in January of 2022, in an attempt to prevent Belarus's participation in the invasion that came just a month later.

This disruption of Poland's rail system doesn't appear to have required any such ransomware or even a penetration of a digital network. But Olejnik cautions that the simplicity of the attack shouldn't lead anyone to underestimate its effects, which may continue to play out given the difficulty of preventing the radio attack on Polish trains' unauthenticated communication systems.

“When you’re a hub of support to war-stricken Ukraine, you’re indeed a target,” says Olejnik. “Low-hanging fruits are always the best approach.”

_Additional reporting by Lily Hay Newman._

The Cheap Radio Hack That Disrupted Poland's Railway System

A ramshackle team of American scientists scrambled to decode the Nazi cipher before the time ran out. Luckily, they had a secret weapon.

“What am I supposed to see?” Krutzler asks, staring at his screen and bouncing his knee like he has a baby on it. His T-shirt reads “Defense Nuclear Weapons School.”

“You’re supposed to see a little ladder,” explains Koeth. “Like DNA strands.”

A few minutes go by before the transmission begins again. This time, it sounds a bit different. Koeth gives the thumbs up. Holly Wilson, a student of Koeth’s who graduated with a bachelor’s in physics in 2023, gets enlisted to transcribe the code into a yellow-lined legal pad. She’s wearing a faded Fleetwood Mac T-shirt and has a massive tattoo of an octopus wrapping her arm. Wilson writes down OKTOBER 7 and DBK WSE before the signal fades.

“That’s it, that’s it!” shouts Koeth. He consults the page from the German Army Staff Machine Key Number 28 book, provided by MRHS in a link on its website. He’ll need to obtain the key setting for the Enigma machine, the first step in decoding the message. The team has been at it for almost an hour.

At last, Koeth opens the wood cover of the Enigma. Although it’s possible to purchase one for between $300,000 to $500,000, Koeth received his as a loan from a collector in California, a WWII buff who has an exact replica of Little Boy, the atomic bomb dropped on Hiroshima, in his backyard. (Ensuing calls from concerned neighbors.)

Koeth’s own workplace might be cause for similar concern. A faculty member at UMD since 2009, his second-floor office holds an impressive collection of radiological antiquities such as Fiestaware, Vaseline glass, and, under lock and key, some Lone Ranger Atomic Bomb Rings, cereal prizes from the 1950s that contained a small amount of polonium 210.

Koeth removes two rotors from the machine, turns one to 6 and the other to 12, and plops them back inside.

“We gotta do the plugboard next,” Koeth announces before closing the lid. He begins to plug and unplug a series of tubes in a way that recalls Ernestine, Lily Tomlin’s immortal phone operator.

“No wonder the Germans lost the war,” says Larry Westrick, an electrical engineer from Opelika, Alabama. “It takes too long to communicate.”

Luckily, tenacity is part of Koeth’s job description. When he was 10, Koeth laid out plans to build a nuclear reactor in his parents’ basement in Piscataway, New Jersey.

Next, entering the code in cyphertext, Koeth pushes some of Enigma’s buttons, which in turn moves the rotors like the inner workings of a clock; a lampboard lights up a corresponding letter in plaintext. “It’s a guessing game,” he says, turning quiet. “Just think,” he says after a while, “they had to do this every day.”

Krutzler, Westrick, and a few newcomers gather around Koeth and his machine. There are 100 letters in the message and so far, none of them seem to make any sense.

“Something is wrong,” they say in unison. A joke goes around that the secret message is “Drink more Ovaltine.”

Koeth refers to a set of instructions. “Basically, you key in the first set of letters, and they should match the second set of letters. Which they don’t.”

The Low-Stakes Race to Crack an Encrypted German U-Boat Message

The US Secret Service’s relationship with the Oath Keepers gets revealed, Tornado Cash cofounders get indicted, and a UK court says a teen is behind a Lapsus$ hacking spree.

“The government needs to stop these companies from packaging and selling our personal information,” US senator Ron Wyden of Oregon told 404 Media in a statement, “and the senior executives that put profit over national security and Americans' safety should be punished accordingly.”

A new report by the Citizens for Responsibility and Ethics in Washington (CREW), a nonprofit government watchdog, found that US Secret Service agents were in close contact with the leader of the far-right militant group the Oath Keepers during the final months of the Trump administration. Emails published in the report suggest a cordial relationship between agents and Stewart Rhodes, the leader of the group.

In one email, an agent wrote that they had just spoken to Rhodes about an upcoming visit by former president Donald Trump to Fayetteville, North Carolina. The agent described himself as “the unofficial liaison to the Oath Keepers (inching towards official).” The agent also said that Rhodes “had specific questions and wanted to liaison \[sic\] with our personnel,” and shared Rhodes’ cell phone number.

In May, Rhodes was found guilty of seditious conspiracy over his role in the insurrection at the Capitol on January 6. He was sentenced to 18 years in prison and 36 months of supervised release.

In an indictment unsealed on Wednesday, August 23, the US Department of Justice alleges that the developers behind Tornado Cash, a cryptocurrency mixer, laundered more than $1 billion dollars that included hundreds of millions for a North Korean hacking group. Roman Semenov and Roman Storm were charged with conspiracy to commit money laundering and sanctions violations, as well as conspiracy to run an unlicensed money-transmitting business. Storm, who lives in Washington state, was arrested on Wednesday, while Semenov, a Russian national, has not yet been taken into custody.

Tornado Cash is a privacy service that obfuscates the trail of ownership for cryptocurrency. According to the indictment, the service violated US sanctions, and its operators knowingly helped “hackers and fraudsters conceal the fruits of their crimes.”

In a statement, Storm’s lawyer, Brian Klein, characterized the charges as dangerous and unprecedented. “We are incredibly disappointed that the prosecutors chose to charge Mr. Storm because he helped develop software, and they did so based on a novel legal theory with dangerous implications for all software developers,” he said. Klein said Storm has been released on bail.

Also on Wednesday, a London court found a key member of the cybercrime group Lapsus$ responsible for several high-profile hacks targeting companies like Uber, Nvidia, and Rockstar Games. Arion Kurtaj, who is now 18, faced 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the UK’s Computer Misuse Act.

From 2021 to 2022, Kurtaj, along with other members of Lapsus$, most of whom are believed to be teenagers, carried out a series of attacks focused on extorting major companies and government agencies around the world, the jury found. The Uber hack, for instance, reportedly cost the company $3 million in damages. At the time, Uber said that the hacker who took responsibility posted pornographic material to an internal information page, alongside the message, “Fuck you wankers.”

The hacking spree prompted a major review earlier this month by US authorities who warned of the rising threat of juvenile hackers.

Source

Wired