Polish Grid Systems Targeted in Cyberattack Had Little Security, Per New Report The hackers behind a cyberattack that targeted Poland's grid infrastructure met little resistance when they hit systems at a heat-and-power plant and wind and solar farms last month. The intruders were able to easily access numerous systems at the affected facilities because the systems were configured with default
Attack Against Poland's Grid Disrupted Communication Devices at About 30 Sites The hackers behind a cyberattack that targeted Poland's grid infrastructure in December disabled communication devices for at least 30 sites across a number of energy facilities in different parts of the country. The hackers succeeded in disabling the communication systems, known as remote terminal units or RTUs, that
Booz Allen Tech Contractor Took IRS Job Specifically to Leak Trump's Tax Records The US Treasury Department announced yesterday that it was canceling all contracts it holds with consulting firm Booz Allen Hamilton because the company failed to prevent one of its contractors from stealing and leaking tax records years ago when he was working on behalf of the firm for the Internal
Cyberattack Targeting Poland’s Energy Grid Used a Wiper A cyberattack that targeted power plants and other energy producers in Poland at the end of December used malware known as a “wiper” that was intended to erase computers as part of an operation intended to cause a power outage and other disruption to services, says European security firm ESET,
Former Trenchant Exec Sold Stolen Code to Russian Buyer Even After Learning that Other Code He Sold Was Being "Utilized" by Different Broker in South Korea The former executive of Trenchant who pleaded guilty this week to selling his company's software hacking tools to a zero-day broker in Russia, sold at least one of these tools to the Russian firm even after learning that a previous tool he sold the broker was being used
John Bolton Indictment Provides Interesting Details About Hack of His AOL Account and Extortion Attempt The investigation into former national security advisor John Bolton's handling of classified material stemmed in part from an admission Bolton made to the FBI in July 2021 that hackers – believed to be from Iran – had breached his private AOL email account and tried to extort him over classified
Voting Machine Company Smartmatic Charged in Federal Indictment That Previously Only Charged Executives The Justice Department has filed charges for the first time against a voting machine company whose systems are used in Los Angeles County, one of the largest election jurisdictions in the country. The company – UK-based Smartmatic and its parent company SGO – is charged, along with the former president of the
How the Infamous APT-1 Report Exposing China’s PLA Hackers Came to Be This is the first in a series of pieces I’ll publish that take an in-depth look at significant events, people and cases in security and surveillance from the past. If there’s something you think would make a good topic for this series, reach out to me at countdowntozeroday@
UAE Recruiting US Personnel Displaced by DOGE to Work on AI for its Military A UAE brigadier general received permission from the Pentagon to recruit former members of the Defense Digital Service to work on artificial intelligence for the UAE military — despite past warnings from US spy agencies and federal lawmakers that UAE could share AI technologies with China
Trump Signs Memorandum Revoking Security Clearance of Former CISA Director Chris Krebs President Donald Trump today signed a Presidential Memorandum revoking any active security clearance currently held by Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency, who famously rumbled publicly with Trump over the latter's false allegations of election fraud during and after the 2020 presidential
Did Trump Admin Order U.S. Cyber Command and CISA to Stand Down on Russia? (Story updated) Two blockbuster stories published on Friday that appear to confirm what many Americans suspected would occur under the Trump administration – that the new regime is going to be softer on Russia than previous administrations, particularly with regard to the threat that Russia poses in cyber space. Since publication, however, one
DOGE Court Documents Shed New Light on DOGE Access and Activity at Treasury Department New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Treasury staff did to limit his access. The documents indicate that the situation is more nuanced than previously reported.
U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, Per First-Ever Report What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations. In a first-of-its-kind report, the US
Anatomy of a Nuclear Scare How fake radiation readings in New York and New Jersey, coupled with a mysterious drone swarm, fueled a nuclear scare and became a harbinger for things to come The ongoing mystery around a New Jersey drone swarm ignited a number of theories last month about who owned the drones and
Voting Machine Company Involved in Bribing Scandal Has Long History of Controversy Last week the U.S. Justice Department charged three current and former executives of a U.S.-founded voting machine company with paying bribes to win lucrative election contracts in the Philippines. Roger Piñate, a Venezuelan citizen and president and co-founder of Smartmatic, a voting machine vendor founded in Boca
Kaspersky Lab Closing U.S. Division; Laying Off Workers Russian cybersecurity firm, Kaspersky Lab, has told workers in its U.S.-based division that they are being laid off this week and that it is closing its U.S. business, according to several sources. The sudden move comes after the U.S. Commerce Department announced last month that it
New Government Ban on Kaspersky Would Prevent Company from Updating Malware Signatures in U.S. The U.S. government has expanded its ban on Kaspersky software in a new move aimed at getting consumers and critical infrastructure to stop using the Russian company’s software products, citing national security concerns. The ban, using new powers granted to the U.S. Commerce Department, would prohibit the
Apple Chip Flaw Lets Hackers Steal Encryption Keys A group of researchers has found a serious security vulnerability in Apple’s M-series of chips that would allow attackers to steal secret keys from Mac and iPad devices. The problem affects Apple M1, M2 and M3 chips — which have been used in Apple desktops, notebooks and tablets since late
Zero Day Moves to Ghost Hi Everyone, This is an update and announcement to let you know that I've moved Zero Day from Substack to Ghost. The migration took a couple of months to complete, and I still have some design tweaks I need to do to the new site and some kinks
Nevada AG Asks Court to Ban Meta from Providing End-to-End Encryption to Minors Nevada's attorney general filed a motion this week to prevent Meta from providing end-to-end encryption to users under eighteen who reside in his state. The request is intended to combat predators who target minors for sexual exploitation and other criminal purposes, the AG states, and to allow law
Newsletter European Standards Body Votes to Release Secret Algorithms After hit with criticism earlier this year for keeping its encryption algorithms secret, the European standards body behind the TETRA algorithms has decided to open them to the public for scrutiny.
Newsletter Sophisticated StripedFly Spy Platform Masqueraded for Years as Crypto Miner Malware discovered in 2017 was long classified as a crypto miner. But researchers at Kaspersky Lab say it's actually part of a sophisticated spy platform that has infected more than a million victims.
Newsletter How North Korean Workers Tricked U.S. Companies into Hiring Them and Secretly Funneled Their Earnings into Weapons Programs Thousands of IT workers allegedly working on behalf of North Korea managed to trick U.S. companies into hiring them as remote developers — then used the money to help finance North Korean weapons.
Newsletter Standards Body Considers Uncloaking Secret Encryption Algorithms The European standards body that created secret encryption algorithms for use in TETRA radio communications is weighing whether to make new algorithms public, following backlash over its secrecy.
Newsletter Did a Journalist Violate Hacking Law to Leak Fox News Clips? The Government Thinks He Did. But attorneys for Timothy Burke say a raid on his home and office exhibit government over-reach and misuse of the federal hacking law, and raises First Amendment issues.
Newsletter Radiation Spikes at Chernobyl: A Mystery Few Seem Interested in Solving Ever since radiation sensors at the Chernobyl nuclear plant spiked dramatically following the Russian invasion, there have been questions about what caused the spikes. Now the mystery deepens.
Newsletter Interview with the ETSI Standards Organization That Created TETRA "Backdoor" Brian Murgatroyd spoke with me about why his standards group weakened an encryption algorithm used to secure critical radio communications of police, military, critical infrastructure and others.
Newsletter SEC Targets SolarWinds' CISO for Rare Legal Action Over Russian Hack In a highly rare move, the SEC sent notice to SolarWinds' CISO, and other specific employees, indicating they may face legal action over Russia's hack of their company.
Newsletter Updates and Timeline for 3CX and X_Trader Hacks Mandiant revealed this week that the hack of 3CX was actually a double supply-chain hack that first involved hacking and compromising another company's software. Here's a timeline of the events.
Newsletter Software Maker 3CX Was Compromised in First-of-its-Kind Threaded Supply-Chain Hack - Updated Hackers first compromised a different software maker and embedded malware in one of its programs. 3CX got compromised when a worker downloaded that program. It's not known why worker downloaded it.
Newsletter Leaked Pentagon Document Claims Russian Hacktivists Breached Canadian Gas Pipeline Company The document, part of a cache of leaks recently circulated on the internet, suggests the hackers had the ability to cause an explosion and sought instruction from the FSB.
Newsletter Hello and an Update I’ve been meaning to send an email to all of you for a while to fill you in on what I’ve been working on and to assure you that I haven’t abandoned Zero Day. I’ve been working on a number of projects that have been taking
Newsletter White House Says President Zelensky Set Security Parameters for His Visit to the U.S. Ukrainian President Volodymyr Zelensky will visit the White House on Wednesday for his first trip outside of Ukraine since the war began. He will hold a press conference and address Congress.
Newsletter Security Firms Aiding Ukraine During War Could Be Considered Participants in Conflict Experts say cybersecurity companies helping to defend Ukraine against Russian cyberattacks during the war could be considered direct participants in the hostilities and open themselves to attack.
Newsletter Viasat Hack "Did Not" Have Huge Impact on Ukrainian Military Communications, Official Says Contrary to initial reports that it resulted in a "really huge loss in communications in the very beginning of war," the hack did not have a huge impact on ability to coordinate military operations.
Newsletter Mysterious New Hacking Group Leaves Researchers Baffled The group, called Metador by the SentinelLabs researchers who discovered them, appears to be well-resourced and engaged in long-term espionage. But who is behind their operation is unclear.
Newsletter Is the Secret Service’s Claim About Erased Text Messages Plausible? (Updated) The Secret Service says data erased from the phones of some of its personnel — that may shed light on the agency's handling of the Jan. 6 insurrection — can’t be recovered. Is it telling the truth?
Newsletter What It Means that the U.S. Is Conducting Offensive Cyber Operations Against Russia Gen. Paul Nakasone's remarks this month about offensive operations against Russia caused a stir. But have people misinterpreted his words?
Newsletter Russia Began Setting Stage for Cyberattacks Against Ukraine a Year Ago The Kremlin’s cyber warriors began working to gain a foothold in Ukrainian government and critical infrastructure networks a year before the invasion, according to a report issued by Microsoft today.
Newsletter Questions about Cyber Conflict Remain Unresolved, Panelists Note Who is an enemy combatant in the cyber realm, and what are the rules of engagement for cyber conflict? These are enduring questions that remain unresolved despite years of punditry about cyberwarfare.
Newsletter Substack Rolls out Two-Factor Authentication for Users More than four years after launching, Substack finally adopts what is considered a security best standard.
Newsletter Unmasking China’s State Hackers Intrusion Truth debuted in 2017, unmasking hackers working for the Chinese government. Five years later they’re still at it, while managing to keep their own identity a secret.
Newsletter Intrusion Truth - Five Years of Naming and Shaming China’s Spies In 2017, a mysterious group called Intrusion Truth began exposing the real identities of hackers behind Chinese spy operations. In an interview, the group discusses their controversial work.
Newsletter Second Wiper Attack Strikes Systems in Ukraine and Two Neighboring Countries The wiper, dubbed HermeticWiper, struck a bank in Ukraine as well as machines in Latvia and Lithuania belonging to two contractors that work with the Ukrainian government.
Newsletter Wiper in Ukraine Used Code Repurposed From WhiteBlackCrypt Ransomware This month's wiper attack against government agencies in Ukraine has been tied to a 2021 ransomware campaign and a 2019 extortion plot against a Russian oligarch, investigators say.
Newsletter Hackers Were in Ukraine Systems Months Before Deploying Wiper According to researchers from Cisco, evidence shows the intruders were in a few government systems late last summer, but didn't deposit their malicious wiper on the systems until recently.
Newsletter Dozens of Computers in Ukraine Wiped with Destructive Malware in Coordinated Attack Dozens of computers at two government agencies in Ukraine are now confirmed to have been wiped by malware known as WhisperGate. The web sites of the two agencies were also defaced last week.
Newsletter What We Know and Don’t Know about the Cyberattacks Against Ukraine - (updated) Dozens of government agencies in Ukraine were targeted in a web site defacement campaign; around the same time some of the same agencies were infected with a destructive wiper. What happened?
Newsletter Cyber Ninjas CEO Launched Second Company Last Year - Updated A spokesman for the controversial company said Thursday that it was dissolving and laying off the CEO and all employees, after a court levied heavy fines against it. But the CEO has a second company.
Newsletter When Russia Helped the U.S. Nab Cybercriminals The U.S. has repeatedly protested Russia's failure to crack down on ransomware attacks emanating from within its borders. But there was a time when Russia helped the U.S. nab cybercriminals.
Newsletter The Israeli Intelligence Community’s Long History of Targeted Killings Transcript of Q&A with author Ronen Bergman, author of Rise and Kill First
Newsletter Sidechannel Interview with Ronen Bergman - Live Oct. 13, 1pm PT/4pm ET Bergman is author of the book Rise and Kill First, about Israel's program of targeted killings, and a New York Times journalist.
Newsletter Controversial Maricopa "Audit" Concludes that Biden Won by More Votes Than Previously Reported What is believed to be a draft report of the controversial "audit" indicates that President Biden actually gained nearly 100 more votes in the recount than previously counted, and Trump lost 261.
Newsletter Former NSA Hacker Describes Being Recruited for UAE Spy Program David Evenden was hired in 2014 to work in Abu Dhabi on a defensive cybersecurity project, only to discover it was actually an offensive spy operation for a United Arab Emirates intelligence service.
Newsletter Hacking Team Customer in Turkey Was Arrested for Spying on Police Colleagues [or: The Spy Story That Spun a Tangled Web] An investigation that weaves a winding tale between police in Ankara who were charged with spying on their own colleagues... and the purchase of Hacking Team's surveillance software.
Newsletter Hackers Leak Surveillance Camera Videos Purportedly Taken From Inside Iran's Evin Prison The reported breach comes weeks after computer systems belonging to Iran's railway system were also hacked. The railway incident has been attributed to Iranian hacktivists.
Newsletter Pegasus Spyware: How It Works and What It Collects An NSO document leaked to the internet reveals how the Pegasus spyware - sold to intelligence and law enforcement agencies around the world - can be used to spy on targeted mobile phones.
Newsletter The NSO “Surveillance List”: What It Is and Isn’t A series of blockbuster stories published this week around a leaked list of 50,000 phone numbers have created confusion about whether the owners of those numbers were targets of surveillance or not.
Newsletter Justice Department Sought Reporter Records from Security Firm Proofpoint, in Bid to Unmask Leak Sources Documents unsealed by a court this week reveal that the Justice Department didn't just go after email providers to obtain reporter records, but also went after the security firm Proofpoint
Newsletter Voting’s Hash Problem: When the System for Verifying the Integrity of Voting Software Lacks Integrity Itself Problems uncovered in the hash-verification process for voting machines made by Election Systems and Software highlight issues with the trustworthiness of voting software and voting machine vendors
Newsletter Negotiating Ransoms: When to Play and When to Fold An interview with the CEO of Coveware, which negotiates payments on behalf of ransomware victims.
Newsletter Checking in It’s been two months this week since I launched this experiment called Zero Day. Now that I’ve had time to see what’s doable on this platform and what’s doable as a writing pace, I wanted to check in with readers to get some feedback. When I
Newsletter Darkside Retreats to the Dark After announcing that its criminal infrastructure has been taken down due to U.S. law enforcement pressure, the Darkside ransomware gang says it's retreating. But is it?
Newsletter Anatomy of a $2 Million Darkside Ransomware Breach Days before the Darkside ransomware creators formally launched their business with a press release last August, a U.S. victim was already preparing to pay them a $2 million ransom.
Newsletter What Happens in Maricopa Won’t Stay in Maricopa How a little-known cybersecurity consulting company is controlling one of the most significant events related to the 2020 presidential election and plans to spread its tactics to other states.
Newsletter US Gov Issues Emergency Order While Colonial Pipeline Is Down The move lets fuel that's backed up in Texas and elsewhere be more quickly transported by trucks while pipeline remains offline. Colonial has not said when its pipelines will be back online.
Newsletter Ransomware Infection on Colonial Pipeline Shows Potential for Worse Gas Disruption Colonial Pipeline says ransomware only infected its business network, not the operations network that controls gas flow. But experts say it had potential to spread to control network and suppliers
Newsletter Recording now Available: Live Chat with Alex Stamos/Chris Krebs on Sidechannel, Friday April 30, 11am PST/2pm EST //// If you missed the live chat today with Alex Stamos and Chris Krebs, I’ve uploaded a recording of it here: //// Hi Everyone, This is just an FYI to let you know that this Friday (April 30) at 11am PST/2pm EST, I’ll be interviewing Alex Stamos and Chris
Newsletter Research Uncovers New Command Servers Used in SolarWinds Campaign Researchers at RiskIQ have discovered 18 additional command servers used in the hacking campaign, which may help identify more victims. They also spotted mysterious server activity in February 2020.
Newsletter Sanctioned Firm Accused of Helping Russian Intelligence Was Part of Microsoft’s Early Vuln Access Program — MAPP A little-seen report issued last month by the Atlantic Council described in detail what a source confirms was the company’s alleged activities on behalf of the Russian government.
Newsletter Introducing Sidechannel, for Zero Day Subscribers Launching a new Discord channel with seven other writers for Zero Day subscribers and others who want to discuss important topics and stories, or just spill the tea
Newsletter Sabotage at Iranian Nuclear Plant Was Likely Meant to Permanently Damage Centrifuges Experts say an electrical blackout on Sunday at the Natanz uranium enrichment plant in Iran wasn't just about halting the centrifuges, but likely was aimed specifically at damaging them.
Newsletter AP Says It Experienced Unprecedented Cyber "Attacks" During 2020 Election These included 10,000 daily phishing attempts and an average of 1.8 million web-based “attacks” per month.
Newsletter Mind the Gap: How the NSA might use SolarWinds campaign to do warrantless spying Officials have said the SolarWinds hacking campaign succeeded in part because of a gap in NSA surveillance power. But what exactly is the gap and how might the gov use it to gain domestic spy power?
Newsletter Delay due to Emergency I wanted to thank all of you who subscribed to the Zero Day newsletter. The response to the launch last Friday has been so positive and unexpected, and I’m looking forward to digging into some great stories for you here. I had planned to publish my second article today,
Newsletter Government Monitoring Won't Stop the Next SolarWinds Campaign, Experts Say The SolarWinds hacking campaign has raised a lot of questions about why intruders behind the operation, believed to be from Russia, weren’t caught sooner as they moved through government and private networks for months undetected. Some have wondered why the National Security Agency’s signals intelligence and skilled hackers,
Newsletter About the Author Kim Zetter is an award-winning investigative journalist who has covered cybersecurity and national security for more than 15 years. She is the author of Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon — which tells the true tale of a covert operation conducted
archived 20 Feb 2026 11:01:02 UTCarchived 20 Feb 2026 11:01:02 UTC
![Hacking Team Customer in Turkey Was Arrested for Spying on Police Colleagues [or: The Spy Story That Spun a Tangled Web]](https://archive.fo/1BGiI/35722ab9463e2a2e7a7f91bd05d15783d701349b.jpg)
