Lauro Perez

Chinese state-backed hackers (Salt Typhoon) breached the wiretap systems of AT&T, Lumen (formerly CenturyLink), and Verizon — gaining access through the legally mandated CALEA backdoors that US law has required telecoms to build into their infrastructure since 1994. The breach represents the security community’s long-predicted outcome: a backdoor built for law enforcement becomes a backdoor for anyone who can reach it.

Stories Covered

Salt Typhoon Exploits CALEA Backdoors: Chinese Hackers Inside US Telecom Wiretap Systems

Chinese government-backed APT Salt Typhoon breached the wiretap systems of at least three of the largest US internet service providers — AT&T, Lumen (formerly CenturyLink), and Verizon — accessing the systems those companies use to facilitate lawful intercepts for law enforcement and government agencies. The compromise was first reported by the Wall Street Journal and confirmed by CNN and the Washington Post, with US government investigation in early stages. The wiretap systems are among the most sensitive in any telecom’s network: they grant access to customer internet traffic, browsing histories, and communications content. Analysts believe the access was aimed at intelligence collection and pre-positioning ahead of a potential future conflict, particularly around Taiwan.

The legal context is critical. The Communications Assistance for Law Enforcement Act (CALEA), passed in 1994 when cell phones were rare and the internet was nascent, requires telecoms and internet service providers to build wiretapping capability into their infrastructure — or encrypt communications in a way that leaves a backdoor accessible to law enforcement. This created a third-party industry of wiretapping compliance vendors that help carriers satisfy the legal requirement. The post-9/11 surveillance expansion under the Patriot Act significantly extended the use of these systems. Security researchers and technologists have warned for decades that a backdoor built for authorized use is structurally identical to a backdoor that any sufficiently capable attacker can exploit — the access mechanisms do not distinguish between a valid law enforcement request and a compromise by a nation-state adversary. The Salt Typhoon intrusion is the materialization of that warning.

The implications are significant in both directions. For individuals: SMS messages have never been end-to-end encrypted — they transit carrier infrastructure in plaintext, stored in databases during routing. Any carrier-level access exposes that data. For broader national security: the systems breached are not narrow point-access tools; they are administrative interfaces with broad, privileged visibility into customer traffic. The distinction between a government-authorized wiretap and a Chinese intelligence collection operation becomes meaningless once a threat actor gains authenticated access to the same interface. Stanford encryption policy expert Riana Pfefferkorn’s observation is accurate: the system designed to protect citizens through surveillance is, in this instance, the mechanism through which they are being surveilled by an adversary. Signal and similar end-to-end encrypted platforms sit outside this exposure by design — encrypted content intercepted at the carrier level is ciphertext without the keys, which remain on user devices.

Listen to the Episode

Kaspersky quietly uninstalled itself from US customers’ computers on September 19, 2024 — and silently installed UltraAV in its place. No consent prompt. No opt-out. Users woke up to find a different antivirus on their machines. The cause: a US government ban on Kaspersky’s Russian-linked operations, which forced the company out of the American market and into a controversial exit that raised serious questions about software consent and the national security logic behind the ban.

Stories Covered

Kaspersky Auto-Removes Itself, Auto-Installs UltraAV: US Ban Forces a Consent-Free Software Swap

The US Commerce Department banned Kaspersky from operating in the United States, citing national security concerns over the company’s Russian origins and the potential for the Russian government to influence or access its products. The ban forced Kaspersky to exit the US market entirely. Its response was to partner with UltraAV, a product of the Pango Group — a US-based cybersecurity company — and transition its paid subscribers automatically. On September 19, 2024, a Kaspersky update rolled out that silently uninstalled Kaspersky and installed UltraAV in its place. Users who had paid for Kaspersky found an unfamiliar antivirus on their systems the next morning, without ever being asked if they wanted it.

The notification defense offered by both companies is weak. Kaspersky sent emails in early September indicating that users would continue receiving protection through UltraAV, their US-based partner. Pango Group told Mashable that “all users with valid email addresses received direct communications.” But receiving a notice that a partner will provide future services is not the same as consenting to a silent auto-install. There is a meaningful difference between “you can choose to switch to UltraAV” and “UltraAV is being installed on your machine tonight.” The backlash on social media was immediate — users confused by an unknown antivirus that appeared without warning, some treating it as malware. The complaint is not unfounded: software that self-installs without explicit consent is exactly the behavior legitimate security tools are supposed to prevent.

On the product comparison: UltraAV has some features Kaspersky lacked, including up to $1 million in identity theft insurance, high-risk transaction monitoring, and social security number alerts. Kaspersky had features UltraAV does not, including webcam protection and online payment protection. Neither product is obviously superior. The national security case for the ban parallels the TikTok situation — the concern is not that Kaspersky has done anything demonstrably malicious, but that as a Russian company it remains subject to Russian government influence or compulsion. Whether that risk justifies banning the product for ordinary consumers (rather than just government networks) is a harder call. Critical infrastructure and government systems are a legitimate concern. For a home user with no connection to sensitive systems, the risk calculus looks different. What is harder to defend is the manner of the exit — users who paid for Kaspersky deserved a real choice about what replaced it.

Listen to the Episode

Apple is dropping its three-year-old lawsuit against NSO Group, the Israeli maker of Pegasus spyware — not because it won, but because winning no longer matters. The spyware market has proliferated so dramatically that eliminating NSO would simply clear space for dozens of competitors who would continue the same attacks, potentially armed with detection-evasion insights gleaned from Apple’s own court filings.

Stories Covered

Apple Drops NSO Lawsuit: Spyware Market Too Fragmented to Win Through Courts

Apple filed suit against NSO Group in 2021 after Pegasus spyware was found exploiting zero-day vulnerabilities in iOS to conduct surveillance on journalists, activists, and political dissidents. The suit was seen as a significant legal counteroffensive against commercial spyware vendors. Three years later, Apple’s executives are seeking to withdraw — citing two interconnected problems. First, the legal discovery process would require Apple to disclose details about how it detects and responds to zero-day exploits, effectively handing a roadmap to every spyware vendor in the market. Second, NSO itself has been fighting to shield its proprietary processes from disclosure, creating an asymmetric situation where Apple shows its hand while NSO stays covered. The calculus turned negative.

The second problem is the more fundamental one. When Apple filed in 2021, NSO Group was the dominant player in the commercial spyware space. A court victory would have materially reduced the threat. By 2024, Google’s Threat Analysis Group reported that 75% of known zero-day exploits against Google products and Android-based systems came from commercial surveillance vendors — plural. Of 37 zero-day vulnerabilities in browsers and mobile devices discovered in one recent year, more than 60% were attributed to spyware vendors selling to governments. The Atlantic Council’s analysis of the Intellexa Consortium documented a complex web of holding companies, developers, and distribution networks that make the spyware market more like an industry than a single threat actor. Apple’s filing acknowledged the shift directly: even a complete victory against NSO would leave a growing list of unaffiliated competitors untouched, each of whom could benefit from the exposed court documents.

The strategic reorientation toward technical countermeasures over legal ones reflects a realistic read of the threat landscape. Apple’s security surface — spanning iPhone hardware, iCloud, iOS across multiple generations, Apple Pay, and device authentication — is vast. Spyware vendors profit precisely from the gap between vulnerability discovery and patch deployment. The commercial surveillance market is growing because it is profitable: government agencies worldwide pay significant sums for capabilities that were once the exclusive domain of national intelligence services. The private sector has largely overtaken government programs in offensive capability development, driven by contract revenue. In that environment, a legal strategy targeting one company is a whack-a-mole approach — costly in disclosure and time, with diminishing returns as the market fragments. Apple’s decision to redirect those resources into its internal threat intelligence program is the correct call.

Listen to the Episode

ESET researchers discovered NGate — an Android malware that weaponizes NFC technology to steal tap-to-pay data from physical credit and debit cards and relay it to an attacker’s device. The attack chains social engineering, phishing, and NFC relay together, ending with fraudulent ATM withdrawals using a victim’s cloned card — no physical card theft required.

Stories Covered

NGate Android Malware: NFC Relay Attack Clones Tap-to-Pay Cards Without Touching Them

NGate is built on NFCGate, a legitimate research tool developed by students at Germany’s University of Darmstadt for capturing, analyzing, and relaying Near Field Communication traffic between devices. ESET, who discovered and named the malware, called it the first of its kind observed in the wild exploiting NFC relay for financial fraud. The attack begins with an SMS to potential victims — typically claiming a tax-related issue — that redirects them to a Progressive Web App (PWA) or web APK. These fake apps mimic bank interfaces and harvest banking credentials including account ID, birthdate, and card PIN. A follow-up phone call from a fake bank employee instructs the victim to enable NFC on their phone and hold their payment card against the back of the device. NGate captures the card’s NFC data and relays it through a server to the attacker. Czech authorities arrested a 22-year-old suspect in connection with the campaign.

The technical mechanism exploits how contactless payment tokenization works. When a card is registered with Google Pay or Apple Pay, a token is generated and stored on the device — not the raw card number. That token is what the phone transmits to payment terminals and ATMs. NGate captures the NFC signals from the victim’s physical card (which also broadcasts tokenized payment data), relays those signals to the attacker’s Android device, and injects them into the device’s secure memory. The attacker’s phone needs to be rooted to access the secure memory areas where payment tokens are stored — once it is, the attacker can present the phone at any NFC-enabled ATM and impersonate the victim’s card. Combined with the PIN captured during phishing, the attacker has everything needed for a full ATM withdrawal. If the NFC relay fails, the fallback is a direct bank transfer using the credential data already stolen.

The attack succeeds because it requires the victim to do almost nothing unusual — holding a card against a phone is a normal behavior that people already associate with tap-to-pay setup. The defense is straightforward: banks do not call customers and ask them to install apps or hold cards against their phone. Any unsolicited call instructing you to download something or enable a phone feature for “verification” should be hung up on immediately. If in doubt, call the bank back using the number on the card — not the number the caller provides. NGate also demonstrates why sideloaded apps (installed outside the Play Store or App Store) remain dangerous even when the social engineering story is plausible. Official app stores are not perfect, but they present a meaningfully higher barrier than a link in an SMS.

Listen to the Episode

OpenAI banned accounts linked to Iran’s covert influence operation Storm 2035, which used ChatGPT to generate social media content targeting the US presidential election from both sides of the political spectrum. Simultaneously, Google disrupted APT42 (linked to Iran’s IRGC) spear-phishing campaigns aimed at US presidential campaign accounts. Nation-state actors are using AI to scale election interference operations — though with limited engagement so far.

Stories Covered

OpenAI Blocks Storm 2035: Iran Used ChatGPT to Generate US Election Propaganda

OpenAI identified and shut down a cluster of ChatGPT accounts tied to Storm 2035, an Iranian covert influence operation that used the AI model to generate social media content about the US presidential election, the conflict in Gaza, Israel’s participation at the Olympic Games, Venezuelan politics, and the Latin X community. Content was produced in English and Spanish and distributed across approximately a dozen accounts on X (formerly Twitter) and one on Instagram. The operation’s tactics included using AI to re-spin comments posted by real social media users, interspersing political content with posts about fashion and beauty to appear authentic, and building fake influencer personas with manufactured interaction history before activating them for influence purposes. OpenAI noted that despite the scale of content generation, the posts received negligible engagement — minimal likes, shares, or comments — and found little evidence the long-form articles generated using ChatGPT were meaningfully distributed.

The parallel threat from Russia is more mature and operationally evolved. Microsoft has tracked an uptick in Russian foreign influence activity targeting the US election. The Doppelganger network (also tracked as Rooza Flood), Storm 1516, and Storm 1841 (Rybar) have all been active. Doppelganger’s particular innovation is link obfuscation: social media posts contain links that initiate multi-hop redirect chains — including URL shorteners like TinyURL — to conceal the final destination and evade automated link-checking bots. Meta reported that the network has disrupted 39 Russian, 30 Iranian, and 11 Chinese influence operations across its platforms since 2017. The ongoing cat-and-mouse is exactly what one would expect: as platforms improve detection, operators shift to nonpolitical cover content (entertainment, lifestyle) and additional redirect layers to avoid tripping automated defenses.

Google’s Threat Analysis Group simultaneously disclosed that it detected and disrupted spear-phishing campaigns by APT42 — an Iranian state-sponsored threat actor affiliated with the Islamic Revolutionary Guard Corps, overlapping with the group also known as Charming Kitten and Mint Sandstorm — targeting personal accounts of high-profile individuals in Israel and the US, including those associated with presidential campaigns. APT42’s approach exploits trusted cloud services: malicious files and phishing pages hosted on Google Drive, Google Sites, OneDrive, and Dropbox to reduce suspicion before redirecting to attacker infrastructure. The broader picture is that influence operations and account-compromise operations are two tracks of the same program — one generates propaganda at scale, the other seeks to take over high-reach accounts to amplify it through an audience that trusts the hijacked identity.

Listen to the Episode

Reason Labs uncovered a polymorphic malware campaign that has infected at least 300,000 Chrome and Edge users through fake download sites mimicking Roblox, YouTube, VLC, and KeePass. The trojans install browser extensions that steal search queries, cannot be removed even in developer mode, and modify the Windows registry to mark the browser as “managed by organization” — locking users out of their own browser settings.

Stories Covered

Extension Trojan Campaign: 300K Users Hit via Fake Download Sites, Fileless PowerShell Delivery

The campaign, active since 2021 and documented by Reason Labs in August 2024, exploits the trust users place in browser extension ecosystems. Victims are lured via ads pointing to look-alike download sites for popular software — Roblox FPS Unlocker, YouTube downloaders, VLC, KeePass. The downloaded executable doesn’t install the expected software. Instead, it registers a scheduled task (Windows equivalent of a cron job) running a PowerShell script named to blend with system processes — patterns like Updater_PrivacyBlocker_PR1 or Microsoft_Windows_Optimizer_Update_Task — which then contacts a remote C2 server to download the second-stage payload directly into memory. Writing nothing to disk at the payload stage is deliberate: in-memory execution leaves no file artifact for antivirus to scan or forensic analysts to extract. At time of writing, Reason Labs reported that almost no AV engines were flagging the C2 domain or the installer. The installers are signed by “Tommy Tech Ltd” — a certificate used across campaign variants going back to 2021.

The extension behavior once installed is the technically interesting part. The malware modifies the browser’s registry entries to declare the machine “managed by an organization,” a legitimately intended enterprise control mechanism that overrides the user’s ability to remove or disable extensions through the normal browser UI — even with developer mode enabled. Search queries are hijacked and routed through attacker-controlled infrastructure. Newer campaign variants also tamper with browser LNK shortcut files to load local extensions and disable automatic browser updates — preventing the browser from patching vulnerabilities the attacker may want to preserve access through. The C2 architecture handles staged execution: the scheduled task runs a short PowerShell script, that script fetches a second-stage script from C2 to memory, which then handles the browser modification. This multi-hop, in-memory architecture makes the campaign resistant to both detection and analysis.

The user-facing symptom is an extension that reappears after every attempt to remove it — reviews on the Chrome Web Store extension pages were filled with complaints from users who had tried and failed to delete it. The core defense is straightforward: only install software from official sources (the Chrome Web Store, Microsoft Edge Add-ons, or software vendor’s official site). Executable downloads from third-party sites — especially ones linked from ads — should be treated with extreme skepticism. The scheduled task persistence mechanism means that even successfully removing the extension leaves a recurring trigger behind; full remediation requires identifying and deleting the scheduled task and its associated PowerShell script from C:\Windows\System32 and the NV Optimizer Log folder. Reason Labs alerted Google and Microsoft, who began taking action, but the underlying distribution vector — fake download sites — remains active.

Listen to the Episode