Scamming operations that once originated in Southeast Asia are now proliferating around the world, likely raking in billions of dollars in the process.

More than 200,000 people in Southeast Asia have been forced to run online scams in recent years, often being enslaved and brutalized, as part of criminal enterprises that have netted billions in stolen funds. Such “pig butchering” operations have largely been concentrated in Myanmar, Cambodia, and Laos, typically rooted in Chinese organized crime groups exploiting instability and poor governance in the region. Though they come at great humanitarian cost, pig butchering scams are undeniably lucrative and, perhaps inevitably, similar operations are now being uncovered on multiple continents and in numerous countries around the world.

A WIRED review of law enforcement and civil society action as well as interviews with numerous researchers show that pig butchering operations that are offshoots of the Southeast Asian activity have emerged in the Middle East, Eastern Europe, Latin America, and West Africa. Many of these expanded operations apparently have links to Chinese-speaking criminals or have evolved in parallel to Chinese Belt and Road Initiative investments, the country’s massive international infrastructure and development initiative.

In 2023, the FBI had reports of nearly $4 billion in losses from the scams, and some researchers put all-time total global losses at $75 billion or more. Beijing has made a concerted effort in recent months to crack down on pig butchering schemes and human trafficking to scamming centers in the Southeast Asian region, but the activity is proliferating around the world nonetheless.

“As all sorts of attackers learn that they can make serious money doing this, they’re going to make those pivots,” says Ronnie Tokazowski, a longtime pig butchering researcher and cofounder of the nonprofit Intelligence for Good. “So pig butchering is cropping up in more and more countries. Even with all the interventions researchers and law enforcement have done there is little to no sign of this stopping.”

Pig butchering emerged in the last five years and is a type of scam that involves building seemingly intimate relationships with victims. Attacks often start by texting potential targets out of the blue and getting them talking. Then attackers begin to build a rapport and introduce the idea of a special or unique investment opportunity. Finally, victims send funds—typically cryptocurrency—through a malicious platform meant to look like a legitimate money management service, and attackers must launder the money from there. All of this takes time and careful planning from a large workforce. Experts say people from more than 60 countries have been abducted and trafficked to Southeast Asian scamming compounds that typically operate with thousands of forced workers. And in recent months, scam centers have been detected around the world as well in different configurations and sizes, but with the same goal.

“Organized crime groups have basically taken advantage of a favorable situation, a favorable environment for them related to governance challenges, limited enforcement capacities, limited regulations and legislative frameworks,” says Benedikt Hofmann, the deputy head of the United Nations Office on Drugs and Crime’s Southeast Asia and Pacific office. “All these ingredients you also find in some other places of the world.”

“What we’ve seen is criminal groups who are invested in this region here, looking beyond this region for establishing similar operations,” Hofmann says of the international expansion.

The wealthy, authoritarian city of Dubai, within the United Arab Emirates, has emerged since 2021 as the largest epicenter of pig butchering outside Southeast Asia. According to the UN, international migrants comprise more than 88 percent of the UAE’s population, making a uniquely diverse, and potentially vulnerable, workforce readily available.

“Dubai is both a destination and also a transition country,” says Mina Chiang, the founder and director of Humanity Research Consultancy, a social enterprise focusing on human trafficking. “We can see lots of compounds that are actually operating in Dubai itself.”

In July, Humanity Research Consultancy identified at least six alleged scam compounds believed to be operating around Dubai. The research—based on testimony from forced laborers, data leaked from a cyberattack, and social media posts—identified potential compounds around industrial and investment parks. These operations “to the best of our knowledge are managed by Chinese-speaking criminals,” the research says, adding that they operate in a similar way to compounds in Southeast Asia.

“They call it a typing center. But a huge scam call center,” reads a one-star review left for a location in Dubai on Google Maps. Another says: “Mostly poor people from Africa working there and mosltly jailed in Dubai. No matter how much they offer you everything is scammed. Highly suggest never ever go there.”

Dubai’s police force did not respond to WIRED’s request for comment about potential scam centers located in the city.

Pig butchering operations may have emerged in Dubai because of immigration and workforce dynamics, but in multiple African countries the activity has started to appear because of an existing culture of organized scamming.

In Nigeria, where digital scamming has been a prominent illicit industry for years across numerous platforms, it was all but inevitable that attackers would adopt the conceits and tactics of pig butchering. The scheme is mature enough that there are now readily available prefab cryptocurrency investment platforms, templates, and scripts available for sale online to anyone who wants to get started. A gang that is already used to carrying out romance scams or business email compromise schemes could easily adapt to the premise and cadence of pig butchering.

“If you look at West Africa’s history with social engineering stuff, it’s a potent mix,” says Sean Gallagher, principal threat researcher at Sophos. “You’ve got a lot of people who have seen this as a way to make a living, especially in Nigeria. And the technology is easily transferable. We’ve seen pig butchering packages for sale that include fake crypto sites and scripts that appear to be tailored to targeting African victims.”

Nigerian law enforcement have been increasingly pursuing cases and even securing convictions related specifically to pig butchering. Gallagher and Intelligence for Good’s Tokazowski also say that in studying and interacting with scammers, they have seen technical indicators that pig butchering attacks may be coming out of Ghana as well. The US Embassy in Ghana has warned about the potential for financial scams originating in the country.

Pig butchering has cropped up in other regions of Africa as well, with ties to Chinese-speaking criminals. In June, 88 people in Namibia were rescued from a scam center, which had links to Chinese nationals who were reportedly arrested. Meanwhile, local reports also indicated that 22 Chinese nationals were sentenced to jail time in Zambia for their links to local scam centers.

Stephanie Baroud, a criminal intelligence analyst in Interpol’s human trafficking unit, says the policing organization, which has been coordinating law enforcement actions, has seen an increase in international scam centers. Not all of them are linked to criminal groups from Asia.

“While sometimes we are noting a link to Asian groups, there are cases where there haven't been,” Baroud says. In some situations, she says, new pig butchering activity around the world seems to be an offshoot of Southeast Asian operations, but unrelated actors appear to be taking the model and adapting it to their resources and expertise.

The scams have emerged in Eastern Europe as well. At least two “fraudulent call centers” trying to con people into investing in cryptocurrency were uncovered by law enforcement in Georgia this month, with reports saying men from Taiwan were forced into working in the country. Local officials, who did not respond to WIRED’s request for comment, have said in recent years they have prosecuted seven companies involved in call center operations.

Scam compounds have also been broken up in Peru and Sri Lanka. And there has even been alleged trafficking in truly unexpected places like the Isle of Man, a British territory where almost 100 people were working between 2022 and 2023 as part of a pig butchering operation, according to a BBC investigation from August.

“The People’s Republic of China–origin criminal groups that are behind these sophisticated forms of scamming are looking to build networks and hubs all around the globe simply because this is so lucrative,” says Jason Tower, the country director for Burma and a long-time security analyst covering China and Southeast Asia at the United States Institute of Peace.

Pig butchering scam centers rely upon multiple layers of criminality to operate, encompassing the recruitment of trafficked people, running scam centers on a day-to-day basis, the development of technology to scam thousands of people, and the sophisticated money laundering required to process billions of dollars. As Chinese authorities have cracked down on Chinese-speaking criminal organizations operating scam centers across Southeast Asia, the groups have likely continued to spread their operations, albeit at a smaller scale.

“I would say it was an intentional hedging strategy, seemingly to diversify the geographic basis of operation and ultimately ensure business continuity,” says John Wojcik, an organized crime analyst at the United Nations Office on Drugs and Crime. “But at the same time, I think it’s also an immediate reaction to mounting law enforcement pressure and regulatory tightening in this region.”

In addition to the geographic spread of pig butchering operations, researchers note that there has also been a shift in the people targeted by traffickers to “work” in scam compounds. “Over the past two years, the countries targeted for recruitment have gradually shifted westward,” says Eric Heintz, a global analyst at human rights organization International Justice Mission.

Many trafficking victims within the early years of pig butchering were based in Southeast Asian countries, but this soon shifted to South Asian nations such as India and Nepal, Heintz says. “We have since seen recruitment posts targeting East African nations like Kenya and Uganda, and then West African countries like Morocco, and then, most recently, we have seen posts targeting El Salvador.”

As always, the spread and evolution of pig butchering is driven by how profitable it can be. Researchers say that another alarming trend involves people from around the world choosing to go work in scam centers or even being liberated from forced labor and returning to keep working voluntarily. As long as the money keeps coming in, pig butchering will keep spreading around the world.

“Fraud is not being seen as a serious crime—not like drugs, not like terrorism,” Humanity Research Consultancy’s Chiang says. “Globally, we need to start shifting that idea, because it creates the same kind of damage, and maybe even more because the amount of money we're talking about is so huge. We are racing against time.”

The Pig Butchering Invasion Has Begun

Plus: The US Justice Department indicts three Iranians over Trump campaign hack, EU regulators fine Meta $100 million for a password security lapse, and the Tor Project enters a new phase.

Researchers found a vulnerability in a Kia web portal that allowed them to track millions of cars, unlock doors, honk horns, and even start engines in seconds, just by reading the car's license plate. The findings are the latest in a string of web bugs that have impacted dozen of carmakers. Meanwhile, a handful of Tesla Cybertrucks have been outfitted for war and are literally being-battle tested by Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion.

As Israel escalates its attacks on Lebanon, civilians on both sides of the conflict have been receiving ominous text messages—and authorities in each country are accusing the other of psychological warfare. The US government has increasingly condemned Russia-backed media outlets like RT for working closely with Russian intelligence—and many digital platforms have removed or banned their content. But they’re still influential and trusted alternative sources of information in many parts of the world.

And there's more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**New Digital Identity Guidelines Strike Back at Dreadful Password Policies**

A new draft of the US National Institute of Standards and Technology's “Digital Identity Guidelines” finally takes steps to eliminate reviled password management practices that have been shown to do more harm than good. The recommendations, which will be mandatory for US federal government entities and serve as guidelines for everyone else, ban the practice of requiring users to periodically change their account passwords, often every 90 days.

The policy of regularly changing passwords evolved out of a desire to ensure that people weren't choosing easily guessable or reused passwords; but in practice, it causes people to choose simple or formulaic passwords so they will be easier to keep track of. The new recommendations also ban “composition rules,” like requiring a certain number or mix of capital letters, numbers, and punctuation marks in each password. NIST writes in the draft that the goal of the Digital Identity Guidelines is to provide “foundational risk management processes and requirements that enable the implementation of secure, private, equitable, and accessible identity systems.”

**DOJ Indicts Alleged Iranian Hackers Over Trump Campaign Breach**

The US Department of Justice unsealed charges on Friday against three Iranian men who allegedly compromised Donald Trump’s presidential campaign and leaked stolen data to media outlets. Microsoft and Google warned last month that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump presidential campaigns, and successfully breached the Trump campaign. The DOJ claims the hackers compromised a dozen people as part of its operation, including a journalist, a human rights advocate, and several former US officials. More broadly, the US government has said in recent weeks that Iran is attempting to interfere in the 2024 election.

“The defendants’ own words made clear that they were attempting to undermine former President Trump’s campaign in advance of the 2024 U.S. presidential election,” Attorney General Merrick Garland said at a press conference on Friday. "We know that Iran is continuing with its brazen efforts to stoke discord, erode confidence in the US electoral process, and advance its malign activities.”

**Irish Regulator Fines Meta More Than $100 Million Over 2019 Password Lapse**

The Irish Data Protection Commission fined Meta €91 million, or roughly $101 million, on Friday for a password storage lapse in 2019 that violated the European Union's General Data Protection Regulation. Following a report by Krebs on Security, the company acknowledged in March 2019 that a bug in its password management systems had caused hundreds of millions of Facebook, Facebook Lite, and Instagram passwords to be stored without protection in plaintext in an internal platform. Ireland's privacy watchdog launched its investigation into the incident in April 2019.

“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data," Irish DPC deputy commissioner Graham Doyle said in a statement. “It must be borne in mind that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

**The Tor Project and the Tails Privacy Operating System Are Merging**

The digital anonymity nonprofit the Tor Project is merging with privacy- and anonymity-focused Linux-based operating system Tails. Pavel Zoneff, the Tor Project’s communications director, wrote in a blog post on Thursday that the move will facilitate collaboration and reduce costs, while expanding both groups' reach. “Tor and Tails provide essential tools to help people around the world stay safe online,” he wrote. “By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.”

The US Could Finally Ban Inane Forced Password Changes

A handful of Tesla’s electric pickup trucks are armed and ready for battle in the hands of Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion. Can the EV take the heat?

The Greeks had their chariots. Patton had his tanks. Now, a handful of soldiers are riding into combat in one of the most unusual-looking vehicles in the history of warfare: an armed Cybertruck.

In a video posted to messaging platform Telegram last week, Ramzan Kadyrov, the leader of Russia’s Chechnya region, showed off a pair of Tesla’s distinctive boxy electric pickup trucks painted forest green and armed with what appear to be Soviet-era DShK 12.7 x 108 mm heavy machine guns—vehicles he claimed had been sent to fight alongside Russian forces taking part in the country’s ongoing invasion of Ukraine.

The footage shows the vehicles patrolling down a dirt road as part of a four-vehicle platoon, with several soldiers manning their weapons mounted on their truck beds and blasting airborne targets out of the sky.

“Mobility, convenience, maneuverability: such qualities of an electric vehicle are in great demand here,” Kadyrov wrote on Telegram.

The new footage came just over a month after Kadyrov published an initial video to Telegram showing off a Cybertruck armed with a Russian Kord 12.7 x 108 mm heavy machine gun. That Cybertruck, Kadyrov claimed in a separate Telegram post made the day before unveiling the fresh pair of vehicles, had recently been disabled “remotely” by Tesla chief Elon Musk, who had previously denied gifting the notorious warlord the vehicle in the first place, likely because it’s prohibited under US sanctions on Russia.

“This is not manly,” Kadyrov seethed on Telegram over the remote shutoff. (Tesla did not immediately respond to WIRED’s request for comment.)

It was only a matter of time before some enterprising combatant somewhere slapped a machine gun on a Cybertruck. Both regular militaries and irregular forces around the world have been whipping up “technicals”—or “nonstandard tactical vehicles” improvised from civilian rides—for more than a century. While the general concept of armored cars outfitted with firearms presaged the outbreak of World War I by at least a decade, the conflict accelerated their production and fielding—and, in moments of necessity, innovation. In one of the earliest documented manifestations of the technical, French navy lieutenant Maxime François Émile Destremau prepared a defense of the strategically important coaling station in the city of Papeete in Tahiti against a pair of German cruisers in September 1914 by tearing six 37 mm cannons off the warship under his command and mounting them on six Ford trucks to repel potential landing parties, according to the 2004 book _On Armor_. As long as the automobile has existed, so has the technical.

The technical as most defense observers know it, built on commercial flatbed pickup trucks like the rugged and reliable Toyota Hilux and Land Cruiser, became a fixture of modern irregular warfare during the so-called “Toyota War” of the 1980s that saw militia forces from Chad achieve a decisive victory over the Libyan military thanks to the superior mobility and maneuverability afforded by their lightweight vehicles. (Chadian forces discovered that, at an appropriately high speed, technicals could traverse open areas mined with Soviet-era munitions without risk of setting them off.)

Since then, technicals have become a fixture of conflicts like the US military campaigns in Afghanistan and Iraq, the Syrian and Libyan Civil Wars, and now the Russian invasion of Ukraine. And those conflicts continued to prompt a flurry of novel innovations when it comes to improvised fighting vehicles. Examples include Libyan militants mounting a S-5 rocket pod meant for an aircraft on the back of a truck and a Land Cruiser outfitted with a Russian-made 14.5 mm ZPU-2 antiaircraft gun that American soldiers traded two cans of chewing tobacco for to secure Hamid Karzai International Airport in Kabul during the US withdrawal from Afghanistan in 2021—the latter of which is now in a US military museum. (Does a DShK on a shopping cart count as a technical? That’s up for debate.)

All of those innovations open up the question: Will an armed Cybertruck actually make for a good technical on the battlefield?

Despite the many issues that have plagued the Cybertruck since its release, the vehicle isn’t necessarily the worst option. While the Cybertruck currently has a maximum range of 340 miles (or 500 miles with an extra battery pack)—well behind the roughly 570- to 700-mile range of the Hilux—the former is actually quicker, capable of accelerating up to 60 mph between 2.6 and 3.9 seconds, depending on the model, a noteworthy achievement given the vehicle’s size and weight.

In terms of safeguarding its occupants from external threats like small arms fire, the Cybertruck’s steel “exoskeleton” offers purportedly superior protection to that of the conventional pickup truck, a feature that Tesla has been quick to flaunt on promotional materials. Finally, the Cybertruck, as an electric vehicle, is freakishly quiet, offering an element of stealth that the US Defense Department in particular has eyed in recent years compared to other fossil-fuel-powered ground vehicles.

“There are some attributes that work,” David Tracy, a cofounder of the car website The Autopian and a former auto engineer, tells WIRED. “It’s off-road capable and has big 35-inch tires and good ground clearance. It has stainless steel panels that can take some amount of abuse. From a defense standpoint—as in, ‘How safe am I in the vehicle?’—if you were to take a stock Hilux or a stock Cybertruck, the Cybertruck would probably be the better choice in a firefight.”

If technicals are built for speed and maneuverability, then the Cybertruck “offers significant benefits over the Hilux,” Tracy says.

“It is absolutely, absurdly quick,” he says. “In a drag race between the two, the Hilux would be an ant in the Cybertruck’s rearview mirror. If you need speed and agility, and it isn’t necessarily going through rigorous off-roading or being fired upon regularly, then it could actually work fine.”

Despite these potential tactical benefits, defense analysts aren’t convinced the Cybertruck has a place on the modern battlefield. As retired Marine colonel Mark Cancian, a senior adviser at the Center for Strategic and International Studies think tank, tells WIRED, the armed vehicles flaunted by Kadyrov on Telegram “are totally cool and totally useless.”

“They are cool because they look like something out of a video game and portray Kadyrov as a sort of futuristic warlord,” Cancian tells WIRED in an email. “They are useless because they don't provide a new capability, except perhaps a bit of stealth.”

Indeed, the Cybertruck is not totally suited for hostile and chaotic environments like the front lines of the Russian invasion of Ukraine. First, the EV’s exoskeleton actually consists of steel panels attached to a standard “unibody” frame that’s more akin to the chassis of a conventional car rather than the “body-on-frame” design of most pickup trucks like the Hilux. This design, according to Motor Trend, makes the former a weaker and less resilient vehicle. Second, while the Cybertruck is certainly off-road capable, it’s still significantly heavier than Hilux, which can make maneuverability and traction on rough terrain a challenge. Third, while its armor portends to offer at least some additional coverage compared to the conventional pickup truck-based technical, the vehicle’s bulletproofing only appears to work with subsonic rounds like the .45 ACP ammo used in Tesla’s tests and not the ubiquitous NATO-standard 5.56 mm round or, say, a shot from a .50 caliber rifle. (Though, to be fair, aftermarket armor packages for the vehicle do exist.)

Beyond design and engineering challenges, there’s also the critical matter of maintenance and logistics, the lifeblood of any motorized conflict. As Tracy points out, the Cybertruck’s unique complexity and software-forward design (like the lack of a physical connection between steering wheel and wheels) means a distinct lack of spare parts and higher potential for catastrophic system failures, challenges that all but guarantee that the vehicle is unable to operate reliably and ensure consistent uptime—not necessarily ideal for troops whose lives may depend on them.

“Simplicity is everything; simplicity and parts availability,” Tracy says. “If you’re driving a complex vehicle and there’s a failure of some sort and you need someone to flash it with a computer, you’re hosed if you’re in the middle of nowhere. The beauty of the Hilux is that they’re very tough, for one, but they can be repaired with simple tools and fairly ubiquitous parts. The Cybertruck does not really make a whole lot of sense in that regard.”

“It’s great that it is safe in a crash and can take a bullet,” he adds. “But if you break a control arm and can’t get the part, it’s pretty useless.”

Plus, the Cybertruck’s reliance on charging stations would make a fleet of armed vehicles “likely impossible to support” in any sort of protracted conflict like that taking place in Ukraine, according to CSIS’s Cancian.

“I doubt there are garages or mechanics near the front lines who can fix these complex devices, which are so unlike the fossil fuel vehicles that the region is accustomed to,” he says. “Further, I doubt there are many recharging stations in the battle area. Unlike with fossil fuel vehicles, where the fuel can be brought to the vehicle if necessary, the Cybertrucks must go to the recharging point.”

How the Cybertruck will actually perform in a combat situation remains to be seen. But if the Kadyrov video is any indication, it’s only a matter of time before an armed Cybertrucks makes the transition from YouTube sensation to tried-and-true, battle-tested technical.

Tesla’s Cybertruck Goes, Inevitably, to War

As Israel intensifies its attacks on Lebanon, eerie messages have been arriving on the phones of civilians on both sides of the border, with authorities in each country accusing the other of psychological warfare.

At the start of September, Nour was having an ordinary evening at home in Beirut—eating pumpkin seeds and watching Netflix—when the SMS hit her device like the smartphone version of a brick through her window. The sender name appeared as eight question marks, “????? ???”, and in the message preview she could read, in clunky, hard-to-understand Arabic, a threat: “We have enough bullets for everyone who needs them.”

To Nour, whose name has been changed to protect her anonymity, it was obvious who had sent this message. “Israel,” she says, “that’s their tone.” The Israeli military did not reply to WIRED’s question about whether they were the source of the message. But the text appeared at a time when Lebanon was on edge, days after Israel and the Lebanese-based group Hezbollah had exchanged air strikes and rockets. It’s unclear how many other people received the SMS threat, although Nour says she saw screenshots on social media of the same message. She was worried the text might contain a malicious link. “I didn’t dare open it,” Nour says.

In Lebanon, the idea of receiving a message from Israel is not new. In the early 2000s, people in Lebanon received recorded phone calls, asking for information about missing Israeli airman Ron Arad, whose plane went down during a bombing mission in the ’80s and is now presumed dead. The last time Nour received a message from a sender she believed to be Israel, it was 2006 and she was a teenager living in the southern suburbs of Beirut. She remembers picking up the landline to hear a robotic voice announce a message that started with the words: “Dear Lebanese people.” That call followed a monthlong war, which killed more than 1,000 people and forced 900,000 to flee their homes.

Violence accompanied last week’s text message too. Israel and Hezbollah have traded fire since the start of the war in Gaza, with a major escalation taking place this week. The latest Israeli airstrikes on Hezbollah targets on Lebanon have been the deadliest in decades, with 558 people killed on Monday alone, according to the country’s health minister.

On Wednesday, Hezbollah launched a rocket at Tel Aviv, which was shot down. There were no reports of casualties. As Lebanese people check on the safety of their family and friends, “most people are now more attached to their phones than usual,” says Mohamad Najem, executive director of the Beirut-based digital rights group SMEX. These messages puncture the feelings of safety people often feel around their phones. “It is definitely creating \[a feeling of\] insecurity for people and fear.”

Across the border, civilians in Israel have also been receiving threatening texts, with the eerie messages demonstrating the psychological role that personal smartphones are now playing in the conflict, on both sides of the border.

The week after Nour got that text, others in Lebanon reportedly began receiving messages via automated calls on their landlines or via text. “If you are in a building with Hezbollah weapons, stay away from the village until further notice,” the message said, echoing similar calls received in Gaza before an airstrike. Between 8 am and 8:30 am on Monday, 80,000 people across Lebanon received these messages, according to a spokesperson for Lebanese telecoms network Ogero who declined to be named. One of those calls rang through to the office of Lebanon’s minister of communication, Ziad Makary, who attributed the message to psychological warfare by the Israelis.

How exactly these phone calls were made is unclear. Suggestions in the media that Lebanon's telecommunications systems had been hacked were rebuffed by the company, which normally blocks phone numbers calling from Israel.

“Originating caller ID was masked with an international or local number. It is not a hack,” the Ogero spokesperson told WIRED. “There has been no breach of the official communications network by the Israelis,” reiterated the office of Lebanon’s telecoms minister, Johnny Corm, on X.

Instead, the calls were generated from “friendly countries which we do not have on our blocklist,” Ogero claimed, declining to specify which ones. The Israel Defense Forces declined to comment on the messages or on how they were sent.

Parties at war have an obligation to give civilians advanced warning of attack, says Lama Fakih, Middle East and North Africa director at Human Rights Watch. “For warnings to be effective under the law, they should be specific,” she says. These messages, however, did not mention which exact villages would be targeted. “And it did result in panic among the civilian population.” By Monday evening, the highways were jammed with thousands of cars fleeing North. “Hezbollah is a secret organization, so people around \[the group\] don't know where the arms are,” claims Wadih Al-Asmar, cofounder of the Lebanese Center for Human Rights.

Across the border in Israel, phones have also been vibrating with ominous messages. Late last Wednesday, Aya Yadlin was still awake in central Israel, texting with a friend, when a new message flashed up on her phone after midnight. On her screen was a SMS from “OREFAlert.” (Israel’s Home Front Command is also known as Oref for short.) When she opened the message, the SMS read: “Emergency alert. You must immediately enter the bomb shelter.” Then there was a link.

Instantly skeptical, Yadlin didn’t click. A lecturer in digital culture at Bar-Ilan University, she knew the authorities didn’t send alerts via text, and there was a typo in the Hebrew. After receiving another message—“Hackers have full access to your devices, return to factory settings”—she blocked the number. If she hadn’t, she would have probably received two more messages, like her sister. The third read in English: “If you want to live, leave. If you want to stay, go to hell.”

These messages were likely a response to the escalation between Israel and Hezbollah, according to a cybersecurity expert in Israel, who declines to be named due to the incident’s sensitivity.

Amid Air Strikes and Rockets, an SMS From the Enemy

Researchers found a flaw in a Kia web portal that let them track millions of cars, unlock doors, and start engines at will—the latest in a plague of web bugs that’s affected a dozen carmakers.

When security researchers in the past found ways to hijack vehicles' internet-connected systems, their proof-of-concept demonstrations tended to show, thankfully, that hacking cars is hard. Exploits like the ones that hackers used to remotely take over a Chevrolet Impala in 2010 or a Jeep in 2015 took years of work to develop and required ingenious tricks: reverse engineering the obscure code in the cars’ telematics units, delivering malicious software to those systems via audio tones played over radio connections, or even putting a disc with a malware-laced music file into the car’s CD drive.

This summer, one small group of hackers demonstrated a technique to hack and track millions of vehicles that’s considerably easier—as easy as finding a simple bug in a website.

Today, a group of independent security researchers revealed that they'd found a flaw in a web portal operated by the carmaker Kia that let the researchers reassign control of the internet-connected features of most modern Kia vehicles—dozens of models representing millions of cars on the road—from the smartphone of a car’s owner to the hackers’ own phone or computer. By exploiting that vulnerability and building their own custom app to send commands to target cars, they were able to scan virtually any internet-connected Kia vehicle’s license plate and within seconds gain the ability to track that car’s location, unlock the car, honk its horn, or start its ignition at will.

After the researchers alerted Kia to the problem in June, Kia appears to have fixed the vulnerability in its web portal, though it told WIRED at the time that it was still investigating the group’s findings and hasn’t responded to WIRED’s emails since then. But Kia’s patch is far from the end of the car industry’s web-based security problems, the researchers say. The web bug they used to hack Kias is, in fact, the second of its kind that they’ve reported to the Hyundai-owned company; they found a similar technique for hijacking Kias' digital systems last year. And those bugs are just two among a slew of similar web-based vulnerabilities they’ve discovered within the last two years that have affected cars sold by Acura, Genesis, Honda, Hyundai, Infiniti, Toyota, and more.

“The more we’ve looked into this, the more it became very obvious that web security for vehicles is very poor,” says Neiko “specters” Rivera, one of the researchers who both found the latest Kia vulnerability and worked with a larger group responsible for the previous collection of web-based car security issues revealed in January of last year.

“Over and over again, these one-off issues keep popping up,” says Sam Curry, another member of the car hacking group, who works as a security engineer for Web3 firm Yuga Labs but says he did this research independently. “It's been two years, there's been a lot of good work to fix this problem, but it still feels really broken.”

**Read a License Plate, Hack a Car**

Before they alerted Kia to its latest security vulnerability, the research group tested their web-based technique on a handful of Kias—rentals, friends’ cars, even cars on dealer lots—and found that it worked in every case. They also showed the technique to WIRED, demonstrating it on the 2020 Kia Soul of a security researcher introduced to them just minutes earlier in a parking lot in Denver, Colorado, as seen in the video above.

The group’s web-based Kia hacking technique doesn’t give a hacker access to driving systems like steering or brakes, nor does it overcome the so-called immobilizer that prevents a car from being driven away, even if its ignition is started. It could, however, have been combined with immobilizer-defeating techniques popular among car thieves or used to steal lower-end cars that don't have immobilizers—including some Kias.

Even in cases when it didn't allow outright theft of a car, the web flaw could have created significant opportunities for theft of a car's contents, harassment of drivers and passengers, and other privacy and safety concerns.

“If someone cut you off in traffic, you could scan their license plate and then know where they were whenever you wanted and break into their car,” says Curry. “If we hadn’t brought this to Kia’s attention, anybody who could query someone’s license plate could essentially stalk them.” For Kias that come installed with a 360-degree camera, that camera, too, was accessible to hackers. Beyond allowing the hijacking of connected features in cars themselves, Curry says, the web portal flaw also allowed hackers to query a broad range of personal information about Kia customers—names, email addresses, phone numbers, home addresses, and even past driving routes in some cases—a potentially massive data leak.

The Kia hacking technique the group found works by exploiting a relatively simple flaw in the backend of Kia's web portal for customers and dealers, which is used to set up and manage access to its connected car features. When the researchers sent commands directly to the API of that website—the interface that allows users to interact with its underlying data—they say they found that there was nothing preventing them from accessing the privileges of a Kia dealer, such as assigning or reassigning control of the vehicles' features to any customer account they created. “It’s really simple. They weren't checking if a user is a dealer,” says Rivera. “And that's kind of a big issue.”

Kia's web portal allowed lookups of cars based on their vehicle identification number (VIN). But the hackers found they could quickly find a car's VIN after obtaining its license plate number using the website PlateToVin.com.

More broadly, Rivera adds, any dealer using the system seemed to have been trusted with a shocking amount of control over which vehicles' features were linked with any particular account. “Dealers have way too much power, even over vehicles that don’t touch their lot,” Rivera says.

**A Dozen Carmakers Websites, Millions of Hackable Cars**

Curry and Rivera, who worked with two other researchers to develop their hacking technique, reported their findings to Kia shortly after demonstrating them to WIRED in June, and the company responded to an inquiry from WIRED to note that it was investigating their findings. “We take this matter very seriously, and value our collaboration with security researchers,” a spokeperson wrote.

Shortly after the researchers reported the issue, Kia did make a change to its web portal API that appeared to block their technique, the researchers say. Then, in August, Kia told the researchers it had validated their findings but was still working on implementing a permanent fix for the problem. Kia hasn't updated the researchers since or responded to WIRED's questions. But after the standard 90-day window given to companies to fix security issues that researchers report, the hackers decided to go public with their findings—though they haven't released their Kia-hacking proof-of-concept application and don't plan to.

The Kia-hacking research group first began to assemble around the idea of probing carmakers' websites and APIs for vulnerabilities in late 2022. A few of them were staying with a friend on a college campus and messing around with the app for a mobile scooter company when they accidentally triggered all the company's scooters across the campus to honk and flash their lights for 15 minutes. At that point, the group “became super interested in trying more ways to make more things honk,” as Curry would write—including vehicles more significant than scooters. Soon after, Curry discovered that Rivera, who'd long been focused on car hacking and had previously worked at the carmaker Rivian, was already looking at web vulnerabilities in vehicle telematics.

In January 2023, they published the initial results of their work, an enormous collection of web vulnerabilities affecting Kia, Honda, Infiniti, Nissan, Acura, Mercedes-Benz, Hyundai, Genesis, BMW, Rolls Royce, and Ferrari—all of which they had reported to the automakers. For at least half a dozen of those companies, the web bugs the group found offered at least some level of control of cars' connected features, they wrote, just as in their latest Kia hack. Others, they say, allowed unauthorized access to data or the companies' internal applications. Still others targeted fleet management software for emergency vehicles and could have even prevented those vehicles from starting, they believe—though they didn't have the means to safely test out that potentially dangerous trick.

In June of this year, Curry says, he discovered that Toyota appeared to still have a similar flaw in its web portal that, in combination with a leaked dealer credential he found online, would have allowed remote control of Toyota and Lexus vehicles' features like tracking, unlocking, honking, and ignition. He reported that vulnerability to Toyota and showed WIRED a confirmation email seeming to demonstrate that he'd been able to reassign himself control of a target Toyota's connected features over the web. Curry didn't film a video of that Toyota hacking technique before reporting it to Toyota, however, and the company quickly patched the bug he'd disclosed, even temporarily taking its web portal offline to prevent its exploitation.

“As a result of this investigation, Toyota promptly disabled the compromised credentials and is accelerating security enhancements of the portal, as well as temporarily disabling the portal until enhancements are complete,” a Toyota spokesperson wrote to WIRED in June.

**More Smart Features, More Dumb Bugs**

The extraordinary number of vulnerabilities in carmakers' websites that allow remote control of vehicles is a direct result of companies' push to appeal to consumers—particularly young ones—with smartphone-enabled features, says Stefan Savage, a professor of computer science at UC San Diego whose research team was the first to hack a car's steering and brakes over the internet in 2010. “Once you have these user features tied into the phone, this cloud-connected thing, you create all this attack surface you didn’t have to worry about before,” Savage says.

Still, he says, even he is surprised at the insecurity of all the web-based code that manages those features. “It’s a little disappointing that it’s as easy to exploit as it has been,” he says.

Rivera says he's observed firsthand in his time working in automotive cybersecurity that car companies often put more focus on “embedded” devices—digital components in non-traditional computing environments like cars—rather than web security, in part because updating those embedded devices can be far more difficult and lead to recalls. “It was clear ever since I started that there was a glaring gap between embedded security and web security in the auto industry,” Rivera says. “These two things mix together very often, but people only have experience in one or the other.”

UCSD's Savage hopes that the Kia-hacking researchers' work might help shift that focus. Many of the early, high-profile hacking experiments that affected cars' embedded systems, like the 2015 Jeep takeover and the 2010 Impala hack pulled off by Savage's team at UCSD, persuaded automakers that they needed to better prioritize embedded cybersecurity, he says. Now car companies need to focus on web security too—even, he says, if it means making sacrifices or changes to their process.

“How do you decide, ‘We’re not going to ship the car for six months because we didn’t go through the web code?’ That’s a a tough sell,” he says. “I would like to think this kind of event causes people to look at that decision more fully.”

Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug

The US government says outlets like RT work closely with Russian intelligence, and platforms have removed or banned their content. But they’re still influential all around the world.

In the lead-up to the 2024 elections, the Biden administration has taken aim at several Russian information operations. Earlier in September, the Department of Justice unsealed an indictment against two employees of RT, a Russian state-backed news network formerly known as Russia Today. At the heart of the indictment was Tenet Media, a company promoting content from right-wing influencers. RT, prosecutors say, largely funded Tenet, and its employees “edited, posted, and directed” content. (The individual influencers deny they knew about the company’s ties to Russia.)

Last week, Meta announced that it would ban RT and other media outlets backed by the Russian state from its platforms. Meanwhile, YouTube said it removed more than 230 channels with connections to Russian-backed media. Those decisions followed the US State Department imposing sanctions on Russian state media, saying that in addition to spreading disinformation about the war in Ukraine, RT was supporting a crowdfunding effort to support the Russian military’s invasion and had developed operations directly tied to Russia’s intelligence agencies.

“These Kremlin-backed media outlets are not only playing this covert influence role to undermine democracy in the United States, but also to meddle in the sovereign affairs of countries around the world,” said Secretary of State Antony Blinken at the time. “As part of RT’s expanded capabilities, the Russian government embedded within RT a unit with cyber operational capabilities and ties to Russian intelligence. RT’s leadership had direct, witting knowledge of this enterprise.”

“Meta's ban of RT and other Russian state media stings a lot because that has been a core channel for the spread of Russian propaganda,” says Samuel Woolley, associate professor and founder of the Propaganda Research Lab at the University of Pittsburgh.

In the US, RT pulled in former war reporter Chris Hedges and late night host Larry King before it lost most of its broadcast access following Russia’s 2022 invasion of Ukraine. But while the sanctions and deplatforming are certainly a blow to propaganda efforts directed at the US—Russian state media has seen some real success on social media—experts who spoke to WIRED say that it by no means will cap the outlets’ reach. RT is well regarded in other parts of the world, particularly in Africa and Latin America, and Spanish language speakers make up the outlet’s largest market outside Russia. It has also invested heavily in old school television infrastructure, with offices in Havana, Buenos Aires, Cairo, Delhi, Algiers, and many other locations that will likely continue to operate unhindered, and offers services in French, German, and Arabic, in addition to English.

“English language speakers haven't been the primary target of RT or Russian media's propaganda efforts,” says Woolley. “And they’ve been building capacity for nearly two decades across Latin America, portions of Africa, and elsewhere in the world. And that has meant in those places that RT and Sputnik have almost become like a fixture of everyday life.”

In Latin America alone, RT’s channels run 24/7, and reported 18 million viewers in 2018. African Stream, which was also named by the State Department as part of Russian state media’s influence architecture and later removed by YouTube and Meta, garnered 460,000 followers on YouTube in the two years it was up and running. And Woolley notes that in these markets, there is likely less competition for viewership than there is in the saturated US media landscape.

“\[Russian media\] made headway in limited media ecosystems, where its attempts to control public opinion are arguably much more effective,” he says. Russian media particularly hones in on anticolonial, anti-Western narratives that can feel particularly salient in markets that have been deeply impacted by Western imperialism. The US also has state-funded media that operates in foreign countries, like Voice of America, though according to the organization’s website, the 1994 US International Broadcasting Act “prohibits interference by any US government official in the objective, independent reporting of news.”

Rubi Bledsoe, a research associate at Center for Strategic and International Studies, says that even with Russian state media removed from some social platforms, its messages are still likely to spread in more covert ways, through influencers and smaller publications with which it has cultivated relationships.

“Not only was Russian media good at hiding that they were a Russian government entity, on the side they would seed some of their stories to local newspapers and local media throughout the region,” she says, noting that the large South American broadcasting corporation Telesur would sometimes partner with RT. (Other times, Russia will back local outlets like Cameroon’s Afrique Média). “All of these secondary and tertiary news outlets are a lot smaller, but can talk to parts of the local population,” she says.

Russian media has also helped cultivate local influencers who often align with its messaging. Bledsoe points to Inna Afinogenova, a Russian Spanish-language broadcaster who previously worked for RT but now has her own independent YouTube channel where she has more than 480,000 followers. (Afinogenova left RT after saying she disagreed with the war in Ukraine.)

And Bledsoe says that the ban from the US might actually be a boon for Russian media in the parts of the world where it’s actively trying to cultivate its image as a trusted media brand. “The narratives that were shared through RT and other Russian media and in Iranian media as well, it's a kind of anti-imperialist dig at the West, and the US,” she says. “Saying the US is the driving force behind this international system and they’re plotting, and they’re out to get you, to impose on other countries’ sovereignty.”

Though Meta was a key avenue for the spread of Russian state media content, it still has a home on other platforms. RT does not appear to have a verified TikTok account, but accounts that exclusively post RT content, like @russian\_news\_ and @russiatodayfrance have tens of thousands of followers on the app. African Stream’s TikTok is still live with nearly 1 million followers. TikTok spokesperson Jamie Favazza referred WIRED to the company’s policies on election-related mis- and disinformation.

A post on X from RT’s account on September 18, the day after the ban, linked to its accounts on platforms like right-wing video sharing platform Rumble, X, and Russian YouTube alternative VK. (RT has 3.2 million followers on X and 125,000 on Rumble.) “Meta can ban us all it wants,” the post read. “But you can always find us here.” X did not respond to a request for comment.

Russia-Backed Media Outlets Are Under Fire in the US—but Still Trusted Worldwide

Plus: The FBI dismantles the largest-ever China-backed botnet, the DOJ charges two men with a $243 million crypto theft, Apple’s MacOS Sequoia breaks cybersecurity tools, and more.

The week was dominated by news that thousands of pagers, walkie-talkies and other devices were exploding across Lebanon on Tuesday and Wednesday in an attack targeting the militant group Hezbollah. At least 32 people were killed, including at least four children, and more than 3,200 people were injured. The covert campaign has widely been attributed to Israel, though none of the country's government agencies have commented.

In addition to the carnage, the attacks have—seemingly by design—had the effect of sowing paranoia and fear, not just among members of Hezbollah but also in the general Lebanese public. Hardware and warfare experts say that the incident is unlikely to establish a global precedent that people's most trusted communication devices and electronics, like smartphones, are rigged with explosives left and right. But it does create the potential to inspire copycats and puts defenders on notice that such attacks are possible.

Researchers say that China’s 2023 Zhujian Cup, a hacking competition with ties to the country's military, took the unusual step of requiring participants to keep the content of the exercise secret—and they may have been targeting a real victim as part of the event. Apple’s new stand-alone app Passwords that launched with iOS 18 may help solve your login problems. And a now-deleted post from billionaire Elon Musk that questioned why no one has attempted to assassinate Joe Biden and Kamala Harris renewed concerns this week that Musk is willing to inspire extremist violence and is a national security threat in the United States.

And there's more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Last month, media outlets, Microsoft, and Google warned that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump political campaigns, and that it had successfully stolen emails from the Trump campaign that were later shared with reporters. Now the FBI has chimed in with the added revelation that the same hackers also sent those stolen Trump communications to the Democrats, too—though for now there's no sign that the Democrats solicited those emails from the Iranians or necessarily even received the Iranians' message.

Republicans were nonetheless quick to compare the news to accusations that the Trump campaign “colluded” with the Russian hackers, part of the Kremlin's GRU military intelligence agency, who breached the Democratic National Committee and the Clinton Campaign in 2016 to carry out a hack-and-leak operation. In a statement, the Trump campaign demanded that the Democrats “must come clean on whether they used the hacked material.” The Harris campaign told CNN that it has cooperated with law enforcement and that it was “not aware of any material being sent directly to the campaign,” believing the emails to be spam or phishing attempts. “We condemn in the strongest terms any effort by foreign actors to interfere in US elections, including this unwelcome and unacceptable malicious activity,” Morgan Finkelstein, the national security spokesperson for the Harris campaign, told CNN.

**FBI Dismantles the Largest-Ever Chinese State-Sponsored Botnet**

The FBI announced this week that it had taken down a network of hacked machines being secretly controlled by a Chinese state-sponsored hacking group known as Flax Typhoon. The botnet, made up of 260,000 routers and internet-of-things devices, was allegedly being run by a Chinese contractor known as the Beijing Integrity Technology Group, a rare instance of a known, publicly traded company operating essentially a massive collection of hacked devices on behalf of the Chinese state. The botnet, according to the FBI and security firm Black Lotus Labs, had been used to hack government agencies, defense contractors, telecoms, and other US and Taiwanese targets. At the time of its takedown, the botnet still encompassed 60,000 machines, making it the largest Chinese state-sponsored botnet ever, according to Black Lotus Labs.

**Two Men Charged With Stealing $243M in Cryptocurrency Using Social Engineering Scam**

On Wednesday night, two young men were arrested after they allegedly stole hundreds of millions of dollars of cryptocurrency and spent the earnings on luxury cars, watches, jewelry, and designer handbags. In an unsealed indictment, the US Department of Justice charged Malone Lam, 20, known online as “Anne Hathaway” and Jeandiel Serrano, 21, aka “VersaceGod,” with stealing $243 million in cryptocurrency and laundering the proceeds through mixing services to conceal the origin.

CoinDesk reported that the men allegedly tricked the heist’s victim, a creditor of the now-defunct trading firm Genesis, using a social engineering scam that led them to reset their Gemini two-factor authentication and transfer 4,100 bitcoin to a compromised wallet. An analysis of the transaction by blockchain investigator ZachXBT revealed that the $243 million was divided among multiple wallets and then distributed to over 15 exchanges.

**Apple MacOS Update Breaks Some Cybersecurity Tools**

On Thursday, TechCrunch reported that Apple's latest desktop operating system update, macOS 15 (Sequoia), breaks some functionality of major security tools made by CrowdStrike, SentinelOne, and Microsoft. It’s unclear what specifically in the update is causing the issues, but social media posts and internal Slack messages reviewed by the tech outlet show that the update has frustrated engineers working on macOS-focused security tools.

A CrowdStrike sales engineer informed colleagues via Slack, as seen by TechCrunch, that the company would not be able to support Sequoia on day one, despite its usual practice of quickly supporting new OS releases. While they hope for a quick patch, they will likely need to scramble to resolve the issue with an update in their own code, assuming no immediate fix is available from Apple, which has not yet commented on the issue.

**Leader of Crypto Extortion Gang Sentenced to 47 Years**

Cryptocurrency theft has become practically a common-garden form of cybercrime. But one brutal gang took that form of thievery to a new level of cruelty and violence, breaking into a series of victims' homes to threaten and extort them into handing over their crypto holdings, sometimes even resorting to kidnapping and torture. This week, that disturbing story came to a close with the sentencing of the group's ring leader, a Florida man named Remy St. Felix, to 47 years in prison. St. Felix is one of 12 members of the gang to have now been charged, convicted, and sentenced. Prior to the home invasions that St. Felix led, another member of the group named Jarod Seemungal allegedly stole millions with more traditional crypto hacking techniques. But St. Felix's more violent, offline extortion attempts netted his gang only around $150,000 in cryptocurrency before they were caught and sentenced to years behind bars. The lesson: Crime doesn't pay—or at least, not the physical kind.

Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

The explosion of thousands of rigged pagers and walkie-talkies will likely make Hezbollah operatives fear any means of electronic communication. It’s having the same effect on the Lebanese population.

“They don't trust their smartphones, so they reach back to these more archaic devices, and those blow up. What's next?” says Schneier. “Everything becomes less efficient, because they can't communicate well.”

Schneier describes the paranoia-inducing effect of the operation as a kind of ongoing “tax” on Hezbollah as an organization. “There are a lot of things you can't do if you can't trust your comms,” he says. Schneier compares the end result to the nearly incommunicado state of a hunted figure like Osama bin Laden, who in his final years was reduced to sending messages only via the human couriers who visited his secret compound in Pakistan.

That paranoia, in fact, has been seeded among Lebanon's population for years. Israel's pager- and walkie-talkie-based attacks follow repeated public warnings from Hezbollah leader Hassan Nasrallah about the surveillance dangers of smartphones, given Israeli intelligence's well-known hacking prowess. “Please break it, bury it, lock it up in a metal box,” Nasrallah said in one speech. In another, he appeared on Lebanese television next to an image of an iPhone circled in red with a slash across it. “These are deadly spies,” he warned. Cell phones were reportedly banned from Hezbollah meetings in favor of pagers.

Now the older, alternative devices Hezbollah has fallen back to carry even greater fears of injury or death. And that fear has come to encompass communications electronics more broadly: At Wednesday's funeral for victims of Tuesday's attack, for instance—an event that was itself the target of another attack—attendees were asked to remove the batteries from their phones.

Creating distrust of communication devices within Hezbollah may well be Israel's purposeful tactic of “preparing the battle space” ahead of impending Israeli military operations against Lebanon, says Thomas Rid, a professor of strategic studies at Johns Hopkins University and author of _Active Measures_, who specializes in disinformation and influence operations. He compares the operation to cyberattacks or physical attacks on “command-and-control” infrastructure at the beginning of a conflict, such as the United States' efforts, documented in former NSA chief Michael Hayden's book _Playing to the Edge_, to destroy the Iraqi military's fiber-optics-based communications in 2003 in order to “herd” the enemy's military toward more easily intercepted radio-based communications.

“This is taking attacks on command-on-control to a whole new level,” Rid says. “They sent the message: ‘No, we’re not just penetrating these devices and bugging them, we're literally blowing them up, taking away the confidence you might have had in your command-and-control and also in any future devices that you might procure.’”

For Israeli intelligence, Rid notes, the attack also represents a stunning reassertion of its power and public image following its disastrous failure to prevent Hamas' attacks of October 7. “This operation goes a long way in terms of demonstrating that they are, perhaps, the most creative and the most ruthless intelligence establishment on the planet right now,” he says.

Thanks to the collateral damage of Israel's brazen offensive, however, its effects—both physical and psychological—have by no means been limited to Hezbollah operatives. The French-Lebanese security researcher Kobeissi, who now works as the founder and CEO of Paris-based tech firm Symbolic Software, says he's already seen false rumors and misleading videos spread among Lebanese people, suggesting for instance that iPhones, too, are exploding. “People are losing their minds, because it's scary as shit, and that's the point,” he says. “It's impossible to think about this as limiting Hezbollah's communications and capabilities without realizing it's also going to have a terrorizing effect on the adjacent population.”

Kobeissi argues that the attack's collateral damage will shape how a generation of people think about Western technology in Lebanon and beyond. “The average Lebanese person doesn't have a specific understanding of what it means to conduct a supply chain attack,” he says. “What they see is that a device made by an American ally, a device they rely on, may blow up. And it's unfortunate that the Israeli intelligence community didn't consider the knock-on effects that this could have globally.”

Aside from that issue of trust, Israel's attack also represents an escalation, says Harvard's Bruce Schneier—a new kind of attack that, now that it's been demonstrated, is sure to be seen again in some form, perhaps even in an act of retaliation against Israel itself.

“It’s not just Hezbollah that should worry. If I were Ukraine, I’d be worried. If I were Russia, I’d worry. If I were Israel, I’d worry. This doesn’t just go one way,” he says. “Now we all live in a world of connected devices that can be weaponized in unexpected ways. What does that world look like?”

First Israel’s Exploding Pagers Maimed and Killed. Now Comes the Paranoia

Thousands of beepers and two-way radios exploded in attacks against Hezbollah, but mainstream consumer devices like smartphones aren’t likely to be weaponized the same way.

For two days this week, Hezbollah has been rocked by a series of small explosions across Lebanon, injuring thousands and killing at least 25. But these attacks haven’t come from rockets or drones. Instead, they’ve resulted from boobytrapped electronics—including pagers, walkie-talkies, and even, reportedly, solar equipment—detonating in coordinated waves. As details come into view of the elaborate supply chain attack that compromised these devices, citizens on the ground in Lebanon and people around the world are questioning whether such attacks could target any device in your pocket.

The campaign to compromise key Hezbollah communication infrastructure with explosives was clearly elaborate and involved. The operation, which is widely believed to have been perpetrated by Israel, goes far beyond past examples of hardware supply chain attacks and may be a source of inspiration for future spycraft around the world. But sources tell WIRED that the specific scale and scope of the effort would not be easily replicated in other contexts. And, more broadly, the resources and precision involved in carrying out such an attack would be prohibitively difficult to maintain over time for key consumer devices like smartphones—which are used so widely and regularly scrutinized by researchers, product testers, and repair technicians.

“I do think there is absolutely potential to see more of this in the longer term, not targeting civilians, but generally targeting other military actors,” says Zachary Kallenborn, an adjunct nonresident fellow with the Center for Strategic and International Studies. Kallenborn says militaries are increasingly relying on commercial technology—from drones to communications devices—all of which could be compromised if supply chains can be exploited by adversaries. “These systems are being sourced from all over the globe,” he says. “What that means, then, is that you also have these global supply chains supporting them.”

While full details of the attacks are still coming to light, the devices that detonated were seemingly compromised with explosives before they arrived in Hezbollah members’ hands. Alan Woodward, a cybersecurity professor at the University of Surrey, says he suspects that an attacker would plant explosives in a device during the manufacturing process, rather than intercepting gadgets after they are finished and then taking them apart to plant explosives. Reporting by the New York Times on Wednesday evening seemed to confirm this theory, indicating that Israel directly manufactured the compromised devices via shell companies. Israel has not commented on any of the attacks.

Early theories that cyberattacks caused device batteries to overheat and explode have been ruled out by cybersecurity experts. The force of the blasts seen in on-the-ground footage would not be consistent with battery fires or explosions, especially given the small size of pager and walkie-talkie batteries.

Lebanon’s political landscape and ongoing economic crisis, coupled with regional fighting between Hezbollah and Israel, created specific opportunities for sabotage. Hezbollah is isolated globally, with countries like the United States and United Kingdom classifying it as a terrorist organization while other countries, such as Russia and China, maintain relations. This impacts Hezbollah’s avenues for importing equipment and vetting suppliers.

Amid ongoing violent conflict with Israel, Hezbollah’s digital communications and activities are also under constant barrage from Israeli hackers. In fact, this constant digital assault reportedly played a role in pushing Hezbollah away from smartphone communication and toward pagers and walkie-talkies in the first place. “Your phone is their agent,” Hezbollah leader Hassan Nasrallah said in February, referring to Israel.

The commercial spyware industry has shown it is possible to fully compromise target smartphones by exploiting chains of vulnerabilities in their mobile operating systems. Developing spyware and repeatedly finding new operating system vulnerabilities as older ones are patched is a resource-intensive process, but it is still less complicated and risky than conducting a hardware supply chain attack to physically compromise devices during or shortly after manufacturing. And for an attacker, monitoring a target’s entire digital life on a smartphone or laptop is likely more valuable than the device’s potential as a bomb.

“I’d hazard a guess that the only reason we aren’t hearing about exploding laptops is that they’re collecting too much intelligence from those,” says Jake Williams, vice president of research and development at Hunter Strategy, who formerly worked for the US National Security Agency. “I think there’s also potentially an element of targeting, too. The pagers and personal radios could pretty reliably be expected to stay in the hands of Hezbollah operatives, but more general purpose electronics like laptops could not.”

There are other more practical reasons, too, that the attacks in Lebanon are unlikely to portend a global wave of exploding consumer electronics anytime soon. Unlike portable devices that were originally designed in the 20th century, the current generation of laptops and particularly smartphones are densely packed with hardware components to offer the most features and the longest battery life in the most efficient package possible.

University of Surrey’s Woodward, who regularly takes apart consumer devices, points out that within modern smartphones there is very limited space to insert anything extra, and the manufacturing process can involve robots precisely placing components on top of each other. X-rays show how tightly packed modern phones are.

“When you open up a smartphone, I think the only way to get any sort of meaningful amount of high explosive in there would be to do something like replace one of the components,” he says, such as modifying a battery to be half battery, half explosives. But “replacing a component in a smartphone would compromise its functionality,” he says, which could lead a user to investigate the malfunction.

In contrast, the model of pager linked to the explosions—a “rugged” device with 85 days of battery life—included multiple replaceable parts. Ang Cui, founder of the embedded device security firm Red Balloon Security, examined the schematics of the pager model apparently used in the attacks and told WIRED that there would be free space inside to plant explosives. The walkie-talkies that exploded, according to the manufacturer, were discontinued a decade ago. Woodward says that when opening up redesigned, current versions of older technologies, such as pagers, many internal electronic components have been “compressed” down as manufacturing methods and processor efficiency have improved.

Smartphone production lines also operate under stricter security measures, especially for high-cost devices like Apple’s iPhones and Google’s flagship Pixel phones. This is partly to guarantee production quality, but also to ensure that employees don’t leak trade secrets or prototypes. Not all low-end Android phones are manufactured with such intense oversight, but it would be more difficult to secretly take over manufacturing of a smartphone than a forgotten pager model. In countries like China, where many devices are manufactured, there is always the possibility of a domestic operation to plant backdoors, but such a scheme would need to be elaborate to skirt international scrutiny of the devices

To find exploding cell phones, you have to go back to 20th century tech. In 1996, Palestinian bombmaker Yahya Ayyash was killed when his mobile phone exploded as he answered a call. His old-style phone—which the New York Times said was ”reportedly a small, slim model that fits in a pocket”—had 50 grams of explosives planted inside it, likely by Israel’s security services. The explosion was reportedly triggered by a radio signal emitted from a plane flying above. And unlike the pager and walkie-talkie attacks this week, Ayyash’s phone was part of a highly targeted attack on him alone.

Even if this week’s exploding device campaign doesn’t have immediate implications for every smartphone in every pocket, though, it expands enormously the specter of hardware supply chain attacks.

“I think that every shady organization worldwide will now be checking their new devices—especially those ordered in bulk from the manufacturer—for explosives,” says a longtime hardware hacker and tech procurement specialist who asked to be identified as Null Pointer. “This hit so hard because it was novel and no one in that community knew to look for it. It's ingenious.”

Your Phone Won’t Be the Next Exploding Pager

In a second attack on Hezbollah members, two-way radios detonated around Lebanon on Wednesday, causing injuries and multiple deaths.

With Hezbollah and Lebanon still reeling from a coordinated wave of pager explosions on Tuesday that killed at least 12 people and injured thousands, another bombardment began on Wednesday, this time taking the form of exploding two-way radios. Footage of the explosions, which was not independently confirmed by WIRED, appears to show even larger blasts than those that emanated from the booby-trapped pagers.

Lebanon’s official news agency also reported exploding home solar systems less than two hours after the radio detonations began on Wednesday, according to the Associated Press. Details of the alleged solar equipment attacks were still developing at the time of publication.

The walkie-talkie explosions appeared to have been orchestrated the same way as the attack on Tuesday, which was likely carried out by intercepting new pagers at some point in their journey through the supply chain and modifying them to add explosive material. Hezbollah had reportedly expanded its use of pagers recently in an attempt to secure communications after the group feared that other channels had been infiltrated by Israeli intelligence. Reuters reported on Wednesday that Hezbollah purchased the walkie-talkies about five months ago as part of the same initiative that led the group to purchase the pagers.

In a statement after Wednesday’s explosions, Lebanon’s Health Ministry said more than 300 people had been injured and nine people had died, with incidents being reported in several regions of the country. The Lebanese Red Cross said more than 30 ambulances were involved in the treatment of people injured.

Though details of Wednesday’s attack are still emerging, the perpetrator of Tuesday’s exploding pager operation is widely believed to be Israel. Fighting between Israel and Hezbollah, which is backed by Iran, has intensified over the past year since Hamas’ October 7 attack on Israel. On Tuesday, Hezbollah blamed Israel for the “criminal aggression that targeted civilians too.”

“I'm floored by the sophistication of this operation,” says Jake Williams, vice president of research and development at Hunter Strategy, who formerly worked for the US National Security Agency. “The scale of this supply chain compromise is unprecedented. It's hard to imagine what technology Hezbollah could consider ‘safe’ at this point.”

Photos and videos posted to social media on Wednesday appeared to show handheld radios, or walkie-talkies, in various states of destruction. In many of the images, the devices, which are larger and bulkier than smartphones, had one side of their casing removed. Middle East experts citing local media reports noted that cars, scooters, and even buildings appear to have been damaged by tampered devices.

“From what we are seeing, including images circulating on social media, the devices exploding are handheld radios, possibly an Icom model,” says Michael Horowitz, head of intelligence at the risk management company Le Beck International.

The second round of explosions on Wednesday indicates that whoever conducted the sabotage and attacks likely had deeply rooted access and knowledge of Hezbollah’s infrastructure and operations. “This shows an even deeper penetration that may have relied on multiple fronts and multiple vectors (different electronic devices and providers),” Horowitz says. “This is unheard of.”

Israel has not yet commented on any of the attacks, and the Israel Defense Forces did not immediately respond to WIRED’s request for comment about the second round of explosions.

The pagers that exploded on Tuesday were mostly Gold Apollo AR-924 model pagers, which the Taiwan-based company says were produced by a third-party firm, Hungary-based BAC Consulting. The New York Times reports that 1 to 2 ounces of explosive were inserted in the pagers before they were distributed to members of Hezbollah. A person listed as the CEO of BAC Consulting did not respond to WIRED’s request for comment. A Hungarian government spokesperson has claimed the company is a “trading intermediary” and does not have a “manufacturing or operational site in Hungary.”

Following the first round of explosions on Tuesday, Human Rights Watch called for an investigation, saying it was not possible to locate all the sabotaged pagers and, as a result, they could end up striking “military targets and civilians without distinction.”

“Customary international humanitarian law prohibits the use of booby traps—objects that civilians are likely to be attracted to or are associated with normal civilian daily use—precisely to avoid putting civilians at grave risk and produce the devastating scenes that continue to unfold across Lebanon today,” Lama Fakih, the group’s Middle East and North Africa director said in a statement.

US secretary of state Anthony Blinken on Wednesday denied the US had advance knowledge of Tuesday’s attack.

“The United States did not know about, nor was it involved in, these incidents,” he said at a conference in Cairo, Egypt. “We’re still gathering the information and gathering the facts.”

Source

Wired