In the spring of 2022, I was sitting in my college apartment studying for an exam when I received a call from an unfamiliar number. Not thinking anything of it, I answered and was stunned to meet a Secret Service agent asking about an unsavory tweet I’d posted about former president George W. Bush four months earlier. 

“When making that tweet,” asked the federal agent on the line, “were you talking about George Bush Sr. or George Bush Jr.?”

My eyes darted between the Detroit Field Office’s list of contacts on its website and my friend in my room, afraid that I’d be indicted on a federal crime at 20 years old. 

“George Bush Jr.,” I responded. “Cause he’s still alive.”

It was unbelievable to me that a federal agent saw my old drunken tweet and considered it important enough to be investigated, much less to find my contact information and call me to confirm whether or not I was a threat. 

Back then, I had an unhealthy relationship with Twitter. I’d hoped to grow an audience on the social media site so I could sell my Substack like my favorite internet micro-celebrities. But drunk one night, after arguing with my roommates about 9/11 and the unjust war in Iraq, I tweeted that George Bush should be dead, and I went to bed. It wasn’t uncommon for me to throw out inflammatory remarks. My roommates, usually more cautious and forward-thinking than I was, advised me to delete it. Ignoring them, I kept it up for reasons like ego and fallacious integrity. Four months later it came back to bite me. 

While my college classmates and I were worried about the federal government interfering in the lives of everyday citizens, it’s not the only area of surveillance I should have been concerned about. Internet service providers and platforms like Twitter and Facebook all regularly moderate their service in ways that can either thrust users into the eyes of law enforcement or keep them safe from surveillance. That’s a distinction that’s often left up to those in power to make. Whether it’s a stupid tweet or a legitimate complaint depends heavily on who’s in charge of making that call.

“Governments in Iran and China are centralized and control service providers, or have very strict rules on who is operating them and how,” says University of Michigan computer science professor Roya Ensafi, founder of Censored Planet. “In a lot of other countries, though, service providers are commercial entities like Comcast and Verizon, so the government has to rule through policy to figure out how to implement censorship. Although it's different, the government always has a good idea of what the ISPs are doing,” she elaborates. 

The US government isn’t usually inclined to release data on its own surveillance activities, but the American Civil Liberties Union, along with other similar organizations, have a mountain of data about the often racist and invasive activities of American intelligence agencies. Plus, social media companies have a long history of cooperating with intelligence agencies in gathering information on their users.

Unfortunately, my thought process wasn’t that complex when I suddenly had to talk to a federal agent on my phone about what I’d posted to Twitter.

“Can I take a second just to verify that you are, in fact, calling me?” I stammered out, recalling that I had a right to verify the agent’s identity–or perhaps call a lawyer before responding with anything that may be incriminating. An investigation by the Secret Service goes through the federal judicial system, after all. I hoped I didn’t need to pay for a fancy-pants federal defense attorney.

“Sure, but if you don’t call me back,  we would have to show up to your address in Ann Arbor,” he replied. 

I called the Chicago Field Office, as the Detroit Field Office was closed that day. “Hi, I’d like to request some information,” I said to the man on the phone. 

“May I ask you why?” he asked. 

What was I supposed to say to this guy? This wasn’t a FOIA request. I swallowed the lump in my throat and nervously capitulated. “I’m currently being investigated, and I wanted to verify that this agent works at the Detroit Field Office from this number before I give any information.”

The investigator checked. This agent did indeed work for the Secret Service. I called him back and was met with more dejected quasi-threats. He listed my father’s name and occupation, my (deceased) mother’s name and occupation, and my sister’s age. He dropped the first four numbers of my social security number before I told him I understood he was legit. As the debacle continued,  I realized I’d accrued the equivalent of a seditious parking ticket.

“Alright, I’ve got no more questions for you. If you pull anything like that again, though, we will not hesitate to show up armed at your door. Can I call a friend to corroborate the information you’ve given me?” the agent asked. I obliged. I thought to myself that it was probably better not to let this thing escalate.

Returning from my exam later that day, I finally told my roommates what had transpired. _They_ were surprised that all of my posturing and bloviating about the “Feds” actually came to bite me. _I_ was embarrassed that I actually ended up in this situation. 

When I told my father what happened, he was hysterical.“Is this going to cost you a job?” he finally asked. It was a good question. I wasn’t sure of the answer, and even though I hoped the whole thing was over, I had no way to know if I were on some kind of watch list going forward. 

So was there any real way to monitor my digital footprint so I wouldn’t be targeted, or to keep myself safe in the future so this wouldn’t happen again?  When I asked Ensafi, she brought up the General Data Protection Regulation in the EU, and California’s Consumer Privacy Act. However, both laws aim to make individuals aware of what commercial entities can and can’t do with your data, not what they can and can’t hand over to law enforcement or government bodies.

“I don’t know whether the day-to-day lives of Americans are affected by surveillance, but I can assure you that one thing we found in our VPN study was that vast numbers of users in the United States using VPNs think that they’re protecting their privacy and security from service providers,” Ensafi says. The presence of internet influencers advertising VPN software has long made me wary of how effective they actually were. Ensafi agrees. 

“Years ago my students and I decided to look into the ecosystem through systematic investigation on how weak implementations are, how weak VPN services are, if they’re leaking DNS data or implementing a kill switch properly or not, as well as understanding users’ perspective better as to why they use VPN services. Do they know what a VPN actually provides? Where do they find VPNs from? They think VPNs are a tool to save the day, but that isn’t always the case.”

I know for a fact that a VPN probably wouldn’t have helped in my case. I have identifiable information publicly available, and a link to some other stuff in my Twitter profile and bio. But Twitter does hand over user information—usually at the behest of a subpoena, but other times whenever it chooses to. Take for example, the case of @PRGuy17. Twitter was ordered to hand over the user’s personal information by a court in Australia during a defamation case. That’s not even considering any actual data-sharing agreements the platform—or other platforms—may have for their own purposes, and who knows what the third parties do with your information. 

VPNs are helpful, but they aren’t especially useful if you find yourself in my situation. One easy solution, of course, is to simply be careful what you say publicly, regardless of whether you’re identifiable or not. Another simple internet hygiene tip I recommend is to avoid suspicious users. I’m not joking. The FBI spends millions of dollars on user surveillance of social media. If it seems like a user is trying to coerce information out of you, especially that of the illicit kind, don’t comply. Don’t click suspicious links, either. These are viruses most of the time, but it’s not just scammers and con artists that set up fake websites to “honeypot” users and grab their IP addresses and other personal information. I don’t expect any of you to be criminals, but you can’t be too careful. If you absolutely must, use secure and encrypted messaging clients like Signal.

I still post opinionated takes on social media, and I try to use sarcasm and satire to comment on government surveillance and conspiracy theories. But I stopped joking about the demise of presidents. Do I know exactly how to avoid this in the future, or how to put a stop to it entirely? Not entirely. It’s hard to offer tips when your words are stuck between private companies and the global surveillance complex. I think I did the right thing by cooperating and trying to minimize the potential fallout from a drunken tweet. But what if the agent—or anyone who potentially reported my tweet—had more dirt on me, or had some kind of personal or political vendetta? 

What I can say for sure is that it’s always good to be careful. I know now to watch what I say and only say things I truly mean. So, above all else, exercise caution. And remember that when you speak on the internet, you never know who’s listening.

I Got Investigated by the Secret Service. Here's How to Not Be Me

Plus: A SpaceX supplier ransom, critical vulnerabilities in dozens of Android phones, and more.

What’s more controversial than a popular surveillance camera maker that has an uncomfortably cozy relationship with American police? When ransomware hackers claim to have breached that company—Amazon-owned camera maker Ring—stolen its data, and Ring responds by denying the breach.

But we’ll get to that.

Five years ago, police in the Netherlands caught members of Russia’s GRU military intelligence red-handed as they tried to hack the Organization for the Prohibition of Chemical Weapons in The Hague. The team had parked a rental car outside the organization’s building and hid a Wi-Fi snooping antenna in its trunk. Within the GRU group was Evgenii Serebriakov, who was caught with further Wi-Fi hacking tools in his backpack.

Since then, surprisingly, Serebriakov has only risen in status. This week, Western intelligence sources told WIRED that Serebriakov is now the new leader of one of the world’s most aggressive hacking units. Serebriakov took over Sandworm, which is responsible for some of the worst cyberattacks in history, in the spring of 2022. His elevation to the senior role, experts say, shows how small the pool of skilled nation-state hackers is likely to be and demonstrates Serebriakov’s value to Russia.

Nowhere on the internet is free from threats—and that includes LinkedIn. This week we looked at how spies, scammers, and hackers from Iran, North Korea, Russia, and China are using the professional network to scout and approach intelligence targets. In addition, LinkedIn is plagued with thousands of suspicious accounts; it removed hundreds from WIRED’s profile when we reported them.

The Western clampdown on TikTok is continuing—this week the UK joined the US, Belgium, Canada, and the European Union in banning the social media app from being used on government devices. But in the US, Senator Mark Warner is trying to pass legislation, in the guise of the bipartisan Restrict Act, that will allow officials to ban apps and services from six “hostile” nations: China, Russia, North Korea, Iran, Cuba, and Venezuela. We sat down with Warner and asked about the plans.

A WIRED analysis of “cybercrime” cases across the US shows how vague and wide-ranging the term can be. Without a clear and universal definition of cybercrime, human rights and civil liberties issues may expand globally. Speaking of criminals, scammers are getting better at using voice deepfakes to con people. And ransomware gangs are sinking to a new deplorable low. As more and more companies and organizations refuse to pay ransoms, criminal gangs are increasingly using extortion as leverage: they are now releasing photos stolen from cancer patients and sensitive student records. 

But wait, there's more. Each week, we round up the security news we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

ALPHV, a prolific group of hackers who extort companies with ransomware and leak their stolen data, said earlier this week that it had breached security camera maker Ring and threatened to dump the company’s data online if it doesn’t pay. “There’s always an option to let us leak your data …” the hackers wrote in a message to Ring on their leak site. Ring has so far responded with a denial, telling Vice’s Motherboard, “We currently have no indications of a ransomware event,” but it says it’s aware of a third-party vendor that has experienced one. That vendor, Ring says, doesn’t have access to any customer records. 

Meanwhile, ALPHV, which has previously used its BlackCat ransomware to target companies like Bandai Namco, Swissport, and hospital firm Lehigh Valley Health Network, stands by its claim to have breached Ring itself, not a third-party vendor. A member of the malware research group VX-Underground shared with WIRED screenshots of a conversation with an ALPHV representative who says that it’s still in “negotiations” with Ring.

Amid the ongoing ransomware epidemic, it’s no surprise that Ring isn’t alone in facing extortion problems. So too is Maximum Industries, a supplier of rocket parts for Elon Musk’s SpaceX. The hackers, a well-known ransomware gang known as LockBit, taunted Musk on their website, threatening to sell the stolen information to the highest bidder if Maximum doesn’t pay by their March 20 deadline. “I would say we were lucky if Space-X contractors were more talkative. But I think this material will find its buyer as soon as possible,” the hackers wrote. “Elon Musk we will help you sell your drawings to other manufacturers.”

Google’s Project Zero, its security research team devoted to finding unknown vulnerabilities in widely used tech products, warned Thursday that it had discovered severe hackable flaws in Samsung chips used in dozens of Android devices. In total, the researchers found 18 distinct vulnerabilities in Samsung’s Exynos modems for smartphones, but they say that four of them are particularly critical and would allow a hacker to “remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number.” Project Zero only rarely publishes information on unpatched vulnerabilities. But it says that it gave Samsung 90 days to fix the flaws, and it hasn’t yet. A bit of public shaming, perhaps, might spur Samsung to move faster to protect Google’s users from an insidious form of attack.

Since 2017, the cryptocurrency “mixer” service ChipMixer quietly grew into a powerhouse of cryptocurrency money laundering, taking in users’ coins, mixing them with others and then sending them back to obscure the money’s trail across blockchains. In the process, the Department of Justice says it laundered $3 billion worth of criminal funds, including ransomware payments, North Korean hackers’ stolen loot, and even profits from the sale of child sexual exploitation materials. Now, in a bust carried out by multiple European law enforcement agencies and coordinated by Europol as well as the FBI and DHS, ChipMixer has been taken offline and its infrastructure seized. The site’s alleged creator, 49-year-old Vietnamese national Minh Quốc Nguyễn, remains out of reach: He’s been charged with money laundering only in absentia. 

But the most intriguing result of the case may have more to do with the meltdown of the now notorious cryptocurrency exchange FTX: A portion of FTX’s funds that were stolen in the midst of its bankruptcy proceedings in November were funneled into ChipMixer. Seizing the servers of that mixing service may well foil the FTX thieves’ attempt to evade tracing and help solve one of the central mysteries of that high-profile heist.

Only in the cryptocurrency world, where thefts of more than half a billion dollars now occur multiple times a year, does the stealing of $200 million merit the lowest spot on a news roundup. Early this week, the distributed trading protocol Euler Finance lost nearly $200 million in cryptocurrency to hackers who found a vulnerability in its code. At first, Euler, the company behind that protocol, offered to let the hackers keep $20 million if they returned the rest of the funds. But after that offer was ignored—in fact, the hackers have sent the funds to the Tornado Cash mixing service in the hopes of covering their tracks—the firm has announced a $1 million bounty on the hackers’ heads.

Security News This Week: Ring Is in a Standoff With Hackers

WIRED spoke with the coauthor of the Restrict Act, a bipartisan bill to crack down on tech from six “hostile” countries.

In the future, it might be a new mobile game or an algorithm helping students study at home. It could be the latest graphics card or exercise bike, or an app that pairs families with puppies. With fewer and fewer aspects of life going untouched by technology, it could be practically anything. Right now, it's TikTok, with its billions of users worldwide. 

US Senator Mark Warner (D-Virginia) wants the United States armed with the ability to take swift action against technology companies suspected of cavorting with foreign governments and spies, to effectively vanish their products from shelves and app stores when the threat they pose gets too big to ignore. His new bill, the Restrict Act, would give that responsibility to the US commerce secretary, charging their office with reviewing and, under certain conditions, banning technologies flagged by US intelligence as a credible threat to US national security. Though the technology's owners and manufacturers would have every right to dispute any outcome in court if the Restrict Act becomes law, it is nevertheless an enormous authority to bestow—one with boundless implications for America's competitors overseas. 

The thought that such decisions could be wildly unpopular at home or elicit misgivings from global allies has not escaped Warner. Without sufficient transparency around the process, the government's moves could result in chaos. Warner says the intelligence community should be held to account for the decisions it influences, providing not only to Americans but also the world the information it needs to understand how and why this new power is being used. He knows it may not always be at liberty to do so.

TikTok's ties to China have more or less spooked authorities in several countries, with numerous officials in the US alone claiming to have spoken directly with whistleblowers who offered tales about abuses of personal data. Today, the United Kingdom joined several other nations, including the US, in banning the app across all government devices. 

The British, like their American, Belgian, and Canadian counterparts, are fearful that the app may offer Beijing's intelligence agencies the ability to track key officials' movements and intercept the sensitive information they keep. Other countries already have laws to accomplish what Warner is seeking to do. In 2020, for instance, India's ministry of electronics banned TikTok entirely, citing authority intended to safeguard the “safety and sovereignty of Indian cyberspace.” 

The Restrict Act's future is unknown, but it's gathered considerable bipartisan support in Congress, and there are very few reasons for America's tech giants to get in the way. To understand more about Warner's position on security, invasive tech, and privacy concerns that hit closer to home, WIRED spoke with the Virginia Democrat this week. Our conversation has been edited for length and clarity.

**WIRED: Tell us about the Restrict Act and its purpose.**

Mark Warner: Over the past few years, we've seen challenges coming from foreign-based technology. Originally it was Kaspersky, a Russian software company, then it was Huawei, a Chinese telecom provider, and more recently, the discussion has been about this Chinese-owned social media app, TikTok. We seem to have a whack-a-mole approach to foreign-based technology, and I think instead we need a comprehensive rules-based approach that recognizes national security is no longer simply tanks and guns, but is really a question about technology and technology competition. In the case of Kaspersky, it was software that kept getting updated from Moscow, and with Huawei, it was a way for the Communist Party in China to listen in. In the case of TikTok, it's the enormous amounts of data being collected that potentially could end up in China or, given the fact that a hundred million Americans a day are using it an average 90 minutes a day, it could be an enormous propaganda tool. Let me be clear: Because China changed its law in 2016 to make sure that, at the end of the day, every company's ultimate master is the Communist Party of China. It's not the shareholders, it's not the employees, it's sure not the customers. And this is a national security risk.

Senator Warner on the Restrict Act and a US TikTok Ban

Evgenii Serebriakov now runs the most aggressive hacking team of Russia’s GRU military spy agency. To Western intelligence, he’s a familiar face.

For years, the hacking unit within Russia's GRU military intelligence agency known as Sandworm has carried out some of the worst cyberattacks in history—blackouts, fake ransomware, data-destroying worms—from behind a carefully maintained veil of anonymity. But after half a decade of the spy agency's botched operations, blown cover stories, and international indictments, perhaps it's no surprise that pulling the mask off the man leading that highly destructive hacking group today reveals a familiar face.

The passport Evgenii Serebriakov used to enter the Netherlands in 2018.

Photograph: Department of Justice

The commander of Sandworm, the notorious division of the agency's hacking forces responsible for many of the GRU's most aggressive campaigns of cyberwar and sabotage, is now an official named Evgenii Serebriakov, according to sources from a Western intelligence service who spoke to WIRED on the condition of anonymity. If that name rings a bell, it may be because Serebriakov was indicted, along with six other GRU agents, after being caught in the midst of a close-range cyberespionage operation in the Netherlands in 2018 that targeted the Organization for the Prohibition of Chemical Weapons in the Hague.

In that foiled operation, Dutch law enforcement didn't just identify and arrest Serebriakov and his team, who were part of a different GRU unit generally known as Fancy Bear or APT28. They also seized Serebriakov’s backpack full of technical equipment, as well as his laptop and other hacking devices in his team’s rental car. As a result, Dutch and US investigators were able to piece together Serebriakov's travels and past operations stretching back years and, given his newer role, now know in unusual detail the career history of a rising GRU official.

According to the intelligence service sources, Serebriakov was placed in charge of Sandworm in the spring of 2022 after serving as deputy commander of APT28, and now holds the rank of colonel. Christo Grozev, the lead Russia-focused investigator for open source intelligence outlet Bellingcat, has also noted Serebriakov's rise: Around 2020, Grozev says, Serebriakov began receiving phone calls from GRU generals who, in the agency's strict hierarchy, only speak to higher-level officials. Grozev, who says he bought the phone data from a Russian black market source, says he also saw the GRU agent's number appear in the phone records of another powerful military unit focused on counterintelligence. "I realized he must be in a command position," says Grozev. "He can't just be a regular hacker anymore."

The fact that Serebriakov appears to have attained that position despite having been previously identified and indicted in the failed Netherlands operation suggests that he must have significant value to the GRU—that he's “apparently too good to dump,” Grozev adds.

Serebriakov's new position leading Sandworm—officially GRU Unit 74455 but also known by the nicknames Voodoo Bear and Iridium—puts him in charge of a group of hackers who are perhaps the world's most prolific practitioners of cyberwar. (They've also dabbled in espionage and disinformation campaigns.) Since 2015, Sandworm has led the Russian government's unprecedented campaign of cyberattacks on Ukraine: It penetrated electric utilities in western Ukraine and Kyiv to cause the first- and second-ever blackouts triggered by hackers and targeted Ukrainian government agencies, banks, and media with countless data-destructive malware operations. In 2017, Sandworm released NotPetya, a piece of self-replicating code that spread to networks worldwide and inflicted a record $10 billion in damage. Sandworm then went on to sabotage the 2018 Winter Olympics in Korea and attack TV broadcasters in the nation of Georgia in 2019, a shocking record of reckless hacking.

With Russia's full-scale invasion of Ukraine a year ago, the GRU's most aggressive hacking unit, now under Serebriakov's leadership, has refocused its efforts on that country. From its headquarters in a tower in the Moscow suburb of Khimki, it has launched new volleys of data-destroying malware, attempted to cause a third blackout—which the Ukrainian government says it prevented—and bombarded Ukrainian and Polish organizations with a fake ransomware campaign known as Prestige.

Serebriakov's pre-Sandworm hacking career was no less brazen. When he was captured along with the six other GRU agents in the Netherlands in 2018, US prosecutors say, he had in his backpack a Wi-Fi Pineapple, a book-sized device designed to spoof Wi-Fi networks and trick victims into connecting to it instead of the intended Wi-Fi hot spot, then carry out man-in-the-middle attacks that intercept or alter the victim's traffic. Serebriakov's team had also parked a rented car outside the Organization for the Prohibition of Chemical Weapons building with an antenna for Wi-Fi hacking hidden in the trunk. The team was likely targeting staffers of the OPCW who were investigating Russia's use of the Novichok nerve agent in the GRU's attempted assassination of defector Sergei Skripal.

Serebriakov posing with a Russian athlete at the Summer Olympics in Rio de Janeiro in 2016.

Photograph: Department of Justice

When investigators examined that confiscated Wi-Fi hacking equipment, they found evidence of a long list of Wi-Fi networks it had connected to previously, essentially mapping out the travels of Serebriakov and his colleagues to carry out previous hacking operations. The hackers, it seemed, had targeted officials at the 2016 Summer Olympics in Rio de Janeiro, from which more than 100 Russian athletes had been banned for performance-enhancing drug use, as well as attendees of a conference in Lausanne, Switzerland, focused on anti-doping efforts in athletics.

Exactly why Dutch authorities released Serebriakov and his fellow spies rather than criminally charge them—or extradite them to the US, where they face an indictment for hacking crimes—has never been explained, and the Dutch MIVD defense intelligence service didn't respond to WIRED's questions about it at the time.

That the figure at the helm of Sandworm today is someone previously identified in that very publicly blown Netherlands operation may demonstrate Serebriakov's value to the GRU: According to the intelligence service sources, he's regarded as having good connections to the security research community and strong technical skills. As for the fiasco of the GRU's Netherlands mission, the intelligence sources say that was blamed on the agents escorting him and his APT28 colleagues, not the hackers themselves. And in some cases, for the GRU, an indictment only bolsters an agent's reputation for boldness and risk-taking. “For the Kremlin, it may be ‘great, you’ve made a splash, built the myth, bolstered our reputation as these techno-raiders, good on you,’” says Gavin Wilde, a former official at the US National Security Agency and the White House National Security Council who now serves as a fellow at the Carnegie Endowment for International Peace.

But Serebriakov's reappearance also indicates that relatively few people serve as key players in high-profile state-sponsored hacking operations, says John Hultquist, the head of threat intelligence at cybersecurity firm Mandiant. Hultquist was part of the group of researchers who initially discovered and named Sandworm, and he has closely tracked the unit for years. “This is someone from a notorious close-access operation, and then he shows up as the leader of another organization we know very well,” says Hultquist, using the term _close-access_ to refer to Serebriakov's short-range Wi-Fi hacking tactics in the Netherlands. “To a certain extent, it demonstrates how small this world is that we’re trying to keep tabs on.”

“The same individuals show up again and again—and I mean the people with the actual hands on the keyboard,” Hultquist adds. “It speaks to the limited number of people in the field. We're still living in a world where talent is apparently limited to the point where we know the adversaries intimately.”

This Is the New Leader of Russia's Infamous Sandworm Hacking Unit

The threat of scammers using voice deepfakes in their cons is real, but researchers say old-school voice-impersonation attacks are still the more pressing concern.

Amid the generative-artificial-intelligence frenzy of the last few months, security researchers have been revisiting the concern that AI-generated voices, or voice deepfakes, have gotten convincing enough and easy enough to produce that scammers will start using them en masse. 

There have been a couple of high-profile incidents in recent years in which cybercriminals have reportedly used voice deepfakes of company CEOs in attempts to steal large amounts of money—not to mention that documentarians posthumously created voice deepfakes of Anthony Bourdain. But are criminals at the turning point where any given spam call could contain your sibling's cloned voice desperately seeking “bail money?" No, researchers say—at least not yet.

The technology to create convincing, robust voice deepfakes is powerful and increasingly prevalent in controlled settings or situations where extensive recordings of a person's voice are available. At the end of February, Motherboard reporter Joseph Cox published findings that he had recorded five minutes of himself talking and then used a publicly available generative AI service, ElevenLabs, to create voice deepfakes that defeated a bank's voice-authentication system. But like generative AI's shortcomings in other mediums, including limitations of text-generation chatbots, voice deepfake services still can't consistently produce perfect results. 

“Depending on the attack scenario, real-time capabilities and the quality of the stolen voice sample must be considered,” says Lea Schönherr, a security and adversarial machine learning researcher at the CISPA Helmholtz Center for Information Security in Germany. “Although it is often said that only a few seconds of the stolen voice are needed, the quality and the length have a big impact on the result of the audio deepfake.”

Digital scams and social engineering attacks like phishing are a seemingly ever-growing threat, but researchers note that scams have existed for decades in which attackers call a victim and attempt to impersonate someone the target knows—no AI necessary. The very fact of their longevity means that these hustles are at least somewhat effective at tricking people into sending attackers money.

“These scams have been around forever. Most of the time, it doesn’t work, but sometimes they get a victim who is primed to believe what they’re saying, for whatever reason,” says Crane Hassold a longtime social engineering researcher and former digital behavior analyst for the FBI. “Many times those victims will swear the person they were talking to was the impersonated person when, in reality, it’s just their brain filling in gaps.”

Hassold says that his grandmother was a victim of an impersonation scam in the mid-2000s when attackers called and pretended to be him, persuading her to send them $1,500.

“With my grandmother, the scammer didn’t say who was calling initially, they just started talking about how they had been arrested while attending a music festival in Canada and needed her to send money for bail. Her response was ‘Crane, is that you?’ and then they had exactly what they needed,” he says. “Scammers are essentially priming their victims into believing what they want them to believe.”

As with many social engineering scams, voice-impersonation cons work best when the target is caught up in a sense of urgency and just trying to help someone or complete a task they believe is their responsibility.

“My grandmother left me a voicemail while I was driving to work saying something like ‘I hope you’re OK. Don’t worry, I sent the money, and I won’t tell anyone,’” Hassold says.

Justin Hutchens, director of research and development at the cybersecurity firm Set Solutions, says he sees deepfake voice scams as a rising concern, but he's also worried about a future in which AI-powered scams become even more automated.

“I expect that in the near future, we will start seeing threat actors combining deepfake voice technology with the conversational interactions supported by large language models,” Hutchens says of platforms like Open AI's ChatGPT.

For now, though, Hassold cautions against being too quick to assume that voice-impersonation scams are being driven by deepfakes. After all, the analog version of the scam is still out there and still compelling to the right target at the right time.

AI-Generated Voice Deepfakes Aren’t Scary Good—Yet

Russia, North Korea, Iran, and China have been caught using fake profiles to gather information. But the platform’s tools to weed them out only go so far.

There is nothing immediately suspicious about Camille Lons’ LinkedIn page. The politics and security researcher’s profile photo is of her giving a talk. Her professional network is made up of almost 400 people; she has a detailed career history and biography. Lons has also shared a link to a recent podcast appearance—“always enjoying these conversations”—and liked posts from diplomats across the Middle East.

So when Lons got in touch with freelance journalist Anahita Saymidinova last fall, her offer of work appeared genuine. They swapped messages on LinkedIn before Lons asked to share more details of a project she was working on via email. “I just shoot an email to your inbox,” she wrote.

What Saymidinova didn’t know at the time was that the person messaging her wasn’t Lons at all. Saymidinova, who does work for Iran International, a Persian-language news outlet that has been harassed and threatened by Iranian government officials, was being targeted by a state-backed actor. The account was an imposter that researchers have since linked to Iranian hacking group Charming Kitten. (The real Camille Lons is a politics and security researcher, and a LinkedIn profile with verified contact details has existed since 2014. The real Lons did not respond to WIRED’s requests for comment.)

When the fake account emailed Saymidinova, her suspicions were raised by a PDF that said the US State Department had provided $500,000 to fund a research project. “When I saw the budget, it was so unrealistic,” Saymidinova says.

But the attackers were persistent and asked the journalist to join a Zoom call to discuss the proposal further, as well as sending some links to review. Saymidinova, now on high alert, says she told an Iran International IT staff member about the approach and stopped replying. “It was very clear that they wanted to hack my computer,” she says. Amin Sabeti, the founder of Certfa Lab, a security organization that researches threats from Iran, analyzed the fake profile’s behavior and correspondence with Saymidinova and says the incident closely mimics other approaches on LinkedIn from Charming Kitten.

The Lons incident, which has not been previously reported, is at the murkiest end of LinkedIn’s problem with fake accounts. Sophisticated state-backed groups from Iran, North Korea, Russia, and China regularly leverage LinkedIn to connect with targets in an attempt to steal information through phishing scams or by using malware. The episode highlights LinkedIn’s ongoing battle against “inauthentic behavior,” which includes everything from irritating spam to shady espionage. 

Missing Links

LinkedIn is an immensely valuable tool for research, networking, and finding work. But the amount of personal information people share on LinkedIn—from location and languages spoken to work history and professional connections—makes it ideal for state-sponsored espionage and weird marketing schemes. False accounts are often used to hawk cryptocurrency, trick people into reshipping schemes, and steal identities.  

Sabeti, who’s been analyzing Charming Kitten profiles on LinkedIn since 2019, says the group has a clear strategy for the platform. “Before they initiate conversation, they know who they are contacting, they know the full details,” Sabeti says. In one instance, the attackers got as far as hosting a Zoom call with someone they were targeting and used static pictures of the scientist they were impersonating.

The fake Lons LinkedIn profile, which was created in May 2022, listed the real Lons’ correct work and education histories and used the same image from her real Twitter and LinkedIn accounts. Much of the biography text on the fake page had been copied from profiles of the real Lons as well. Sabeti says the group ultimately wants to gain access to people’s Gmail or Twitter accounts to gather private information. “They can collect intelligence,” Sabeti says. “And then they use it for other targets.” 

The UK government said in May 2022 that “foreign spies and other malicious actors” had approached 10,000 people on LinkedIn or Facebook over 12 months. One person acting on behalf of China, according to court documents, found that the algorithm of one “professional networking website” was “relentless” in suggesting potential new targets to approach. Often these approaches start on LinkedIn but move to WhatsApp or email, where it may be easier to send phishing links or malware.

In one previously unreported example, a fake account connected to North Korea’s Lazarus hacking group, pretended to be a recruiter at Meta. They started by asking the target how their weekend was before inviting them to complete a programming challenge to continue the hiring process, says Peter Kalnai, the senior malware researcher at security firm ESET who discovered the account. But the programming challenge was a scam designed to deploy malware to the target’s computer, Kalnai says. The LinkedIn messages sent by the scammers didn’t contain many grammatical errors or other typos, he says, which made the attack more difficult to catch. “Those communications were convincing. No red flags in the messages.”

It’s likely that scam and spam accounts are much more common on LinkedIn than those connected to any nation or government-backed groups. In September last year, security reporter Brian Krebs found a flood of fake chief information security officers on the platform and thousands of false accounts linked to legitimate companies. Following the reporting, Apple and Amazon’s profile pages were purged of hundreds of thousands of fake accounts. But due to LinkedIn’s privacy settings, which make certain profiles inaccessible to users who don’t share connections, it’s difficult to gauge the scope of the problem across the platform. 

The picture gets clearer at an individual company level. An analysis of WIRED’s company profile in January showed 577 people listing WIRED as their current employer—a figure well above the actual number of staff. Several of the accounts appeared to use profile images generated by AI, and 88 profiles claimed to be based in India. (WIRED does not have an India office, although its parent company, Condé Nast, does.) One account, listed as WIRED’s “co-owner,” used the name of a senior member of WIRED’s editorial staff and was advertising a suspicious financial scheme. 

In late February, soon after we told LinkedIn about suspicious accounts linked to WIRED, approximately 250 accounts were removed from WIRED’s page. The total employee count dropped to 225, with 15 people based in India—more in line with the real number of employees. The purpose of these removed accounts remains a mystery.

“If people were using fake accounts to impersonate WIRED journalists, that would be a major issue. In the disinformation space, we have seen propagandists pretend to be journalists to gain credibility with their target audiences,” says Josh Goldstein, a research fellow with the CyberAI Project at Georgetown University’s Center for Security and Emerging Technology. “But the accounts you shared with me don’t seem to be of that type.” 

Without more information, Goldstein says, it’s impossible to know what the fake accounts linked to WIRED may have been up to. Oscar Rodriguez, LinkedIn’s vice president in charge of trust, privacy, and equity, says the company does not go into detail about why it removes specific accounts. But he says many of the accounts linked to WIRED were dormant. 

Fighting Fakes

In October 2022, LinkedIn introduced several features meant to clamp down on fake and scam profiles. These included tools to detect AI-generated profile photos and filters that flag messages as potential scams. LinkedIn also rolled out an “About” section for individual profiles that shows when an account was created and whether the account has been verified with a work phone number or email address. 

In its most recent transparency report, covering January to June 2022, LinkedIn said that 95.3 percent of the fake accounts it discovered were blocked by “automated defenses,” including 16.4 million that were blocked at the time of registration. LinkedIn’s Rodriguez says the company has identified a number of signs it looks for when hunting fake accounts. For instance, commenting or leaving messages with super-human speed—a potential sign of automation—might cue LinkedIn to ask the account to provide a state-issued ID and make the account inaccessible to other users.

Similarly, when an account is being created, a mismatch between its IP address and listed location wouldn’t automatically be a trigger—someone could be traveling or using a VPN—but it might be a “yellow flag,” Rodriguez says. If the account shares other characteristics with previously removed accounts from a particular region or set of devices, he adds, that might be a clearer signal that the account is fraudulent.

“For the very small percent of accounts that managed to interact with members, we retrace our steps to understand the common characteristics across the different accounts,” Rodriguez says. The information is then used to “cluster” groups of accounts that may be fraudulent. Sabeti says LinkedIn is “very proactive” when human rights or security organizations report suspicious accounts. “It’s good in comparison with the other tech companies,” he says.

In some cases, LinkedIn’s new defenses appear to be working. In December, WIRED created two fake profiles using AI text generators. “Robert Tolbert,” a mechanical engineering professor at Oxford University, had an AI-generated profile photo and a resume written by ChatGPT, complete with fake journal articles. The day after the account was created, LinkedIn asked for ID verification. A second fake profile attempt—a “software developer” with Silicon Valley credentials and no photo—also received a request for an ID the following day. Rodriguez declined to comment on why these accounts were flagged, but both accounts were inaccessible on LinkedIn after they received the request for ID.

But detecting fake accounts is tricky—and scammers and spies are always trying to stay ahead of systems designed to catch them. Accounts that slip past initial filters but haven’t started messaging other people—like many of the scam accounts claiming to be WIRED staff—seem to be particularly hard to catch. Rodriguez says dormant accounts are generally removed through user reports or when LinkedIn discovers a fraudulent cluster. 

Today, WIRED’s page is a fairly accurate snapshot of its current staff. The fake Camille Lons profile was removed after we began reporting this story—Rodriguez did not say why. But in a process similar to the Lons impersonators, we conducted one additional experiment to try to slip past LinkedIn’s filters. 

With his permission, we created an exact duplicate of the profile for Andrew Couts, the editor of this story, only swapping out his photo for an alternative. The only contact information we provided when creating the account was a free ProtonMail account. Before we deleted the account, Fake Couts floated around on LinkedIn for more than two months, accepting connections, sending and receiving messages, browsing job listings, and promoting the occasional WIRED story. Then, one day, Fake Couts received a message from a marketer with an offer that seems too good to be true: a custom-built “professional WordPress website at no cost.”

A Spy Wants to Connect With You on LinkedIn

From US state laws to the international stage, definitions of “cybercrime” remain vague, broad, and increasingly entrenched in our legal systems.

Some state anti-hacking laws are even broader than the CFAA, says Crocker, the EFF attorney. California Penal Code Section 502, which Crocker describes as “pretty typical” of state-level cybercrime laws, includes language similar to the CFAA’s vague “unauthorized access” prohibition. But it also stipulates that someone who “knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network” may have broken state law. 

Crocker says the EFF has argued against prosecutions where the only alleged criminal activity that occurred under Section 502 was the defendant downloading publicly accessible data that the owner of the data failed to keep private—a common activity among security researchers and journalists.

All of these broadly worded state-level cybercrime statutes can lead to over-criminalization, says Nellie King, president of the National Association of Criminal Defense Lawyers. It becomes particularly problematic when there’s little clarity about when an activity crosses the line from legal to illegal. Laws against “cyber-stalking” are a good example, King says. “I can’t tell you how many of those cases where I have to go in and say, ‘This is not stalking. This is being annoying.’” 

In addition to vague laws, cybercrime statutes are sometimes essentially duplicates of other laws on the books, which means people can be charged twice for the same act—a “double counting of crime,” says Crocker. For example, prosecutors could “charge someone with the underlying crime of fraud but then enhance it with another crime of fraud conducted over the internet where there's no harm to the actual computers or networks,” he says. King agrees, adding that states can tack on additional “cyber-related” charges “to get the sentencing jacked.”

Finally, unlike the CFAA, many state cybercrime laws have not been heavily tested by the courts, says Crocker, which leaves them open to broader interpretation. “Most states have relatively sparse case law on their state hacking law,” he says, “so you have … laws without a lot of interpretation, which is a very risky area for individuals who risk running afoul of these laws.”

Rushing Into the Void

The solution to vague, expansive cybercrime legislation is to craft legal definitions that are limited to “cyber-dependent” activities, experts say. “If ‘cybercrime’ is going to mean anything, it has to be specifically limited to crimes done to computer systems and networks using computer systems and networks,” Crocker says. “In other words, it has to be the kind of crime that could not exist if this technology did not exist. ‘Cybercrime’ can't just be any bad thing done using a computer.”

Of course, amending the mountain of US state and federal cybercrime laws is unlikely to happen, Crocker says. Even just the CFAA, which Congress could update at any time, remains largely unchanged despite several attempts to amend the law. The greatest opportunity to prevent further expansion of over-criminalization through cybercrime laws now is with the UN treaty. But even with support from many member nations to limit the list of crimes covered by the treaty to “cyber-dependent” ones, and concerted efforts from civil liberties groups to exclude offenses committed unintentionally or without causing serious harm and to add safeguards against abuse, Article 19’s Gutiérrez remains skeptical.

“The probability that we get this, I think, is very low,” Gutiérrez says.

Still, the treaty’s negotiations are ongoing, with the Ad Hoc Intergovernmental Committee scheduled to meet for the fifth round of negotiations in mid-April and the sixth round in late summer. The final text of the treaty is expected to be completed by February 2024—a tight time frame that Gutiérrez says could cause trouble for an international agreement of this complexity, magnitude, and consequence.

The speed of the negotiations means there is little time to bring the treaty’s language more in line with what civil liberties and human rights groups say is essential. In fact, it could lead to a country like Russia or China slipping in language at the last minute that would be even more detrimental to what’s already in the negotiating document—something that reportedly happened during the fourth negotiating session in January. “The truth is that the issues are so complex, they are so technical, and there's very little time to negotiate all this,” Gutiérrez says. “So there’s no question some of this language will get into the treaty, because it's not just overlooked—the process is really, really being super rushed.”

The World’s Real ‘Cybercrime’ Problem

With victims refusing to pay, cybercriminal gangs are now releasing stolen photos of cancer patients and sensitive student records.

In February, attackers from the Russia-based BlackCat ransomware group hit a physician practice in Lackawanna County, Pennsylvania, that's part of the Lehigh Valley Health Network (LVHN). At the time, LVHN said that the attack “involved” a patient photo system related to radiation oncology treatment. The health care group said that BlackCat had issued a ransom demand, “but LVHN refused to pay this criminal enterprise.” 

After a couple of weeks, BlackCat threatened to publish data stolen from the system. “Our blog is followed by a lot of world media, the case will be widely publicized and will cause significant damage to your business,” BlackCat wrote on their dark-web extortion site. “Your time is running out. We are ready to unleash our full power on you!” The attackers then released three screenshots of cancer patients receiving radiation treatment and seven documents that included patient information.

The medical photos are graphic and intimate, depicting patients' naked breasts in various angles and positions. And while hospitals and health care facilities have long been a favorite target of ransomware gangs, researchers say the situation at LVHN may indicate a shift in attackers' desperation and willingness to go to ruthless extremes as ransomware targets increasingly refuse to pay.

 “As fewer victims pay the ransom, ransomware actors are getting more aggressive in their extortion techniques,” says Allan Liska, an analyst for the security firm Recorded Future who specializes in ransomware. “I think we’ll see more of that. It follows closely patterns in kidnapping cases, where when victims’ families refused to pay, the kidnappers might send an ear or other body part of the victim.”

Researchers say that another example of these brutal escalations came on Tuesday when the emerging ransomware gang Medusa published sample data stolen from Minneapolis Public Schools in a February attack that came with a $1 million ransom demand. The leaked screenshots include scans of handwritten notes that describe allegations of a sexual assault and the names of a male student and two female students involved in the incident.

“Please note, MPS has not paid a ransom,” the Minnesota school district said in a statement at the beginning of March. The school district enrolls more than 36,000 students, but the data apparently contains records related to students, staff, and parents dating back to 1995. This week, Medusa posted a 50-minute-long video in which attackers appeared to scroll through and review all the data they stole from the school, an unusual technique for advertising exactly what information they currently hold. Medusa offers three buttons on its dark-web site, one for anyone to pay $1 million to buy the stolen MPS data, one for the school district itself to pay the ransom and have the stolen data deleted, and one to pay $50,000 to extend the ransom deadline by one day.

“What’s notable here, I think, is that in the past the gangs have always had to strike a balance between pressuring their victims into paying and not doing such heinous, terrible, evil things that victims don’t want to deal with them,” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “But because targets are not paying as often, the gangs are now pushing harder. It's bad PR to have a ransomware attack, but not as terrible as it once was—and it's really bad PR to be seen paying an organization that does terrible, heinous things.”

The public pressure is certainly mounting. In response to the leaked patient photos this week, for example, LVHN said in a statement, “This unconscionable criminal act takes advantage of patients receiving cancer treatment, and LVHN condemns this despicable behavior.”

The FBI Internet Crime Complaint Center (IC3) said in its annual Internet Crime Report this week that it received 2,385 reports about ransomware attacks in 2022, totaling $34.3 million in losses. The numbers were down from 3,729 ransomware complaints and $49 million in total losses in 2021. “It has been challenging for the FBI to ascertain the true number of ransomware victims as many infections go unreported to law enforcement,” the report notes.

But the report specifically calls out evolving and more aggressive extortion behavior. “In 2022, the IC3 has seen an increase in an additional extortion tactic used to facilitate ransomware,” the FBI wrote. “The threat actors pressure victims to pay by threatening to publish the stolen data if they do not pay the ransom.”

In some ways, the change is a positive sign that efforts to combat ransomware are working. If enough organizations have the resources and tools to resist paying ransoms, attackers eventually may not be able to generate enough revenue and, ideally, would abandon ransomware entirely. But that makes this shift toward more aggressive tactics a precarious moment. 

“We really haven’t seen things like this before. Groups have done unpleasant things, but it was adults that were targeted, it wasn’t sick cancer patients or school kids,” Callow says. “I hope that these tactics will bite them in the butt and that companies will say no, we cannot be seen funding an organization that does these heinous things. That’s my hope anyway. Whether they will react that way remains to be seen.”

Ransomware Attacks Have Entered a ‘Heinous’ New Phase

Plus: A data breach exposes Washington, Ring camera footage has a new problem, and the George Santos scandal slips into the world of cybercrime.

In a statement released a day before the investigation’s release, Jayd Henricks, the group’s president, said, “It isn't about straight or gay priests and seminarians. It’s about behavior that harms everyone involved, at some level and in some way, and is a witness against the ministry of the church.”

No national US data privacy laws prohibit the sale of this kind of data.

On Wednesday, the District of Columbia’s health insurance exchange confirmed that it was working with law enforcement to investigate an alleged leak after a database containing personal information of about 170,000 individuals was offered for sale on a hacker forum popular with cybercriminals. The reported breach in DC Health Link, as the exchange is known, could expose sensitive personal data of lawmakers, their employees, and their families. Thousands of the exchange’s participants work in the US House and Senate, and a sample of the stolen data set reviewed by CyberScoop indicates that the victims of the breach also range from lobbyists to coffee shop employees. 

According to a letter to the head of the DC Health Benefit Exchange Authority from House Speaker Kevin McCarthy and Minority Leader Hakeem Jeffries, the FBI has apparently purchased some of the stolen data from the dark web. While the FBI had not yet determined the extent of the breach, according to the letter, “the size and scope of impacted House customers could be extraordinary.”

A report by Politico published March 7 details how Ring, Amazon’s home-surveillance company, handed law enforcement videos captured by an Ohio man’s 20 Ring cameras against his will. In December, the Hamilton Police Department sought a warrant for camera footage—including from inside the man’s house—while investigating his neighbor. According to the report, after he willingly providing video to the police that showed the street outside his home, police used the courts to access more footage against his will.

While law enforcement often seeks warrants for digital data, those warrants typically pertain to the subject of a particular investigation. However, as networked home surveillance cameras have become increasingly popular, sometimes blanketing city blocks, law enforcement is increasingly turning to individuals who are completely unaffiliated with a case to provide data. According to Politico, the lack of legal controls on what police can ask for opens the door for a bystander’s indoor home footage to be lawfully acquired by police.

Following Politico's story, Gizmodo reported that a customer service agent for Ring told a concerned customer that the Politico story was a “hoax” perpetrated by a competitor. In response, an Amazon spokesperson told Gizmodo that the company does not in fact think the story was a hoax and the statement was the result of a misunderstanding on the part of the customer support agent. “We will ensure the agent receives the appropriate coaching,” the spokesperson said.

A former roommate of noted fabulist George Santos told federal authorities that the US congressman from Long Island, New York, had orchestrated a credit card skimming operation in Seattle in 2017. In a declaration submitted to authorities and obtained by Politico, the Brazilian man—convicted of credit card fraud and deported from the US—told the FBI, “Santos taught me how to skim card information and how to clone cards. He gave me all the materials and taught me how to put skimming devices and cameras on ATM machines.” 

According to the declaration, Gustavo Ribeiro Trelha met Santos in 2016 when he rented a room from him in his Florida apartment. There Santos reportedly taught Trelha how to use credit card cloning equipment and eventually flew him to Seattle to begin stealing financial information. “My deal with Santos was 50 percent for him, 50 percent for me,” Trelha wrote.

How a Catholic Group Doxed Gay Priests

The FBI’s latest Internet Crime Report highlights the stunning rise of investment-themed crimes over the past 18 months.

For seven years, the FBI's Internet Crime Complaint Center (IC3) has tallied the reports the US law enforcement agency receives about all different types of digital crime, and it has consistently found that business email compromise (BEC) scams resulted in the highest total losses each year. But in its latest Internet Crime Report, released today for incidents in 2022, “investment” scams have overtaken all others as the biggest digital threat, with $3.3 billion in losses last year.

IC3 reported that BEC—in which attackers trick businesses into making bogus payments or intercept legitimate payments—resulted in nearly $2.4 billion worth of losses in 2021 and $2.7 billion in 2022. In other words, those attacks are still a significant and rising threat. But investment scams, particularly those that claim to offer a path for cryptocurrency investment, have exploded over the past 18 months. They have been particularly fueled by so-called “pig butchering” scams, in which attackers cold-contact a target via texts or other messaging platforms, start a conversation to build trust, and then say they can help the individual get in the door on a lucrative investment deal.

The $3.31 billion of overall investment scam losses in 2022 compares with $1.45 billion in 2021, an increase of 127 percent. And the FBI notes that cryptocurrency investment scams specifically caused losses of $2.57 billion in 2022, up from $907 million in 2021—an increase of 183 percent. 

In 2021, IC3 tracked pig-butchering attacks by that name and categorized them under the umbrella of “romance scams” rather than cryptocurrency scams, citing $429 million in losses related to pig butchering that year. In the new report, IC3 doesn't mention the phrase “pig butchering” but says in an appendix that “one complaint may have multiple crime types.”

The figures seem to reflect IC3's efforts to quickly adjust its understanding of how these scams are operating amidst pig butchering's sudden rise. But it's hard to get a definitive picture, since it depends on how you categorize the different types of scams. For example, romance scams (also called “confidence fraud”) dropped from 24,299 complaints in the 2021 report to 19,021 in 2022. The associate losses dropped from $956 million to $736 million. But the US Federal Trade Commission said last month that it had received reports of close to 70,000 romance scams in 2022 and losses of $1.3 billion. 

“Crypto-investment scams saw unprecedented increases in the number of victims and the dollar losses to these investors,” the FBI wrote in the 2022 Internet Crime Report. “Many victims have assumed massive debt to cover losses from these fraudulent investments.”

Researchers who have been tracking pig butchering say the trend is unmistakable. In recent research by the security firm Sophos, for example, senior threat researcher Sean Gallagher tracked one criminal campaign that originally appeared to have amassed about $500,000 worth of stolen cryptocurrency in one month. After continuing to investigate and identifing more wallets linked to the attackers, though, Gallagher concluded that the gang had stolen about $3 million over five months.

“This is one of the craziest times I’ve ever seen,” says Ronnie Tokazowski, a longtime researcher and principal threat adviser at the cybersecurity firm Cofense. “BEC has been number one for seven years in a row, and we as a society struggled to get our heads around the BEC stuff when it was primarily coming from West Africa. Now we’re seeing a shift to an entirely different geography, with most pig-butchering attacks coming out of Southeast Asia. It's concerning that now we have two geographies and billions of dollars in losses to deal with.”

In addition to BEC and investment scams, IC3 counted 2,385 complaints about ransomware in 2022 totaling $34.3 million in losses, down from 3,729 ransomware reports in 2021 that resulted in $49 million in losses. 

The FBI is always quick to emphasize that the numbers in IC3 reports likely undercount real totals, as it depends on victims from all over the world voluntarily reporting their experiences. This means that increases and decreases can't be assumed to correspond perfectly with the true numbers, which are unknown. But researchers say that IC3 data are a useful and valuable indicator. It's striking, for example, that the rise in investment scam losses came in a year when the FBI received 5 percent fewer reports overall than the previous year—800,944 complaints in 2022, down from 847,376 in 2021.

“Though cybercriminals are continuously seeking to make their attacks more resilient, more disruptive, and harder to counter, public reporting to the IC3 helps us gain a better understanding of the threats we face daily,” Timothy Langan, the FBI's executive assistant director, wrote in the report. “As these threats increase, we continue to encourage victims to report cyber incidents and cyber-enabled frauds to the FBI so that we may impose risks and consequences on malicious cyber actors.”

Source

Wired