As Israel intensifies its attacks on Lebanon, eerie messages have been arriving on the phones of civilians on both sides of the border, with authorities in each country accusing the other of psychological warfare.

At the start of September, Nour was having an ordinary evening at home in Beirut—eating pumpkin seeds and watching Netflix—when the SMS hit her device like the smartphone version of a brick through her window. The sender name appeared as eight question marks, “????? ???”, and in the message preview she could read, in clunky, hard-to-understand Arabic, a threat: “We have enough bullets for everyone who needs them.”

To Nour, whose name has been changed to protect her anonymity, it was obvious who had sent this message. “Israel,” she says, “that’s their tone.” The Israeli military did not reply to WIRED’s question about whether they were the source of the message. But the text appeared at a time when Lebanon was on edge, days after Israel and the Lebanese-based group Hezbollah had exchanged air strikes and rockets. It’s unclear how many other people received the SMS threat, although Nour says she saw screenshots on social media of the same message. She was worried the text might contain a malicious link. “I didn’t dare open it,” Nour says.

In Lebanon, the idea of receiving a message from Israel is not new. In the early 2000s, people in Lebanon received recorded phone calls, asking for information about missing Israeli airman Ron Arad, whose plane went down during a bombing mission in the ’80s and is now presumed dead. The last time Nour received a message from a sender she believed to be Israel, it was 2006 and she was a teenager living in the southern suburbs of Beirut. She remembers picking up the landline to hear a robotic voice announce a message that started with the words: “Dear Lebanese people.” That call followed a monthlong war, which killed more than 1,000 people and forced 900,000 to flee their homes.

Violence accompanied last week’s text message too. Israel and Hezbollah have traded fire since the start of the war in Gaza, with a major escalation taking place this week. The latest Israeli airstrikes on Hezbollah targets on Lebanon have been the deadliest in decades, with 558 people killed on Monday alone, according to the country’s health minister.

On Wednesday, Hezbollah launched a rocket at Tel Aviv, which was shot down. There were no reports of casualties. As Lebanese people check on the safety of their family and friends, “most people are now more attached to their phones than usual,” says Mohamad Najem, executive director of the Beirut-based digital rights group SMEX. These messages puncture the feelings of safety people often feel around their phones. “It is definitely creating \[a feeling of\] insecurity for people and fear.”

Across the border, civilians in Israel have also been receiving threatening texts, with the eerie messages demonstrating the psychological role that personal smartphones are now playing in the conflict, on both sides of the border.

The week after Nour got that text, others in Lebanon reportedly began receiving messages via automated calls on their landlines or via text. “If you are in a building with Hezbollah weapons, stay away from the village until further notice,” the message said, echoing similar calls received in Gaza before an airstrike. Between 8 am and 8:30 am on Monday, 80,000 people across Lebanon received these messages, according to a spokesperson for Lebanese telecoms network Ogero who declined to be named. One of those calls rang through to the office of Lebanon’s minister of communication, Ziad Makary, who attributed the message to psychological warfare by the Israelis.

How exactly these phone calls were made is unclear. Suggestions in the media that Lebanon's telecommunications systems had been hacked were rebuffed by the company, which normally blocks phone numbers calling from Israel.

“Originating caller ID was masked with an international or local number. It is not a hack,” the Ogero spokesperson told WIRED. “There has been no breach of the official communications network by the Israelis,” reiterated the office of Lebanon’s telecoms minister, Johnny Corm, on X.

Instead, the calls were generated from “friendly countries which we do not have on our blocklist,” Ogero claimed, declining to specify which ones. The Israel Defense Forces declined to comment on the messages or on how they were sent.

Parties at war have an obligation to give civilians advanced warning of attack, says Lama Fakih, Middle East and North Africa director at Human Rights Watch. “For warnings to be effective under the law, they should be specific,” she says. These messages, however, did not mention which exact villages would be targeted. “And it did result in panic among the civilian population.” By Monday evening, the highways were jammed with thousands of cars fleeing North. “Hezbollah is a secret organization, so people around \[the group\] don't know where the arms are,” claims Wadih Al-Asmar, cofounder of the Lebanese Center for Human Rights.

Across the border in Israel, phones have also been vibrating with ominous messages. Late last Wednesday, Aya Yadlin was still awake in central Israel, texting with a friend, when a new message flashed up on her phone after midnight. On her screen was a SMS from “OREFAlert.” (Israel’s Home Front Command is also known as Oref for short.) When she opened the message, the SMS read: “Emergency alert. You must immediately enter the bomb shelter.” Then there was a link.

Instantly skeptical, Yadlin didn’t click. A lecturer in digital culture at Bar-Ilan University, she knew the authorities didn’t send alerts via text, and there was a typo in the Hebrew. After receiving another message—“Hackers have full access to your devices, return to factory settings”—she blocked the number. If she hadn’t, she would have probably received two more messages, like her sister. The third read in English: “If you want to live, leave. If you want to stay, go to hell.”

These messages were likely a response to the escalation between Israel and Hezbollah, according to a cybersecurity expert in Israel, who declines to be named due to the incident’s sensitivity.

Amid Air Strikes and Rockets, an SMS From the Enemy

Researchers found a flaw in a Kia web portal that let them track millions of cars, unlock doors, and start engines at will—the latest in a plague of web bugs that’s affected a dozen carmakers.

When security researchers in the past found ways to hijack vehicles' internet-connected systems, their proof-of-concept demonstrations tended to show, thankfully, that hacking cars is hard. Exploits like the ones that hackers used to remotely take over a Chevrolet Impala in 2010 or a Jeep in 2015 took years of work to develop and required ingenious tricks: reverse engineering the obscure code in the cars’ telematics units, delivering malicious software to those systems via audio tones played over radio connections, or even putting a disc with a malware-laced music file into the car’s CD drive.

This summer, one small group of hackers demonstrated a technique to hack and track millions of vehicles that’s considerably easier—as easy as finding a simple bug in a website.

Today, a group of independent security researchers revealed that they'd found a flaw in a web portal operated by the carmaker Kia that let the researchers reassign control of the internet-connected features of most modern Kia vehicles—dozens of models representing millions of cars on the road—from the smartphone of a car’s owner to the hackers’ own phone or computer. By exploiting that vulnerability and building their own custom app to send commands to target cars, they were able to scan virtually any internet-connected Kia vehicle’s license plate and within seconds gain the ability to track that car’s location, unlock the car, honk its horn, or start its ignition at will.

After the researchers alerted Kia to the problem in June, Kia appears to have fixed the vulnerability in its web portal, though it told WIRED at the time that it was still investigating the group’s findings and hasn’t responded to WIRED’s emails since then. But Kia’s patch is far from the end of the car industry’s web-based security problems, the researchers say. The web bug they used to hack Kias is, in fact, the second of its kind that they’ve reported to the Hyundai-owned company; they found a similar technique for hijacking Kias' digital systems last year. And those bugs are just two among a slew of similar web-based vulnerabilities they’ve discovered within the last two years that have affected cars sold by Acura, Genesis, Honda, Hyundai, Infiniti, Toyota, and more.

“The more we’ve looked into this, the more it became very obvious that web security for vehicles is very poor,” says Neiko “specters” Rivera, one of the researchers who both found the latest Kia vulnerability and worked with a larger group responsible for the previous collection of web-based car security issues revealed in January of last year.

“Over and over again, these one-off issues keep popping up,” says Sam Curry, another member of the car hacking group, who works as a security engineer for Web3 firm Yuga Labs but says he did this research independently. “It's been two years, there's been a lot of good work to fix this problem, but it still feels really broken.”

**Read a License Plate, Hack a Car**

Before they alerted Kia to its latest security vulnerability, the research group tested their web-based technique on a handful of Kias—rentals, friends’ cars, even cars on dealer lots—and found that it worked in every case. They also showed the technique to WIRED, demonstrating it on the 2020 Kia Soul of a security researcher introduced to them just minutes earlier in a parking lot in Denver, Colorado, as seen in the video above.

The group’s web-based Kia hacking technique doesn’t give a hacker access to driving systems like steering or brakes, nor does it overcome the so-called immobilizer that prevents a car from being driven away, even if its ignition is started. It could, however, have been combined with immobilizer-defeating techniques popular among car thieves or used to steal lower-end cars that don't have immobilizers—including some Kias.

Even in cases when it didn't allow outright theft of a car, the web flaw could have created significant opportunities for theft of a car's contents, harassment of drivers and passengers, and other privacy and safety concerns.

“If someone cut you off in traffic, you could scan their license plate and then know where they were whenever you wanted and break into their car,” says Curry. “If we hadn’t brought this to Kia’s attention, anybody who could query someone’s license plate could essentially stalk them.” For Kias that come installed with a 360-degree camera, that camera, too, was accessible to hackers. Beyond allowing the hijacking of connected features in cars themselves, Curry says, the web portal flaw also allowed hackers to query a broad range of personal information about Kia customers—names, email addresses, phone numbers, home addresses, and even past driving routes in some cases—a potentially massive data leak.

The Kia hacking technique the group found works by exploiting a relatively simple flaw in the backend of Kia's web portal for customers and dealers, which is used to set up and manage access to its connected car features. When the researchers sent commands directly to the API of that website—the interface that allows users to interact with its underlying data—they say they found that there was nothing preventing them from accessing the privileges of a Kia dealer, such as assigning or reassigning control of the vehicles' features to any customer account they created. “It’s really simple. They weren't checking if a user is a dealer,” says Rivera. “And that's kind of a big issue.”

Kia's web portal allowed lookups of cars based on their vehicle identification number (VIN). But the hackers found they could quickly find a car's VIN after obtaining its license plate number using the website PlateToVin.com.

More broadly, Rivera adds, any dealer using the system seemed to have been trusted with a shocking amount of control over which vehicles' features were linked with any particular account. “Dealers have way too much power, even over vehicles that don’t touch their lot,” Rivera says.

**A Dozen Carmakers Websites, Millions of Hackable Cars**

Curry and Rivera, who worked with two other researchers to develop their hacking technique, reported their findings to Kia shortly after demonstrating them to WIRED in June, and the company responded to an inquiry from WIRED to note that it was investigating their findings. “We take this matter very seriously, and value our collaboration with security researchers,” a spokeperson wrote.

Shortly after the researchers reported the issue, Kia did make a change to its web portal API that appeared to block their technique, the researchers say. Then, in August, Kia told the researchers it had validated their findings but was still working on implementing a permanent fix for the problem. Kia hasn't updated the researchers since or responded to WIRED's questions. But after the standard 90-day window given to companies to fix security issues that researchers report, the hackers decided to go public with their findings—though they haven't released their Kia-hacking proof-of-concept application and don't plan to.

The Kia-hacking research group first began to assemble around the idea of probing carmakers' websites and APIs for vulnerabilities in late 2022. A few of them were staying with a friend on a college campus and messing around with the app for a mobile scooter company when they accidentally triggered all the company's scooters across the campus to honk and flash their lights for 15 minutes. At that point, the group “became super interested in trying more ways to make more things honk,” as Curry would write—including vehicles more significant than scooters. Soon after, Curry discovered that Rivera, who'd long been focused on car hacking and had previously worked at the carmaker Rivian, was already looking at web vulnerabilities in vehicle telematics.

In January 2023, they published the initial results of their work, an enormous collection of web vulnerabilities affecting Kia, Honda, Infiniti, Nissan, Acura, Mercedes-Benz, Hyundai, Genesis, BMW, Rolls Royce, and Ferrari—all of which they had reported to the automakers. For at least half a dozen of those companies, the web bugs the group found offered at least some level of control of cars' connected features, they wrote, just as in their latest Kia hack. Others, they say, allowed unauthorized access to data or the companies' internal applications. Still others targeted fleet management software for emergency vehicles and could have even prevented those vehicles from starting, they believe—though they didn't have the means to safely test out that potentially dangerous trick.

In June of this year, Curry says, he discovered that Toyota appeared to still have a similar flaw in its web portal that, in combination with a leaked dealer credential he found online, would have allowed remote control of Toyota and Lexus vehicles' features like tracking, unlocking, honking, and ignition. He reported that vulnerability to Toyota and showed WIRED a confirmation email seeming to demonstrate that he'd been able to reassign himself control of a target Toyota's connected features over the web. Curry didn't film a video of that Toyota hacking technique before reporting it to Toyota, however, and the company quickly patched the bug he'd disclosed, even temporarily taking its web portal offline to prevent its exploitation.

“As a result of this investigation, Toyota promptly disabled the compromised credentials and is accelerating security enhancements of the portal, as well as temporarily disabling the portal until enhancements are complete,” a Toyota spokesperson wrote to WIRED in June.

**More Smart Features, More Dumb Bugs**

The extraordinary number of vulnerabilities in carmakers' websites that allow remote control of vehicles is a direct result of companies' push to appeal to consumers—particularly young ones—with smartphone-enabled features, says Stefan Savage, a professor of computer science at UC San Diego whose research team was the first to hack a car's steering and brakes over the internet in 2010. “Once you have these user features tied into the phone, this cloud-connected thing, you create all this attack surface you didn’t have to worry about before,” Savage says.

Still, he says, even he is surprised at the insecurity of all the web-based code that manages those features. “It’s a little disappointing that it’s as easy to exploit as it has been,” he says.

Rivera says he's observed firsthand in his time working in automotive cybersecurity that car companies often put more focus on “embedded” devices—digital components in non-traditional computing environments like cars—rather than web security, in part because updating those embedded devices can be far more difficult and lead to recalls. “It was clear ever since I started that there was a glaring gap between embedded security and web security in the auto industry,” Rivera says. “These two things mix together very often, but people only have experience in one or the other.”

UCSD's Savage hopes that the Kia-hacking researchers' work might help shift that focus. Many of the early, high-profile hacking experiments that affected cars' embedded systems, like the 2015 Jeep takeover and the 2010 Impala hack pulled off by Savage's team at UCSD, persuaded automakers that they needed to better prioritize embedded cybersecurity, he says. Now car companies need to focus on web security too—even, he says, if it means making sacrifices or changes to their process.

“How do you decide, ‘We’re not going to ship the car for six months because we didn’t go through the web code?’ That’s a a tough sell,” he says. “I would like to think this kind of event causes people to look at that decision more fully.”

Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug

The US government says outlets like RT work closely with Russian intelligence, and platforms have removed or banned their content. But they’re still influential all around the world.

In the lead-up to the 2024 elections, the Biden administration has taken aim at several Russian information operations. Earlier in September, the Department of Justice unsealed an indictment against two employees of RT, a Russian state-backed news network formerly known as Russia Today. At the heart of the indictment was Tenet Media, a company promoting content from right-wing influencers. RT, prosecutors say, largely funded Tenet, and its employees “edited, posted, and directed” content. (The individual influencers deny they knew about the company’s ties to Russia.)

Last week, Meta announced that it would ban RT and other media outlets backed by the Russian state from its platforms. Meanwhile, YouTube said it removed more than 230 channels with connections to Russian-backed media. Those decisions followed the US State Department imposing sanctions on Russian state media, saying that in addition to spreading disinformation about the war in Ukraine, RT was supporting a crowdfunding effort to support the Russian military’s invasion and had developed operations directly tied to Russia’s intelligence agencies.

“These Kremlin-backed media outlets are not only playing this covert influence role to undermine democracy in the United States, but also to meddle in the sovereign affairs of countries around the world,” said Secretary of State Antony Blinken at the time. “As part of RT’s expanded capabilities, the Russian government embedded within RT a unit with cyber operational capabilities and ties to Russian intelligence. RT’s leadership had direct, witting knowledge of this enterprise.”

“Meta's ban of RT and other Russian state media stings a lot because that has been a core channel for the spread of Russian propaganda,” says Samuel Woolley, associate professor and founder of the Propaganda Research Lab at the University of Pittsburgh.

In the US, RT pulled in former war reporter Chris Hedges and late night host Larry King before it lost most of its broadcast access following Russia’s 2022 invasion of Ukraine. But while the sanctions and deplatforming are certainly a blow to propaganda efforts directed at the US—Russian state media has seen some real success on social media—experts who spoke to WIRED say that it by no means will cap the outlets’ reach. RT is well regarded in other parts of the world, particularly in Africa and Latin America, and Spanish language speakers make up the outlet’s largest market outside Russia. It has also invested heavily in old school television infrastructure, with offices in Havana, Buenos Aires, Cairo, Delhi, Algiers, and many other locations that will likely continue to operate unhindered, and offers services in French, German, and Arabic, in addition to English.

“English language speakers haven't been the primary target of RT or Russian media's propaganda efforts,” says Woolley. “And they’ve been building capacity for nearly two decades across Latin America, portions of Africa, and elsewhere in the world. And that has meant in those places that RT and Sputnik have almost become like a fixture of everyday life.”

In Latin America alone, RT’s channels run 24/7, and reported 18 million viewers in 2018. African Stream, which was also named by the State Department as part of Russian state media’s influence architecture and later removed by YouTube and Meta, garnered 460,000 followers on YouTube in the two years it was up and running. And Woolley notes that in these markets, there is likely less competition for viewership than there is in the saturated US media landscape.

“\[Russian media\] made headway in limited media ecosystems, where its attempts to control public opinion are arguably much more effective,” he says. Russian media particularly hones in on anticolonial, anti-Western narratives that can feel particularly salient in markets that have been deeply impacted by Western imperialism. The US also has state-funded media that operates in foreign countries, like Voice of America, though according to the organization’s website, the 1994 US International Broadcasting Act “prohibits interference by any US government official in the objective, independent reporting of news.”

Rubi Bledsoe, a research associate at Center for Strategic and International Studies, says that even with Russian state media removed from some social platforms, its messages are still likely to spread in more covert ways, through influencers and smaller publications with which it has cultivated relationships.

“Not only was Russian media good at hiding that they were a Russian government entity, on the side they would seed some of their stories to local newspapers and local media throughout the region,” she says, noting that the large South American broadcasting corporation Telesur would sometimes partner with RT. (Other times, Russia will back local outlets like Cameroon’s Afrique Média). “All of these secondary and tertiary news outlets are a lot smaller, but can talk to parts of the local population,” she says.

Russian media has also helped cultivate local influencers who often align with its messaging. Bledsoe points to Inna Afinogenova, a Russian Spanish-language broadcaster who previously worked for RT but now has her own independent YouTube channel where she has more than 480,000 followers. (Afinogenova left RT after saying she disagreed with the war in Ukraine.)

And Bledsoe says that the ban from the US might actually be a boon for Russian media in the parts of the world where it’s actively trying to cultivate its image as a trusted media brand. “The narratives that were shared through RT and other Russian media and in Iranian media as well, it's a kind of anti-imperialist dig at the West, and the US,” she says. “Saying the US is the driving force behind this international system and they’re plotting, and they’re out to get you, to impose on other countries’ sovereignty.”

Though Meta was a key avenue for the spread of Russian state media content, it still has a home on other platforms. RT does not appear to have a verified TikTok account, but accounts that exclusively post RT content, like @russian\_news\_ and @russiatodayfrance have tens of thousands of followers on the app. African Stream’s TikTok is still live with nearly 1 million followers. TikTok spokesperson Jamie Favazza referred WIRED to the company’s policies on election-related mis- and disinformation.

A post on X from RT’s account on September 18, the day after the ban, linked to its accounts on platforms like right-wing video sharing platform Rumble, X, and Russian YouTube alternative VK. (RT has 3.2 million followers on X and 125,000 on Rumble.) “Meta can ban us all it wants,” the post read. “But you can always find us here.” X did not respond to a request for comment.

Russia-Backed Media Outlets Are Under Fire in the US—but Still Trusted Worldwide

Plus: The FBI dismantles the largest-ever China-backed botnet, the DOJ charges two men with a $243 million crypto theft, Apple’s MacOS Sequoia breaks cybersecurity tools, and more.

The week was dominated by news that thousands of pagers, walkie-talkies and other devices were exploding across Lebanon on Tuesday and Wednesday in an attack targeting the militant group Hezbollah. At least 32 people were killed, including at least four children, and more than 3,200 people were injured. The covert campaign has widely been attributed to Israel, though none of the country's government agencies have commented.

In addition to the carnage, the attacks have—seemingly by design—had the effect of sowing paranoia and fear, not just among members of Hezbollah but also in the general Lebanese public. Hardware and warfare experts say that the incident is unlikely to establish a global precedent that people's most trusted communication devices and electronics, like smartphones, are rigged with explosives left and right. But it does create the potential to inspire copycats and puts defenders on notice that such attacks are possible.

Researchers say that China’s 2023 Zhujian Cup, a hacking competition with ties to the country's military, took the unusual step of requiring participants to keep the content of the exercise secret—and they may have been targeting a real victim as part of the event. Apple’s new stand-alone app Passwords that launched with iOS 18 may help solve your login problems. And a now-deleted post from billionaire Elon Musk that questioned why no one has attempted to assassinate Joe Biden and Kamala Harris renewed concerns this week that Musk is willing to inspire extremist violence and is a national security threat in the United States.

And there's more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Last month, media outlets, Microsoft, and Google warned that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump political campaigns, and that it had successfully stolen emails from the Trump campaign that were later shared with reporters. Now the FBI has chimed in with the added revelation that the same hackers also sent those stolen Trump communications to the Democrats, too—though for now there's no sign that the Democrats solicited those emails from the Iranians or necessarily even received the Iranians' message.

Republicans were nonetheless quick to compare the news to accusations that the Trump campaign “colluded” with the Russian hackers, part of the Kremlin's GRU military intelligence agency, who breached the Democratic National Committee and the Clinton Campaign in 2016 to carry out a hack-and-leak operation. In a statement, the Trump campaign demanded that the Democrats “must come clean on whether they used the hacked material.” The Harris campaign told CNN that it has cooperated with law enforcement and that it was “not aware of any material being sent directly to the campaign,” believing the emails to be spam or phishing attempts. “We condemn in the strongest terms any effort by foreign actors to interfere in US elections, including this unwelcome and unacceptable malicious activity,” Morgan Finkelstein, the national security spokesperson for the Harris campaign, told CNN.

**FBI Dismantles the Largest-Ever Chinese State-Sponsored Botnet**

The FBI announced this week that it had taken down a network of hacked machines being secretly controlled by a Chinese state-sponsored hacking group known as Flax Typhoon. The botnet, made up of 260,000 routers and internet-of-things devices, was allegedly being run by a Chinese contractor known as the Beijing Integrity Technology Group, a rare instance of a known, publicly traded company operating essentially a massive collection of hacked devices on behalf of the Chinese state. The botnet, according to the FBI and security firm Black Lotus Labs, had been used to hack government agencies, defense contractors, telecoms, and other US and Taiwanese targets. At the time of its takedown, the botnet still encompassed 60,000 machines, making it the largest Chinese state-sponsored botnet ever, according to Black Lotus Labs.

**Two Men Charged With Stealing $243M in Cryptocurrency Using Social Engineering Scam**

On Wednesday night, two young men were arrested after they allegedly stole hundreds of millions of dollars of cryptocurrency and spent the earnings on luxury cars, watches, jewelry, and designer handbags. In an unsealed indictment, the US Department of Justice charged Malone Lam, 20, known online as “Anne Hathaway” and Jeandiel Serrano, 21, aka “VersaceGod,” with stealing $243 million in cryptocurrency and laundering the proceeds through mixing services to conceal the origin.

CoinDesk reported that the men allegedly tricked the heist’s victim, a creditor of the now-defunct trading firm Genesis, using a social engineering scam that led them to reset their Gemini two-factor authentication and transfer 4,100 bitcoin to a compromised wallet. An analysis of the transaction by blockchain investigator ZachXBT revealed that the $243 million was divided among multiple wallets and then distributed to over 15 exchanges.

**Apple MacOS Update Breaks Some Cybersecurity Tools**

On Thursday, TechCrunch reported that Apple's latest desktop operating system update, macOS 15 (Sequoia), breaks some functionality of major security tools made by CrowdStrike, SentinelOne, and Microsoft. It’s unclear what specifically in the update is causing the issues, but social media posts and internal Slack messages reviewed by the tech outlet show that the update has frustrated engineers working on macOS-focused security tools.

A CrowdStrike sales engineer informed colleagues via Slack, as seen by TechCrunch, that the company would not be able to support Sequoia on day one, despite its usual practice of quickly supporting new OS releases. While they hope for a quick patch, they will likely need to scramble to resolve the issue with an update in their own code, assuming no immediate fix is available from Apple, which has not yet commented on the issue.

**Leader of Crypto Extortion Gang Sentenced to 47 Years**

Cryptocurrency theft has become practically a common-garden form of cybercrime. But one brutal gang took that form of thievery to a new level of cruelty and violence, breaking into a series of victims' homes to threaten and extort them into handing over their crypto holdings, sometimes even resorting to kidnapping and torture. This week, that disturbing story came to a close with the sentencing of the group's ring leader, a Florida man named Remy St. Felix, to 47 years in prison. St. Felix is one of 12 members of the gang to have now been charged, convicted, and sentenced. Prior to the home invasions that St. Felix led, another member of the group named Jarod Seemungal allegedly stole millions with more traditional crypto hacking techniques. But St. Felix's more violent, offline extortion attempts netted his gang only around $150,000 in cryptocurrency before they were caught and sentenced to years behind bars. The lesson: Crime doesn't pay—or at least, not the physical kind.

Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

The explosion of thousands of rigged pagers and walkie-talkies will likely make Hezbollah operatives fear any means of electronic communication. It’s having the same effect on the Lebanese population.

“They don't trust their smartphones, so they reach back to these more archaic devices, and those blow up. What's next?” says Schneier. “Everything becomes less efficient, because they can't communicate well.”

Schneier describes the paranoia-inducing effect of the operation as a kind of ongoing “tax” on Hezbollah as an organization. “There are a lot of things you can't do if you can't trust your comms,” he says. Schneier compares the end result to the nearly incommunicado state of a hunted figure like Osama bin Laden, who in his final years was reduced to sending messages only via the human couriers who visited his secret compound in Pakistan.

That paranoia, in fact, has been seeded among Lebanon's population for years. Israel's pager- and walkie-talkie-based attacks follow repeated public warnings from Hezbollah leader Hassan Nasrallah about the surveillance dangers of smartphones, given Israeli intelligence's well-known hacking prowess. “Please break it, bury it, lock it up in a metal box,” Nasrallah said in one speech. In another, he appeared on Lebanese television next to an image of an iPhone circled in red with a slash across it. “These are deadly spies,” he warned. Cell phones were reportedly banned from Hezbollah meetings in favor of pagers.

Now the older, alternative devices Hezbollah has fallen back to carry even greater fears of injury or death. And that fear has come to encompass communications electronics more broadly: At Wednesday's funeral for victims of Tuesday's attack, for instance—an event that was itself the target of another attack—attendees were asked to remove the batteries from their phones.

Creating distrust of communication devices within Hezbollah may well be Israel's purposeful tactic of “preparing the battle space” ahead of impending Israeli military operations against Lebanon, says Thomas Rid, a professor of strategic studies at Johns Hopkins University and author of _Active Measures_, who specializes in disinformation and influence operations. He compares the operation to cyberattacks or physical attacks on “command-and-control” infrastructure at the beginning of a conflict, such as the United States' efforts, documented in former NSA chief Michael Hayden's book _Playing to the Edge_, to destroy the Iraqi military's fiber-optics-based communications in 2003 in order to “herd” the enemy's military toward more easily intercepted radio-based communications.

“This is taking attacks on command-on-control to a whole new level,” Rid says. “They sent the message: ‘No, we’re not just penetrating these devices and bugging them, we're literally blowing them up, taking away the confidence you might have had in your command-and-control and also in any future devices that you might procure.’”

For Israeli intelligence, Rid notes, the attack also represents a stunning reassertion of its power and public image following its disastrous failure to prevent Hamas' attacks of October 7. “This operation goes a long way in terms of demonstrating that they are, perhaps, the most creative and the most ruthless intelligence establishment on the planet right now,” he says.

Thanks to the collateral damage of Israel's brazen offensive, however, its effects—both physical and psychological—have by no means been limited to Hezbollah operatives. The French-Lebanese security researcher Kobeissi, who now works as the founder and CEO of Paris-based tech firm Symbolic Software, says he's already seen false rumors and misleading videos spread among Lebanese people, suggesting for instance that iPhones, too, are exploding. “People are losing their minds, because it's scary as shit, and that's the point,” he says. “It's impossible to think about this as limiting Hezbollah's communications and capabilities without realizing it's also going to have a terrorizing effect on the adjacent population.”

Kobeissi argues that the attack's collateral damage will shape how a generation of people think about Western technology in Lebanon and beyond. “The average Lebanese person doesn't have a specific understanding of what it means to conduct a supply chain attack,” he says. “What they see is that a device made by an American ally, a device they rely on, may blow up. And it's unfortunate that the Israeli intelligence community didn't consider the knock-on effects that this could have globally.”

Aside from that issue of trust, Israel's attack also represents an escalation, says Harvard's Bruce Schneier—a new kind of attack that, now that it's been demonstrated, is sure to be seen again in some form, perhaps even in an act of retaliation against Israel itself.

“It’s not just Hezbollah that should worry. If I were Ukraine, I’d be worried. If I were Russia, I’d worry. If I were Israel, I’d worry. This doesn’t just go one way,” he says. “Now we all live in a world of connected devices that can be weaponized in unexpected ways. What does that world look like?”

First Israel’s Exploding Pagers Maimed and Killed. Now Comes the Paranoia

Thousands of beepers and two-way radios exploded in attacks against Hezbollah, but mainstream consumer devices like smartphones aren’t likely to be weaponized the same way.

For two days this week, Hezbollah has been rocked by a series of small explosions across Lebanon, injuring thousands and killing at least 25. But these attacks haven’t come from rockets or drones. Instead, they’ve resulted from boobytrapped electronics—including pagers, walkie-talkies, and even, reportedly, solar equipment—detonating in coordinated waves. As details come into view of the elaborate supply chain attack that compromised these devices, citizens on the ground in Lebanon and people around the world are questioning whether such attacks could target any device in your pocket.

The campaign to compromise key Hezbollah communication infrastructure with explosives was clearly elaborate and involved. The operation, which is widely believed to have been perpetrated by Israel, goes far beyond past examples of hardware supply chain attacks and may be a source of inspiration for future spycraft around the world. But sources tell WIRED that the specific scale and scope of the effort would not be easily replicated in other contexts. And, more broadly, the resources and precision involved in carrying out such an attack would be prohibitively difficult to maintain over time for key consumer devices like smartphones—which are used so widely and regularly scrutinized by researchers, product testers, and repair technicians.

“I do think there is absolutely potential to see more of this in the longer term, not targeting civilians, but generally targeting other military actors,” says Zachary Kallenborn, an adjunct nonresident fellow with the Center for Strategic and International Studies. Kallenborn says militaries are increasingly relying on commercial technology—from drones to communications devices—all of which could be compromised if supply chains can be exploited by adversaries. “These systems are being sourced from all over the globe,” he says. “What that means, then, is that you also have these global supply chains supporting them.”

While full details of the attacks are still coming to light, the devices that detonated were seemingly compromised with explosives before they arrived in Hezbollah members’ hands. Alan Woodward, a cybersecurity professor at the University of Surrey, says he suspects that an attacker would plant explosives in a device during the manufacturing process, rather than intercepting gadgets after they are finished and then taking them apart to plant explosives. Reporting by the New York Times on Wednesday evening seemed to confirm this theory, indicating that Israel directly manufactured the compromised devices via shell companies. Israel has not commented on any of the attacks.

Early theories that cyberattacks caused device batteries to overheat and explode have been ruled out by cybersecurity experts. The force of the blasts seen in on-the-ground footage would not be consistent with battery fires or explosions, especially given the small size of pager and walkie-talkie batteries.

Lebanon’s political landscape and ongoing economic crisis, coupled with regional fighting between Hezbollah and Israel, created specific opportunities for sabotage. Hezbollah is isolated globally, with countries like the United States and United Kingdom classifying it as a terrorist organization while other countries, such as Russia and China, maintain relations. This impacts Hezbollah’s avenues for importing equipment and vetting suppliers.

Amid ongoing violent conflict with Israel, Hezbollah’s digital communications and activities are also under constant barrage from Israeli hackers. In fact, this constant digital assault reportedly played a role in pushing Hezbollah away from smartphone communication and toward pagers and walkie-talkies in the first place. “Your phone is their agent,” Hezbollah leader Hassan Nasrallah said in February, referring to Israel.

The commercial spyware industry has shown it is possible to fully compromise target smartphones by exploiting chains of vulnerabilities in their mobile operating systems. Developing spyware and repeatedly finding new operating system vulnerabilities as older ones are patched is a resource-intensive process, but it is still less complicated and risky than conducting a hardware supply chain attack to physically compromise devices during or shortly after manufacturing. And for an attacker, monitoring a target’s entire digital life on a smartphone or laptop is likely more valuable than the device’s potential as a bomb.

“I’d hazard a guess that the only reason we aren’t hearing about exploding laptops is that they’re collecting too much intelligence from those,” says Jake Williams, vice president of research and development at Hunter Strategy, who formerly worked for the US National Security Agency. “I think there’s also potentially an element of targeting, too. The pagers and personal radios could pretty reliably be expected to stay in the hands of Hezbollah operatives, but more general purpose electronics like laptops could not.”

There are other more practical reasons, too, that the attacks in Lebanon are unlikely to portend a global wave of exploding consumer electronics anytime soon. Unlike portable devices that were originally designed in the 20th century, the current generation of laptops and particularly smartphones are densely packed with hardware components to offer the most features and the longest battery life in the most efficient package possible.

University of Surrey’s Woodward, who regularly takes apart consumer devices, points out that within modern smartphones there is very limited space to insert anything extra, and the manufacturing process can involve robots precisely placing components on top of each other. X-rays show how tightly packed modern phones are.

“When you open up a smartphone, I think the only way to get any sort of meaningful amount of high explosive in there would be to do something like replace one of the components,” he says, such as modifying a battery to be half battery, half explosives. But “replacing a component in a smartphone would compromise its functionality,” he says, which could lead a user to investigate the malfunction.

In contrast, the model of pager linked to the explosions—a “rugged” device with 85 days of battery life—included multiple replaceable parts. Ang Cui, founder of the embedded device security firm Red Balloon Security, examined the schematics of the pager model apparently used in the attacks and told WIRED that there would be free space inside to plant explosives. The walkie-talkies that exploded, according to the manufacturer, were discontinued a decade ago. Woodward says that when opening up redesigned, current versions of older technologies, such as pagers, many internal electronic components have been “compressed” down as manufacturing methods and processor efficiency have improved.

Smartphone production lines also operate under stricter security measures, especially for high-cost devices like Apple’s iPhones and Google’s flagship Pixel phones. This is partly to guarantee production quality, but also to ensure that employees don’t leak trade secrets or prototypes. Not all low-end Android phones are manufactured with such intense oversight, but it would be more difficult to secretly take over manufacturing of a smartphone than a forgotten pager model. In countries like China, where many devices are manufactured, there is always the possibility of a domestic operation to plant backdoors, but such a scheme would need to be elaborate to skirt international scrutiny of the devices

To find exploding cell phones, you have to go back to 20th century tech. In 1996, Palestinian bombmaker Yahya Ayyash was killed when his mobile phone exploded as he answered a call. His old-style phone—which the New York Times said was ”reportedly a small, slim model that fits in a pocket”—had 50 grams of explosives planted inside it, likely by Israel’s security services. The explosion was reportedly triggered by a radio signal emitted from a plane flying above. And unlike the pager and walkie-talkie attacks this week, Ayyash’s phone was part of a highly targeted attack on him alone.

Even if this week’s exploding device campaign doesn’t have immediate implications for every smartphone in every pocket, though, it expands enormously the specter of hardware supply chain attacks.

“I think that every shady organization worldwide will now be checking their new devices—especially those ordered in bulk from the manufacturer—for explosives,” says a longtime hardware hacker and tech procurement specialist who asked to be identified as Null Pointer. “This hit so hard because it was novel and no one in that community knew to look for it. It's ingenious.”

Your Phone Won’t Be the Next Exploding Pager

In a second attack on Hezbollah members, two-way radios detonated around Lebanon on Wednesday, causing injuries and multiple deaths.

With Hezbollah and Lebanon still reeling from a coordinated wave of pager explosions on Tuesday that killed at least 12 people and injured thousands, another bombardment began on Wednesday, this time taking the form of exploding two-way radios. Footage of the explosions, which was not independently confirmed by WIRED, appears to show even larger blasts than those that emanated from the booby-trapped pagers.

Lebanon’s official news agency also reported exploding home solar systems less than two hours after the radio detonations began on Wednesday, according to the Associated Press. Details of the alleged solar equipment attacks were still developing at the time of publication.

The walkie-talkie explosions appeared to have been orchestrated the same way as the attack on Tuesday, which was likely carried out by intercepting new pagers at some point in their journey through the supply chain and modifying them to add explosive material. Hezbollah had reportedly expanded its use of pagers recently in an attempt to secure communications after the group feared that other channels had been infiltrated by Israeli intelligence. Reuters reported on Wednesday that Hezbollah purchased the walkie-talkies about five months ago as part of the same initiative that led the group to purchase the pagers.

In a statement after Wednesday’s explosions, Lebanon’s Health Ministry said more than 300 people had been injured and nine people had died, with incidents being reported in several regions of the country. The Lebanese Red Cross said more than 30 ambulances were involved in the treatment of people injured.

Though details of Wednesday’s attack are still emerging, the perpetrator of Tuesday’s exploding pager operation is widely believed to be Israel. Fighting between Israel and Hezbollah, which is backed by Iran, has intensified over the past year since Hamas’ October 7 attack on Israel. On Tuesday, Hezbollah blamed Israel for the “criminal aggression that targeted civilians too.”

“I'm floored by the sophistication of this operation,” says Jake Williams, vice president of research and development at Hunter Strategy, who formerly worked for the US National Security Agency. “The scale of this supply chain compromise is unprecedented. It's hard to imagine what technology Hezbollah could consider ‘safe’ at this point.”

Photos and videos posted to social media on Wednesday appeared to show handheld radios, or walkie-talkies, in various states of destruction. In many of the images, the devices, which are larger and bulkier than smartphones, had one side of their casing removed. Middle East experts citing local media reports noted that cars, scooters, and even buildings appear to have been damaged by tampered devices.

“From what we are seeing, including images circulating on social media, the devices exploding are handheld radios, possibly an Icom model,” says Michael Horowitz, head of intelligence at the risk management company Le Beck International.

The second round of explosions on Wednesday indicates that whoever conducted the sabotage and attacks likely had deeply rooted access and knowledge of Hezbollah’s infrastructure and operations. “This shows an even deeper penetration that may have relied on multiple fronts and multiple vectors (different electronic devices and providers),” Horowitz says. “This is unheard of.”

Israel has not yet commented on any of the attacks, and the Israel Defense Forces did not immediately respond to WIRED’s request for comment about the second round of explosions.

The pagers that exploded on Tuesday were mostly Gold Apollo AR-924 model pagers, which the Taiwan-based company says were produced by a third-party firm, Hungary-based BAC Consulting. The New York Times reports that 1 to 2 ounces of explosive were inserted in the pagers before they were distributed to members of Hezbollah. A person listed as the CEO of BAC Consulting did not respond to WIRED’s request for comment. A Hungarian government spokesperson has claimed the company is a “trading intermediary” and does not have a “manufacturing or operational site in Hungary.”

Following the first round of explosions on Tuesday, Human Rights Watch called for an investigation, saying it was not possible to locate all the sabotaged pagers and, as a result, they could end up striking “military targets and civilians without distinction.”

“Customary international humanitarian law prohibits the use of booby traps—objects that civilians are likely to be attracted to or are associated with normal civilian daily use—precisely to avoid putting civilians at grave risk and produce the devastating scenes that continue to unfold across Lebanon today,” Lama Fakih, the group’s Middle East and North Africa director said in a statement.

US secretary of state Anthony Blinken on Wednesday denied the US had advance knowledge of Tuesday’s attack.

“The United States did not know about, nor was it involved in, these incidents,” he said at a conference in Cairo, Egypt. “We’re still gathering the information and gathering the facts.”

Walkie-Talkies Explode in New Attack on Hezbollah

Participants in a hacking competition with ties to China’s military were, unusually, required to keep their activities secret, but security researchers say the mystery only gets stranger from there.

Capture the flag hacking contests at security conferences generally serve two purposes: to help participants develop and demonstrate computer hacking and security skills, and to assist employers and government agencies with discovering and recruiting new talent.

But one security conference in China may have taken its contest a step further—potentially using it as a secret espionage operation to get participants to collect intelligence from an unknown target.

According to two Western researchers who translated documentation for China’s Zhujian Cup, also known as the National Collegiate Cybersecurity Attack and Defense Competition, one part of the three-part competition, held last year for the first time, had a number of unusual characteristics that suggest its potentially secretive and unorthodox purpose.

Capture the flag (CTF) and other types of hacking competitions are generally hosted on closed networks or “cyber ranges”—dedicated infrastructure set up for the contest so that participants don’t risk disrupting real networks. These ranges provide a simulated environment that mimics real-world configurations, and participants are tasked with finding vulnerabilities in the systems, obtaining access to specific parts of the network, or capturing data.

There are two major companies in China that set up cyber ranges for competitions. The majority of the competitions give a shout out to the company that designed their range. Notably, Zhujian Cup didn’t mention any cyber range or cyber range provider in its documentation, leaving the researchers to wonder if this is because the contest was held in a real environment rather than a simulated one.

The competition also required students to sign a document agreeing to several unusual terms. They were prohibited from discussing the nature of the tasks they were asked to do in the competition with anyone; they had to agree not to destroy or disrupt the targeted system; and at the end of the competition, they had to delete any backdoors they planted on the system and any data they acquired from it. And unlike other competitions in China the researchers examined, participants in this portion of the Zhujian Cup were prohibited from publishing social media posts revealing the nature of the competition or the tasks they performed as part of it.

Participants also were prohibited from copying any data, documents, or printed materials that were part of the competition; disclosing information about vulnerabilities they found; or exploiting those vulnerabilities for personal purposes. If a leak of any of this data or material occurred and caused harm to the contest organizers or to China, according to the pledge that participants signed, they could be held legally responsible.

“I promise that if any information disclosure incident (or case) occurs due to personal reasons, causing loss or harm to the organizer and the country, I, as an individual, will bear legal responsibility in accordance with the relevant laws and regulations,” the pledge states.

The contest was hosted last December by Northwestern Polytechnical University, a science and engineering university in Xi'an, Shaanxi, that is affiliated with China’s Ministry of Industry and Information Technology and also holds a top-secret clearance to conduct work for the Chinese government and military. The university is overseen by China’s People’s Liberation Army.

Neither the university nor several cosponsors of the contest responded to WIRED’s inquiry about the competition.

Dakota Cary, a strategic advisory consultant at security firm Sentinel One, and Eugenio Benincasa, senior cyber defense researcher at the Center for Security Studies at ETH Zurich university in Switzerland, discovered the unusual contest and its requirements while researching China’s hacking competitions. The two have written a report for the Atlantic Council and plan to present their findings on Thursday at the Labscon security conference in Arizona.

They acknowledge that there is no hard evidence that the competition was used to attack a real-world target and that the evidence they do have is circumstantial. But they said they are 85 percent confident that this is what occurred because no alternative explanations make sense.

“There are a lot of good alternative explanations, and none of them have supporting evidence,” says Cary, who is fluent in Mandarin and has studied China’s offensive hacking capabilities extensively for years.

One possible alternative is that the target of the attack was a domestic company or organization that cooperated with the contest in order to give students experience in finding vulnerabilities in a real network and also provide the company with a threat assessment that could help it better secure its network against real-world adversaries.

Cary, however, says such exercises in China are called “crowd-testing” contests. But nowhere in the description of the Zhujian Cup does this phrase appear. “If it’s a real CTF exercise, why are \[participants\] deleting data and … backdoors?” he asks. And why are students told they could be held legally responsible if data or material they possess as part of the competition gets leaked? And if the students were attacking a target inside a cyber range, how could this cause “loss or harm to the organizer and the country,” per the wording in the pledge?

The competition was held on a weekend over the New Year’s holiday last year, on December 30 and 31. If the target was indeed a real-world network, the researchers note that holidays are often a time when security teams are short-staffed or less attentive and alert to intrusions. About 200 students from 29 schools participated in the weekend competition, which consisted of three parts, according to a description of the contest published by the school: a theoretical knowledge competition, a vulnerability discovery contest, and a “public-network target, actual combat attack competition.” The latter is the portion that Cary and Benincasa believe focused on a real-world target.

The researchers surveyed more than 120 capture-the-flag competitions organized in China since 2004—many of them held annually—to understand how the country has used such competitions to recruit talent and expand its cyber offensive and defensive capabilities. They say that China really began to focus on developing its cyber talent in 2015, after the Edward Snowden leaks had exposed the extensive hacking operations conducted by the US National Security Agency for intelligence purposes.

To strengthen its cyber defenses, China focused on revamping and expanding cybersecurity education programs and recruitment efforts between 2015 and 2021. A big part of the latter included the development and regulation of capture-the-flag competitions.

CTFs aren’t unique to China, of course; they are held around the world, including in the US, where one of the oldest—held annually at the Defcon hacking conference in Las Vegas—has existed for nearly two decades. The US government also hosts hackathons to help recruit talent, though not at the scale of China.

Since 2014, the researchers say, more than 540 capture-the-flag rounds of competition have occurred in China. The most intense activity began in 2018, which is also when China’s Central Cyberspace Affairs Commission and Ministry of Public Security issued a notice about the regulation and promotion of such contests. Now Chinese nationals must apply to the MPS for permission to participate in hacking competitions outside of China. Chinese leaders noticed Chinese students and security professionals were having great success competing in hacking competitions internationally and realized that each time someone from China won one of these competitions, the country was losing a potentially valuable asset with the vulnerabilities they disclosed as part of the contest. Now any vulnerabilities discovered by a Chinese national must be reported to the government and not disclosed publicly.

But importantly, China’s efforts in building its domestic capture-the-flag contests means that today it has one of the most robust hacking contest ecosystems in the world, the researchers say, including sector-specific ones for health care and law enforcement. The researchers estimate that about 300,000 people have participated in the contests over the last decade, but the researchers found only four that are open to students. The contests are led by universities across the country while also being supported by companies and the government. Contest winners and others who demonstrate good skill get entered into a national database.

Cary says that if the Zhujian Cup did involve a live target, it’s “remarkable” that the organizers put students in a position that could make them legally culpable if they got caught. But if so, it wouldn’t be the first time the government used students for intelligence operations. In 2022, the Financial Times reported that China had recruited unwitting university students to translate documents and data stolen in espionage operations conducted by the country’s hacking teams, reportedly without telling the students the source of the material.

This also may not be the first time a hacking competition in China played a role in a real-world breach subsequently attributed to China. In 2015, researchers at Threat Connect found curious evidence of a possible overlap between the TOPSEC Cup hacking competition coordinated by China’s Southeast University in 2014 and the subsequent hack of health care giant Anthem that same year. Southeast has financial connections to China’s civilian intelligence agency, the Ministry of State Security.

Did a Chinese University Hacking Competition Target a Real Victim?

At least eight people have been killed and more than 2,700 people have been injured in Lebanon by exploding pagers. Experts say the blasts point toward a supply chain compromise, not a cyberattack.

The AP-900 runs on two AAA batteries, which, like any battery, could be induced to explode, but likely not with such force and scale as the explosions depicted in alleged videos of the blasts. If the pagers used by Hezbollah are the AR-924 or another model that runs on lithium-ion batteries, which can cause more dangerous explosions, it’s still unlikely that a regular pager battery alone could produce blasts that could injure multiple people.

“Those explosions aren’t just batteries,” says Jake Williams, vice president of research and development at Hunter Strategy who formerly worked for the US National Security Agency. “Based on the reporting, these pagers were likely interdicted by Israeli authorities and modified with explosives. This highlights the risks of supply chain security, especially in places where technology is harder to ship to.”

Gold Apollo did not immediately respond to WIRED's request for comment.

Williams points out that such an operation would likely involve operatives on both the tech distribution side and the Hezbollah procurement side. “You compromise the supply chain, but you don't want thousands of explosive pagers running around Lebanon,” he says. “The mole gets them to exactly the right people.”

Some reports on Tuesday indicate that Hezbollah recently expanded its use of pagers in an attempt to secure communications after other channels had been infiltrated by Israeli intelligence. The Associated Press reported that an anonymous “Hezbollah official” said the group had recently adopted a “new brand” of pagers that “first heated up, then exploded.”

“It's unlikely that hacking was involved, as it's likely that explosive material had to be inside the pagers to cause such an effect,” says Lukasz Olejnik, an independent consultant and visiting senior research fellow at King’s College London’s Department of War Studies. “Reports mention the delivery of new pagers recently, so perhaps the delivery was compromised.”

Michael Horowitz, head of intelligence at Middle East and North Africa risk management company Le Beck International, says if the attack is supply-chain-based, then it could have taken years to prepare and involved infiltrating a supplier and placing explosives inside new pagers.

“This is a major security breach, particularly if we’re talking about a charge that was placed inside the devices—which, in my opinion, is the most likely scenario,” Horowitz says. “This would mean that Israel has managed to infiltrate Hezbollah providers to the point of delivering hundreds (if not thousands) of devices used for secured communication.”

The incident comes amid escalations of fighting between Israel and Hezbollah in recent months, raising fears of a full-blown war. In the hours before the explosions on Tuesday, Israel said its war goals would include allowing 60,000 people to return to Northern Israel after they were evacuated following Hezbollah attacks, and it would not rule out military action.

Horowitz says the incident could be a “prelude to a broader offensive” and possibly meant to disrupt Hezbollah’s communications networks. It is likely that replacing a large number of pagers would take some time to organize. Alternatively, Horowitz says, the attack could also have been conducted to show the “scale of Israel's intelligence penetration.”

“This is a high-value operation that you wouldn't use just to cause injuries,” Horowitz says.

Even if the blasts were not caused by a cyber-physical attack that induced the pager batteries to explode, it's still possible that explosives planted in the pagers were detonated using a remote command, possibly even a specially crafted pager message. Some footage appeared to show users checking their pagers right as the explosions occurred, though this could have been coincidental.

The operation could have a psychological impact on Hezbollah given that bombs may have been lurking undetected in such an unassuming device. And though Tuesday’s attacks were notably aggressive, it would not be the first time Israeli intelligence has reportedly planted explosives in electronics.

_Updated at 3:25 pm ET, September 17, 2024: Added additional details about potential ways the attack could have been carried out._

_Updated at 3:40 pm ET, September 17, 2024: Added additional details about the pager model that may have been used in the attack._

_Updated at 5:20 pm ET, September 17, 2024: Updated to reflect the latest casualty figures._

The Mystery of Hezbollah’s Deadly Exploding Pagers

Musk’s now-deleted post questioning why no one has attempted to assassinate Joe Biden and Kamala Harris renews concerns over his work for the US government—and potential to inspire extremist violence.

Shortly following reports of an apparent second assassination attempt against former US president and 2024 Republican presidential nominee Donald Trump, Elon Musk decided to speak up.

“And no one is even trying to assassinate Biden/Kamala 🤔,” Musk, X’s owner, wrote in a now deleted post, in response to another person asking, “Why they want to kill Donald Trump?”

After deleting the post—which could be interpreted as a call to murder President Joe Biden and Vice President Kamala Harris, Trump’s Democratic opponent in the US presidential election—Musk indicated that it was merely a joke that fell flat given the context. “Well, one lesson I’ve learned is that just because I say something to a group and they laugh doesn’t mean it’s going to be all that hilarious as a post on 𝕏,” he wrote, adding, “Turns out that jokes are WAY less funny if people don’t know the context and the delivery is plain text.”

The incident was the latest in a long line of increasingly incendiary political posts from Musk, whose substantial defense contracts with the US government may give him access to highly sensitive information even while he makes potential threats against the sitting commander in chief. And they point to the more pressing risk that Musk’s recent rhetoric has posed: the potential to inspire further political violence.

While Sunday night’s post is gone, it appears likely that Musk could receive some attention from federal law enforcement, if he hasn’t already.

The United States Secret Service declined WIRED’s request to comment on Musk’s post. “We can say, however, that the Secret Service investigates all threats related to our protectees,” USSS spokesperson Nate Herring tells WIRED.

“In my experience, the Secret Service would take such a comment very seriously,” says Michael German, a former FBI special agent and a liberty and national security fellow at NYU School of Law’s Brennan Center for Justice. “Typically, agents would go out and interview the subject to ensure that there wasn't an existing threat, and to make the subject aware that the agency takes such statements seriously.”

German notes that it’s possible the FBI could also launch an investigation. However, it’s unlikely that Musk would face any charges for his post. “On its face, the tweet would not meet the ‘true threat’ test, in that it wasn't a direct threat to do harm to the vice president, so it wouldn't likely proceed to prosecution,” German says. Still, “it would create a record of the investigations.”

The FBI declined WIRED’s request to comment on Musk’s post. X did not immediately respond to WIRED’s request for comment.

Both Biden and Harris have released statements condemning the apparent attempt on Trump’s life and political violence more broadly. In a statement to ABC News, the White House condemned Musk’s post. "Violence should only be condemned, never encouraged or joked about,” the statement says. “This rhetoric is irresponsible."

Where things get dicier for Musk is his role as a major contractor for the US Department of Defense and NASA. According to Reuters, SpaceX signed a $1.8 billion contract in 2021 with the National Reconnaissance Office, which oversees US spy satellites. The US Space Force also signed a $70 million contract late last year with SpaceX to build out military-grade low-earth-orbit satellite capabilities. Starlink, SpaceX’s commercial satellite internet wing, is providing connectivity to the US Navy.

Source

Wired