Plus: Hamas raised millions in crypto, Exxon used hacked data, and more.

The media consortium, along with security researchers from Amnesty International and Google’s Threat Analysis Group, were able to show Vietnam’s connection to the Predator hacking campaign through documents they obtained that detail the Vietnamese government’s contract with Intellexa in 2020, and later an extension of the deal to allow the use of the Predator software. The internal documents went so far as to capture the response of Intellexa’s founder, Israeli former military hacker turned entrepreneur Tal Dilian, when the deal was announced: “Wooow!!!!” Vietnam’s government would later target French officials with Predator before this year’s campaign targeting US congressmen.

Despite efforts by Israel and other nations to cut off funding to Hamas in recent years, the group raised millions of dollars worth of cryptocurrency before the past weekend’s attack that killed more than a thousand Israelis. An analysis by _The Wall Street Journal_ found that Hamas, Palestinian Islamic Jihad, and Hezbollah had collectively raised hundreds of millions in crypto over the past several years, with $41 million going to Hamas specifically. Given that the _Journal_ learned of that funding in part through Israeli seizures of crypto accounts, however, it’s not clear how much of that money was frozen or seized versus how much might have actually been successfully laundered or liquidated by Hamas and other groups. 

In response to the weekend’s attacks, the Israeli government and the world’s largest crypto exchange, Binance, both announced that a new round of Hamas crypto accounts had been frozen. Though crypto has helped Hamas and other groups move funds across borders, its traceability on blockchains has presented a challenge for designated terrorist groups. In 2021, for instance, Hamas asked its supporters to stop making donations via cryptocurrency, due to the ease of tracking those transactions and unmasking contributors.

Last year, _Reuters_ reporters Chris Bing and Raphael Satter published an investigation into Aviram Azari, an Israeli private investigator who is accused of using mercenary hackers to gather intelligence on the critics of major corporations involved in lawsuits against them. 

Now, prosecutors in the Southern District of New York, where Azari has been convicted on criminal charges, have filed a sentencing memo that notes that activists’ communications stolen by Azari’s hackers were later used by Exxon in the company’s attempts to head off investigations and lawsuits by state attorneys general. The memo still doesn’t name Exxon as Azari’s client, but it implicitly suggests a link between the company and Azari: Prosecutors point in their memo to leaks of climate activists’ private emails to media, which were later cited by Exxon in their responses to state attorney generals as evidence of underhanded tactics by activists as they tried to prove that Exxon knew and covered up the role of fossil fuels in climate change. A Massachusetts lawsuit against Exxon that resulted from the state’s investigation is ongoing.

Internet giant Akamai warned this week that the infamous Magecart hacker crew, long focused on credit card fraud, has developed a clever new technique for spoofing credit card payment fields. The hackers managed to hide their malicious scripts in the 404 “page not found” error pages of ecommerce sites, then trigger those pages to load a spoofed payment field that impersonates a checkout page to steal credit card information. “The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion,” warned Akamai researcher Roman Lvovsky. Akamai noted that the technique was used on the website of significant brands in the food and retail industries but declined to name them.

The US Congress Was Targeted With Predator Spyware

The rapid spread of violent videos and photos, combined with a toxic stew of mis- and disinformation, now threatens to spill over into real-world violence.

Yesterday, FBI director Christopher Wray attempted to assure the Jewish community in the US that his agency is taking any threats seriously. “I am not, in any way, trying to alarm you, but I want you to be confident that the FBI is most assuredly paying attention,” he said during an update on domestic security guidance following the Hamas attacks. “We remain vigilant to the potential of this event to inspire violence.”

The terms “jihad” and “day of rage” were both trending on X this morning, having been boosted by prominent accounts, including one belonging to hard-right representative Marjorie Taylor-Greene of Georgia. “If we are not going to vote today for a Speaker, why don't we just go home and regroup next week? I’ll buy ammo while I’m home,” Greene wrote on X.

Rogan O’Handley, a former Hollywood lawyer who has become a influential far-right figure under the pseudonym DC Draino, falsely claimed that Hamas had called for “an international day of terrorism.” O’Handley, who has 1.1 million followers on X, added, “I will not be changing 1 thing about my daily life b/c I will not let terrorism win,” he wrote. “I will, however, be carrying an extra mag. Be safe y’all.”

A WIRED review of Facebook, Instagram, and TikTok found dozens of posts highlighting Meshaal’s comments and the potential threat from the “day of jihad” but little evidence of threats against Muslims posted on those platforms. On Instagram yesterday, popular right-wing podcaster Charlie Kirk wrote: “Day of Jihad? Arm up.” The post has received 34,000 likes. Meta did not respond to a request for comment about Kirk’s post.

Amidst the flurry of threats, disinformation, and real acts of violence, it appears that X is attempting to limit search results for the terms “global day of jihad” and “jihad,” both of which returned no results when WIRED searched on mobile, desktop, and in different countries. While a search for the term “jihad” on X didn’t return any posts, it did suggest three people to follow, the first of which was US president Joe Biden.

X did not respond to WIRED’s request for comment about the violent threats on its platform or the lack of search results for terms related to jihad.

The calls for violence from right-wing accounts online echo violent responses from extremist groups in the days following the outbreak of the war.

While many right-wing groups have posted Islamophobic content and calls for violence against Muslims, many others have doubled down on their antisemitic worldview and are posting violent threats against Jews.

In a post on Telegram, the Texas chapter of the extremist group the Proud Boys, using multiple antisemitic slurs to describe Jews, called for the “extermination” of the Jewish people.

Rumors of a ‘Global Day of Jihad’ Have Unleashed a Dangerous Wave of Disinformation

In an attempt to wrest control from raucous far-right hardliners amid the fight for a new House speaker, Republican Party leaders are instituting phone bans to keep backroom deals secret.

Last week, after helping foment the eight-person coup that ended Kevin McCarthy’s 269-day reign as speaker of the United States House of Representatives Matt Gaetz’s signature smirk was everywhere. The 41-year-old Florida congressman peacocked through a slew of must-see Beltway cable news shows, dancing on McCarthy’s political grave, and generally basking in the brilliance of his successful scheme—one he openly doubted would work just the night before it did.

This week, Gaetz shut up—or, more accurately, he was shut up.

It’s not just Gaetz. All week long, unidentified Republican Party puppet masters have muzzled House members, scrambling to portray unity in the face of the disarray emanating from today’s leaderless House GOP. This includes the rare step of confiscating Republican’s electronic devices in an attempt to prevent leaks in the midst of their secret meetings to pick McCarthy’s replacement.

“I don't know who keeps talking in real time, because that's what they're concerned about,” Chris Smith, a New Jersey Republican, tells WIRED.

Nothing seems to be going right for House Republicans. Just ask the party’s handpicked majority leader, Steve Scalise. To the surprise of most, on Thursday night, he bowed out of the speaker race just a day after the majority of the conference tapped him to replace McCarthy. Even after disconnecting members and stopping real-time leaks, a minority of the majority party scuttled Scalise in less than 48 hours. Despite the wishes of party leaders, this revolt isn’t leaving our screens anytime soon.

It’s impossible to mute contemporary lawmakers for very long. The more party leaders try, the more the Republican base erupts with accusations of secret side deals. Still, party leaders are scrambling to regain control—if only momentarily and only in the Capitol’s plethora of backrooms.

“They're a little either whiplashed or gun shy from the McCarthy stuff. Gaetz and others knew they could blow up the Congress, but they didn't know how to rebuild it,” David Jolly, a former Florida Republican congressman, tells WIRED. “And in the rebuilding phase, they're sensitive to some of the negative press and the negative impressions.”

Today’s members of Congress are beholden to their online followings, not some party leader. Even one picked by the overwhelming majority—some 96 percent, in McCarthy’s case—of their peers. Regaining control of the seemingly uncontrollable seems to, once again, be proving a fool’s errand.

“The power centers no longer go up through leadership,” Jolly says. “Go back as far as you want—20 years, 30 years, whatever—all power structures funneled through leadership. Now they're all these independent power structures that reward and stabilize members regardless of if they've been there a year or 30 years. In fact, in many ways, the people who have been there 30 years probably have less security than the ones that just got there.”

Stripping members of their electronic devices is punishment for leaks and Gaetz-style boasting. It's being lauded by many members annoyed that their internal party deliberations often make headlines before they even hit the exits. But it’s backfiring.

Republican Party deliberations are staying secret longer—mere minutes longer, really—but the digital time-out isn’t fostering party unity. Following one of the party’s daily secret meetings this week, Republicans announced that Louisiana congressman Steve Scalise would be their nominee for the new House speaker, beating out Ohio’s Jim Jordan. Now the real trouble begins. In the wake of McCarthy’s speakership—the third-shortest in US history—the Republican Party’s right flank is emboldened, empowered, and feeling more justified than ever in their self-righteous quest to rid Washington of what they view as the federal government’s biggest problems.

The far-right Freedom Caucus and its allies began the House speaker fight in January, demanding more transparency, like the ability to review bills 72 hours before voting. Just last week, as he was moving his motion to vacate the speaker, Gaetz accused McCarthy of making "secret side deals" with US president Joe Biden. It seems calls for transparency withered alongside McCarthy’s short-lived speakership. If anything, the party seems mostly unified in embracing a new level of secrecy.

Phoneless in Washington

It’s still unclear who is running things among House Republicans. WIRED reached out to a slew of Republican leaders—former speaker McCarthy, speaker pro tem Patrick McHenry, former speaker-designate Scalise, majority whip Tom Emmer, and GOP conference chair Elise Stefanik—asking who made the call to temporarily confiscate member’s phones this week. None responded.

With no one in charge, everyone’s in charge. Each member of Congress is coached to run their office like a business, with each serving as the CEO, CFO, and mascot. Who’s Cupid without a bow and arrow? Ask a phoneless politician.

“Oh, wow. Really?” John Larson, a Connecticut Democrat, says after WIRED informs him of his rowdy Republican neighbor’s new no-phone rule. “It goes to show you the level of trust in this place, huh?”

It’s not unheard of for lawmakers to be stripped of their devices. US senators had to check their phones and tablets when they sat as the jury for former US president Donald Trump’s two impeachments. They were also only allowed to drink water and milk (yeah, it’s a thing).

Lawmakers also turn over their personal and government-issued devices before heading into classified briefings, like the one House members had Wednesday morning on the Israel-Hamas war. Most of the time, like the rest of us, lawmakers’ fingers are all but one with their screens.

“One of the members said to me—I won’t say who she was—she goes, ‘I need my phone!’” Smith, the New Jersey lawmaker, says with a laugh. “It is a different world. For a while there, all of us went to our grandkids or kids to figure out how to use these things. Now we got it down, and we can't stop it!”

But stop they did. Many Republicans report that these deviceless—and largely staffless—meetings are a welcome change. “I think it does help. Looking over at your colleague, wondering if he's the one livestreaming it, it foments mistrust,” Thomase Massie, a Republican Kentuckian, tells WIRED. “I think you have more direct, but coarser, conversations if there aren’t witnesses in the room. You’re missing the good stuff!”

Still, Massie is attuned to the complaints from the base about secret meetings. “If we don't have some kind of public vote on the floor, or in conference, where everybody accounts for their own vote, I feel like they can claim this is a stolen election,” Massie says. “If you come out of a secret room, with a secret ballot, and say, ‘This is our choice. Take our word for it,’ I think a lot of people want to know how their congressmen voted, and they want them to prove it, either in a roll call here or on the floor.”

But confiscating rank-and-file Republicans’ devices didn’t heal the internet-fueled internal GOP rift barely hiding underneath the party’s near universal hatred of Joe Biden, love of tax cuts, and fear of Donald Trump. It merely paused the cage match again. And, as usual, some of McCarthy’s fiercest opponents are now the loudest critics of the clampdown on devices.

“It’s ridiculous, really,” Tim Burchett—the Tennessee Republican who partnered with Gaetz in orchestrating McCarthy’s demise—tells WIRED. “You know someone’s gonna walk out and tell it.”

If anything, the no-phone rule is only fueling the Republican Party’s new ranks of conspiracy-laden conservatives. Burchett doesn’t know who made the call—but he blames McCarthy anyway. “That’s part of his leadership team that’s in place still,” Burchett says. “It'll work for a little while, and then somebody will figure something out.”

That Escalated Quickly—and Is Far From Over

Burchett, Gaetz, Marjorie Taylor Greene, and their fellow GOP hardliners were leaders of the transparency pack ahead of McCarthy’s ouster. Problem is, the public is now locked out of their private feeding frenzy at the feet of the party’s next generation of potential power brokers.

Just as McCarthy did in January, Scalise hosted holdouts and opponents alike for private meetings. While Republicans were encouraged to personally air their concerns and demands alike to his face, something was different this time, at least according to former speaker-designate Scalise.

“No side deals,” Scalise told reporters huddled outside an impromptu Thursday afternoon GOP conference meeting. “Let’s have this in full view of everybody. No side deals. No secret meetings.”

Full view? Just no phones allowed. No side deals either? Just private one-on-one conversations with some of the most expensive—morally speaking, at the very least—votes to buy on Capitol Hill.

Just as McCarthy did in January, Scalise moved further right—or at least did all he could to placate holdouts. It seemed to be working, just as it did for McCarthy—until it didn’t.

The towel came flying in after just one day of private confabs with the farthest-flung rightward wing of today’s rightward-tilting GOP. Scalise flipped at least one vote, but at what cost? Freshman Anna Paulina Luna is a Floridian who was slingshotted into this 118th Congress via her previous perch as a so-called social media influencer. Scalise denies doling out promises, and Luna refuses to say how the majority leader won her trust and met her demand.

All we know is, Scalise flipped her from a no to a yes. And she left the private meeting satisfied, feeling confident he met each one of the three bright red lines she’s publicly drawn in the proverbial political sands: impeaching Biden, slapping his son Hunter Biden with a subpoena, and defunding special counsel Jack Smith, thus halting the two federal cases he’s spearheading against Trump.

"After talking to Representative Scalise, I feel very confident that he's going to allow me to aggressively pursue justice for this country and this nation," Luna told reporters after meeting with Scalise on Wednesday. "He will be aggressively allowing me to pursue and do my job."

That’s a lot of weighty demands for anyone to placate in one day. One down, but Scalise still had 106 or so to go. Many were adamantly unbudgeable, even if they did go through the formal motions of sitting down with Scalise. The de-phoning experiment failed to unite the GOP’s new ranks of partisans, so vulnerable members are now demanding party leaders try other out-of-the-box options.

“We have to have something that takes the personality and emotion out of it,” says Marc Molinaro, a freshman Republican from New York. “At the end of the day, in the conference, we have to have a deliberative effort to get from whatever number the top vote getter has to 217. That has to happen in a deliberative way. We didn't have that the last few days.”

Frustration turned to anger after McCarthy was pushed out. Now, after more than a week of the House being ground to a halt by the majority party, embarrassment is now transforming into desperation. Ineptitude is not a good look, which speaker pro tem Patrick McHenry understands. When WIRED asks if Molinaro’s got any new ideas to try next, the former government relations consultant’s mind darts to a recent closed-door conversation he had with McHenry.

“Patrick McHenry suggested we don't get food or water, and maybe that will help,” Molinaro tells WIRED. “That was a joke. I don't want people to think he's gonna starve us.”

Like good policy, all good humor is grounded in reality, no? The unanswered question—one hovering ominously over all US politics these days—is, do Republicans live in the same reality as, well, Republicans? MAGA’s now passé—a distinction without a difference, really. That is, unless centrist Republicans actually declare the difference. That’s a step too far for most tenets cramped in Trump’s new small-tent GOP. Scalise gets the distinction, but he stops short of defining the difference.

"There's some folks that really need to look in the mirror over the next couple of days and decide are we going to get back on track, or if they're going to pursue their own agenda," Scalise told reporters at the Capitol Thursday night. That’s the same tightrope McCarthy—who only was granted his recently retired gavel in the 15th bruising round of speaker votes back in January—teetered on throughout his tenuous nine-month tenure. It’s also much like the one Senate minority leader Mitch McConnell has delicately maneuvered around—or sidestepped—on the other side of the Capitol. Center-right Republicans seem to finally be standing up to minority rule of their majority.

“It shows a structural problem,” Michael Waltz, a third-term Floridia Republican, tells WIRED. “You have to, in a republic, be able to rule by majority vote, and when we have a structural problem that came out of January where we can't, then I think that's gotta be fixed.”

Scalise’s surrender seems to have dislodged something. Some Republicans say it’s time to call on the House parliamentarian—the chamber’s procedural brain trust—to see if there’s an obscure loophole they can use to bypass this latest Republican blockade of Republicans. “There’s suggestion of that, but I don't see consensus around that,” Waltz says, even as he says tweaking internal party rules is different than overhauling House rules. “We're gonna be addressing our rules.” For now, the majority of the GOP don’t dare tamper with House rules, in no small part because Trump’s base is enlivened, engaged, and digitally screaming at the party’s rank and file.

Thing is, all of this was inevitable. “We knew this. I felt this in November when we, sadly, won with such a slim majority,” Chuck Fleischmann, a seven-term Tennessean, tells WIRED. “You could feel the difficulties of that slim majority present at that time. It just came into fruition 10 months later.”

Inevitable sure; painful nonetheless. Scalise is affable, genuine, and beloved by many, especially as he currently battles cancer after surviving a mass shooting just six years ago.

“The mood is pensive. There was a little bit of surprise there,” Fleischmann says. “This is not going to be an easy process. We had an historic event last week—a first, the vacating of the chair—so moving forward in these uncharted waters, in these uncharted times, is going to be difficult with a very slim majority.”

Slim and divided. Moments after Scalise and his entourage of aides and suit-donning officers left the Capitol Thursday evening, his inglorious departure was already a distant memory to second-term Michelle Fischbach of Minnesota.

“I’m looking for my phone,” the flustered congresswoman fretted, rifling through the huge handbag she set on a bronze-rimmed trash can in the Capitol’s dingy basement. When asked if she was frustrated by how the day ended, with Scalise’s walk of shame before his political family and the press corps, Fischbach spoke up on behalf of the minority of the minority of the majority party, telling WIRED, “It’s more frustrating that I can’t find my phone.”

The frustration is palpable.

US House Republicans Had Their Phones Confiscated to Stop Leaks

Dubbed “HTTP/2 Rapid Reset,” the flaw requires issuing patches to virtually every web server around the world before the problem can be eradicated.

Google, Amazon, Microsoft, and Cloudflare revealed this week that they battled massive, record-setting distributed denial of service attacks against their cloud infrastructure in August and September. DDoS attacks, in which attackers attempt to overwhelm a service with junk traffic to bring it down, are a classic internet menace, and hackers are always developing new strategies to make them bigger or more effective. The recent attacks were particularly noteworthy, though, because hackers generated them by exploiting a vulnerability in a foundational web protocol. This means that while patching efforts are well underway, fixes will need to essentially reach every web server globally before these attacks can be fully stamped out.

Dubbed “HTTP/2 Rapid Reset,” the vulnerability can only be exploited for denial of service—it doesn't allow attackers to remotely take over a server or exfiltrate data. But an attack doesn't need to be fancy to cause major problems—availability is vital for access to any digital service, from critical infrastructure to crucial information.

“DDoS attacks can have wide-ranging impacts to victim organizations, including loss of business and unavailability of mission-critical applications,” Google Cloud's Emil Kiner and Tim April wrote this week. “Time to recover from DDoS attacks can stretch well beyond the end of an attack.”

Another facet of the situation is where the vulnerability came from. Rapid Reset isn't in a particular piece of software but in the specification for the HTTP/2 network protocol used for loading webpages. Developed by the Internet Engineering Task Force (IETF), HTTP/2 has been around for about eight years and is the faster, more efficient successor to the classic internet protocol HTTP. HTTP/2 works better on mobile and uses less bandwidth, so it has been extremely widely adopted. IETF is currently developing HTTP/3.

“Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack,” Cloudflare's Lucas Pardue and Julien Desgats wrote this week. Though it seems that there are a minority of implementations that are not impacted by Rapid Reset, Pardue and Desgats emphasize that the problem is broadly relevant to "every modern web server.”

Unlike a Windows bug that gets patched by Microsoft or a Safari bug that gets patched by Apple, a flaw in a protocol can't be fixed by one central entity because each website implements the standard in its own way. When major cloud services and DDoS-defense providers create fixes for their services, it goes a long way toward protecting everyone who uses their infrastructure. But organizations and individuals running their own web servers need to work out their own protections.

Dan Lorenc, a longtime open source software researcher and CEO of the software supply chain security company ChainGuard, points out that the situation is an example of a time when the availability of open source and the prevalence of code reuse (versus always building everything from scratch) is an advantage, because many web servers have likely copied their HTTP/2 implementation from somewhere else rather than reinvent the wheel. If these projects are maintained, they will develop Rapid Reset fixes that can proliferate out to users.

It will take years to reach full adoption of these patches, though, and there will still be some services that did their own HTTP/2 implementation from scratch and don't have a patch coming from anywhere else.

“It's important to note that the big tech companies discovered this while it was being actively exploited,” Lorenc says. “It can be used to take a service down like operational tech or industrial control. That’s scary.”

Though the string of recent DDoS attacks on Google, Cloudflare, Microsoft, and Amazon raised the alarm for being so large, the companies were ultimately able to repel the attacks, which didn't cause lasting damage. But just by carrying out the assaults, hackers revealed the existence of the protocol vulnerability and how it could be exploited—a cause and effect known in the security community as “burning a zero day.” Even though the patching process will take time, and some web servers will remain vulnerable long term, the internet is safer now than if attackers hadn't shown their cards by exploiting the flaw.

“A bug like this in the standard is unusual, it's a novel vulnerability and was a valuable finding for whoever first discovered it,” Lorenc says. “They could have saved it or even probably sold it for a lot of money. I'm always going to be curious about the mystery of why someone decided to burn this one.”

HTTP/2 Rapid Reset: A New Protocol Vulnerability Will Haunt the Web for Years

Whoever looted FTX on the day of its bankruptcy has now moved the stolen money through a long string of intermediaries—including a service owned by FTX itself.

As the criminal trial of FTX founder Sam Bankman-Fried unfolds in a Manhattan courtroom, some observers in the cryptocurrency world have been watching a different FTX-related crime in progress: The still-unidentified thieves who stole more than $400 million out of FTX on the same day that the exchange declared bankruptcy have, after nine months of silence, been busy moving those funds across blockchains in an apparent attempt to cash out their loot while covering their tracks. Blockchain watchers still hope that money trail might help to identify the perpetrators of the heist—and answer the looming question of whether someone with insider knowledge of FTX was involved.

Today, cryptocurrency tracing firm Elliptic released a new report on the complex path those stolen funds have taken over the 11 months since they were pulled out of FTX on November 11 of last year. Elliptic's tracing shows how that nine-figure sum, which FTX puts at between $415 million and $432 million, has since moved through a long list of crypto services as the thieves attempt to prepare it for laundering and liquidation, and even through one service owned by FTX itself. But those hundreds of millions also sat idle for all of 2023—only to begin to move again this month, in some cases as Bankman-Fried himself sat in court, raising new and unanswered questions about the thieves' identities and plans.

“The funds basically didn't move for nine months, and then a couple of days before the trial starts, they start to move again,” says Tom Robison, Elliptic's cofounder and chief scientist. “Why did they have to move the funds now? It doesn't really make sense to start laundering funds at the time when there's so much attention on the victim of the hack.”

Aside from that strange timing, Elliptic says the FTX thieves have largely taken steps typical for the perpetrators of large-scale crypto heists as the culprits sought to secure the funds, swap them for more easily laundered coins, and then funnel them through cryptocurrency "mixing" services to achieve that laundering. The majority of the stolen funds, Elliptic says, were stablecoins that, unlike other forms of cryptocurrency, can be frozen by their issuer in the case of theft. In fact, the stablecoin issuer Tether moved quickly to freeze $31 million of the stolen money in response to the FTX heist. So the thieves immediately began exchanging the rest of those stablecoins for other crypto tokens on decentralized exchanges like Uniswap and PancakeSwap—which don't have the know-your-customer requirements that centralized exchanges do, in part because they don't allow exchanges for fiat currency.

In the days that followed, Elliptic says, the thieves began a multi-step process to convert the tokens they'd traded for the stablecoins into cryptocurrencies that would be easier to launder. They used “cross-chain bridge” services that allow cryptocurrencies to be exchanged from one blockchain to another, trading their tokens on the bridges Multichain and Wormhole to convert them to Ethereum. By the third day after the theft, the thieves held a single Ethereum account worth $306 million, down about $100 million from their initial total due to the Tether seizure and the cost of their trades.

From there, the thieves appear to have focused on exchanging their Ethereum for Bitcoin, which is often easier to feed into "mixing" services that offer to blend a user's bitcoins with those of other users to prevent blockchain-based tracing. On November 20, nine days after the theft, they traded about a quarter of their Ethereum holdings for Bitcoin on a bridge service called RenBridge—a service that was, ironically, itself owned by FTX. “Yes, it is quite amazing, really, that the proceeds of a hack were basically being laundered through a service owned by the victim of the hack,” says Elliptic's Robison.

On December 12, a month after the theft, most of the bitcoins from that RenBridge trade were then fed into a mixing service called ChipMixer. At that point, the thieves went strangely quiet. The rest of their Ethereum would remain dormant for the next nine months.

Only on September 30, just days ahead of Bankman-Fried's trial, did the remainder of the funds begin to move again, Elliptic says. By that time, both RenBridge and ChipMixer had been shut down—RenBridge due to its parent company FTX's collapse and ChipMixer due a law enforcement seizure. So the thieves pivoted to trading their Ethereum for Bitcoin on a service called THORSwap and then routing those bitcoins into a mixing service called Sinbad.

Sinbad has over the past year become a popular destination for criminal cryptocurrency, particularly crypto stolen by North Korean hackers. But Elliptic's Robison notes that despite this, the movement of funds appears less sophisticated than what he's seen in the typical North Korean heist. “It doesn't use some of the services that Lazarus typically use,” Robison says, referring to the broad group of North Korean state-sponsored hackers known as Lazarus. “So it doesn't look like them.”

Does the timing of those new movements of funds ahead of—and even during—Bankman-Fried's trial suggest someone with insider knowledge is responsible? Elliptic's Robison notes that, while the timing is conspicuous, he can only speculate at this point. It's possible that the timing has been purely coincidental, Robison says. Or someone might be moving the money now to make it _look_ like an FTX insider—potentially one who fears they might be about to lose their internet access. Neither Bankman-Fried nor his fellow executives have been charged with the theft, and some of the money movements have taken place while Bankman-Fried has been in court, with only a laptop disconnected from the internet.

Eventually, no doubt, the thieves will attempt to cash out their stolen and laundered cryptocurrency for some sort of fiat currency. Robison is still hopeful that, despite their use of mixers, they can still be identified at that point—though he declined to definitively answer whether Elliptic can defeat those mixing services' anonymity measures. “I think they probably will be successful in cashing out at least some of these funds. I think whether they're going to get away with it is a separate question,” says Robison. “There's already a blockchain trail to be followed, and I think that trail will only become clearer with time.”

Two other cryptocurrency tracing firms, TRM Labs and Chainalysis, have both been hired by FTX's new regime under CEO John Ray III to aid in the investigation. TRM Labs declined to comment on the case. Chainalysis didn’t respond to WIRED’s request for comment, nor did FTX itself.

If those cryptocurrency tracers succeed, we may someday have an answer to the mystery of the FTX heist. In the meantime, however, FTX's many aggrieved creditors will be left to keep one eye on Bankman-Fried's trial and the other on the Bitcoin blockchain.

How the FTX Thieves Have Tried to Launder Their $400 Million Haul

A video posted by Donald Trump Jr. showing Hamas militants attacking Israelis was falsely flagged in a Community Note as being years old, thus making X's disinformation problem worse, not better.

Yesterday afternoon, Donald Trump Jr. posted a graphic video to X (formerly Twitter) that purported to show Hamas fighters murdering Israeli citizens during the attack last Saturday morning. “You don’t negotiate with this,” Trump Jr. wrote. “There’s only one way to handle this.” The son of former US president Donald Trump added that the video had come from a “source within Israel.”

The post was shared widely, and within hours it had amassed over 4 million views.

Then X’s user-generated fact-checking system, Community Notes, appended a message to the tweet, stating: “This is an old video and is not from Israel,” accompanied by a link to the original video. The note suggested that Trump Jr. was contributing to what has been a flood of disinformation on X since Hamas militants attacked Israel on Saturday, supercharged by verified users and accompanied by other conspiracy theories pushed by the company’s owner, Elon Musk.

But WIRED has now verified that the Community Notes system appears to be wrong. According to an independent OSINT analysis published on Wednesday, the video Trump Jr. posted is real. It was recorded during Saturday’s attack and does show Hamas fighters shooting Israelis, the analysis found.

The incident highlights how Community Notes, touted this week by X as one of the crucial ways it was tackling disinformation, is still struggling to function as intended and is, in some instances, adding to the level of disinformation on X rather than correcting it.

The Community Notes system is made up of X users who volunteer to fact-check posts on the site. It is X’s primary fact-checking mechanism since Musk eradicated virtually all full-time Trust and Safety staff and part-time moderators who previously did that work.

The volunteers, who must be approved by X to contribute to Community Notes, suggest notes to add to what they believe are misleading posts. Those notes are only displayed publicly once a sufficient number of volunteers have approved them.

Once approved, notes are regarded as “helpful” and posted publicly. This is how X describes what it sees as a “helpful” note: “Enough contributors from different perspectives agreed that this note is helpful, so it’s being shown as context on the post.”

Earlier this week, X praised the Community Notes team for tackling the misinformation that has flooded the platform in the past week and said new accounts are being enrolled “in real time to propose and rate notes.” On Tuesday, an NBC investigation found the system was not functioning as proposed; of the two Israel-Hamas misinformation claims investigated by the outlet, more than a quarter had notes that remained private as they had not been approved by enough volunteers, while roughly two-thirds had no notes at all.

X replaces the names of users who suggest the notes with aliases, making it impossible to see who submits any particular note. In the case of the note on Trump Jr’s account, the note was submitted by a user pseudonymously identified as “Mellow Sun Swan” four hours after Trump Jr posted the video.

This was the eighth note the user had submitted, according to their profile, but the first to have been approved. The user has in recent days submitted multiple notes on posts related to Iranian links to the conflict.

In the case of the Trump Jr. video, the Community Notes user linked to a video posted on the Iranian social media platform Wisgoon as evidence that the video was from years ago, not this past weekend. In the post, the upload date on the video is in Persian, which, when translated, reads “15 Mehr 1402,” a date in the Persian calendar. This date translates in the Gregorian calendar to October 7, 2023—the date Hamas attacked Israel.

An open source intelligence researcher tells WIRED that they confirmed the video’s veracity by tracking the original video, which was broadcast by a Gaza civilian on a Facebook livestream on Saturday morning. The researcher, who posts anonymously on social media using the handle OSINTtechnical, is frequently cited by news outlets covering conflict zones.

Soon after the Trump Jr. note was published, an account associated with the far right that has advocated for banning the Anti-Defamation League tried to back up the claim about the video being fake, sharing a screenshot that showed the results of a reverse-image search for the thumbnail image of the original video. The results appear to show a series of links to Wisgoon featuring the same image, all of which have dates from seven or eight years ago. However, this is because the recent video was listed in the related videos list of the older videos, not proof that it is an older video.

On Wednesday afternoon, the note on Trump's tweet was updated to link to the tweet from the account linked to the far right.

X replied with an automated response to WIRED’s questions, stating: “Busy now, please check back later.” Trump Jr. did not respond to WIRED’s request for comment.

A Graphic Hamas Video Donald Trump Jr. Shared on X Is Actually Real, Research Confirms

The United Nations' top internet governance body will allegedly host its next two annual meetings in countries known for repressive internet policies and human rights abuses.

The United Nations’ main internet governance body looks set to host its next international forum in Riyadh, Saudi Arabia. In 2025, the UN may take its discussions on the future of an open internet to Russia. Holding the Internet Governance Forum (IGF), back to back, in authoritarian countries notorious for their surveillance and censorship of the internet risks making “a joke of the whole system,” one advocate says.

While the UN has yet to formally announce the host countries for either meeting, Saudi Arabia's minister of communications and information technology, Abdullah Alswaha, seemed to let the news slip at this year’s forum in Tokyo, Japan, which began on Sunday and ends Thursday.

In a short speech before the plenary, Alswaha ran through some key issues facing the IGF, including generative artificial intelligence and the digital divide. He proposed to the attendees that “we continue this dialog at Riyadh IGF ‘24.” He repeated that idea again at the end of his speech, leaving attendees buzzing.

“It's extremely problematic,” Barbora Bukovská, senior director for law and policy at human rights organization Article 19, tells WIRED. She learned the news on Tuesday from colleagues in Tokyo. “Their human rights record and their record on digital freedoms should disqualify them from having it.”

In recent years, Riyadh has engaged in digital surveillance of dissidents, administering the death penalty against citizens who called out its human rights record online. The Saudi regime also ordered the 2018 extrajudicial killing of journalist Jamal Khashoggi. Freedom House, a pro-democracy nonprofit, assesses that Saudi Arabia maintains one of the world’s most restrictive and censored internet systems, only marginally better than Russia.

“The IGF is a community, it's a multi-stakeholder event,” Bukovská says. “You are supposed to have not just governments and companies, but also civil society, activists, and so on.” She says it will be difficult to invite democracy and open internet advocates to Riyadh. “How are they supposed to participate in Saudi Arabia, when you can be targeted by spyware, and with all kinds of restrictions? So I think it's extremely problematic.”

The IGF is a relatively new organization, having been set up in 2006. Its purpose is more advisory than regulatory, serving as a chance for countries, corporations, civil society organizations, and activists to discuss and debate various aspects of how the internet itself is run. “It's quite interesting and important for shaping the responses on certain issues,” Bukovská says.

While it may not be responsible for standards and regulations like the International Telecommunications Union—which has also been the subject of an international tug-of-war between censorship-minded countries and those who support an open internet—it is the main UN body devoted to internet governance. Where it is hosted matters, Bukovská says. Countries like Saudi Arabia can use the Forum “as a decoy to present themselves as a part of the international community, which respects human rights.”

Oppressive governments have worked hard to dismantle the shared system of governance model of the internet, argues Léa Fiddler, pushing instead for “sovereign digital ecosystems over which they can exert even more control, leading to what is often called the ‘splinternet.”

Fiddler is a visiting fellow for democracy and human rights at the Atlantic Council’s DFRLab. She wrote in advance of the 2023 Forum that the IGF will have an “outsized impact on how the internet looks and operates over the next several decades.” The IGF is also due to renew and rewrite its mandate in the coming years, she notes. “The conclusions that stakeholders come to at IGF will inform their stance on efforts at risk of being exploited for authoritarian purposes.”

There have been proposals put forth at the UN to substantially alter the balance of power in global internet governance. Fiddler points to the “Global Digital Compact,” which could substantially increase the UN’s role in regulating the internet. In a similar vein, Bukovská points to a cybersecurity treaty currently being proposed by Russia which, critics fear, is so vague that it could permit prosecution and targeting of journalists and democracy advocates.

Saudi Arabia will not be the first illiberal regime to host the IGF. Last year’s Forum was held in Addis Ababa, Ethiopia, amid an internet shutdown in the country’s Tigray region. Critics like digital rights group AccessNow decried the choice of venue at the time. “We cannot have a truly resilient internet or shared, sustainable, common future if we systematically silence or ignore those most at risk of rights violations,” the organization wrote in a statement.

It’s unclear if Saudi Arabia was the only country to actually submit a bid to host the 2024 Forum.

In 2021, Canadian cybersecurity firm eQualitie launched a petition to have the 2024 Forum in Montreal. Dozens of tech companies and civil society organizations from Canada and around the world signed on to the petition, but the Canadian government appears to have ignored the request. A spokesperson for Canadian foreign affairs minister Melanie Joly did not return a request for comment.

In a press release, eQualitie called Riyadh’s selection a "missed opportunity" and that Saudi Arabia's successful bid "raises concerns about the Forum's ability to maintain its principles of open dialogue and collaboration with civil society."

In a LinkedIn post, Bukovská sarcastically wrote of the trend being set by the UN body hosting an internet governance conference in Riyadh. “I guess I will also be looking forward to visiting Pyongyang, Teheran, or Moscow in the years to come.” But there are good odds that the IGF’s next meeting will, in fact, be held in Russia.

In 2020, the Russian Internet Governance Forum issued a press release indicating that Russia had been chosen as the 2025 host, citing official confirmation sent by the UN. It was repeated again in December 2021 by Russia’s deputy prime minister, Dmitry Chernyshenko. “Choosing Russia as the venue to host the 20th forum is a great honor for us and evidence that our country’s strong positions in the field of the development of the information society and digital technologies are recognized,” he said in a speech.

WIRED has previously reported on how a concerted American campaign for the presidency of the International Telecommunications Union thwarted Russian efforts to take over the body.

“This actually makes a joke of the whole system,” Bukovská says. She points to similar efforts at the UN Human Rights Council. “If you want to protect the integrity of these UN systems, as something where states should be held accountable for their human rights violations, it should not go to these countries.”

This spring, the Norwegian government announced its bid for the 2025 forum. The IGF has not officially indicated where the forum will be held, and the Norwegian government did not respond to a request for comment.

It is increasingly clear that the world’s most repressive countries are vying, either in conjunction or independently, to gain more control of how the very mechanics of the internet operate.

The UN Risks Normalizing Internet Censorship

X’s Trust and Safety team says it’s working to remove false information related to the Israel-Hamas war. Meanwhile, Elon Musk is sharing conspiracies and chatting with QAnon promoters.

yesterday night, what’s left of the Trust and Safety team at X (formerly Twitter) announced the measures it was taking to try and curb the virulent spread of disinformation around the Israel-Hamas war on its platform.

The statement, issued three days after the conflict began, reads: “As the events continue to unfold rapidly, a cross-company leadership group has assessed this moment as a crisis requiring the highest level of response.”

One person who does not appear to be part of this crisis team is X owner Elon Musk.

Instead of tackling the dangerous disinformation problem on his platform, Musk instead spent yeterday night into this morning continuing to spread disinformation about the conflict, conversing with a known QAnon promoter, boosting anti-Muslim conspiracy theories, and laughing at a video detailing how transphobic content on X can get you new followers.

Musk also promoted a new feature that allows X Premium subscribers to see only replies from other people willing to pay $8 a month, which Musk said would “help a lot with spam bots” on the platform—an issue Musk previously claimed he had already all but eradicated.

“​​If successful, X will evolve to be the collective consciousness of humanity or, more accurately, the human-machine collective,” Musk posted in reply to a follower who said he was doing a great job running the company.

Meanwhile, disinformation about the conflict in the Middle East continues to rage on the platform, driven primarily by verified accounts.

Yesterday evening, X’s Trust and Safety team, which is currently leaderless after Ella Irwin resigned in June, wrote on X that it had “removed newly created Hamas-affiliated accounts” and was working with the Global Internet Forum to Counter Terrorism (GIFCT), an industry body that helps coordinate content moderation across social media platforms, to “try and prevent terrorist content from being distributed online.”

The Safety team’s statement also lauded the user-generated Community Notes system and said new accounts were being enrolled to address the flood of disinformation on the platform. The Safety team also revealed that it had removed “several hundreds accounts for attempting to manipulate trending topics.”

Since Musk took control of the platform just under a year ago, he has restructured it to encourage engagement over everything else. As a result, accounts that subscribe to X Premium now have a monetary incentive to post content that is engaging regardless of how truthful it is. This was highlighted clearly on yesterday night when, at the same time as the Safety team posted its update, a new viral piece of disinformation was spreading unchecked on X.

Sulaiman Ahmed, a self-described investigative journalist, posted the false claim that the Church of Saint Porphyrius in Gaza City, one of the oldest churches in the world, was destroyed by an Israeli bomb. The post received over 1 million views in the span of three hours.

Ahmed is a subscriber to X Premium, which means his posts are given priority in search results and newsfeeds over other users, and he also allows followers to subscribe to his content directly through X, allowing him to profit from increased engagement with his content.

Yesterday evening, the church posted an update on Facebook dismissing the claim, adding that it was taking in refugees left homeless following Israel’s bombing campaign in retaliation to the Hamas attack that began on Saturday morning.

Despite the church’s rebuttal—and Ahmed himself subsequently admitting that the church was untouched—the disinformation spread far and wide on X. WIRED conducted a search for the “Saint Porphyrius Orthodox Church” on X this morning and found that Ahmed’s original false post was the third result. Multiple other posts from verified users all repeating the lie were also promoted at the top of the results, none of which had Community Notes attached to them.

Eliot Higgins, founder of investigative journalist outlet Bellingcat, pointed out that the false information was being shared by a wide variety of accounts, all of which had one thing in common: a subscription to X Premium.

“If Musk hadn't made it so hard to research disinformation on his website, this case would be a good way to show the growing overlap of the pro-Assad, the pro-Putin, and the US alt-right griftospheres,” Higgins wrote on X, adding: “Musk hasn't given the voiceless a voice, he's just dragged us all down into the swamp, and the only people who truly benefit are shameless grifters.”

Elon Musk Is Personally Undermining X’s Efforts to Curb Israel-Hamas War Disinformation

Google is making passkeys, the emerging passwordless login technology, the default option for users as it moves to make passwords “obsolete.”

Less than six months ago, Google announced that it was launching support for the password replacement known as “passkeys” for all personal accounts across its billions of users. Today, the company said it is going a step further and will make passkeys the default login setting for users.

When you log in to your Google account, you’ll get a prompt to create a passkey and start using it for login instead of relying on your Gmail address and password. Google will be turning on the “skip password when possible” option in account settings, which is essentially the passkey green light. Users who don't want to kill their password just yet will still be able to turn that setting off so they don't receive the prompts.

Password-based authentication is so ubiquitous in digital systems that it isn't easy to replace. But passwords have inherent security problems because they can be guessed and stolen. And since it's so difficult to keep track of dozens or hundreds of passwords, users often reuse the same passwords on multiple accounts, making it easier for attackers to unlock all of those accounts in one fell swoop. Passkeys are specifically designed to address these issues and dramatically reduce the risk of phishing attacks by instead relying on a scheme that manages cryptographic keys stored on your devices for account authentication.

Google didn't share statistics on passkey adoption so far, saying instead in a blog post that “people have used passkeys on their favorite apps like YouTube, Search and Maps, and we’re encouraged by the results.” The company points out that passkey support is expanding across other apps and services. Apple and Microsoft both support passkeys. And companies like Uber and eBay recently launched passkeys, and they're coming to WhatsApp soon.

“Passwordless is something we set out to achieve 10-plus years ago, and we’re thrilled to not only see us already on the next step of the journey with passkeys by offering them by default, but also to see the great feedback from users who have made the switch,” Christiaan Brand, identity and security group product manager at Google, tells WIRED.

There's so much inertia on passwords around the world that even a player as big and influential as Google can't force the issue overnight. But the company is clearly using its influence to steer users with gentle pressure that seems likely to continue mounting as passkeys gain broader momentum.

“We’ll keep you updated on where else you can start using passkeys across other online accounts,” the company wrote today. “In the meantime, we’ll continue encouraging the industry to make the pivot to passkeys—making passwords a rarity, and eventually obsolete.”

Google Makes Passkeys Default, Stepping Up Its Push to Kill Passwords

Hacktivism is increasingly a feature of modern kinetic warfare. It’s playing out with particular ferocity in the conflict between Israel and Hamas.

After an attack on Israel by Hamas on Saturday, Israel declared war and fighting escalated throughout the weekend. As the death toll mounts on both sides and the Israeli Defense Force (IDF) prepares an offensive, hacktivists in the region and around the world have joined the fight.

Within hours of Hamas militants and rockets entering Israel, such “hacktivist” attacks started to spring up against both Israeli and Palestinian websites and applications. In the short period since the conflict escalated, hackers have targeted dozens of government websites and media outlets with defacements and DDoS attacks, attempts to overload targets with junk traffic and bring them down. Some groups claim to have stolen data, attacked internet service providers, and hacked the Israeli missile alert service known as Red Alert.

“I saw at least 60 websites get DDoS attacks,” says Will Thomas, a cyber threat intelligence researcher at cybersecurity firm Equinix who has been following the online activity. “Half of those are Israeli government sites. I've seen at least five sites be defaced to show ‘Free Palestine’–related messages.”

Most prominently seen in the war between Russia and Ukraine, it is increasingly common for both ideologically motivated hackers and cybercriminals to remotely join the chaos on either side of an escalating conflict by attacking government systems or other institutions.

Alex Leslie, a threat intelligence analyst at the security firm Recorded Future, says that he and his colleagues have identified three subsets of activity within the digital pandamonium of the Israel-Hamas war so far. The majority of the digital attacks seem to stem from preexisting groups or a broader context of similar activity adjacent to other conflicts. “The scope is international, but rather limited to preexisting ideological blocs within hacktivism,” Leslie says.

The subgroups that Recorded Future has identified so far are “self-proclaimed ‘Islamic’ hacktivists that claim to support Palestine. These groups have historically targeted India and have been around for years” Leslie says. “Pro-Russian hacktivists that are pivoting to target Israel, likely with the intent of sowing chaos and spreading Russian state narratives. And groups that are ‘new,’ in that they were launched within the last \[days\] and have limited activities prior to this weekend.”

Since Russia’s 2022 invasion of Ukraine, some prominent hacktivist groups backing Russian interests have emerged, including gangs known as “Anonymous Sudan” and “Killnet,” both of which appeared to wade into the conflict between Hamas and Israel this weekend. Some groups have also been active in reaction to India’s support of Israel, both in favor of and against this support.

Hackers from the group known as AnonGhost, who are seemingly conducting pro-Palestinian campaigns, have been launching DDoS attacks and attempting to target infrastructure and application programming interfaces (APIs). The group claimed the alleged attack on the Israeli Red Alert missile warning platform. Researchers from the threat intelligence firm Group-IB said on Monday that the hackers exploited bugs in Red Alert’s systems to intercept data, send spam messages to some users, and possibly even send fake missile strike warnings. The app’s developers did not return a request from WIRED for comment. The Red Alert app has been targeted by hacktivists in the past, and Hamas itself has previously been accused of circulating malicious imposter versions of Israeli missile alert apps.

Meanwhile, the hacktivist group ThreatSec, which says it has “attacked Israel” previously, claimed it targeted Alfanet, an internet service provider based in the Gaza Strip. In a post on Telegram, the group claimed to have taken control of servers belonging to the company and impacted its TV station systems.

Doug Madory, director of internet analysis at monitoring firm Kentik, says that Alfanet was inaccessible for around 10 hours on Saturday, October 7—before the hacktivists posted their claim. The ISP’s systems have since been back online and communicating with the wider world. “Some of their services could still be broken,” Madory says, pointing to an Alfanet TV website and a web portal that were inaccessible on Sunday evening.

In response to a request for comment from WIRED via Facebook Messenger, Alfanet shared a statement in Arabic saying that communications were cut off due to “the complete destruction” of its headquarters. “Crews are working with all their might to restore service after the bombing of the headquarters and the main tower, despite the difficult and dangerous circumstances,” the message says via machine translation. The company did not comment on the role of a cyberattack, if any, in the outage.

Internet connectivity in Gaza has also been broadly disrupted by electricity outages as Israel implements what Defense Minister Yoav Gallant called a “complete siege” on Monday, cutting off the region’s electricity and supply lines for water, food, and fuel.

Amid the chaos of any erupting kinetic war, hacktivism often fuels disinformation, misinformation, and panic. This can lead to unintended consequences. For some digital actors, unpredictability itself is the goal.

“The Indian cyber force actually claimed to DDoS hamas.ps and webmail.gov.ps,” Equinix’s Thomas says. Meanwhile, "there's one group called the Cyber Avengers who are claiming to steal documents from Israel's national electricity authority. They claimed they stole documents from Israel's Dorad power plant. \[But\] they are actually known for making up stuff and creating sort of fake infrastructure and screenshotting.”

Victoria Kivilevich, director of threat research at the Israeli cybersecurity firm Kela, says that while hacktivist activity may add to the turmoil, she doesn’t expect that it will significantly impact warfare on the ground.

“We can expect to see more groups and DDoS attacks because of the severity of the conflict and general evolution of hacktivist groups, however, so far we don't expect any significant impact on the overall threat landscape.”

Last week, the International Committee of the Red Cross put forth rules of engagement for “civilian hackers” wading into a conflict. The eight directives, which are based on international human rights law, came primarily in the context of Russia’s war on Ukraine, but they are relevant globally. They emphasize minimizing threats to civilians’ safety and ban cyberattacks on health care facilities. They also ban use of computer worms and require that actors “comply with these rules even if the enemy does not.”

In response to the release, some hacktivist groups active on both sides of Russia’s war in Ukraine said they would attempt to follow the rules when possible, but others said it wasn’t feasible or rejected the premise entirely. In its efforts to gather grassroots support, Ukraine has encouraged a sort of legitimized version of hacktivism by establishing a volunteer “IT Army” for its war effort against Russia. All of this has created a nuanced and unpredictable element in the digital component of kinetic wars.

“What we saw in Ukraine with hacktivism has set a precedent moving forward,” Recorded Future’s Leslie says. “We believe that many of these groups are motivated by attention. That’s why we see so many groups that probably shouldn’t be active in this conflict for geopolitical reasons jumping into the fray. They want people to know that they’re active and capable of reacting to any event—even if the intentions are disingenuous. Hacktivism is intertwined with information and influence operations, and it is here to stay.”

Source

Wired