IN THIS ARTICLE, YOU WILL LEARN: NFT-focused news website NFTEvening and the NFT market’s data and analytics-based platform…

**IN THIS ARTICLE, YOU WILL LEARN:**

*   **Study Overview**: NFTEvening and Storible collaborated on a study to test whether AI, specifically Long Short-Term Memory (LSTM) networks, can recover missing cryptocurrency seed phrases by analyzing 85.7 million combinations using the BIP39 word list.

*   **AI’s Capabilities**: The neural network, trained for 30 days, achieved a prediction rate of 994,051 guesses per second. It could recover one missing word in 0.02 seconds, two words in 29 seconds, and three words in 2.28 hours. Recovery of up to four words required 178 hours, with recovery times increasing exponentially for more missing words.

*   **LSTM Functionality**: LSTMs are a type of RNN that excels in sequential data processing, using memory cells and gates to predict and complete patterns in text-like data, making them suitable for seed phrase prediction.

*   **Security of Crypto Seed Phrases**: Despite AI’s advancements, the massive number of possible seed phrase combinations makes it practically impossible for AI to recover enough words to breach cryptocurrency wallets. For example, cracking eight missing words would take 174 times the universe’s age.

*   **Conclusion and Disclaimer**: The study shows that AI is not a current threat to cryptocurrency seed phrase security if the phrase remains secret. However, these findings are based on current AI capabilities and computational limits.

NFT-focused news website NFTEvening and the NFT market’s data and analytics-based platform Storible collaborated to conduct a study to investigate whether powerful AI, specifically a type called Long Short-Term Memory (LSTM), can crack cryptocurrency seed phrases. 

For this research, they analysed 85,714,285 seed phrase combinations using 2048 words from the BIP39 word list to determine the time it takes for AI to recover missing crypto seed phrases and the feasibility of LSTM networks in recovering lost or incomplete cryptocurrency phrases.

For this, a neural network was trained on a cloud-based server for 30 days to predict seed phrases and estimate recovery time. The model used LSTM architecture, achieving an average prediction rate of 994,051 guesses per second. The recovery time was analyzed using scenarios from one to twelve missing words.

The results showed that AI could retrieve one missing word in 0.02 seconds, two words in 29 seconds, three words in 2.28 hours, and up to four words in a max recovery time of 178. Moreover, AI can discover the correct seed phrase sequence of 12 words in just 8 minutes, whereas the time needed to recover 8 missing words from a seed phrase is 174 times longer than the universe’s current age.

****What is LSTM?****

For your information, a seed phrase is like a secret password for your cryptocurrency. It is a list of 12-24 words that gives you access to your digital wallet.

LSTM networks are Recurrent Neural Networks (RNN) that excel in remembering information over extended sequences. They incorporate memory cells and gates to control information flow, allowing them to effectively learn and predict patterns in sequential data like text and time series.

****How LSTMs Work in Seed Phrase Recovery****

LSTMs can predict the next likely word in a sequence or complete missing words by observing patterns in known seed phrases. Memory cells store crucial information, with three gates – forget, input, and output – regulating the flow of information. The forget gate discards irrelevant information, the input gate determines new information, and the output gate controls the next word prediction.

The researchers tried to use this AI to guess missing words in seed phrases. They tested it on millions of possible combinations. They found that even with this powerful AI, it would take an incredibly long time, longer than the universe’s age, to guess enough words to steal someone’s cryptocurrency.

The research indicates that AI is not a threat to your cryptocurrency if you keep your seed phrase secret. While AI may eventually crack seed phrases, it is currently highly secure. Though LSTMs offer powerful capabilities for sequence learning, the sheer number of possible combinations and the inherent complexity of seed phrase structures make successful recovery highly improbable.

_**Disclaimer:** This analysis provides an estimate based on current AI capabilities and computational power._

1.  AI-based Model to Predict Extreme Wildfire Danger
2.  Are We on the Brink of Saying Goodbye to Passwords?
3.  Google’s Gemini AI Chatbot Keeps Telling Users to Die
4.  Guessing passcode “just from the way we tilt our phone”
5.  unCAPTCHA algorithm Crack Google’s AI System reCAPTCHA

Study Finds AI Can Guess Crypto Seed Phrases in 0.02 Seconds

Secure Gaming during holidays is essential as cyberattacks rise by 50%. Protect accounts with 2FA, avoid fake promotions,…

Secure Gaming during holidays is essential as cyberattacks rise by 50%. Protect accounts with 2FA, avoid fake promotions, use secure downloads, and trust verified tools to enjoy safe, uninterrupted gameplay.

The holiday season is a time of joy for gamers, with more free time to play, exciting events, and in-game promotions. However, this festive period comes with higher risks of cyberattacks than any other period of the year.

Studies by Wowvendor, a company dealing in WoW services, indicate that hackers increase their activity by 50% during the holidays and especially prey on gamers via malware and phishing. This article will detail these risks and give some useful advice on how to enjoy gaming without compromising your account security.

****The Rise of Cyber Threats During Holidays****

The gaming community gets busy during the holidays. Unfortunately, cybercriminals find this an attractive target. The key reasons for increased risks are as follows:

*   **Increased player traffic** – A large consumer base of online gaming creates, in turn, more opportunities for hackers to exploit vulnerabilities.
*   **Attractive holiday promotions** – Many players get tricked into fake giveaways and deals, without knowing it compromises their data security.
*   **Malware in pirated games** – Most of the time, hackers put harmful software inside cracked versions of popular titles.

For instance, cybersecurity companies have informed that the number of phishing emails with “in-game rewards notifications” and “discount offers” have spiked around the times of past holiday seasons. These examples of threats put the importance of vigilance during peak gaming hours deeper into focus.

****Common Cyber Threats to Gamers****

Cyber threats range from gaming cyber attacks and data security incidents to DDoS attacks. This will likely impact some players more and possibly their performance during peak gaming periods. Understanding these dangers can help players stay protected:

****Fake add-ons, mods and Phishing schemes** **

Hacks through counterfeit mods are common in games such as World of Warcraft. Hackers distribute these infected mods using counterfeit mods and give the malware the chance to steal login credentials or infect the device they’re playing on. Additionally, fraudulent links and websites trick people into providing personal information or downloading malicious software.

****DDoS attacks** **

The gaming industry is seeing a lot of DDoS attacks (distributed denial of service attacks), wherein hacker group gets a network of infected devices (botnet) that perform a network DDoS attack to inundate a game server or a group of players with a massive amount of traffic. This overload disrupts the server or network connection and has broken the game so that normal users can’t even get in.

These attacks send many requests and place a heavy load onto the server. Hackers aim at certain players’ IP addresses and try to degrade their connection, or that of the player behind it, to give themselves an in-game advantage. This type of targeted interference disrupts competitive gameplay and can negatively impact a game’s experience for the player.

Additionally, the number of ransomware attacks against gaming accounts has risen as well. They involve locking players out of their accounts and asking for payment to access them. When you are faced with unfamiliar software or links, it’s best to stay awake and alert to risks.

****Best Practices for Secure Gaming****

A large number of cyber attacks on gamers can stem from unauthorized downloads, according to leading cyber security firm Kaspersky. To enjoy your games safely during the holidays, follow these cybersecurity tips:

*   **Download software from official sources** — Do not download games or updates from untrusted websites — they can hide malware.
*   **Use two-factor authentication (2FA)** — It simply gives you extra protection for your gaming accounts.
*   **Verify promotional offers** — Don’t accept offers that are simply too good even to be true. There are always official channels for you to confirm their legitimacy.
*   **Avoid cracked games** — First and foremost pirated games are illegal, and they’re dangerous for security reasons too.

Working with your use of strong, unique passwords across all your accounts, these measures can go a long way toward mitigating your risk of being victimized in this way.

****The Role of Gaming Companies****

Leading gaming companies have stepped up their efforts to combat cyber threats. Their initiatives include:

*   **Enhanced security systems** – AI detecting and blocking unusual activity on gaming networks.
*   **Regular updates and patches** – Time and time again, developers release updates to patch vulnerabilities, and protect players with updates.
*   **Player education** – Many platforms offer users a way of recognizing and preventing scammers.

For instance, World of Warcraft’s creators, Blizzard Entertainment, is constantly monitoring its ecosystem for threats and expelling them while at the same time urging players to use solutions, for example, 2FA. Machine learning has been introduced into other companies, such as Valve and Riot Games, in an attempt to detect possible hacking through in-game behaviours.

****Advanced Cybersecurity Tools for Gamers****

Gamers now have access to cutting-edge cybersecurity solutions tailored to safeguard their online experience:

*   **Gaming-optimized VPNs** – VPN services will make sure that you have safe, encrypted connections while reducing latency and optimizing the routing of the server. It shields against DDoS attacks and keeps the gameplay smooth.
*   **Anti-phishing extensions** – Google Safe Browsing and Microsoft Defender SmartScreen are tools that actively block malicious sites and alert players that a phishing page is attempting to lure them into a trick.
*   **Behavioural analytics and anti-cheat systems** – Dedicated platforms use machine learning to analyze login patterns and in-game behaviour, detecting anomalies like hacking or unauthorized access.
*   **DDoS mitigation services** – Distribution denial-of-service attacks that cause gaming servers to stop working are identified and neutralized by Cloudflare, Akamai Prolexic, and other companies that protect gaming servers so that gamers can continue enjoying online sessions uninterrupted.

With these state-of-the-art tools, gamers will be protected from changing threats, which will protect gaming for the holidays and beyond.

****Stay on the Safe Side****

The holiday season is a wonderful opportunity to connect with your favourite games and communities. While cyber threats do increase during this period, staying informed and adopting secure practices can protect your gaming experience. From using official platforms to enabling two-factor authentication, every step you take helps reduce risks.

Gaming companies are also playing their part by providing services and insights that enhance player safety. By working together and staying alert, gamers can fully embrace the holiday spirit, free from cybersecurity concerns.

1.  What is Blockchain Gaming and its Play-to-Earn Model?
2.  Exploring Data Privacy and Security in B2B Gaming Data
3.  The Rise of Blockchain Gaming and Secure Marketplaces
4.  Winos4.0 Malware Targeting Windows via Fake Gaming Apps
5.  Gcore Thwarts 500 Million PPS DDoS Attack on Gaming Company

Secure Gaming During the Holidays

The US water sector suffered a stream of cyberattacks over the past year and half, from a mix of cybercriminals, hacktivists, and nation-state hacking teams. Here's how the industry and ICS/OT security experts are working to better secure vulnerable drinking and wastewater utilities.

Source: Vyacheslav Lopatin via Alamy Stock Photo

The unprecedented wave of high-profile cyberattacks on US water utilities over the past year has just kept flowing.

In one incident, pro-Iranian hackers penetrated a Pittsburgh-area water utility's PLC and defaced the touchscreen with an anti-Israel message, forcing the utility to revert to manual control of its water pressure-regulation system. A water and wastewater operator for 500 North American communities temporarily severed connections between its IT and OT networks after ransomware infiltrated some back-end systems and exposed its customers' personal data. Customer-facing websites and the telecommunications network at the US's largest regulated water utility went dark after an October cyberattack.

Those were just some of the more chilling stories that have recently sparked fear over the security and physical safety of drinking water and wastewater systems. The cyberattacks have spurred warnings and security guidelines from the Cybersecurity and Infrastructure Security Agency (CISA), the White House, the FBI and the Office of the Director of National Intelligence (ODNI), the Environmental Protection Agency (EPA), and the Water ISAC (Information Sharing and Analysis Center).

Most of the attacks landed on the softest of targets, small water utilities without security expertise and resources, in mainly opportunistic attacks. Meanwhile, cyberattacks on large utilities like Veolia and American Water hit IT, not OT, systems — none of which actually disrupted water services. Overall, the cyberattacks on water appeared to be mainly about "poking around and eroding confidence," says Gus Serino, president of I&C Secure and a former process control engineer for the Massachusetts Water Resources Authority.

Related:IoT Cloud Cracked by 'Open Sesame' Over-the-Air Attack

The race is now on to secure the water sector — especially the smaller more vulnerable utilities — from further cyberattacks. Many larger water utilities already have been "stepping up their game" in securing their OT networks, and others started building out their security infrastructures years ago, notes Dale Peterson, president of ICS/OT security consultancy Digital Bond. "My first client in 2000 was a water utility," he recalls. "Some \[large utilities\] have been working on this for a very long time."

The challenge lies in securing smaller utilities, without overprescribing them with unnecessary and high-overhead security infrastructure. Tools that require expertise and overhead are a nonstarter at sites where there isn't even dedicated IT support, much less cyber know-how. Peterson argues that government recommendations for sophisticated security monitoring systems are just plain overkill for most small utilities. These tiny outfits have bigger and more tangible priorities, he says, like replacing aging or damaged pipes in their physical infrastructure.

Related:Frenos Takes Home the Prize at 2024 DataTribe Challenge

**ICS/OT Cyber-Risk: Something in the Water?**

Like other ICS/OT industries, water utilities of all sizes have been outfitting once-isolated programmable logic controller (PLC) systems and OT equipment with remote access, so operators can more efficiently monitor and manage plants from afar — to control water pumps or check alarms, for instance. That has put traditionally isolated equipment at risk.

"They are starting and stopping pumps, setting changes, responding to alarms or failures \[in\] a system. They remote in to look at SCADA/HMI screens to see what's wrong or to take corrective action," explains I&C Secure's Serino, who works closely with water utilities. He says it's rare for those systems to be properly segmented, and VPNs are "not always" used for secure remote access.

PLC vendors such as Siemens are increasingly building security features into their devices, but water plants don't typically run this next-generation gear.

"I have yet to see any secure PLCs deployed" in smaller water sites, Serino says. "Even if there are new PLCs, their security features are not 'on.' So if you \[an attacker\] can get in and get access to the device on that network, you can do whatever you are capable of doing to a PLC."

Related:20% of Industrial Manufacturers Are Using Network Security as a First Line of Defense

Because many ICS/OT systems integrators that install OT systems traditionally do not also set up security for the equipment and software they install in water utility networks, these networks often are left exposed, with open ports or default credentials. "We need to help integrators making \[and installing\] SCADA equipment for these utilities make sure they are secured" for utilities, says Chris Sistrunk, technical leader of Google Cloud Mandiant's ICS/OT consulting practice and a former senior engineer at Entergy. 

Default credentials are one of the most common security weaknesses found in OT networks, as well as industrial devices sitting exposed on the public Internet. The Iranian-based Cyber Av3ngers hacking group easily broke into the Israeli-made Unitronics Vision Series PLCs at the Aliquippa Municipal Water Authority plant (as well as other water utilities and organizations), merely by logging in with the PLCs' easily discoverable factory-setting credentials.

The good news is that some major systems integrators such as Black & Veatch are working with large water utilities on building security into their new OT installations. Ian Bramson, vice president of global industrial cybersecurity at Black & Veatch, says his team works with utilities that consider security a physical safety issue. "They are looking to build \[security\] in and not bolt it in," he explains, to prevent any physical safety consequences from poor cybersecurity security controls.

**Cybersecurity Cleanup for Water**

Meanwhile, there are plenty of free cybersecurity resources for resource-strapped water utilities, including the Water-ISAC's top 12 Security Fundamentals and the American Waterworks Association (AWWA)'s free security assessment tool for water utilities that helps them map their environments to the NIST Cybersecurity Framework. Kevin Morley, manager of federal relations for the AWWA and a utility cybersecurity expert, says the tool includes a survey of the utility's technology and then provides a priority list of the security controls the utility should adopt and address, focusing on risk and resilience.

"It creates a heat map" of where the utility's security weaknesses and risks lie, he says. That helps arm a utility with a cybersecurity business case in the budget process. "They can go to leadership and say 'we did this analysis and this is what we found,'" he explains.

There's also a new cyber volunteer program that assists rural water utilities. The National Rural Water Association recently teamed up with DEF CON to match volunteer cybersecurity experts to utilities in need of cyber help. Six utilities in Utah, Vermont, Indiana, and Oregon encompass the initial cohort for the bespoke DEF CON Franklin project, where volunteer ICS/OT security experts will assess their security posture and help them secure and protect their OT systems from cyber threats.

Mandiant's Sistrunk, who serves as a volunteer cyber expert for some small utilities, points to three main and basic security steps small (and large) utilities should take to improve their defenses: enact multifactor authentication, especially for remote access to OT systems; store backups offline or with a trusted third party; and have a written response plan for who to call when a cyberattack hits.

Serino recommends a firewall as well. "Get a firewall if you don't have one, and have it configured and locked down to control data flows in and out," he says. It's common for firewalls at a water utility to be misconfigured and left wide open to outgoing traffic, he notes: "If an adversary can get in, they could establish their own persistence and command and control, so hardening up the perimeter" for both outgoing and ingoing traffic is important.

He also recommends centralized logging of OT systems, especially for larger water utilities with the resources to support logging and detection operations: "Have the ability to detect a problem so you can stop it before it reaches the end goal of causing an impact."

**About the Author**

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Hackers Are Hot for Water Utilities

The work on quantum computing hit some major milestones in 2024, making the path to a workable quantum computer seem closer than ever. Google, Microsoft, and other research efforts hit significant milestones this year, but is the cybersecurity world ready?

Source: Marko Aliaksandr via Shutterstock

The quest to create a useful quantum computer reached a significant milestone at the end of 2024 with Google's announcement of its Willow chip. The chip promises reduced noise and fewer errors as the number of qubits grows — a necessary step to advance toward advanced quantum computing. Despite some debate on when these systems will actually become available, experts still advise making plans and migrating to post-quantum technologies.

The shift from today's technology, where adding more qubits adds more noise, to a future where increasing the number of qubits exponentially reduces the amount of noise — an achievement known as "threshold scalability" — conquers a major impediment to quantum computers. Creating a 1,000-qubit quantum computer requires foundational advancements beyond today's noisy intermediate-scale quantum (NISQ) computers to create reliable logical qubits that can be used in easily scaled architectures.

The Google announcement marks "a significant leap forward," says Karl Holmqvist, founder and CEO at Lastwall, an identity services provider focused on quantum resilience.

"Companies should be starting to get concerned about a usable quantum computer now," Holmqvist says. "This is not because there is proof of a cryptographically relevant quantum computer yet. It is because there are active campaigns that are currently taking place to capture encrypted data and store it until there is a system that can break our asymmetric encryption."

Related:Dark Reading Confidential: Quantum Has Landed, So Now What?

The threat posed by quantum computers seems to be becoming more real every day. In addition to Google's Willow chip announcement, Microsoft announced in November that it had reached a 24-qubit milestone with Atom Computing using lasers, while Japanese researchers from the Riken Quantum Computer Research Center announced a "general-purpose" optical quantum computer.

The future implications could be dire. The Hudson Institute, a free-market think tank, warns that quantum computers pose a systemic cyber-risk to financial systems; it published two papers describing risks of disruption to the US financial system and cryptocurrencies.

**Less Than a Decade Away?**

Quantum computing is one of those technologies that many have perennially predicted is only a decade away. Currently, the median estimate among experts is that within 15 years, a quantum computer will be able to break RSA-2048 in 24 hours, according to the "Quantum Threat Timeline Report 2024."

The middle-of-the-road estimate of when quantum computers will pose an encryption threat is less than 15 years. Source: Global Risk Institute

While many experts see the possibility of a useful quantum computer in less than a decade — based on three key areas: hardware progression, error correction, and algorithm development — useful quantum computers still have a long way to go before they become possible. For example, while Google's work on Willow is a major step toward making error correction — mainly a theoretical field before this decade — more achievable in larger quantum computing chips, achieving this step is just the second milestone out of six listed on its quantum computer road map.

Related:Quantum Leap: Advanced Computing Is a Vulnerable Cyber Target

In addition, gauging the risk is difficult, with terms such as "threshold scalability" and "quantum supercomputers" muddying the waters, says Rebecca Krauthamer, co-founder and CEO of QuSecure.

"There's so much complicated vocabulary when it comes to quantum, the thing that people need to look out for is when they start seeing quantum computers beginning to solve problems that they recognize," Krauthamer says. "So whether it's improved battery technology, or route optimization for self-driving cars, or optimized portfolio management, or breaking encryption — that's the time everybody should have already migrated to post-quantum technologies, and not just post-quantum but crypto-agile management of cryptography."

Yet the lack of significant benefits for the private sector could put a damper on development. The Boston Consulting Group, for example, points out that quantum computing programs have had difficulty converting effort into value.

"Quantum computing today provides no tangible advantage over classical computing in either commercial or scientific applications," BCG stated in a July analysis. "Though experts agree that there are clear scientific and commercial problems for which quantum solutions will one day far surpass the classical alternative, the newer technology has yet to demonstrate this advantage at scale."

**Experts Still Urge Preparation**

In addition, the point at which nation-states could use quantum computers to break encryption could be sooner, increasing the risk for some industries. Quantinuum, for example, accelerated its road map for fully fault-tolerant quantum computing to 2030 and warns that quantum secure solutions will likely be necessary before 2035.

"Given where we stand today, the need to complete migration to PQC \[post-quantum computing\] to effectively protect sensitive data needs to be prioritized," says Duncan Jones, head of cybersecurity for Quantinuum.

Quantinuum expects incremental advances in the next few years. That includes improvements in error correction and qubit scaling, continued research into applications such as quantum decryption, and, as a result, greater adoption of PQC technologies, such as post-quantum encryption, quantum key distribution, and quantum random number generation (QRNG), says the company's Jones.

"Organizations implementing quantum-safe strategies today should focus on PQC migration while ensuring their cryptographic foundations are as strong as possible through the use of QRNGs," he says. "This approach provides immediate security benefits while preparing for future quantum-safe technologies."

Google acknowledges that while its error correction breakthrough is significant, there is a difference between theory and practice.

"We still have a long way to go before we reach our goal of building a large-scale, fault-tolerant quantum computer," two members of the Google Quantum AI team stated in a blog post. "The engineering challenge ahead of us is immense."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Quantum Computing Advances in 2024 Put Security In Spotlight

iProov uncovers a major Dark Web operation selling stolen identities with matching biometrics, posing a serious threat to KYC verification systems

****SUMMARY****

*   **Dark Web Identity Fraud Operation:** iProov uncovered a sophisticated dark web network collecting genuine identity documents and facial images to bypass KYC verification.

*   **Voluntary Identity Compromise:** Individuals in regions like LATAM and Eastern Europe are willingly selling their personal and biometric data for short-term financial gain.

*   **Evolving Fraud Techniques:** Attackers use methods ranging from basic static images to advanced tools like deepfake software and custom AI models to defeat liveness checks.

*   **Global Biometric Data Risks:** High-profile breaches (e.g., ZKTeco and ChiceDNA) reveal vulnerabilities in biometric access systems and facial recognition technologies.

*   **Multi-Layered Defense Needed:** Experts recommend advanced real-time verification, challenge-response mechanisms, and continuous monitoring to counter these sophisticated threats.

iProov, a provider of science-based biometric identity verification solutions, has uncovered a large-scale Dark Web operation dedicated to bypassing Know Your Customer (KYC) verification checks. This operation involves systematically collecting genuine identity documents and corresponding facial images.

The iProov Security Operations Center (iSOC) and the company’s Biometric Threat Intelligence service discovered this threat through extensive threat-hunting activities and red team testing. The dark web group has amassed a substantial collection of these identities, potentially obtained through compensated participation where individuals willingly provide their personal information in exchange for payment. This alarming trend extends beyond traditional data theft, as individuals knowingly compromise their identities for short-term financial gain.

“What’s particularly alarming about this discovery is not just the sophisticated nature of the operation, but the fact that individuals are willingly compromising their identities for short-term financial gain,” said Andrew Newell, Chief Scientific Officer at iProov in a press release. Selling identity documents and biometric data not only risks financial security but also provides criminals with genuine identity packages for sophisticated impersonation fraud, Newell added.

This operation, primarily observed in the LATAM and Eastern Europe regions, presents a significant challenge to organizations relying on biometric verification. Genuine credentials paired with matching facial images can easily bypass traditional document verification and basic facial matching systems.

Furthermore, the sophistication of these attacks continues to evolve. While basic attacks utilize simple methods like printed photos or static images, mid-tier attackers employ more advanced techniques such as real-time face-swapping and Deepfake software.

The most sophisticated attackers leverage custom AI models and specialized software to create synthetic faces that can respond to liveness challenges, making it increasingly difficult to distinguish between genuine and fabricated interactions.

This indicates that verification systems face a multi-layered challenge in detecting fake documents and genuine credentials misused by unauthorized individuals. Biometric data, like fingerprints and facial recognition, is increasingly used for identification and security purposes. However, recent incidents involving major vendors and service providers highlight a growing threat to this sensitive information. 

> 📢 EXPOSED: Criminal networks aren't stealing identities anymore.
> 
> They're buying them. Legally. With cash.
> 
> And because these are REAL documents freely given, traditional fraud checks are useless.
> 
> Watch how this works 📷 or Read more: https://t.co/0mX1VSf9my pic.twitter.com/X2KR4tJ61t
> 
> — iProov (@iProov) December 23, 2024

In June 2024, Hackread reported Kaspersky Lab discovered 24 vulnerabilities in ZKTeco’s biometric access systems, which are used for facial recognition and entry control.  The vulnerabilities ranged from SQL injection vulnerabilities to buffer overflow flaws, allowing attackers to inject malicious code.

In September 2024, a separate incident exposed the sensitive data of thousands of customers who used ChiceDNA, an Indiana-based genetic testing and facial matching service. An unsecured WordPress folder left publicly accessible contained biometric images, personal details, and even facial DNA data.

Therefore, organizations should adopt a multi-layered verification approach to combat such threats. This includes verifying the presented identity against official documents and detecting real persons using embedded imagery and metadata analysis.

Real-time verification using unique challenge-response mechanisms, along with managed detection and response through advanced technologies and continuous monitoring, is also essential. Improving protection against sophisticated attacks would make it harder for attackers to spoof verification systems.

1.  **Thousands of UEFA Customer Credentials Sold on Dark Web**
2.  **Stolen Singaporean Identities Sold on Dark Web Starting at $8**
3.  **Dark Web Sales Fuel 32% Increase in Healthcare Cyberattacks**
4.  **Hackers Sell Fake Pegasus Spyware on Clearnet and Dark Web**
5.  **Dark Web Anti-Bot Services Help Phishers Bypass Google Alerts**

Researchers Uncover Dark Web Operation Entirely Focused on KYC Bypass

From Chinese cyberspies breaching US telecoms to ruthless ransomware gangs disrupting health care for millions of people, 2024 saw some of the worst hacks, breaches, and data leaks ever.

Every year has its own mix of digital security debacles, from the absurd to the sinister, but 2024 was particularly marked by hacking sprees in which cybercriminals and state-backed espionage groups repeatedly exploited the same weakness or type of target to fuel their frenzy. For attackers, the approach is ruthlessly efficient, but for compromised institutions—and the individuals they serve—the malicious rampages had very real consequences for people's privacy, safety, and security.

As political turmoil and social unrest intensify around the world, 2025 will be a complicated—and potentially explosive—year in cyberspace. But first, here's WIRED's look back on this year's worst breaches, leaks, state-sponsored hacking campaigns, ransomware attacks, and digital extortion cases. Stay alert, and stay safe out there.

**China's Salt Typhoon Telecom Breaches**

Espionage operations are a fact of life, and relentless Chinese campaigns have been a constant in cyberspace for years now. But the China-linked espionage group Salt Typhoon carried out a particularly noteworthy operation this year, infiltrating a slew of US telecoms including Verizon and AT&T (plus others around the world) for months. And US officials told reporters earlier this month that many victim companies are still actively attempting to remove the hackers from their networks.

The attackers surveilled a small group of people—less than 150 by current count—but they include individuals who were already subject to US wiretap orders as well as state department officials and members of both the Trump and Harris presidential campaigns. Additionally, texts and calls from other people who interacted with the Salt Typhoon targets were inherently also caught up in the espionage scheme.

**Snowflake Customer Breaches**

Throughout the summer, attackers were on a tear, breaching prominent companies and organizations that were all customers of the cloud data storage company Snowflake. The spree barely qualifies as hacking, since cybercriminals were simply using stolen passwords to log in to Snowflake accounts that didn't have two-factor authentication turned on. The end result, though, was an extraordinary amount of data stolen from victims including Ticketmaster, Santander Bank, and Neiman Marcus. Another prominent victim, the telecom giant AT&T, said in July that “nearly all” records relating to its customers' calls and texts from a seven-month stretch in 2022 were stolen in a Snowflake-related intrusion. The security firm Mandiant, which is owned by Google, said in June that the rampage impacted roughly 165 victims.

In July, Snowflake added a feature so account administrators could make two-factor authentication mandatory for all of their users. In November, suspect Alexander “Connor” Moucka was arrested by Canadian law enforcement for allegedly leading the hacking spree. He was indicted by the US Department of Justice for the Snowflake tear and faces extradition to the US. John Erin Binns, who was arrested in Turkey for an indictment related to a 2021 breach of the telecom T-Mobile, was also indicted on charges related to the Snowflake customer breaches.

**Change Healthcare Ransomware Attack**

At the end of February, the medical billing and insurance processing company Change Healthcare was hit with a ransomware attack that caused disruptions at hospitals, doctor's offices, pharmacies, and other health care facilities around the US. The attack is one of the all-time largest breaches of medical data, impacting more than 100 million people. The company, which is owned by UnitedHealth, is a dominant medical billing processor in the US. It said days after the attack started that it believed ALPHV/BlackCat, a notorious Russian-speaking ransomware gang, was behind the assault.

Personal data stolen in the attack included patient phone numbers, addresses, banking and other financial information, and health records including diagnoses, prescriptions, and treatment details. The company paid a $22 million ransom to ALPHV/BlackCat at the beginning of March in an attempt to contain the situation. The payment seemingly emboldened attackers to hit health care targets at an even greater rate than usual. With ongoing, rolling notifications to more than 100 million victims—with more still being discovered—lawsuits and other blowback has been mounting. This month, for example, the state of Nebraska sued Change Healthcare, alleging that “failures to implement basic security protections” made the attack much worse than it should have been.

**Russia's Midnight Blizzard Hit Microsoft**

Microsoft said in January that it had been breached by Russia's “Midnight Blizzard” hackers in an incident that compromised company executives' email accounts. The group is tied to the Kremlin's SVR foreign intelligence agency and is specifically linked to SVR's APT 29, also known as Cozy Bear. After an initial intrusion in November 2023, the attackers targeted and compromised historic Microsoft system test accounts that then allowed them to access what the company said were “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” From there, the group exfiltrated “some emails and attached documents.” Microsoft said that the attackers seemed to be looking for information about what the company knew about them—in other words, Midnight Blizzard doing reconnaissance on Microsoft's research into the group. Hewlett-Packard Enterprise (HPE) also said in January that it had suffered a corporate email breach attributed to Midnight Blizzard.

**National Public Data**

The background check company National Public Data suffered a breach in December 2023, and data from the incident started showing up for sale on cybercriminal forums in April 2024. Different configurations of the data cropped up again and again over the summer, culminating in public confirmation of the breach by the company in August. The stolen data included names, Social Security numbers, phone numbers, addresses, and dates of birth. Since National Public Data didn't confirm the breach until August, speculation about the situation grew for months and included theories that the data included tens or even hundreds of millions of Social Security numbers. Though the breach was significant, the true number of impacted individuals seems to be, mercifully, much lower. The company reported in a filing to officials in Maine that the breach affected 1.3 million people. In October, National Public Data's parent company, Jerico Pictures, filed for Chapter 11 bankruptcy reorganization in the Southern District of Florida, citing state and federal investigations into the breach as well as a number of lawsuits that the company is facing over the incident.

**Honorable Mention: North Korean Cryptocurrency Theft**

A lot of people steal a lot of cryptocurrency every year, including North Korean cybercriminals who have a mandate to help fund the hermit kingdom. A report from the cryptocurrency tracing firm Chainalysis released this month, though, underscores just how aggressive Pyongyang-backed hackers have become. The researchers found that in 2023, hackers affiliated with North Korea stole more than $660 million across 20 attacks. This year, they stole roughly $1.34 billion across 47 incidents. The 2024 figures represent 20 percent of total incidents Chainalysis tracked for the year and a whopping 61 percent of the total funds stolen by all actors.

The sheer domination is impressive, but the researchers emphasize the seriousness of the crimes. “US and international officials have assessed that Pyongyang uses the crypto it steals to finance its weapons of mass destruction and ballistic missiles programs, endangering international security,” Chainalysis wrote.

The Worst Hacks of 2024

Stay protected from SEO poisoning, a cyber threat exploiting search engine rankings to spread malware and phishing scams.…

Stay protected from SEO poisoning, a cyber threat exploiting search engine rankings to spread malware and phishing scams. Learn risks, real-world examples, and preventive measures for safer browsing.

Did you know that over 80% (PDF) of cyberattacks exploit online platforms, including search engines? These indispensable tools guide billions of users to the content they seek, but their trustworthiness can be weaponized.

Cybercriminals are exploiting search engine optimization (SEO) techniques to distribute malware, launch phishing attacks, and spread harmful content. This practice, known as SEO poisoning, manipulates search results to lure unsuspecting users into clicking on malicious links.

Recent reports indicate a significant rise in SEO poisoning attacks. Between August 2023 and January 2024, there was a 60% increase in malware detections stemming from malicious search results. Such trends highlight the growing sophistication of these tactics and the critical need for vigilance among businesses and individuals alike.

****What is SEO Poisoning?****

SEO poisoning is a malicious strategy where cybercriminals manipulate search engine algorithms to rank harmful websites prominently in search results. These websites often contain malware, phishing schemes, or scams designed to steal sensitive information.

Attackers capitalize on high-demand keywords tied to trending topics or urgent events, such as natural disasters, major product launches, or public health crises. By employing techniques like keyword stuffing, spammy backlinks, and deceptive content, they make their sites appear legitimate and lure unsuspecting users.

****Key Risks of SEO Poisoning:****

*   **Malware Distribution:** Clicking on infected links can install ransomware, spyware, or other malware.
*   **Phishing Scams:** Users are tricked into providing sensitive data like passwords or credit card information.
*   **Reputation Damage:** Legitimate businesses can lose credibility if associated with malicious links.

One example is the surge of Gootloader malware in early 2023. Attackers targeted niche search terms, such as _“implied employment agreement,”_ to redirect users to infected websites. These attacks emphasize how even low-competition search terms can become cybercriminals’ playgrounds.

****Real-World Examples of SEO Manipulation****

SEO manipulation has been used in several high-profile attacks, exploiting the trust users place in search results:

*   **Fake Antivirus Software:** Users searching for free antivirus tools were directed to malicious sites posing as trusted providers. These fake programs encrypted files and demanded ransom payments, exploiting users’ trust in well-known antivirus brands like Avast, Bitdefender and Malwarebytes. Fake antivirus websites have been known to impersonate popular security providers to deceive users.

*   Holiday Shopping Scams: During peak shopping seasons, cybercriminals created fake e-commerce sites targeting popular products. These fraudulent sites were designed to rank high in search results, allowing attackers to trick users into entering their payment information, which the criminals then stole.

*   **Software Search Exploitation:** In 2023, searches for popular tools like Blender 3D led users to fraudulent sites offering infected downloads. Such campaigns highlight the dangers of SEO poisoning when targeting trusted software.

These examples show how attackers exploit trust in search results and highlight the importance of vigilance, particularly during periods of heightened online activity.

****Protecting Against SEO-Based Threats****

Although SEO poisoning is a persistent threat, proactive measures can help both businesses and individual users reduce the risks.

****For Businesses****

Businesses must safeguard their websites and digital presence from exploitation. Trusted SEO providers can optimize websites while identifying and mitigating vulnerabilities, such as fake backlinks or unauthorized content changes, often exploited in SEO poisoning campaigns.

According to Stellar SEO, a custom SEO services provider, exploiting SEO-related vulnerabilities has even been adopted by top-tier groups such as the Chinese DragonRank, which was recently discovered manipulating search engines to redirect users to malicious websites.

****For Users****

Users can protect themselves by adopting proactive online habits:

*   **Verify the Source:** Always inspect URLs carefully before clicking, especially when searching for trending or high-demand topics.
*   **Use Trusted Security Tools:** Antivirus software and browser extensions can help identify and block harmful sites. For example, providers like _Kaspersky_ have shown how cybercriminals exploit marketing strategies to launch attacks.
*   **Stay Informed:** Awareness of the latest cybersecurity trends is crucial for recognizing and avoiding malicious tactics.

By combining secure SEO strategies with vigilance, businesses and users can significantly reduce their exposure to SEO poisoning threats.

****How Search Engines Are Combating SEO Poisoning****

Search engines like Google and Bing constantly update their algorithms to detect and penalize malicious websites. These updates target behaviors such as keyword stuffing, suspicious backlinking patterns, and misleading content.

****Key Defensive Measures Include:****

*   **Machine Learning Algorithms:** These tools analyze billions of web pages for signs of malicious intent.
*   **Safe Browsing Technology:** Platforms like Google warn users about harmful websites before they can be accessed.
*   **Domain Reputation Systems:** Search engines evaluate the trustworthiness of domains to demote those linked to malicious activity.

Despite these efforts, cybercriminals continue to evolve their techniques, creating sophisticated tactics to bypass detection. For instance, in November 2024, attackers exploited niche search queries like _“Are Bengal cats legal in Australia“_ to lure users to malicious websites. Such incidents underscore the importance of proactive measures by users and businesses to complement automated systems. Recognizing and avoiding malicious links remains a shared responsibility.

****Conclusion****

SEO poisoning is a growing threat at the intersection of cybersecurity and digital marketing. By exploiting legitimate SEO techniques, cybercriminals deceive users, distribute malware, and undermine trust in search engines.

For businesses, partnering with trusted providers of custom SEO services ensures websites are optimized securely, preventing vulnerabilities that attackers might exploit. For users, adopting habits like verifying sources, using reliable security tools, and staying informed about emerging threats is essential for staying safe online.

Every time you search online, consider the risks that lurk behind seemingly trustworthy links. By remaining vigilant and proactive, we can protect our digital spaces and maintain trust in the tools that shape our online world. 

1.  **Google Algorithm Updates vs SEO Strategies**
2.  **Best SEO Experts to Follow on Twitter (X) in 2025**
3.  **How to Improve SEO with Enhanced Web Security**
4.  **Link Farming: SEO Boost or Cybersecurity Threat?**
5.  **Fake GlobalProtect VPN Downloads Spread WikiLoader Malware**

SEO Poisoning: How Cybercriminals Are Turning Search Engines into Traps

KEY SUMMARY POINTS Securelist by Kaspersky has published its latest threat intelligence report focused on the activities of…

****KEY SUMMARY POINTS****

*   **Focus Shift to Nuclear Industry**: The Lazarus Group, linked to North Korea, has shifted its targets to the nuclear industry, marking a potential escalation from its earlier focus on defense, aerospace, and cryptocurrency.

*   **Fake Job Posting Tactics**: Their attacks, observed in January 2024, employ fake job postings (Operation DreamJob) to deliver malicious files disguised as job assessments, gaining access to victims’ systems.

*   **Advanced Malware Techniques**: The group uses sophisticated tools like Ranid Downloader and a novel plugin-based malware, “CookiePlus,” which operates in memory, making it harder for security systems to detect.

*   **Exploitation of Vulnerabilities**: Lazarus continues refining its tactics, exploiting vulnerabilities like Google Chrome zero-day and leveraging innovative malware like “RustyAttr” on macOS.

*   **Call for Caution**: The increasing sophistication and activity of the Lazarus Group underscore the need for heightened cybersecurity measures, particularly in sensitive industries.

Securelist by Kaspersky has published its latest threat intelligence report focused on the activities of the notorious Lazarus hacking group, which, as we know it, has links to the North Korean government.

According to Securelist’s research, the Lazarus Group has shifted its focus to targeting individuals within the nuclear industry lately. This indicates an upcoming escalation in their operations, as they previously concentrated on sectors like defense, aerospace, and cryptocurrency. 

“We observed a similar attack in which the Lazarus group delivered archive files containing malicious files to at least two employees associated with the same nuclear-related organization over the course of one month,” the report read.   

Malicious files created on the victims’ hosts (Via Secure List)

The attacks observed by Kaspersky occurred in January 2024 and followed the pattern of using fake job postings, a tactic known as the DeathNote campaign or “Operation DreamJob.”

This involves creating fake job postings and enticing potential victims with tempting career opportunities. During the “interview” process, malicious files are subtly introduced, often disguised as legitimate assessment tests.

The attack starts with an initial file disguised as job assessments for prominent companies, which contains a ZIP archive with malicious executables or trojanized legitimate tools like VNC viewers.

Once executed, the trojan prompts the victim to enter an IP address provided by the attackers via separate communication channels like messenger apps. This grants the attackers unauthorized access to the compromised machine, enabling them to move laterally within the network and potentially steal sensitive data or disrupt critical operations.  

An XOR key is generated based on the IP address to decrypt the internal resources of the VNC executable and unzip the data. The unzipped data is then downloaded by Ranid Downloader, which fetches further malicious payloads like MISTPEN, RollMid, LPEClient, Charamel Loader, ServiceChanger, and CookiePlus. The payload type (DLL or shellcode) is determined by a flag within the data structure. The execution results of these plugins are encrypted and sent back to the C2 server.

A key innovation in these recent attacks is the introduction of “CookiePlus,” a novel plugin-based malware. This downloader operates primarily in memory, loading malicious payloads dynamically. This evasive technique makes it harder for traditional security solutions to detect and mitigate the threat.

The development of CookiePlus demonstrates the Lazarus Group’s continuous efforts to refine its tools and evade detection. By introducing new modular malware and adapting their tactics, they aim to maintain a persistent presence within targeted networks and achieve their objectives.

The group has been particularly active lately. In November Group-IB discovered the Lazarus group’s new trojan, “RustyAttr,” which hides malicious code in extended attributes on macOS systems and in October the group exploited a Google Chrome zero-day vulnerability to target cryptocurrency investors with a deceptive NFT game. This calls for continuous vigilance to safeguard your digital assets.

1.  Lazarus Exploits Chrome 0-Day with Fake NFT Game
2.  North Korean Hackers Team Up with Play Ransomware
3.  Lazarus’ Magecart attack steal card data from EU, US sites
4.  Lazarus Hits Blockchain Pros with Fake Video Conferencing
5.  Lazarus hackers suspected of targeting Indian space agency

Lazarus Group Targets Nuclear Industry with CookiePlus Malware

Explore how Ethereum revolutionizes industries with smart contracts, DeFi, NFTs, gaming, DAOs, and sustainability, shaping the future of…

Explore how Ethereum revolutionizes industries with smart contracts, DeFi, NFTs, gaming, DAOs, and sustainability, shaping the future of business innovation and blockchain technology.

Vitalik Buterin developed Ethereum in 2014 after taking inspiration from Bitcoin. However, he envisioned an open-source blockchain through which users could access smart contracts and trade cryptocurrency by excluding third parties. The reasons were clear: traditional financial companies risk compromising users’ data and exposing them to cybersecurity threats, which are less likely to occur on the blockchain, where users can maintain anonymity. Decentralization ensures robust maintenance through a network of global nodes and validators.

Since the blockchain offered developers many perspectives and tools, cryptocurrency has also become popular, reaching second place after Bitcoin. Now, you can buy Ethereum with a debit card or credit through Google Pay or Apple Pay, making it highly accessible globally.  Hence, one can say Ethereum’s future is bright, especially since the blockchain might become an innovative solution to modern problems. Here’s how. 

****Ethereum will promote the DeFi market** **

Decentralized Finance (DeFi) is expected to be the future of the financial industry, as it will merge features of decentralization, transparency and immutability into financial service companies like banks. This will be possible as security protocols, software, and hardware advancements will replace our current outdated systems. The financial sector of the future will ensure high accessibility to all communities, low fees for interest rates and autonomy due to decentralization. 

DeFi will be helpful for: 

*   Liquidity pools;
*   Prediction markets;
*   Non-fungible tokens;
*   Decentralized exchanges;

Developing DeFi apps might seem time-consuming at the moment. Moreover, we’re currently navigating uncertainty in regulations for crypto and blockchain, as well as in security measures, so it might take some time until DeFi apps can be safely used worldwide. 

****Ethereum will ensure access to smart contracts** **

Smart contracts are what made Ethereum so demanded by companies. They automatically seal contracts when the parties involved accomplish the predetermined instructions. Therefore, smart contracts could save companies a lot of time and money by employing automation, so there’s no need for third parties to be involved. 

Smart contracts can be useful in DeFi, for example, as they can allow fast and easy landing and borrowing. They can also help the supply chain management sector by automating the process of verifying product origin and tracing their history. Due to their benefits of interoperability and scalability, smart contracts can be applied to real estate, healthcare, and every other type of business. 

****Ethereum will innovate gaming** **

The gaming industry is one of the most successful ones, being one of the few sectors that flourished during the pandemic and continued growing after. Some of the most recent innovations in gaming include cloud gaming, AI-based development, and Virtual Reality, so it’s constantly changing to meet customer demands and expectations. 

Luckily, the Ethereum blockchain has already hopped on the trends, which is why blockchain P2E (play-to-earn) games are now widespread. Axie Infinity, the Sandbox, and Decentraland have already amassed millions of plays worldwide, allowing gamers to earn crypto while playing fun games. Most of these games are already based on the Ethereum blockchain as the network offers developers plenty of tools and mediums, so we expect it to innovate the gaming industry further. 

****Ethereum will enhance governance through DAOs****

In centralized networks, governance is based on a single central entity that makes all the critical decisions and manages businesses. While this system can be efficient because it ensures security and compliance, it can make it difficult for networks to scale and expose organizations to resistance to change. 

That’s why many are excited about working through DAOs (decentralized autonomous organizations) on Ethereum. Decisions here are made by multiple individuals, so participants are empowered to contribute to the group’s well-being. At the same time, participants’ votes are visible on the public blockchain, encouraging users to work together in building a safe space for investors and developers. 

****Ethereum can navigate business sustainability** **

Business sustainability is the latest industry trend, as companies must keep up with customer demand for green and ethical products. However, there are various challenges along the way, especially when it comes to holding companies accountable for their impact on nature. 

That’s where the Ethereum blockchain could help bring more transparency into the business area by tracking how much energy a business consumes and the carbon emissions resulting from various manufacturing or waste management actions. Ethereum is already equipped with such technology that can help assess external information through blockchain oracles. This technology would allow smart contracts to receive and send information on energy reports from the weather, for example. 

****Ethereum will power up non-fungible tokens** **

NFTs have been trending for a while as they offer investors new opportunities to expand their portfolios in a fun way. At the same time, the underlying technology allows for tokenizing real-world assets, from parcels of land to vehicles. 

The Ethereum blockchain allowed NFTs to grow and flourish, as artists had all the tools necessary to create and share them with communities. But in the future, we expect the blockchain to make it convenient for anyone to mint and trade NFTs, as the number of users that use NFTs is expected to grow to 11.64m by 2025, according to Statista. 

****Ethereum can ensure self-sovereign identity** **

Centralized systems expose users to cybersecurity vulnerabilities, leading to identity theft and unauthorized access. Luckily, with Ethereum blockchains, users will be able to store data on the network and choose who they’re sharing it with. 

This is called self-sovereign identity (SSI), which uses blockchain technology to make data more private and offer users control over their personal information. However, this would require them to use multiple identity platforms and keep track of their data alone. 

****Is Ethereum the perfect tool for future business innovation?** **

The Ethereum blockchain is an advanced network through which developers can learn to create NFTs, dApps, DAOs, and much more. The infrastructure uses smart contracts to deploy anything on the blockchain. Therefore, we expect Ethereum to become the driving force of future decentralization and efficiency. Users on the blockchain can promote DeFi, benefit from DAO governance, and make businesses more sustainable, which will ensure empowerment and high accessibility at the same time. 

1.  Could Bitcoin Be The Future Of DeFi?
2.  Is the Blockchain Secure? Yes, and Here’s Why
3.  Accepting Ethereum (ETH) for Businesses, An Overview
4.  Exploring the Phenomenal Rise of Ethereum as a Digital Asset
5.  Ethereum’s Layer 2 Solutions Could Outrun the Main Blockchain

_Editor’s Note: The information provided in this article is for informational purposes only and should not be considered financial advice. Please conduct your own research and consult a professional advisor before making any financial decisions, including buying or investing in cryptocurrency._

Why Ethereum Will Be a Key Platform for Businesses in the Future

Plus: Google’s U-turn on creepy “fingerprint” tracking, the LockBit ransomware gang’s teased comeback, and a potential US ban on the most popular routers in America.

It’s been a busy year in cybersecurity, but it’s not over yet. This week, we revealed how hackers figured out how to “jailbreak” digital license plates—which are legally issued in at least a couple of states and are valid across the US—allowing them to change the license plate number to basically anything. That means someone with this capability can avoid tolls and tickets, or even change their plate to be the same as their enemy.

While the company that makes the plates, Reviver, makes clear that doing this would be both illegal and a terms-of-service violation, we’re guessing that the people who want to hide their car’s credentials so they can speed all over town aren’t too concerned about that.

Staff at the Cybersecurity and Infrastructure Security Agency are preparing for an uncertain future. Several CISA employees told WIRED that they’re afraid the incoming Trump administration will scrap key programs that they say are keeping Americans safe from cyberattacks and other threats—or that the agency itself could be dismantled.

In recent years, financial scams that involve bilking people out of their cryptocurrency holdings have come to be known by an eye-catching, catch-all name: “pig butchering.” But it’s time for a rebrand, according to officials at Interpol. The term, which is a translation from Chinese and refers to the slow process of fattening up a pig before slaughtering it, was likely created by the scammers themselves. As such, its use could further degrade victims of these scams or shame them into not reporting a crime.

Doing crimes in public is, apparently, all the rage. We took a deep dive into the world of drug dealers who are advertising their goods on open web platforms like Instagram, X, and Snapchat. The practice isn’t new, but authorities in Europe say it’s growing more popular.

And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**FAA Bans Drones Over Parts of NJ and NY but “Has Not Identified Anything Anomalous”**

The US Federal Aviation Administration said on Thursday that it was temporarily banning drone flights over dozens of critical infrastructure and utility sites in New Jersey and New York “at the request of federal security partners.” The restrictions are set to last 30 days. The announcement comes as panic over reported mysterious drone sightings in the two states has surged in recent weeks. The FAA said in a joint statement with the US Department of Homeland Security, Department of Defense, and FBI on Wednesday that the US government has not found evidence of malicious or unexplained aircraft.

"Having closely examined the technical data and tips from concerned citizens, we assess that the sightings to date include a combination of lawful commercial drones, hobbyist drones, and law enforcement drones, as well as manned fixed-wing aircraft, helicopters, and stars mistakenly reported as drones,” the agencies wrote. "We have not identified anything anomalous and do not assess the activity to date to present a national security or public safety risk over the civilian airspace in New Jersey or other states in the northeast.”

The agencies said that the FBI has received more than 5,000 tips about reported drone sightings in recent weeks that have generated about 100 leads investigated by local, state, and federal officials. None have proved to be problematic or concerning. The mass hysteria is itself creating dangerous conditions, though. The FAA warned on Wednesday that there has been a significant uptick in people pointing lasers at aircraft, which is illegal because it can be dangerous and distracting for pilots.

**Google U-Turn Allows Creepy “Fingerprint” Tracking Next Year**

Back in 2019, Google made its position on the online tracking method called fingerprinting pretty clear. “Unlike cookies, users cannot clear their fingerprint, and therefore cannot control how their information is collected,” the company said in a blog post. “We think this subverts user choice and is wrong.”

That viewpoint appears to have changed. This week, Google announced that, starting in February 2025, advertisers would be allowed to use fingerprinting. The method is largely hidden and allows online activity to be tracked by building up a profile using characteristics from your device—for instance, your phone type, language settings, timezone, can be combined with other information unique to your setup and identify you.

Google indicated the change in new advertising policies, which will go into force next year. The current version of the policy says fingerprinting is not allowed, while that reference has been scrubbed from the new version. The change drew instant criticism, with the UK’s data regulator, the Information Commissioner’s Office (ICO), saying that “fingerprinting is not a fair means of tracking users online” and it called the U-turn “irresponsible.” The ICO said it is talking to Google about the shift.

**LockBit Teases Potential Comeback as Alleged Developer Faces US Extradition**

Early this year, the notorious Lockbit ransomware group was thoroughly dismantled by a law enforcement operation, called Operation Cronos. The group’s website was taken over, details of its members and their cyberattacks extracted, decryption tools released, and its alleged Russian mastermind identified.

Now, the US government is attempting to extradite Rostislav Panev, an Israeli citizen who it suggested worked as a LockBit developer between 2019 and 2024. According to Ynet news, Panev was arrested in August and it is alleged that he received more than $230,000 in Bitcoin and developed ransomware tools from the gang. According to a complaint unsealed by US officials, Panev said he was regularly paid $10,000 per month for software development. Panev’s lawyers deny the claims.

At the same time, the organizers of the LockBit ransomware claim that they have created a new “4.0” version of their tools and will be “launching” them in February. A post on LockBit’s reincarnated dark-web sites urged potential hackers to sign up. As with many cybercrime groups, LockBit has lied about its activities in the past, and following the humiliation of its disruption, many other cybercriminals may not trust its tattered brand.

**One of America’s Most Popular Router Manufacturers May Be Banned**

Chinese technology company and router maker TP-Link could be banned in the US, a report from The Wall Street Journal this week claimed. Officials at the Defense, Commerce, and Justice departments have launched investigations into the company over potential cybersecurity and national security concerns around its routers. The Commerce Department has reportedly subpoenaed TP-Link, which has more than 60 percent of the US retail market for routers. A ban could reportedly happen next year.

While TP-Link is a Chinese company, its products are sold in the US by a separate California-based business. In October, Microsoft said that TP-Link routers “make up most” of a network of compromised devices that it has detected being used in Chinese hacking campaigns. The news of the potential ban follows the previous bans of Huawei and ZTE equipment and comes as TikTok will challenge its ban before the US Supreme Court in early January.

Tag

#google