Innovation of rupture is not simply a bold invention—it’s a shift in power, usage, and norms. This article explores two dominant visions of innovation, the role patents play in enabling or constraining breakthroughs, and the systemic resistance that disruptors must navigate. Using Freemindtronic’s sovereign cybersecurity technologies as a real-world case, we analyze how regulatory inertia, industrial dependencies, and biased standards affect the path to adoption. Anchored in field experience and strategic reflection, this narrative offers a vision of innovation that is resilient, disruptive, and sovereign by design.
About the author — Jacques Gascuel is the inventor and founder of Freemindtronic Andorra, where he pioneers disruptive sovereign cybersecurity technologies based on patented architectures. With a legal background and a strategic mindset, he explores how hardware-based security and normative resistance intersect in sovereign contexts. His work focuses on building autonomous systems — offline, OS-independent, and resilient by design — to address the systemic inertia in regulated environments. Through his publications, Jacques bridges field innovation, legal asymmetry, and technological sovereignty, offering a vision of cybersecurity that breaks compliance boundaries without compromising purpose.
Disruptive innovation doesn’t bloom from comfort. It emerges where certainties tremble—when new visions confront the inertia of accepted norms. In today’s strategic landscape, where sovereignty meets cybersecurity and systemic inertia blocks transformation, innovation of rupture becomes more than a buzzword. It’s a tension between evolving what exists and inventing what doesn’t. Many organizations believe innovation must adapt to existing frameworks. Others argue real progress demands defiance—crafting new usage models, new markets, and entirely new expectations. This friction fuels the deeper dilemma: should innovators conform to dominant systems or design alternatives that reshape the rules? In practice, innovation of rupture sits at this crossroads. It alters market structures, redefines user behaviors, and demands new regulatory thinking. But to disrupt effectively, it must challenge more than just technical limitations. It must shake habits, belief systems, and institutional dependencies. This article explores: While patents are commonly viewed as tools for safeguarding innovation, they rarely ensure its success. A patent may shield an idea from duplication, but it does not compel the market to embrace it. This tension is especially true for innovations of rupture, which often disrupt comfortable norms and threaten entrenched interests. Patents are legal instruments designed to grant inventors exclusive rights over their creations. They protect intellectual property, encourage investment, and often strengthen negotiation power. Yet, as powerful as patents are on paper, they do not automatically accelerate adoption. A patented disruptive technology may languish if it collides with regulatory inertia or lacks strategic alignment. 👉 According to the European Patent Office (EPO), over 50% of patents never make it to market. That figure increases when the technology challenges dominant standards or requires user behavior change. When disruption alters usage patterns or demands new norms, patents become part of a broader strategy—not a safety net. For instance, sovereign cybersecurity tools that operate without OS dependency or cloud access may bypass known frameworks entirely. In doing so, they risk clashing with legislation and standards designed around centralized control. 📌 Consider this: a patented sovereign security device offers offline encryption, no RAM exposure, and total independence. But if legal frameworks mandate auditability through centralized servers, the disruptive power becomes paradoxical—it’s secured by law yet suppressed by law. Innovation of rupture thrives only when the patent’s protection aligns with market readiness, user context, and communication strategy. Adoption requires more than exclusivity—it calls for trust, usability, and perceived legitimacy. The patent may block competitors, but only strategic narrative enables traction. As we move forward, it becomes clear that even well-protected inventions need to confront a larger force: systemic resistance driven by lobbying, standards, and industrial dependencies. Even the most visionary innovations are rarely welcomed with open arms. When a technology disrupts existing structures or threatens entrenched powers, it enters an ecosystem where resistance is embedded. Systemic forces—legislative inertia, industrial dependencies, and hidden lobbying—work collectively to defend the status quo. And this resistance doesn’t always wear a uniform. Sometimes it looks like compliance. Other times it’s masked as best practices. Standards are designed to harmonize markets, ensure safety, and guide interoperability. Yet in practice, some norms are shaped by dominant players to protect their advantage. When a disruptive technology operates outside conventional OS frameworks, centralized infrastructure, or cloud ecosystems, it may be deemed non-compliant—not because it is unsafe, but because it is independent. Strategic disobedience then becomes a necessity, not a weakness. The power of lobbying often lies in its subtlety. Through influence on advisory boards, standardization committees, or regulatory language, certain entities steer innovation in directions favorable to existing infrastructures. As reported in the OECD’s regulatory innovation framework, this type of resistance can stall sovereign solutions under the guise of safety, stability, or ecosystem integrity. Large-scale institutions—whether governmental, financial, or industrial—build upon legacy systems that are expensive to replace. Technologies that challenge those infrastructures often face delayed integration, skepticism, or exclusion. Sovereign cybersecurity tools, for instance, may offer superior decentralization, but if the ecosystem demands centralized logging or remote validation, their deployment becomes politically complex. In theory, disruptive innovation sparks transformation. In practice, it challenges conventions head-on. Freemindtronic’s sovereign cybersecurity solutions demonstrate what happens when disruption refuses to conform. Designed to operate fully offline, independent of operating systems or cloud infrastructure, these hybrid HSMs (Hardware Security Modules) embody true innovation of rupture. They don’t just secure — they redefine the terms of security itself. Freemindtronic’s DataShielder NFC HSM devices offer autonomous encryption, air-gapped by design. Credentials and cryptographic operations remain insulated from operating systems, RAM, and clipboard exposure — a direct response to threats like Atomic Stealer (AMOS), which weaponize native OS behaviors. This sovereign architecture decentralizes trust, eliminates third-party dependencies, and removes the attack surface exploited by memory-based malware. In a landscape where cybersecurity often means cloud integration and centralized monitoring, Freemindtronic’s solution is strategically disobedient. Despite its resilience and privacy-by-design principle, this type of sovereign hardware often encounters systemic resistance. Why? Because mainstream standards favor interoperability through centralized systems. Secure messaging protocols, compliance tools, and authentication flows assume OS/cloud integration. A device that deliberately avoids those channels may be seen as “non-compliant” — even when it’s demonstrably more secure. For Freemindtronic, rupture is not a side effect — it’s a strategic direction. By embedding sovereignty at the hardware level, the company redefines what cybersecurity means in hostile environments, mobility constraints, and regulatory asymmetry. Patents protect the technical methods. Field validation confirms operational effectiveness. But the real challenge lies in aligning this innovation with institutions still tethered to centralized control. Innovation of rupture offers strategic independence—but when used maliciously or without accountability, it can destabilize sovereign balance. Technologies designed for autonomy and security may become instruments of opacity, evasion, or even asymmetrical disruption. Furtive devices that bypass OS, cloud, and traceability protocols pose new ethical and political dilemmas. While sovereign tools empower users, they may also obstruct lawful oversight. This paradox reveals the fragility of digital sovereignty: the very features that protect against surveillance can be weaponized against institutions. If rupture becomes uncontrolled stealth, sovereignty turns inward—and may erode from within. State actors must balance innovation support with strategic safeguards. Furtive tech, if exploited by criminal networks or hostile entities, could bypass national defense, disrupt digital infrastructure, or undermine democratic mechanisms. The challenge is to maintain sovereignty without losing visibility. The answer is not to suppress rupture, but to govern its implications. Innovation must remain open—but the usage contexts must be anticipated, the risks modeled, and the countermeasures embedded. Otherwise, strategic disobedience may mutate into strategic evasion. In environments shaped by digital surveillance and institutional control, sovereign technologies must do more than protect — they must resist. Freemindtronic’s HSM architectures do not rely on operating systems, cloud, or centralized protocols. Their independence is not incidental — it is intentional. These devices stand as natural barriers against intrusion, espionage, and normative capture. By operating offline, memory-free, and protocol-neutral, these sovereign systems form natural countermeasures against technical espionage. At the institutional level, they resist interception, logging, and backend exploitation. At the individual level, they preserve digital autonomy, shield private credentials, and deny access vectors that compromise sovereignty. This architecture doesn’t just avoid surveillance — it actively denies the mechanisms that enable it. In doing so, it redefines the notion of defensive security: not as passive protection, but as active strategic disobedience. Sovereign HSMs like those from Freemindtronic don’t block threats — they render them inoperative. The CIA’s 2022 study on cyber deterrence recognizes that disruption of espionage pathways is more effective than traditional deterrence. Similarly, Columbia SIPA’s Cyber Disruptions Dataset catalogs how sovereign tech can neutralize even state-level surveillance strategies. Not all rupture starts by defying the frame. Sometimes, it emerges from strategic differentiation within existing norms. The Boxilumix® technology developed by Asclepios Tech exemplifies this pathway: it doesn’t reject post-harvest treatment—it reimagines it through light modulation, without chemicals. Boxilumix® respects regulatory frameworks yet achieves measurable innovation: longer shelf life, improved appearance, enhanced nutritional value. These advancements address stringent export demands and create value without entering regulatory conflict. Their approach earned high-level validation: Seal of Excellence (European Commission), Booster Agrotech (Business France), and multiple awards for sustainable food innovation. It proves that innovation of rupture can also arise from mastering differentiation, not just rebellion. Whether through institutional challenge or smart alignment, innovation succeeds when it balances context, purpose, and narrative. Asclepios Tech shows that rupture can be elegant, embodied through precision rather than force. Inventing is never enough. For innovation of rupture to matter, it must be adopted—and for adoption to happen, strategy must shape perception. Disruptive technologies don’t just fight technical inertia; they challenge political, cultural, and institutional expectations. Without a compelling narrative, even the most sovereign innovation remains marginal. Innovators often underestimate how tightly trust is bound to context. A sovereign security device may prove resilient in lab conditions, but if users, regulators, or institutions lack visibility into its methods or relevance, adoption slows. Disruption must speak the language of its environment—whether that’s national sovereignty, data protection, or resilience in critical infrastructure. A powerful narrative aligns the innovation with deeper social and institutional needs. It must translate disruption into clarity—not just for engineers, but for decision-makers, legal analysts, and end users. The message must express purpose, urgency, and credible differentiation. Long before markets shift, minds must be convinced. Creating new usage is more strategic than improving old ones. Sovereign cybersecurity tools succeed when they’re not just better, but necessary. Frictionless integration, context-aware functions, and layered utility drive usage organically. Once a tool shapes how people behave, it reshapes how industries and institutions respond. To thrive amid systemic blockers, innovators must anticipate regulatory gaps, industrial dependencies, and political asymmetries. Strategic rupture doesn’t mean isolation—it requires calibrated tension. By preparing answers to compliance queries, forging alternative trust models, and demonstrating social impact, the innovator positions disruption not as rebellion but as solution. Far from being speculative, the concept of innovation of rupture and technological sovereignty is increasingly echoed in global institutional and academic discourse. Recent studies expose how lobbying, standardization politics, and intellectual property systems can hinder strategic adoption. The need for independent frameworks, sovereign infrastructures, and regulatory agility is no longer just theoretical—it’s an emerging priority. The OECD report “Lobbying in the 21st Century” (2021) reveals how influential actors shape regulatory norms to sustain dominant business models. This aligns with our earlier analysis: disruption often faces resistance dressed as “standards.” Transparency International’s statement on OECD lobbying reforms warns of “unregulated influence ecosystems” that may suppress sovereign technologies before public adoption begins. The German institute Fraunhofer ISI defines technological sovereignty as the capacity to “make independent technological choices” in strategically sensitive domains. Their report underscores the role of rupture in escaping dependency traps — especially in digital infrastructure. Dutch research center TNO’s whitepaper details how decentralized, sovereign cybersecurity tools strengthen resilience. Offline hardware models — as exemplified by Freemindtronic — are cited as viable alternatives to cloud-based dependencies. The Stockholm School of Economics provides a detailed thesis on patent limitations: “The Impact of the Patent System on Innovation” by Julian Boulanger explains how patents fail when they lack socio-regulatory traction. Further, Télécom ParisTech’s thesis by Serge Pajak “La propriété intellectuelle et l’innovation” explores how innovation of rupture faces challenges when legal frameworks are not strategically aligned. An EU-wide study by Frontiers in Political Science “Digital Sovereignty and Strategic Autonomy” analyzes conflicts between national interest and imposed technical standards. It confirms what field innovators already know: real sovereignty often requires navigating beneath the surface of compatibility and compliance. The vision behind innovation of rupture is not isolated—it is increasingly echoed across high-level institutions, deeptech policy reports, and academic research. Sovereignty, disobedience by design, and resistance to normative capture are themes gaining traction in both state-level and multilateral contexts. Below is a curated set of official studies, whitepapers, and theses that lend credibility and depth to the disruptive sovereignty framework. The OECD’s report “Lobbying in the 21st Century” highlights how technical standards and regulatory influence are often shaped to favor incumbents. Norms may reflect ecosystem biases, not innovation potential. Transparency International further warns that unregulated influence ecosystems suppress sovereign technologies under the guise of compliance. Fraunhofer Institute’s 2021 paper frames sovereignty as the ability to make independent choices in tech-critical areas. It recognizes rupture as a mechanism to escape dependency traps and enhance strategic autonomy. The Dutch innovation hub TNO lays out clear alternatives to cloud-centric security in its 2024 whitepaper “Cybersecurity and Digital Sovereignty”. It cites air-gapped HSMs as foundational elements of resilience—a core tenet of Freemindtronic’s technology. The DGE’s Deeptech 2025 report defines innovation of rupture as a strategic lever to address industrial sovereignty, cybersecurity, and supply chain independence. It calls for regulatory flexibility and intellectual property reforms to enable adoption. In Springer’s 2024 monograph “Cyber Sovereignty”, researchers analyze how digital sovereignty is used by nations to reassert control in fragmented and unregulated technological ecosystems. It positions rupture as both political and technical strategy. Frontiers in Political Science explores the friction between pan-European norms and national digital autonomy. It validates sovereign hardware and non-cloud infrastructures as legitimate modes of technological independence. Sovereignty doesn’t exclude collaboration. As argued in Intereconomics’ article “Coopetitive Technological Sovereignty”, strategic autonomy may be best achieved by choosing productive interdependence—where innovation remains independent, but dialogue continues. Disruption without sovereignty is often short-lived. True rupture begins when innovation no longer seeks validation from the systems it challenges. As we’ve seen, patents offer protection but not traction, standards can ossify into gatekeeping tools, and market adoption demands a layered strategy. But beyond technique lies posture—a deliberate alignment between vision and action, even when action diverges from dominant models. Strategic disobedience is not recklessness—it’s methodical. It means identifying systemic bottlenecks, assessing normative traps, and crafting technologies that are contextually aware yet structurally independent. Sovereign tools do not just perform—they resist absorption. And for inventors operating at the frontier, that resistance is not a flaw but a function. Technological rupture often unsettles the familiar. It may provoke critique, trigger lobbying pushback, or be framed as “unusual.” But redefinition is born in discomfort. Freemindtronic’s example proves that by designing for autonomy and resilience, innovation can sidestep fragility and embrace sovereignty—not as a theme, but as a framework. This perspective is not closed—it’s open to interpretation, continuation, and even contradiction. Disruptive sovereignty is not a monologue. It’s a strategic invitation to reimagine innovation beyond compatibility, beyond compliance, and beyond control. It calls inventors, policymakers, and tech leaders to embody a form of creation that respects context but isn’t bound by it.Executive Summary
Strategic Reading Guide
Key Strategic Takeaways
Innovation beyond comfort zones
The Patent Paradox: Protection vs Adoption
Protection without traction
Innovation of rupture meets legal friction
Strategic alignment matters
Systemic Resistance: Lobbying, Norms and Market Inertia
Norms as strategic control mechanisms
Lobbying as invisible resistance
Legacy dependencies and institutional inertia
When norms are crafted around centralized control, true sovereignty looks disruptive. And disruption, by design, resists permission.Case Study – Freemindtronic and Sovereign HSM Disruption
Security without OS or cloud dependency
A technology that challenges normative ecosystems
Strategic positioning amid systemic resistance
Freemindtronic’s sovereign HSMs don’t just defend against threats — they reject the frameworks that enable them. That’s where rupture becomes strategy.Risks of Rupture – When Sovereign Technology Challenges Sovereignty Itself
Between emancipation and erosion
National interest and digital asymmetry
Proactive governance over sovereign tools
Without contextual safeguards, innovation of rupture risks becoming a vehicle for sovereignty denial—not reinforcement.Disruptive Counter-Espionage – Sovereignty by Design
Natural sovereignty barriers: institutional and individual
Espionage denial as strategic posture
Global recognition of disruption as countermeasure
Whether institutional or personal, sovereignty begins where espionage ends. Freemindtronic’s rupture model isn’t a shield. It’s a denial of exposure.Innovation Between Differentiation and Disruption
Conforming without compromising innovation
Recognition through integration
Strategic lesson — arbitrating innovation paths
Sometimes, the most strategic disruption is knowing how to differentiate—without leaving the frame entirely.Strategic Adoption: Making Rupture Acceptable
Context drives legitimacy
Storytelling as strategic infrastructure
Usage as a trigger of adoption
Tactical alignment with resistance
Visibility, narrative, and context make rupture acceptable—even when it remains strategically disobedient.Institutional and Academic Validation of Disruptive Sovereignty
OECD – Lobbying and normative bias
Fraunhofer ISI – Technology sovereignty as policy framework
TNO – Autonomy and digital resilience
Academic theses – Patents and resistance strategies
EU studies – Strategic autonomy and sovereignty
From OECD to Fraunhofer, EU institutions to doctoral research, the call for sovereignty in innovation is growing. Freemindtronic’s model is not fringe—it’s frontline.Strategic Validation — When Institutions and Research Confirm the Sovereign Path
OECD – Lobbying and Normative Resistance
Fraunhofer ISI – Defining Technology Sovereignty
TNO – Sovereign Cybersecurity Architectures
France – Deeptech and Sovereign Innovation Strategy
Springer – Cyber Sovereignty and Global Power Shifts
Frontiers – EU and Strategic Autonomy
Academic Theses – Patents and Resistance Mechanics
Towards Coopetitive Sovereignty
From OECD and Fraunhofer to EU bodies and French industrial strategy, your thesis is not just visionary—it’s reflected in the architecture of future innovation governance.Towards Disruptive Sovereignty – A Strategic Perspective
The role of the inventor: method over compliance
Accept discomfort, pursue redefinition
From strategic insight to collective movement
To disrupt meaningfully, innovators must stop asking for permission—and start building what permission never allowed.
Tag Archives: NFC HSM
Atomic Stealer AMOS: Redefining Mac Cyber Threats Featured in Freemindtronic’s Digital Security section, this analysis by Jacques Gascuel explores one of the most sophisticated and resilient macOS malware strains to date. Atomic Stealer Amos merges cybercriminal tactics with espionage-grade operations, forming a hybrid threat that challenges traditional defenses. Gascuel dissects its architecture and presents actionable strategies to protect national systems and corporate infrastructures in an increasingly volatile digital landscape.
Explore More in Digital Security
Stay ahead of advanced cyber threats with in-depth articles from Freemindtronic’s Digital Security section. From zero-day exploits to hardware-based countermeasures, discover expert insights and field-tested strategies to protect your data, systems, and infrastructure.
Executive Summary
Atomic Stealer (AMOS) redefined how macOS threats operate. Silent, precise, and persistent, it bypassed traditional Apple defenses and exploited routine user behavior to exfiltrate critical data. This article offers a strategic analysis of AMOS’s evolution, infection techniques, threat infrastructure, and its geopolitical and organizational impact. It also provides concrete defense recommendations, real-world case examples, and a cultural reassessment of how we approach Apple endpoint security.
Atomic Stealer AMOS: The Mac Malware That Redefined Cyber Infiltration
Last Updated: 08 july 2025
Version: 1.0
Source: Freemindtronic Andorra
Atomic Stealer – Navigation Guide
- Macs Were Safe. Until They Weren’t.
- Updated Threat Capabilities July 2025
- A Threat Engineered for Human Habits
- Adaptation as a Service
- Two Clicks Away from a Breach
- Institutional Blind Spots
- Detecting the Undetectable
- Malware-as-a-Service, Industrial Grade
- Strategic Exposure: Who’s at Risk
- What Defenders Fear Next
- Threat Actor Attribution: Who’s Really Behind AMOS?
- Indicators of Compromise (IOCs)
- Defenders’ Playbook: Active Protection
- Freemindtronic Solutions to Secure macOS
- What About Passkeys and Private Keys?
- DataShielder: Hardware Immunity Against macOS Infostealers
- PassCypher Protection Against AMOS
- Atomic Stealer Amos and the Future of macOS Security Culture
- Verified Sources
Macs Were Safe. Until They Weren’t.
For more than a decade, macOS held a reputation as a bastion of digital safety. Many believed its architecture inherently protected users from the kind of sophisticated malware seen on Windows. This belief was widespread, deeply rooted—and dangerously wrong.
In April 2023, that myth cracked open.
Security researchers from Malwarebytes and Moonlock spotted a new macOS malware circulating on Telegram. It wasn’t loud. It wasn’t chaotic. It didn’t encrypt files or display ransom notes. Instead, it crept in silently, exfiltrating passwords, session tokens, and cryptocurrency wallets before anyone noticed. They called it Atomic Stealer AMOS for short.
It doesn’t log keystrokes. It doesn’t need to. AMOS exploits macOS-native trust zones like Keychain and iCloud Keychain. Only air-gapped hybrid HSM solutions — like NFC HSM and PGP HSM — fully isolate your secrets from such attacks.
✪ Illustration showing Apple’s ecosystem under scrutiny, symbolizing the covert infiltration methods used by Atomic Stealer AMOS.
By mid-2025, Atomic had breached targets in over 120 countries. It wasn’t a side-story in the malware landscape anymore—it had become a central threat vector, especially for those who had mistakenly assumed their Macs were beyond reach.
In April 2023, that myth cracked open…
They called it Atomic Stealer AMOS for short.
It doesn’t encrypt or disrupt. It quietly exfiltrates credentials, tokens, and crypto wallets—without triggering alerts.
Updated Threat Capabilities July 2025
Since its initial discovery, Atomic Stealer AMOS has evolved dramatically, with a much more aggressive and stealthy feature set now observed in the wild.
- Persistence via macOS LaunchDaemons and LaunchAgents
AMOS now installs hidden.agent
and.helper
files, such ascom.finder.helper.plist
, to maintain persistence even after reboot. - Remote Command & Control (C2)
AMOS communicates silently with attacker servers, enabling remote command execution and lateral network movement. - Modular Payload Deployment
Attackers can now inject new components post-infection, adapting the malware’s behavior in real time. - Advanced Social Engineering
Distributed via fake installers, trojanized Homebrew packages, and spoofed CAPTCHA prompts. Even digitally signed apps can be weaponized. - Global Spread
Targets across 120+ countries including the United States, France, Italy, UK, and Canada. Attribution links it to a MaaS operation known as “Poseidon.”
Recommended Defense Enhancements
To defend against this rapidly evolving macOS threat, experts recommend:
- Monitoring for unauthorized
.plist
files and LaunchAgents - Blocking unexpected outbound traffic to unknown C2 servers
- Avoiding installation of apps from non-official sources—even if signed
- Strengthening your Zero Trust posture with air-gapped tools like SeedNFC HSM and Bluetooth Keyboard Emulator to eliminate clipboard, keychain, and RAM-based exfiltration vectors
Risk Scoring Update for Atomic Stealer AMOS
Capability | Previous Score | July 2025 Score |
---|---|---|
Stealth & Evasion | 8/10 | 9/10 |
Credential & Crypto Theft | 9/10 | 10/10 |
Persistent Backdoor | 0/10 | 10/10 |
Remote Access / C2 | 2/10 | 10/10 |
Global Reach & Target Scope | 9/10 | 9/10 |
Overall Threat Level | 7.6 / 10 | 9.6 / 10 |
✪ Illustration showing Atomic Stealer AMOS breaching Apple’s ecosystem, using stealthy exfiltration methods across macOS environments.
New Backdoor: Persistent and Programmable
In early July 2025, Moonlock – MacPaw’s cybersecurity arm – confirmed a significant upgrade: AMOS now installs a hidden backdoor (via .helper
/.agent + LaunchDaemon), which survives reboots and enables remote command execution or additional payload delivery — elevating its threat level dramatically
A Threat Engineered for Human Habits
Atomic Stealer AMOS didn’t rely on zero-days or brute force. It exploited something far more predictable: human behavior.
Freelancers seeking cracked design plugins. Employees clicking “update” on fake Zoom prompts. Developers installing browser extensions without scrutiny. These seemingly minor actions triggered full system compromise.
Once deployed, AMOS used AppleScript prompts to request credentials and XOR-encrypted payloads to evade detection. It embedded itself via LaunchAgents and LaunchDaemons, securing persistence across reboots.
✪ A visual breakdown of Atomic Stealer’s infection method on macOS, from fake update to credential theft and data exfiltration.
Its targets were no less subtle:
- Passwords saved in Chrome, Safari, Brave
- Data from over 50 crypto wallets (Ledger, Coinomi, Exodus…)
- Clipboard content—often cryptocurrency transactions
- Browser session tokens, including cloud accounts
SpyCloud Labs – Reverse Engineering AMOS
Atomic didn’t crash systems or encrypt drives. It simply harvested. Quietly. Efficiently. Fatally.
Adaptation as a Service
What makes AMOS so dangerous isn’t just its code—it’s the mindset behind it. This is malware designed to evolve, sold as a service, maintained like a product.
Date | Evolution Milestone |
---|---|
Apr 2023 | First sightings in Telegram forums |
Sep 2023 | ClearFake phishing campaigns weaponize delivery |
Dec 2023 | Encrypted payloads bypass antivirus detection |
Jan 2024 | Fake Google Ads launch massive malvertising wave |
Jul 2025 | Persistent remote backdoor integrated |
✪ This infographic charts the infection stages of Atomic Stealer AMOS, highlighting key milestones from its emergence via cracked macOS apps to sophisticated phishing and remote access techniques.
Picus Security – MITRE ATT&CK mapping
Two Clicks Away from a Breach
To understand AMOS, you don’t need to reverse-engineer its binaries. You just need to watch how people behave.
In a real-world example, a freelance designer downloaded a cracked font plugin to meet a deadline. Within hours, AMOS drained her wallet, accessed her saved credentials, and uploaded client documents to a remote server.
In a separate case, a government office reported unusual login activity. Investigators found a spoofed Slack update triggered the breach. It wasn’t Slack. It was AMOS.
✪ Illustration depicting the dual nature of Atomic Stealer (AMOS) attacks: a freelancer installing a cracked plugin and a government employee clicking a fake Slack update, both leading to data theft and wallet drain.
Institutional Blind Spots
In 2024, Red Canary flagged Atomic Stealer among the top 10 macOS threats five times. A year later, it had infected over 2,800 websites, distributing its payload via fake CAPTCHA overlays—undetectable by most antivirus suites.
Cybersecurity News – 2,800+ infected websites
AMOS breached:
- Judicial systems (document leaks)
- Defense ministries (backdoor surveillance)
- Health agencies (citizen data exfiltration)
✪ A choropleth heatmap visualizing the global spread of Atomic Stealer AMOS malware, highlighting red zones of high infection (USA, Europe, Russia) and a legend indicating severity levels.
Detecting the Undetectable
AMOS leaves subtle traces:
- Browser redirects
- Unexpected password resets
- .agent or .runner processes
- Apps flickering open
To mitigate:
- Update macOS regularly
- Use Little Snitch or LuLu
- Audit ~/Library/LaunchAgents
- Avoid unverified apps
- Never run copy-paste terminal commands
✪ This infographic checklist outlines 5 key reflexes to detect and neutralize Atomic Stealer (AMOS) infections on macOS systems.
Threat Actor Profile: Who’s Behind AMOS?
While AMOS has not been officially attributed to a specific APT group, indicators suggest it was developed by Russian-speaking actors, based on:
- Forum discussions on Russian-language Telegram groups
- Code strings and comments in Cyrillic
- Infrastructure overlaps with known Eastern European malware groups
These threat actors are not simply financially motivated. The precision, modularity, and persistence of AMOS suggests potential use in state-adjacent cyber operations or intelligence-linked campaigns.
Its evolution also parallels other known cybercrime ecosystems operating in Russia and Belarus, often protected by a “hands-off” doctrine as long as they avoid targeting domestic networks.
Malware-as-a-Service: Industrial Grade
- Custom builds with payload encryption
- Support and distribution via Telegram
- Spread via ClickFix and malvertising
- Blockchain-based hosting using EtherHiding
✪ Écosystème MaaS d’Atomic Stealer comparé à Silver Sparrow et JokerSpy, illustrant ses tactiques uniques : chiffrement XOR, exfiltration crypto, AppleScript et diffusion via Telegram.
Malware Name | Year | Tactics | Unique to AMOS |
---|---|---|---|
Silver Sparrow | 2021 | Early Apple M1 compatibility | ✗ |
JokerSpy | 2023 | Spyware in Python, used C2 servers | ✗ |
Atomic Stealer | 2023–2025 | MaaS, XOR encryption, AppleScript, wallet exfiltration | ✅ |
AMOS combines multiple threat vectors—social engineering, native scripting abuse, and crypto-focused data harvesting—previously scattered across different strains.
Strategic Exposure: Who’s at Risk
Group | Severity | Vector |
---|---|---|
Casual Users | High | Browser extensions |
Crypto Traders | Critical | Clipboard/wallet interception |
Startups | Severe | Slack/Teams compromise |
Governments | Extreme | Persistent surveillance backdoors |
What Defenders Fear Next
The evolution isn’t over. AMOS may soon integrate:
- Biometric spoofing (macOS Touch ID)
- Lateral movement in creative agencies
- Steganography-based payloads in image files
Security must not follow. It must anticipate.
Strategic Outlook Atomic Stealer AMOS
- GDPR breaches from exfiltrated citizen data (health, justice)
- Legal risks for companies not securing macOS endpoints
- Cross-border incident response complexities due to MaaS
- Urgent need to update risk models to treat Apple devices as critical infrastructure
Threat Actor Attribution: Who’s Really Behind AMOS?
While Atomic Stealer (AMOS) has not been officially attributed to any known APT group, its evolution and operational model suggest the involvement of a Russian-speaking cybercriminal network, possibly APT-adjacent.
The malware’s early presence on Russian-language Telegram groups, combined with:
- Infrastructure linked to Eastern Europe,
- XOR obfuscation and macOS persistence techniques,
- and a sophisticated Malware-as-a-Service support network
…indicate a semi-professionalized developer team with deep technical access.
Whether this actor operates independently or under informal “state-blind tolerance” remains unclear. But the outcome is strategic: AMOS creates viable access for both criminal monetization and state-aligned espionage.
Related reading: APT28’s Campaign in Europe
Indicators of Compromise (IOCs)
Here are notable Indicators of Compromise for Atomic Stealer AMOS:
File Hashes
- fa34b1e87d9bb2f244c349e69f6211f3 – Encrypted loader sample (SHA256)
- 9d52a194e39de66b80ff77f0f8e3fbc4 – macOS .dmg payload (SHA1)
Process Names / Artifacts
- .atomic_agent or .launch_daemon
- /Library/LaunchAgents/com.apple.atomic.*
- /private/tmp/atomic/tmp.log
C2 IPs / Domains (as of Q2 2025)
- 185.112.156.87
- atomicsec[.]ru
- zoom-securecdn[.]net
Behavioral
- Prompt for keychain credentials using AppleScript
- Sudden redirection to fake update screens
- Unusual clipboard content activity (crypto strings)
These IOCs are dynamic. Correlate with updated threat intel feeds.
Defenders’ Playbook: Active Protection
✪ Security teams can proactively counter AMOS using a layered defense model:
SIEM Integration (Ex: Splunk, ELK)
- Monitor execution of osascript and creation of LaunchAgents
- Detect access to ~/Library/Application Support with unknown binaries
- Alert on anomalous clipboard behavior or browser token access
EDR Rules (Ex: CrowdStrike, SentinelOne)
- Block unsigned binaries requesting keychain access
- Alert on XOR-obfuscated payloads in user directories
- Kill child processes of fake Zoom or Slack installers
Sandbox Testing
- Detonate .dmg and .pkg in macOS VM with logging enabled
- Watch for connections to known C2 indicators
- Evaluate memory-only behaviors in unsigned apps
General Hygiene
- Remove unverified extensions and “free” tools
- Train users against fake updates and cracked apps
- Segment Apple devices in network policy to enforce Zero Trust
AMOS is stealthy, but its behaviors are predictable. Behavior-based defenses offer the best chance at containment.
Freemindtronic Solutions to Secure macOS
To counter threats like Atomic Stealer, Freemindtronic provides macOS-compatible hardware and software cybersecurity solutions:
DataShielder: Hardware Immunity Against macOS Infostealers
DataShielder NFC HSM
- Offline AES-256 and RSA 4096 key storage: No exposure to system memory or macOS processes.
- Phishing-resistant authentication: Secure login via NFC, independent from macOS.
- End-to-end encrypted messaging: Works even for email, LinkedIn, and QR-based communications.
- No server, no account, no trace: Total anonymity and data control.
DataShielder HSM PGP
- Hardware-based PGP encryption for files, messages, and emails.
- Zero-trust design: Doesn’t rely on macOS keychain or system libraries.
- Immune to infostealers: Keys never leave the secure hardware environment.
Use Cases for macOS Protection
- Securing Apple Mail, Telegram, Signal messages with AES/PGP
- Protecting crypto assets via encrypted QR exchanges
- Mitigating clipboard attacks with hardware-only storage
- Creating sandboxed key workflows isolated from macOS execution
These tools shift the attack surface away from macOS and into a secure, externalized hardware vault.
✪ Hybrid HSM from Freemindtronic securely stores AES-256 encryption keys outside macOS, protecting email and messaging apps like Apple Mail, Signal, and Telegram.
SeedNFC HSM Tag
Hardware-Secured Crypto Wallets — Invisible to Atomic Stealer AMOS
Atomic Stealer (AMOS) actively targets cryptocurrency wallets and clipboard content linked to crypto transactions. The SeedNFC HSM 100 Tag, powered by the SeedNFC Android app, offers a 100% externalized and offline vault that supports up to 50 wallets (Bitcoin, Ethereum, and others), created directly on the blockchain.
✪ Even if Atomic Stealer compromises the macOS system, SeedNFC HSM keeps crypto secrets unreachable via secure local or Bluetooth emulation channels.
Unlike traditional browser extensions or software wallets:
Private keys are stored fully offline — never touch system memory or the clipboard.
Wallets can be used on macOS and Windows via:
- Web extensions communicating over an encrypted local network,
- Or via Bluetooth keyboard emulation to inject public keys, passwords, or transaction data.
- Wallet sharing is possible via RSA-4096 encrypted QR codes.
-
All functions are triggered via NFC and executed externally to the OS.
This creates a Zero Trust perimeter for digital assets — ideal against crypto-focused malware like AMOS.
Bluetooth Keyboard Emulator
Zero-Exposure Credential Delivery — No Typing, No Trace
✪ Freemindtronic’s patented NFC HSM delivers secure, air-gapped password entry via Bluetooth keyboard emulation — immune to clipboard sniffers, and memory-based malware like AMOS.
Since AMOS does not embed a keylogger, it relies on clipboard sniffing, browser-stored credentials, and deceptive interface prompts to steal data.
The Bluetooth Keyboard Emulator bypasses these vectors entirely. It allows sensitive information to be typed automatically from a NFC HSM device (such as DataShielder or PassCypher) into virtually any target environment:
- macOS and Windows login screens,
- BIOS, UEFI, and embedded systems,
- Shell terminals or command-line prompts,
- Sandboxed or isolated virtual machines.
This hardware-based method supports the injection of:
- Logins and passwords
- PIN codes and encryption keys (e.g. AES, PGP)
- Seed phrases for crypto wallets
All credentials are delivered via Bluetooth keyboard emulation:
- No clipboard usage
- No typing on the host device
- No exposure to OS memory, browser keychains, or RAM
This creates a physically segmented, air-gapped credential input path — completely outside the malware’s attack surface. Against threats like Atomic Stealer (AMOS), it renders data exfiltration attempts ineffective by design.
Bluetooth keyboard emulation bypasses AMOS exfiltration entirely. Credentials are securely “typed” into systems from NFC HSMs, without touching macOS memory or storage.
What About Passkeys and Private Keys?
While AMOS is not a keylogger, it doesn’t need to be — because it can access your Keychain under the right conditions:
- Use native macOS tools (e.g.,
security
CLI, Keychain API) to extract saved secrets - Retrieve session tokens and autofill credentials
- Exploit unlocked sessions or prompt fatigue to access sensitive data
Passkeys, used for passwordless login via Face ID or Touch ID, are more secure due to Secure Enclave, yet:
- AMOS can hijack authenticated sessions (e.g., cookies, tokens)
- Cached WebAuthn tokens may be abused if the browser remains active
- Keychain-stored credentials may still be exposed in unlocked sessions
Why External Hardware Security Modules (HSMs) Are Critical
Unlike macOS Keychain, Freemindtronic’s NFC HSM and HSM PGP solutions store secrets completely outside the host system, offering true air-gap security and malware immunity.
Key advantages over macOS Keychain:
- No clipboard or RAM exposure
- No reliance on OS trust or session state
- No biometric prompt abuse
- Not exploitable via API or command-line tools
✪ This infographic compares the vulnerabilities of macOS Keychain with the security of Freemindtronic’s NFC HSM technologies, showing how they resist Atomic Stealer AMOS threats.
Three Isolated Access Channels – All AMOS-Resistant
1. Bluetooth Keyboard Emulator (InputStick)
- Sends secrets directly via AES-128 encrypted Bluetooth HID input
- Works offline — ideal for BIOS, command-line, or sandboxed systems
- Not accessible to the OS at any point
2. Local Network Extension (DataShielder / PassCypher)
- Ephemeral symmetric key exchange over LAN
- Segmented key architecture prevents man-in-the-middle injection
- No server, no database, no fingerprint
3. HSM PGP for Persistent Secrets
- Stores secrets encrypted in AES-256 CBC using PGP
- Works with web extensions and desktop apps
- Secrets are decrypted only in volatile memory, never exposed to disk or clipboard
If your credentials live in macOS, they’re fair game. If they live in NFC HSMs or PGP HSMs — with no OS, clipboard, or RAM exposure — they’re not.
PassCypher Protection Against Atomic Stealer AMOS
PassCypher solutions are highly effective in neutralizing AMOS’s data exfiltration techniques:
PassCypher NFC HSM
- Credentials stored offline in an NFC HSM, invisible to macOS and browsers.
- No use of macOS keychain or clipboard, preventing typical AMOS capture vectors.
- One-time password insertion via Bluetooth keyboard emulation, immune to keyloggers.
PassCypher HSM PGP
- Hardware-secured PGP encryption/decryption for emails and messages.
- No token or password exposure to system memory.
- Browser integration with zero data stored locally — mitigates web injection and session hijacking.
Specific Protections
Attack Vector Used by AMOS | Mitigation via PassCypher |
---|---|
Password theft from browsers | No password stored in browser or macOS |
Clipboard hijacking | No copy-paste use of sensitive info |
Fake login prompt interception | No interaction with native login systems |
Keychain compromise | Keychain unused; HSM acts as sole vault |
Webmail token exfiltration | Tokens injected securely, not stored locally |
These technologies create a zero-trust layer around identity and messaging, nullifying the most common AMOS attack paths.
Atomic Stealer AMOS and the Future of macOS Security Culture
✪ Atomic doesn’t just expose flaws in Apple’s defenses. It dismantles our assumptions.
For years, users relied on brand prestige instead of security awareness. Businesses excluded Apple endpoints from serious defense models. Governments overlooked creative and administrative Macs as threats.
That era is over.
Atomic forces a cultural reset. From now on, macOS security deserves equal investment, equal scrutiny, and equal priority.
It’s not just about antivirus updates. It’s about behavioral change, threat modeling, and zero trust applied consistently—across all platforms.
Atomic Stealer will not be the last macOS malware we face. But if we treat it as a strategic wake-up call, it might be the last we underestimate.
If your credentials live in macOS, they’re fair game. If they live in NFC HSMs with no OS or network dependency, they’re not.
Strategic Note
Atomic Stealer is not a lone threat—it’s a blueprint for hybrid cyber-espionage. Treating it as a one-off incident risks underestimating the evolution of adversarial tooling. Defense today requires proactive anticipation, not reactive response.
Electronic Warfare in Military Intelligence by Jacques gascuel I will keep this article updated with any new information, so please feel free to leave comments or contact me with suggestions or additions.his article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
The Often Overlooked Role of Electronic Warfare in Military Intelligence
Electronic Warfare in Military Intelligence has become a crucial component of modern military operations. This discipline discreetly yet vitally protects communications and gathers strategic intelligence, providing armed forces with a significant tactical advantage in an increasingly connected world.
Historical Context: The Evolution of Electronic Warfare in Military Intelligence
From as early as World War II, electronic warfare established itself as a critical strategic lever. The Allies utilized jamming and interception techniques to weaken Axis forces. This approach was notably applied through “Operation Ultra,” which focused on deciphering Enigma messages. During the Cold War, major powers refined these methods. They incorporated intelligence and countermeasures to secure their own networks.
Today, with rapid technological advancements, electronic warfare combines state-of-the-art systems with sophisticated intelligence strategies. It has become a cornerstone of modern military operations.
These historical foundations underscore why electronic warfare has become indispensable. Today, however, even more advanced technologies and strategies are essential to counter new threats.
Interception and Monitoring Techniques in Electronic Warfare for Military Intelligence
In military intelligence, intercepting enemy signals is crucial. France’s 54th Electronic Warfare Regiment (54e RMRT), the only regiment dedicated to electronic warfare, specializes in intercepting adversary radio and satellite communications. By detecting enemy frequencies, they enable the armed forces to collect critical intelligence in real time. This capability enhances their ability to anticipate enemy actions.
DataShielder NFC HSM Master solutions bolster these capabilities by securing the gathered information with Zero Trust and Zero Knowledge architecture. This ensures the confidentiality of sensitive data processed by analysts in the field.
Current technological advancements paired with electronic warfare also spotlight the modern threats that armed forces must address.
Emerging Technologies and Modern Threats
Electronic warfare encompasses interception, jamming, and manipulation of signals to gain a strategic edge. In a context where conflicts occur both on the ground and in the invisible spheres of communications, controlling the electromagnetic space has become essential. Powers such as the United States, Russia, and China invest heavily in these technologies. This investment serves to disrupt enemy communications and safeguard their own networks.
Recent conflicts in Ukraine and Syria have highlighted the importance of these technologies in disrupting adversary forces. Moreover, new threats—such as cyberattacks, drones, and encrypted communications—compel armies to innovate. Integrating artificial intelligence (AI) and 5G accelerates these developments. DataShielder HSM PGP Encryption meets the need for enhanced protection by offering robust, server-free encryption, ideal for high-security missions where discretion is paramount.
While these technological advancements are crucial, they also pose complex challenges for the military and engineers responsible for their implementation and refinement.
Change to: Challenges of Electronic Warfare in Military Intelligence: Adaptation and Innovation
Despite impressive advancements, electronic warfare must continually evolve. The rapid pace of innovation renders cutting-edge equipment quickly obsolete. This reality demands substantial investments in research and development. It also requires continuous training for electronic warfare specialists.
DataShielder products, such as DataShielder NFC HSM Auth, play a pivotal role in addressing these challenges. For instance, NFC HSM Auth provides secure, anonymous authentication, protecting against identity theft and AI-assisted threats. By combining advanced security with ease of use, these solutions facilitate adaptation to modern threats while ensuring the protection of sensitive information.
These advances pave the way for emerging technologies, constantly reshaping the needs and methods of electronic warfare.
Analyzing Emerging Technologies: The Future of Electronic Warfare
Integrating advanced technologies like AI is vital for optimizing electronic warfare operations. AI automates interception and jamming processes, increasing military system responsiveness. DataShielder NFC HSM Auth fits seamlessly into this technological environment by protecting against identity theft, even when AI is involved. Post-quantum cryptography and other advanced security techniques in the DataShielder range ensure lasting protection against future threats.
To better understand the real-world application of these technologies, insights from field experts are essential.
Case Studies and Operational Implications: The Testimony of Sergeant Jérémy
Insights from the Field: The Realities of Electronic Warfare Operations
In the field of electronic warfare, the testimony of Sergeant Jérémy, a member of the 54th Transmission Regiment (54e RMRT), provides a deeper understanding of the challenges and operational reality of a job that is both technical, discreet, and demanding. Through his accounts of operations in Afghanistan, Jérémy illustrates how electronic warfare can save lives by providing essential support to ground troops.
Real-Time Threat Detection and Protection in Combat Zones
During his mission in Afghanistan, at just 19, Jérémy participated in radiogoniometry operations, identifying the location of electromagnetic emissions. In one convoy escort mission, his equipment detected signals from enemy forces, indicating a potential ambush. Thanks to this detection, he alerted his patrol leader, allowing the convoy to take defensive measures. This type of mission demonstrates how electronic warfare operators combine technical precision and composure to protect deployed units.
Tactical Jamming and Strategic Withdrawals
In another operation, Jérémy and his team helped special forces withdraw from a combat zone by jamming enemy communications. This temporary disruption halted adversary coordination, giving allied troops the necessary time to retreat safely. However, this technique is not without risks: while crucial, jamming also prevents allied forces from communicating, adding complexity and stress for operators. This mission underscores the delicate balance between protecting allies and disorganizing the enemy, a daily challenge for electronic warfare specialists.
The Role of Advanced Equipment in Electronic Warfare Missions
On missions, the 54e RMRT uses advanced interception, localization, and jamming equipment. These modern systems, such as radiogoniometry and jamming devices, have become essential for the French Army in electronic intelligence and neutralizing adversary communications. However, these missions are physically and psychologically demanding, requiring rigorous training and a capacity to work under high pressure. Sergeant Jérémy’s testimony reminds us of the operational reality behind each technology and demonstrates the rigor with which electronic warfare operators must adapt and respond.
To listen to the complete testimony of Sergeant Jérémy and learn more about his journey, you can access the full podcast here.
Examining the methods of other nations also reveals the varied approaches to electronic warfare.
International Military Doctrines in Electronic Warfare for Military Intelligence
Military doctrines in electronic warfare vary from one country to another. For example, the United States integrates electronic warfare and cyber operations under its “multi-domain operations.” Meanwhile, Russia makes electronic warfare a central element of hybrid operations, combining jamming, cyberattacks, and disinformation. This diversity shows how each country adapts these technologies based on its strategic goals and specific threats.
The growing importance of electronic warfare is also reflected in international alliances, where cooperation is essential to address modern threats.
NATO’s Role in Electronic Warfare
Electronic warfare is also crucial for military alliances such as NATO. Multinational exercises allow for testing and perfecting electronic warfare capabilities, ensuring that allied forces can protect their communications and disrupt those of the enemy. This cooperation strengthens the effectiveness of electronic warfare operations. It maximizes the resilience of allied networks against modern threats.
Recent events demonstrate how electronic warfare continues to evolve to meet the demands of modern battlefields.
Recent Developments in Electronic Warfare
In 2024, the U.S. military spent $5 billion on improving electronic warfare capabilities, notably during the Valiant Shield 2024 exercise. During this event, innovative technologies like DiSCO™ (Distributed Spectrum Collaboration and Operations) were tested. This technology enables real-time spectrum data sharing for the rapid reprogramming of electronic warfare systems. These developments highlight the growing importance of spectral superiority in modern conflicts.
In Ukraine, electronic warfare allowed Russian forces to jam communications and simulate signals to disorient opposing units. This capability underscores the need to strengthen GPS systems and critical communications.
In response to these developments, advanced technological solutions like those of DataShielder provide concrete answers.
Integrating DataShielder Solutions
In the face of rising identity theft and AI-assisted cyber espionage threats, innovative solutions like DataShielder NFC HSM Auth and DataShielder HSM PGP Encryption have become indispensable. Each DataShielder device operates without servers, databases, or user accounts, enabling end-to-end anonymity in real time. By encrypting data through a segmented AES-256 CBC, these products ensure that no trace of sensitive information remains on NFC-enabled Android phones or computers.
- DataShielder NFC HSM Master: A robust counter-espionage tool that provides AES-256 CBC encryption with segmented keys, designed to secure communications without leaving any traces.
- DataShielder NFC HSM Auth: A secure authentication module essential for preventing identity theft and AI-assisted fraud in high-risk environments.
- DataShielder NFC HSM Starter Kit: This all-in-one kit offers complete data security with real-time, contactless encryption and authentication, ideal for organizations seeking to implement comprehensive protection from the outset.
- DataShielder NFC HSM M-Auth: A flexible solution for mobile authentication, enabling secure identity verification and encryption without dependence on external networks.
- DataShielder PGP HSM Encryption: Offering advanced PGP encryption, this tool ensures secure communication even in compromised network conditions, making it ideal for sensitive exchanges.
By leveraging these solutions, military intelligence and high-security organizations can securely encrypt and authenticate communications. DataShielder’s technology redefines how modern forces protect themselves against sophisticated cyber threats, making it a crucial component in electronic warfare.
The convergence between cyberwarfare and electronic warfare amplifies these capabilities, offering new opportunities and challenges.
Cyberwarfare and Electronic Warfare in Military Intelligence: A Strategic Convergence
Electronic warfare operations and cyberattacks, though distinct, are increasingly interconnected. While electronic warfare neutralizes enemy communications, cyberattacks target critical infrastructure. Together, they create a paralyzing effect on adversary forces. This technological convergence is now crucial for modern armies. Products like DataShielder NFC HSM Master and DataShielder HSM PGP Encryption guarantee secure communications against combined threats.
This convergence also raises essential ethical and legal questions for states.
Legal and Ethical Perspectives on Electronic Warfare
With its growing impact, electronic warfare raises ethical and legal questions. Should international conventions regulate its use? Should new laws be created to govern the interception and jamming of communications? These questions are becoming more pressing as electronic warfare technologies improve.
In this context, the future of electronic warfare points toward ever more effective technological innovations.
Looking Ahead: New Perspectives for Electronic Warfare in Military Intelligence
The future of electronic warfare will be shaped by AI integration and advanced cryptography—key elements for discreet and secure communications. DataShielder NFC HSM Master and DataShielder HSM PGP Encryption are examples of modern solutions. They ensure sensitive data remains protected against interception, highlighting the importance of innovation to counter emerging threats.
What Is IK Rating?
IK Rating Guide is essential for understanding the level of protection an enclosure offers against external mechanical impacts. This guide explains the IK rating system, from IK01 to IK10, and why IK10 represents the highest vandal resistance available. Understanding these ratings ensures you select the right protection level for your electrical enclosures.
Stay informed with our posts dedicated to Technical News to track its evolution through our regularly updated topics.
IK Rating Guide: Understanding the IK Rating System
Frequently Asked Questions (FAQ)
IK ratings measure resistance to mechanical impacts. In contrast, IP ratings assess protection against dust and water.
Improving an IK rating typically involves upgrading the material or adding protective features. This might require replacing the existing enclosure.
IK10 represents the maximum impact energy (20 joules) that standard testing procedures evaluate. This provides the highest available protection against physical impacts.
For more detailed information on IK ratings and their classifications, you can visit the IEC Electropedia. This resource offers in-depth explanations and standards related to IK codes, supporting your understanding of how these ratings are developed and applied.
Russian Cyberattack on Microsoft: Unprecedented Threat Uncovered
The recent Russian cyberattack on Microsoft, orchestrated by the notorious group Midnight Blizzard, has revealed a far more severe threat than initially anticipated. Learn how Microsoft is countering this sophisticated attack and what implications it holds for global cybersecurity.
Stay informed with our posts dedicated to Cyberculture to track its evolution through our regularly updated topics.
How to protect yourself from the attack against Microsoft Exchange?
The attack against Microsoft Exchange was a serious security breach in 2023. Thousands of organizations worldwide were hacked by cybercriminals who exploited vulnerabilities in Microsoft’s email servers. How did this happen? What were the consequences? How did Microsoft react? And most importantly, how can you protect your data and communications? Read our comprehensive analysis and discover Freemindtronic’s technology solutions.
Cyberattack against Microsoft: discover the potential dangers of stalkerware spyware, one of the attack vectors used by hackers. Stay informed by browsing our constantly updated topics.
How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts
On December 13, 2023, Microsoft was the target of a sophisticated attack by a hacker group called Lapsus$. This attack exploited another vulnerability in Microsoft Exchange, known as CVE-2023-23415, which allowed the attackers to execute remote code on the email servers using the ICMP protocol. The attackers were able to access the email accounts of more than 10,000 Microsoft employees, some of whom were working on sensitive projects such as the development of GTA VI or the launch of Windows 12. The attackers also published part of the stolen data on a website called DarkBeam, where they sold more than 750 million fraudulent Microsoft accounts. Microsoft reacted quickly by releasing a security patch on December 15, 2023, and collaborating with the authorities to arrest the perpetrators of the attack. One of the members of the Lapsus$ group, an Albanian hacker named Kurtaj, was arrested on December 20, 2023, thanks to the cooperation between the American and European intelligence services1234.
What were the objectives and consequences of the attack?
The attack against Microsoft Exchange affected more than 20,000 email servers worldwide, belonging to businesses, institutions and organizations from different sectors. These servers were vulnerable because they used outdated versions of the software, which no longer received security updates. The attack exploited a critical vulnerability known as ProxyLogon (CVE-2023-23415), allowing the attackers to execute remote code on the servers and access the email accounts. Despite the efforts to solve the problem, many vulnerable servers remained active, exposing the email accounts of about 30,000 high-level employees, including executives and engineers. The attackers were able to steal confidential information, such as internal projects, development plans, trade secrets or source codes.
What were the objectives of the attack?
The attack was attributed to Lapsus$, a hacker group linked to Russia. According to Microsoft, the group’s main objective was to gain access to sensitive information from various targets, such as government agencies, think tanks, NGOs, law firms, medical institutions, etc. The group also aimed to compromise the security and reputation of Microsoft, one of the leading technology companies in the world. The attack was part of a larger campaign that also involved the SolarWinds hack, which affected thousands of organizations in 2020.
What were the impacts of the attack?
The attack had serious impacts on the victims, both in terms of data loss and reputation damage. The data stolen by the attackers included personal and professional information, such as names, addresses, phone numbers, email addresses, passwords, bank details, credit card numbers, health records, etc. The attackers also leaked some of the data on the DarkBeam website, where they offered to sell the data to the highest bidder. This exposed the victims to potential identity theft, fraud, blackmail, extortion, or other cybercrimes. The attack also damaged the reputation of Microsoft and its customers, who were seen as vulnerable and unreliable by their partners, clients, and users. The attack also raised questions about the security and privacy of email communication, which is widely used in the digital world.
What were the consequences of the attack?
The attack had several consequences for Microsoft and its customers, who had to take urgent measures to mitigate the damage and prevent further attacks. Microsoft had to release a security patch for the vulnerability, and urge its customers to update their software as soon as possible. Microsoft also had to investigate the origin and extent of the attack, and cooperate with the authorities to identify and arrest the attackers. Microsoft also had to provide support and assistance to its customers, who had to deal with the aftermath of the attack. The customers had to check their email accounts for any signs of compromise, and change their passwords and security settings. They also had to notify their contacts, partners, and clients about the breach, and reassure them about the security of their data. They also had to monitor their online activities and accounts for any suspicious or fraudulent transactions. The attack also forced Microsoft and its customers to review and improve their security policies and practices, and adopt new solutions and technologies to protect their data and communication.
How did the attack succeed despite Microsoft’s defenses?
The attack was sophisticated and stealthy, using several techniques to bypass Microsoft’s defenses. First, the attackers exploited a zero-day vulnerability, which means that it was unknown to Microsoft and the public until it was discovered and reported. Second, the attackers used a proxy tool to disguise their origin and avoid detection. Third, the attackers used web shells to maintain persistent access to the servers and execute commands remotely. Fourth, the attackers used encryption and obfuscation to hide their malicious code and data. Fifth, the attackers targeted specific servers and accounts, rather than launching a massive attack that would have raised more suspicion.
What are the communication vulnerabilities exploited by the attack?
The attack exploited several communication vulnerabilities, such as:
- Targeted phishing: The attackers sent fake emails to the victims, pretending to be from legitimate sources, such as Microsoft, their bank, or their employer. The emails contained malicious links or attachments, that led the victims to compromised websites or downloaded malware on their devices. The attackers then used the malware to access the email servers and accounts.
- SolarWinds exploitation: The attackers also used the SolarWinds hack, which was a massive cyberattack that compromised the software company SolarWinds and its customers, including Microsoft. The attackers inserted a backdoor in the SolarWinds software, which allowed them to access the networks and systems of the customers who installed the software. The attackers then used the backdoor to access the email servers and accounts.
- Brute force attack: The attackers also used a brute force attack, which is a trial-and-error method to guess the passwords or encryption keys of the email accounts. The attackers used automated tools to generate and test a large number of possible combinations, until they found the right one. The attackers then used the passwords or keys to access the email accounts.
- SQL injection: The attackers also used a SQL injection, which is a technique to insert malicious SQL commands into a web application that interacts with a database. The attackers used the SQL commands to manipulate the database, and access or modify the data stored in it. The attackers then used the data to access the email accounts.
Why did the detection and defense systems of Microsoft Exchange not work?
The detection and defense systems of Microsoft Exchange did not work because the attackers used advanced techniques to evade them. For example, the attackers used a proxy tool to hide their IP address and location, and avoid being traced or blocked by firewalls or antivirus software. The attackers also used web shells to create a backdoor on the servers, and execute commands remotely, without being noticed by the system administrators or the security software. The attackers also used encryption and obfuscation to conceal their malicious code and data, and prevent them from being analyzed or detected by the security software. The attackers also used zero-day vulnerability, which was not known or patched by Microsoft, and therefore not protected by the security software.
How did Microsoft react to the attack?
Microsoft reacted to the attack by taking several actions, such as:
The main actions of Microsoft
- Releasing a security patch: Microsoft released a security patch for the vulnerability exploited by the attack, and urged its customers to update their software as soon as possible. The patch fixed the vulnerability and prevented further attacks.
- Investigating the attack: Microsoft investigated the origin and extent of the attack, and collected evidence and information about the attackers and their methods. Microsoft also cooperated with the authorities and other organizations to identify and arrest the attackers.
- Providing support and assistance: Microsoft provided support and assistance to its customers, who were affected by the attack. Microsoft offered guidance and tools to help the customers check their email accounts for any signs of compromise, and change their passwords and security settings. Microsoft also offered free credit monitoring and identity theft protection services to the customers, who had their personal and financial data stolen by the attackers.
Microsoft also released patches for the vulnerabilities exploited by the attack
Microsoft also released patches for the other vulnerabilities exploited by the attack, such as the SolarWinds vulnerability, the brute force vulnerability, and the SQL injection vulnerability. Microsoft also improved its detection and defense systems, and added new features and functions to its software, to enhance the security and privacy of email communication.
What are the lessons to be learned from the attack?
The attack was a wake-up call for Microsoft and its customers, who had to learn from their mistakes and improve their security practices. Some of the lessons to be learned from the attack are:
Email security
Email is one of the most widely used communication tools in the digital world, but also one of the most vulnerable to cyberattacks. Therefore, it is essential to ensure the security and privacy of email communication, by applying some best practices, such as:
- Using strong and unique passwords for each email account, and changing them regularly.
- Using multi-factor authentication (MFA) to verify the identity of the email users, and prevent unauthorized access.
- Using encryption to protect the content and attachments of the email messages, and prevent them from being read or modified by third parties.
- Using digital signatures to verify the authenticity and integrity of the email messages, and prevent them from being spoofed or tampered with.
- Using spam filters and antivirus software to block and remove malicious emails, and avoid clicking on suspicious links or attachments.
- Using secure email providers and platforms, that comply with the latest security standards and regulations, and offer features such as end-to-end encryption, zero-knowledge encryption, or self-destructing messages.
Multi-factor authentication
Multi-factor authentication (MFA) is a security method that requires the user to provide two or more pieces of evidence to prove their identity, before accessing a system or a service. The pieces of evidence can be something the user knows (such as a password or a PIN), something the user has (such as a smartphone or a token), or something the user is (such as a fingerprint or a face scan). MFA can prevent unauthorized access to email accounts, even if the password is compromised, by adding an extra layer of security. Therefore, it is recommended to enable MFA for all email accounts, and use reliable and secure methods, such as biometric authentication, one-time passwords, or push notifications.
Principle of least privilege
The principle of least privilege (POLP) is a security concept that states that each user or system should have the minimum level of access or permissions required to perform their tasks, and nothing more. POLP can reduce the risk of data breaches, by limiting the exposure and impact of a potential attack. Therefore, it is advisable to apply POLP to email accounts, and assign different roles and privileges to different users, depending on their needs and responsibilities. For example, only authorized users should have access to sensitive or confidential information, and only administrators should have access to system settings or configuration.
Software update
Software update is a process that involves installing the latest versions or patches of the software, to fix bugs, improve performance, or add new features. Software update is crucial for email security, as it can prevent the exploitation of vulnerabilities that could allow attackers to access or compromise the email servers or accounts. Therefore, it is important to update the software regularly, and install the security patches as soon as they are available. It is also important to update the software of the devices that are used to access the email accounts, such as computers or smartphones, and use the latest versions of the browsers or the applications.
System monitoring
System monitoring is a process that involves observing and analyzing the activity and performance of the system, to detect and resolve any issues or anomalies. System monitoring is vital for email security, as it can help to identify and stop any potential attacks, before they cause any damage or disruption. Therefore, it is essential to monitor the email servers and accounts, and use tools and techniques, such as logs, alerts, reports, or audits, to collect and analyze the data. It is also essential to monitor the email traffic and behavior, and use tools and techniques, such as firewalls, intrusion detection systems, or anomaly detection systems, to filter and block any malicious or suspicious activity.
User awareness
User awareness is a state of knowledge and understanding of the users, regarding the security risks and threats that they may face, and the best practices and policies that they should follow, to protect themselves and the system. User awareness is key for email security, as it can prevent many human errors or mistakes, that could compromise the email accounts or expose the data. Therefore, it is important to educate and train the email users, and provide them with the necessary information and guidance, to help them recognize and avoid any phishing, malware, or social engineering attacks, that could target their email accounts.
What are the best practices to strengthen information security?
Information security is the practice of protecting the confidentiality, integrity, and availability of the information, from unauthorized or malicious access, use, modification, or destruction. Information security is essential for email communication, as it can ensure the protection and privacy of the data and messages that are exchanged. Some of the best practices to strengthen information security are:
- Adopt the Zero Trust model: The Zero Trust model is a security approach that assumes that no user or system can be trusted by default, and that each request or transaction must be verified and authorized, before granting access or permission. The Zero Trust model can enhance information security, by reducing the attack surface and preventing the lateral movement of the attackers, within the system.
- Use advanced protection solutions: Advanced protection solutions are security solutions that use artificial intelligence, machine learning, or other technologies, to detect and respond to the most sophisticated and complex cyberattacks, that could target the email accounts or data. Some of these solutions are endpoint detection and response (EDR), identity and access management (IAM), or data encryption solutions.
- Hire cybersecurity experts: Cybersecurity experts are professionals who have the skills and knowledge to design, implement, and maintain the security of the system and the information, and to prevent, detect, and respond to any cyberattacks, that could affect the email accounts or data. Cybersecurity experts can help to strengthen information security, by providing advice, guidance, and support, to the email users and administrators.
How can Freemindtronic technology help to fight against this type of attack?
Freemindtronic offers innovative and effective technology solutions such as EviCypher NFC HSM and EviPass NFC HSM and EviOTP NFC HSM and other PGP HSMs. They can help businesses to fight against this type of attack based on Zero Day and other threats. Their technology is embedded in products such as DataShielder NFC HSM and DataShielder HSM PGP and DataShielder Defense or PassCypher NFC HSM or PassCypher HSM PGP. These products provide security and communication features for data, email and password management and offline OTP secret keys.
- DataShielder NFC HSM is a portable device that allows to encrypt and decrypt data and communication on a computer or on an Android NFC smartphone. It uses a contactless hardware security module (HSM) that generates and stores encryption keys securely and segmented. It protects the keys that encrypt contactless communication. This has the effect of effectively fighting against all types of communication vulnerabilities, since the messages and attachments will remain encrypted even if they are corrupted. This function regardless of where the attack comes from, internal or external to the company. It is a counter-espionage solution. It also offers other features, such as password management, 2FA – OTP (TOTP and HOTP) secret keys. In addition, DataShielder works offline, without server and without database. It has a configurable multi-authentication system, strong authentication and secure key sharing.
- DataShielder HSM PGP is an application that transforms all types of physical storage media (USB key, S, SSD, KeyChain / KeyStore) connected or not connected into HSM. It has the same features as its NFC HSM version. However, it also uses standard AES-256 and RSA 4096 algorithms, as well as OpenPGP algorithms. It uses its HSMs to manage and store PGP keys securely. In the same way, it protects email against phishing and other email threats. It also offers other features, such as digital signature, identity verification or secure key sharing.
- DataShielder Defense is a dual-use platform for civilian and military use that offers many functions including all those previously mentioned. It also works in real time without server, without database from any type of HSM including NFC. It also has functions to add trust criteria to fight against identity theft. It protects data and communication against cyberattacks and data breaches.
In summary
To safeguard against the Microsoft Exchange attack, prioritize security updates and patches. Embrace Freemindtronic’s innovative solutions for enhanced protection. Stay vigilant against phishing and employ robust authentication methods. Opt for encryption to shield communications. Engage cybersecurity experts for advanced defense strategies. By adopting these measures, you can fortify your defenses against cyber threats and ensure your data’s safety.
How Telegram Shapes the Information War in Ukraine
In this article, we explore how Telegram and Ukraine’s information warfare are intertwined. We look at how the messaging app is influencing the Russia-Ukraine conflict, and how it can be used for good or evil. We also discuss the benefits and risks of using Telegram, as well as how security and freedom of expression can be enhanced with EviCypher NFC HSM technology.
How Telegram Influences the Conflict between Russia and Ukraine
Telegram and the information war in Ukraine are closely related. Telegram is a messaging app that offers users a secure and confidential way to communicate, thanks to its end-to-end encryption system. It has a large user base around the world, especially in Eastern Europe, where it plays a vital role in the information war between Russia and Ukraine.
Telegram’s Usage in Ukraine: Updated Statistics
Popularity and Download Trends
According to the report of the research company SimilarWeb, Telegram is the second most downloaded messaging app in Ukraine, after Viber, with 3.8 million downloads in 2021. It is also the fourth most used app in terms of time spent, with an average of 16 minutes per day. Telegram has about 10 million active users in Ukraine, which is almost a quarter of the country’s population.
Telegram’s Role in Ukrainian Media Landscape
Telegram is particularly appreciated by Ukrainians for its channel functionality, which allows to broadcast messages to a large audience. Some of these channels have become influential but controversial sources of information, as their owners and sources are often unknown. Among the most popular channels in Ukraine, we can mention:
- @Zelenskyi, the official channel of President Volodymyr Zelensky, which has more than 2 million subscribers. It publishes announcements, speeches, interviews and videos of the head of state. It was created in 2019, during Zelensky’s election campaign, who was then an actor and a comedian.
- @NashyGroshi, the channel of the journalistic project “Our Money”, which has more than 1.5 million subscribers. It publishes investigations, reports and analyses on corruption, abuse of power, political scandals and judicial cases in Ukraine. It was created in 2008, by journalist Denys Bihus, who received several awards for his work.
- @Resident, the channel of blogger and activist Anatoliy Shariy, which has more than 1.3 million subscribers. It publishes comments, criticisms and sarcasms on the political and social news in Ukraine. He is known for his pro-Russian, anti-European and anti-government positions. He is currently in exile in Spain, where he is wanted by the Ukrainian justice for high treason and incitement to hatred.
These channels illustrate the diversity and complexity of the Ukrainian media landscape, which is marked by the conflict with Russia, the democratic transition, the fight against corruption and the polarization of society. They are also a reflection of the issues and challenges related to the use of Telegram, which can be both a tool of communication, information and manipulation.
Oleksiy Danilov’s Stance on Telegram’s Usage in Ukraine
Concerns Over National Security
Oleksiy Danilov is the secretary of the National Security and Defense Council of Ukraine, the body responsible for coordinating and controlling the activities of the executive bodies in the fields of national security and defense. He is also the head of cybersecurity of the country, and in this capacity, he expressed his reservations about the use of Telegram by Ukrainians. In February 2022, he stated that some anonymous and manipulative Telegram channels represented a threat to national security, and that they should be de-anonymized and regulated. He particularly targeted the channel @Resident, which broadcasts pro-Russian and anti-Ukrainian comments, and which is suspected of being linked to the Russian intelligence services. He also criticized the channel @Zelenskyi, which according to him, is not controlled by the Ukrainian president, but by advisers who seek to influence his policy.
Debating Telegram’s Influence in Ukraine
These statements provoked mixed reactions in Ukraine. Some supported Danilov’s position, believing that it was necessary to fight against misinformation and propaganda that undermine the sovereignty and democracy of the country. Others denounced an attempt at censorship and an attack on freedom of expression, recalling that Telegram was one of the few spaces where Ukrainians could access independent and diverse information.
How Telegram Influences the Information War in Ukraine
The Benefits and Risks of End-to-End Encryption
Telegram is a messaging app that lets you send messages, photos, videos, documents, and make voice and video calls. Its privacy policy is based on data encryption and non-cooperation with authorities. You can also create groups and channels that can reach thousands or millions of users.
End-to-end encryption is a technology that makes sure only the people in a conversation can read the messages, not even the service provider. Telegram has this option, but it is not on by default. You have to choose it for each chat, by switching to the “secret chat” mode. However, Telegram’s encryption is not based on standard protocols, and security experts have found some flaws.
Anonymous Channels and Their Impact on the Ukrainian Conflict
The channels are spaces where an administrator can send messages to a large audience. They can be public or private, and they can have millions of followers. Some channels are influential but controversial sources of information, as their owners and sources are often unknown. The channels can spread misinformation, propaganda, fake news, or violence.
Telegram and Russian propaganda have a strong connection, as many pro-Russian channels use the app to influence the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to communicate and organize their actions against the Russian aggression.
Bots, Payment Services and Unique Usernames: A Double-Edged Sword
Bots are programs that interact with users. They offer services, information, or entertainment. Anyone can create them. They can be part of chats or channels. Bots can be helpful or harmful. They can collect personal data, send spam, or spread viruses.
Payment Services: Handy or Dishonest?
You can also use payment services via Telegram. These features use third-party platforms, such as Stripe or Apple Pay. They need bank or credit card information. Payment services can be handy or dishonest. They can steal sensitive data, scam users, or fund illegal activities.
Unique Usernames: Fun or Troublesome?
Another feature of Telegram is the unique usernames. They let users contact each other easily, without sharing their phone number. Users can create and change them at any time. Unique usernames can be fun or troublesome. They can enable harassment, identity theft, or account sale.
These features of Telegram raise issues of cybersecurity, privacy, end-to-end encryption, and application security. They can be used by bad actors, who want to harm Ukraine or its people. They can also be regulated by the authorities, who want to control the information or access the data of the users.
Telegram and the Information War in Ukraine: A Challenge
One of the main challenges of Telegram and the information war in Ukraine is to balance the freedom of expression and the protection of national security. Telegram and the Ukrainian conflict are closely intertwined. The app is used by both sides to communicate, inform, and influence. Telegram and Russian propaganda have a strong connection. Many pro-Russian channels use the app to sway the public opinion in Ukraine and other countries. Telegram and the Ukrainian resistance also use the app to coordinate and organize their actions against the Russian aggression. Telegram and cybersecurity in Ukraine are also crucial. The app can be a source of threats or a tool of defense.
Telegram VS Other Messaging Apps: A Comparative Analysis
WhatsApp: Popular but Questionable Confidentiality
WhatsApp is the most popular messaging app in the world, with more than 2 billion users. It offers end-to-end encryption by default for all conversations, which guarantees the protection of data. However, it belongs to Facebook, which has a dubious reputation in terms of respect for privacy, and which has raised fears about the sharing of data with other applications of the group. WhatsApp is also subject to the requests of the authorities, who can demand access to the metadata, such as the phone number, the IP address or the location of the users.
Signal: High Security but Limited User Base
Signal is a messaging app that claims to be the most secure and confidential on the market. It also offers end-to-end encryption by default for all conversations, and it does not collect any personal data. It is developed by a non-profit organization, which does not depend on advertising or investors. It is recommended by personalities such as Edward Snowden or Elon Musk. Signal is however less popular than WhatsApp or Telegram, with about 50 million users. It also offers fewer features, such as file sharing, information channels, bots or payment services.
Telegram: Innovative but Security Concerns
Telegram is between these two apps, offering more features than Signal, but less security than WhatsApp. Telegram allows users to choose the level of encryption and privacy they want, by opting for the “secret chat” mode or the “normal chat” mode. Telegram also allows users to enjoy innovative services, such as channels, bots, payments or unique usernames. However, Telegram also presents risks, such as fakes news, inappropriate content, privacy breaches or cyberattacks. Telegram is therefore an app that offers advantages and disadvantages, and that requires vigilance and discernment from users.
Telegram’s Global Perception and Regulation
Russia: Origin and Opposition
Russia is the country of origin of Telegram, but also its main adversary. The Kremlin tried to block the app in 2018, invoking reasons of national security and fight against terrorism. It demanded that Telegram provide it with the encryption keys to access the messages of the users, which Pavel Durov refused. It then ordered the telecom operators to block access to Telegram, but this measure proved ineffective, as Telegram used cloud servers to bypass the blocking. Many Russian users also use VPNs or proxies to access the app. In 2020, the Kremlin finally lifted the ban on Telegram, acknowledging its failure and stating that the app had cooperated with the authorities to remove extremist content. However, some observers suspect that Telegram made concessions to the Kremlin to lift the blocking, such as collaborating with the Russian services or censoring some channels.
France: Striving for Digital Regulation
France is a country that wants to be at the forefront of the regulation of digital platforms, especially in terms of fighting online hate. It adopted in 2020 a law that obliges the platforms to remove illegal content, such as incitement to violence, discrimination or terrorism, within 24 hours, under penalty of financial sanctions. This law also applies to messaging apps, such as Telegram, which must set up reporting and moderation mechanisms for content. France recognizes the right of users to privacy and end-to-end encryption, but it also asks the service providers to cooperate with the law enforcement to access the encrypted data when needed. France is also a country where Telegram is used by radical groups, such as jihadists or yellow vests, who take advantage of the app to organize, mobilize or defend themselves.
Ukraine: Balancing Utility and Risks
Ukraine is a country that has an ambivalent attitude towards Telegram, recognizing its usefulness, but also its dangers. On the one hand, Telegram is a source of information and a tool of resistance for many Ukrainians, who face the threat of Russian aggression and the challenges of democratic transition. On the other hand, Telegram is also a vector of misinformation and propaganda, which can undermine the sovereignty and stability of the country. Ukraine does not have a specific law to regulate Telegram, but it has some legal provisions to protect national security and public order, which can be used to restrict or block the app if necessary. Ukraine also cooperates with international organizations, such as the EU or NATO, to counter the cyber threats and the hybrid warfare that target the country.
EviCypher NFC HSM: Enhancing Telegram’s Security
The Role of Contactless Encryption Technology
One of the main challenges of using Telegram is to ensure the security and confidentiality of the data exchanged, especially in a context of information war. To meet this challenge, a possible solution consists of using EviCypher NFC HSM technology, which is a contactless encryption technology developed by Freemindtronic, an Andorran company specializing in the design of counter-espionage solutions implementing in particular contactless security with NFC technology. EviCypher NFC HSM uses two types of encryption algorithms for data:
- Symmetric encryption in AES-256 for data such as texts (messages), thanks to its sub-technology EviCrypt. It uses a unique key, which is randomly generated and segmented into several parts. This key is used to encrypt and decrypt messages with the AES 256-bit algorithm.
- Asymmetric encryption in RSA-4096 for symmetric encryption keys. It uses a pair of keys, which is generated and used from the NFC HSM device and which is based on the RSA 4096-bit algorithm. This pair of keys is used to share the symmetric key of at least 256 bits between the NFC HSM devices remotely, by encrypting the symmetric key with the public key of the recipient and decrypting the symmetric key with the private key of the recipient. The symmetric key is then stored and re-encrypted in the NFC HSM device of the recipient, with the trust criteria imposed by the sender if he has encapsulated them in the shared encryption key.
Practical Applications of EviCypher NFC HSM
EviCypher NFC HSM is a technology that uses hardware security modules (HSM) to store and use encrypted secrets. It allows contactless encryption with the NFC communication protocol. You can integrate the NFC HSM into various media, such as a card, a sticker, or a key ring. Then, you can pair it with an NFC phone, tablet, or computer. This way, you can encrypt everything before using any messaging service, including Telegram. EviCypher NFC HSM also has anti-cloning, anti-replay, and counterfeit detection mechanisms. It is part of the DataShielder product range, which offers serverless and databaseless encryption solutions.
Telegram and the Ukrainian conflict
EviCypher NFC HSM is compatible with Telegram, a messaging app that influences the information war between Russia and Ukraine. It offers more security and confidentiality than Telegram’s end-to-end encryption, which is not based on recognized standards. It also gives you more flexibility and control than Telegram’s secret chat mode, as you can choose the trust criteria for the encryption keys. Moreover, it is more convenient and simple than Telegram’s normal chat mode, as you can encrypt and decrypt messages with a simple gesture.
Telegram and cybersecurity in Ukraine
EviCypher NFC HSM is a useful technology with Telegram, as it enhances the security and confidentiality of the data exchanged, especially in a context of information war. It is also a universal technology, as you can use it with any other messaging app, such as WhatsApp, Signal, Messenger, etc. It is also an innovative technology, as it uses the NFC communication protocol to perform contactless encryption, without requiring any connection or installation.
Concluding Insights on Telegram’s Role in Ukraine
In this article, we have seen how Telegram plays a vital role in the information war between Russia and Ukraine, and what issues and challenges there are in using this messaging app. We have also seen how the technology EviCypher NFC HSM can be a useful solution to enhance the security and confidentiality of the data exchanged with Telegram. We hope that this article has been informative and interesting for you, and that it has helped you to better understand the situation of Telegram in Ukraine and in other countries. Thank you for reading.
Overview of Cited Sources
Here are the sources of the article, which are valid, reliable, relevant and if possible official links that allow to justify and verify the statements made in this article:
- [Liga.net]: the news site that published the interview of Oleksiy Danilov on November 2, 2023, in which he expresses his concerns about Telegram.
- [NV.ua]: the news site that reported the statement of Oleksiy Danilov, who alerted the nation to the critical vulnerabilities of Telegram, on November 2, 2023.
- [RT – Pravda]: the Ukrainian news site that related the remarks of Oleksiy Danilov, who answered the questions of journalists during a press conference on November 3, 2023.
- [Number of Telegram Users in 2023? 55 Telegram Stats (backlinko.com)]: an article that gives figures on the use of Telegram in the world and in Ukraine.
- [NV.ua -NSDC]: the official website of the National Security and Defense Council of Ukraine, which published the press release of Oleksiy Danilov, who clarified his recent comments on Telegram, on November 15, 2023
- [Ukrainians turn to encrypted messengers, offline maps and Twitter amid Russian invasion]: an article that describes how Ukrainians use Telegram and other digital tools to protect themselves and get informed in the face of the Russian aggression.
- [Pravda – France 24]: the French news site that contains a video of the interview of Oleksiy Danilov with the journalist Gulliver Cragg, dated January 23, 2023.
- [NFC HSM Technology – Freemindtronic]: an article that explains the NFC HSM technologies and how they work.
- [EviCypher NFC HSM technology – Freemindtronic]: a page that contains articles and videos on the NFC HSM technologies.
- [FAQ for the Technically Inclined – Telegram APIs]: a page that provides technical information about the Telegram APIs and the MTProto protocol.
5Ghoul: A Threat to 5G Security
5G has benefits, but also risks. 5Ghoul is a set of 5G NR flaws that affect Qualcomm and MediaTek modems, used by most 5G devices. 5Ghoul can disrupt or make unusable smartphones, routers and modems 5G. In this article, we will see what 5Ghoul is, how it compares to other 5G attacks, and how to protect yourself with contactless encryption, which uses NFC.
5Ghoul: How Contactless Encryption Can Secure Your 5G Communications from Modem Attacks
5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems. These flaws allow to launch denial-of-service attacks or degrade the quality of the 5G network.
What is 5Ghoul?
5Ghoul is a set of 14 5G NR (New Radio) vulnerabilities, the protocol that governs the communication between 5G devices and base stations (gNB). Among these vulnerabilities, 10 are public and 4 are still confidential. They were discovered by researchers from the Singapore University of Technology and DesignSingapore University of Technology and Design.
The 5Ghoul vulnerabilities exploit implementation errors in Qualcomm and MediaTek modems, which do not comply with the specifications of the 5G NR protocol. They allow an attacker to create a fake base station, which pretends to be a legitimate one, and send malicious messages to 5G devices that connect to it. These messages can cause errors, crashes or infinite loops in the modems, resulting in denial-of-service attacks or degradations of the quality of the 5G network.
Which devices are affected by 5Ghoul?
The researchers tested the 5Ghoul vulnerabilities on 714 models of 5G smartphones from 24 different brands, including Lenovo, Google, TCL, Microsoft, etc. They also tested routers and modems 5G from various manufacturers. They found that the 5Ghoul vulnerabilities affect all 5G devices equipped with Qualcomm and MediaTek modems, which account for more than 90% of the market.
What are the impacts of 5Ghoul?
The impacts of 5Ghoul depend on the vulnerability exploited and the type of device targeted. The researchers classified the 5Ghoul vulnerabilities into three categories, according to their severity:
Level 1 vulnerabilities
Level 1 vulnerabilities are the most severe. They allow to render 5G devices completely unusable, by locking them in a state where they can neither connect nor disconnect from the 5G network. These vulnerabilities require a manual reboot of the devices to be resolved. Among the level 1 vulnerabilities, there is for example the CVE-2023-33043, which causes a crash of the Qualcomm X55/X60 modem by sending an invalid MAC/RLC message.
Level 2 vulnerabilities
Level 2 vulnerabilities are less critical, but still harmful. They allow to degrade the quality of the 5G network, by reducing the throughput, latency or stability of the connection. These vulnerabilities can be resolved by reconnecting to the 5G network. Among the level 2 vulnerabilities, there is for example the CVE-2023-33044, which causes packet loss on the MediaTek T750 modem by sending an invalid RRC message.
Level 3 vulnerabilities
Level 3 vulnerabilities are the least dangerous. They allow to disrupt the normal functioning of 5G devices, by displaying error messages, modifying settings or triggering alerts. These vulnerabilities have no impact on the quality of the 5G network. Among the level 3 vulnerabilities, there is for example the CVE-2023-33045, which causes an error message on the Qualcomm X55/X60 modem by sending an invalid RRC message.
How to protect yourself from 5Ghoul?
The researchers informed the manufacturers of Qualcomm and MediaTek modems of the 5Ghoul vulnerabilities, as well as the 5G network operators and the 5G device manufacturers. They also published a demonstration kit of the 5Ghoul vulnerabilities on GitHub, to raise awareness among the public and the scientific community of the risks of 5G NR.
To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, as soon as they are available. They must also avoid connecting to unreliable or unknown 5G networks, which could be fake base stations. In case of doubt, they can disable 5G and use 4G or Wi-Fi.
How 5Ghoul compares to other 5G attacks?
5Ghoul is not the first security flaw that affects 5G. Other 5G attacks have been discovered in the past, exploiting weaknesses in the protocol or in the equipment. Here are some examples of 5G attacks and their differences with 5Ghoul:
ReVoLTE
ReVoLTE is an attack that allows to listen to voice calls 4G and 5G by exploiting a vulnerability in the encryption of data. This vulnerability is due to the fact that some base stations reuse the same encryption key for multiple communication sessions, which allows an attacker to decrypt the content of the calls by capturing the radio signals.
It is different from 5Ghoul because it does not target the 5G modem, but the encryption of data. ReVoLTE also requires that the attacker be close to the victim and have specialized equipment to intercept the radio signals. ReVoLTE does not cause denial of service or degradation of the network, but it compromises the confidentiality of communications.
ToRPEDO
ToRPEDO is an attack that allows to locate, track or harass mobile phone users 4G and 5G by exploiting a vulnerability in the paging protocol. This protocol is used to notify mobile devices of incoming calls or messages. By sending repeated messages to a phone number, an attacker can trigger paging messages on the network, and thus determine the position or identity of the target device.
It is different from 5Ghoul because it does not target the 5G modem, but the paging protocol. ToRPEDO also requires that the attacker knows the phone number of the victim and has access to the mobile network. ToRPEDO does not cause denial of service or degradation of the network, but it compromises the privacy of users.
IMP4GT
IMP4GT is an attack that allows to degrade the quality of the 5G network by exploiting a vulnerability in the security protocol. This protocol is used to authenticate and encrypt the communications between 5G devices and base stations. By modifying the messages exchanged between the two parties, an attacker can mislead the network and the device on the level of security required, and thus reduce the throughput or latency of the connection.
It is different from 5Ghoul because it does not target the 5G modem, but the security protocol. IMP4GT also requires that the attacker be close to the base station and have equipment capable of modifying the messages. IMP4GT does not cause denial of service or crash of the modem, but it degrades the quality of the network.
SS7
SS7 is a set of signaling protocols used by mobile operators to establish and manage calls and messages between different networks. SS7 has existed since the 1970s and has not evolved much since, making it vulnerable to hacking attacks. By exploiting the flaws of SS7, an attacker can intercept SMS and voice calls, locate and track users, bypass two-factor authentication, or subscribe subscribers to paid services without their consent.
It is different from 5Ghoul because it does not target the 5G modem, but the signaling protocol. SS7 affects all types of mobile networks, including 5G, because it still uses SS7 for some functions, such as mobility management or compatibility with 2G and 3G networks. SS7 requires that the attacker has access to the signaling network, which is not easy to obtain, but not impossible. SS7 does not cause denial of service or crash of the modem, but it compromises the confidentiality and integrity of communications.
How and why to encrypt SMS, MMS and RCS without contact?
Contactless encryption is a method of protecting mobile communications that uses NFC (Near Field Communication) technology to establish a secure connection between two devices. NFC is a wireless communication protocol that allows to exchange data by bringing two compatible devices within a few centimeters of each other.
Contactless encryption relies on the use of an external device called NFC HSM (Hardware Security Module), which is a hardware security module that stores and manages encryption keys. The NFC HSM comes in the form of a card, a keychain or a bracelet, that the user must bring close to his phone to activate the encryption. The NFC HSM communicates with the phone via NFC and transmits the encryption key needed to secure the messages.
The technologies EviCore NFC HSM and EviCypher NFC HSM are examples of contactless encryption solutions developed by the Andorran company Freemindtronic. EviCore NFC HSM is a hardware security module that allows to encrypt SMS, MMS and RCS (Rich Communication Services) end-to-end, meaning that only the recipients can read the messages. EviCypher NFC HSM is a hardware security module that allows to encrypt multimedia files (photos, videos, audio, etc.) and share them via SMS, MMS or RCS.
Contactless encryption has several advantages over conventional encryption of mobile communications:
It offers a higher level of security, because the encryption key is not stored on the phone, but on the NFC HSM, which is more difficult to hack or steal.
It is compatible with all types of mobile networks, including 5G, because it does not depend on the communication protocol used, but on NFC.
It is easy to use, because it is enough to bring the NFC HSM close to the phone to activate the encryption, without having to install a specific application or create an account.
It is transparent, because it does not change the appearance or functioning of the messages, which remain accessible from the native application of the phone.
Statistics on 5Ghoul
How widespread are 5Ghouls? What are the trends and impacts of these flaws? Some statistics on 5Ghoul, based on sources and data that are a priori reliable.
5Ghoul: a threat to 5G devices
5Ghoul is a set of 5G NR vulnerabilities that affect Qualcomm and MediaTek modems, which are used by most 5G devices on the market. According to the researchers who discovered 5Ghoul, these vulnerabilities can cause denial-of-service attacks or network degradations.
- How many 5G devices are affected by 5Ghoul? According to a report by Counterpoint Research, Qualcomm and MediaTek accounted for 79% of the global smartphone chipset market in Q3 2020. Qualcomm had a 39% share, while MediaTek had a 40% share. Assuming that all Qualcomm and MediaTek chipsets are vulnerable to 5Ghoul, this means that nearly 8 out of 10 smartphones are potentially at risk.
- How many 5G NR vulnerabilities are known? According to the CVE (Common Vulnerabilities and Exposures) database. There are 16 CVE entries related to 5G NR as of April 2021. Four of them are ZeroDay vulnerabilities that have not been publicly disclosed nor fixed by the manufacturers. These vulnerabilities are classified as level 1 or 2, meaning that they can cause denial-of-service attacks or network degradations.
- How many 5G attacks have been reported? According to the SANS Internet Storm Center, there have been no reports of 5Ghoul attacks in the wild as of April 2021. However, this does not mean that 5Ghoul is not exploited by malicious actors. The researchers who discovered 5Ghoul have developed a proof-of-concept tool called 5Ghoul-Scanner, which can detect and exploit 5Ghoul vulnerabilities. They have also released a video demonstration of 5Ghoul attacks.
Conclusion
5Ghoul is a security flaw that affects 5G modems from Qualcomm and MediaTek, which are used by most 5G devices on the market. 5Ghoul allows an attacker to disrupt the functioning of smartphones, routers and modems 5G, or even make them unusable. 5Ghoul stands out from other 5G attacks known, such as ReVoLTE, ToRPEDO, IMP4GT or SS7, by the fact that it targets the 5G modem, that it does not require secret information or specialized equipment, and that it causes denial-of-service attacks or degradations of the network. To protect yourself from 5Ghoul, 5G device users must update their modems with the latest security patches, and avoid connecting to unreliable or unknown 5G networks.
Why You Need DataShielder Defense NFC HSM
DataShielder Defense NFC HSM, a patented solution, ensures maximum confidentiality and anonymization of communications from sovereign entities. Using NFC technology, this HSM manages up to 200 secrets offline, contactless and shareable via any communication method, including email and SMS. A GreenTech innovation, it is interoperable, backward compatible and versatile, designed to immediately respond to various specific needs and customizable for enhanced secret security.
DataShielder Defense NFC HSM: How to Protect Your Sovereign Communications with a Revolutionary Solution
The protection of sovereign entities and the enhancement of existing defense and intelligence systems are crucial challenges in today’s world. Sovereign communications, such as those between heads of state, diplomats, military personnel, or secret agents, are constantly exposed to threats of interception, hacking, or manipulation. These threats can compromise the security, integrity, and confidentiality of sensitive information, and have serious consequences for national and international security.
To address these challenges, a revolutionary solution has been developed by Freemindtronic, a andorran company specialized in data security and encryption. This solution is called DataShielder Defense NFC HSM, and it is the ultimate solution for protecting all forms of communications of sovereign entities. This innovative and cutting-edge solution, protected by two patents, guarantees an unparalleled level of confidentiality and trust among humans, without compromise. With DataShielder, your secrets and sensitive data remain inaccessible and indecipherable, even in case of compromise of the equipment and information and communication systems.
In this article, we will explain how DataShielder Defense NFC HSM works, what are its features and benefits, and how it can be customized to suit your specific needs. We will also show how this solution could have influenced several major events in the history of communication security, and how it has received international recognition and awards for its excellence.
How DataShielder Defense NFC HSM Works
DataShielder Defense NFC HSM is a device that uses Near Field Communication (NFC) technology to create, store, and use up to 200 different secrets in a single device. A secret can be anything that you want to protect, such as an encryption key, a password, a PIN code, a cryptocurrency key, a bank account information, or a message. DataShielder allows you to share your encrypted secrets via all the means of communication available in the world, such as postal mail, webcam, email, SMS, MMS, RCS, messaging, or directly between two NFC HSM devices.
To use DataShielder, you need an Android NFC phone or tablet, and the DataShielder app, which is available for free on the Google Play Store. You also need a DataShielder Defense NFC HSM device, which is a small and discreet card that can be customized to fit different formats and accessories. The device does not require any battery or external power source, as it uses the energy of the NFC signal of the phone to operate on demand.
To create a secret, you simply need to tap your phone on the device, and choose the type of secret you want to create. You can either generate a random secret, or import an existing one. You can also add specific trust criteria for each secret, such as BSSID, geographical area, password, fingerprint, QR code or barcode scan, and phone UID. The absence of any of these criteria makes the access to the secret impossible, ensuring maximum and personalized security.
To use a secret, you simply need to tap your phone on the device, and choose the secret you want to use. You can either use it directly on your phone, or send it to another device or person. You can also use the secret to unlock secure USB or SSD keys, to log in to your favorite websites, to make secure voice calls and SMS, to manage your banking information, to generate and use cryptocurrency wallets, and more.
To share a secret, you simply need to tap your phone on the device, and choose the secret you want to share. You can either share it directly with another NFC HSM device, or encrypt it with the RSA-4096 public key of the recipient, and send it via any means of communication. The recipient will need to decrypt the secret with their NFC HSM device, using the EviSCP HSM (ZKP) protocol, which is a patented technology that ensures a secure and confidential exchange of secrets.
Pegasus: The Cost of Spying
Pegasus is a powerful spyware that has been used by several countries to spy on political figures, journalists, human rights activists or opponents. How does it work, who has been spied on, what are the consequences, and how much does it cost? Find out in this article.
Pegasus: The Cost of Spying with the Most Powerful Spyware in the World
Pegasus is a spyware developed by the Israeli company NSO Group. It allows to remotely monitor the activities of a mobile phone. According to an investigation conducted by a consortium of international media, several countries have used this software to spy on political figures, journalists, human rights activists or opponents.
The scandal of Pegasus has provoked a global outcry. It has raised many questions about the legality, the ethics and the consequences of this cyber-surveillance. How does Pegasus work? Who has been spied on by Pegasus? Who is responsible for the spying? What are the consequences of the spying? And most importantly, how much does Pegasus cost?
In this article, we will try to answer these questions in detail. We will use reliable and verified sources of information. We will also present some statistics and comparisons to give you an idea of the scale and the impact of Pegasus.
What is Pegasus?
Pegasus is a spyware, also called spy software. It allows to remotely monitor the activities of a mobile phone. It can access the messages, the calls, the contacts, the photos, the videos, the location, the microphone or the camera of the target phone. It can also activate or deactivate certain functions of the phone, such as Wi-Fi or Bluetooth.
Pegasus: a spyware that raises many questions
Pegasus is a powerful spyware that the NSO group designed. It can monitor and steal data and activities from mobile phones secretly. The NSO group is an Israeli company founded in 2010 by former members of Unit 8200; the Israeli military intelligence service. The company claims that its software aims to fight terrorism and organized crime; such as pedophiles or cartel leaders. It also claims that it only sells it to governments or authorized security agencies; with the approval of the Israeli Ministry of Defense. The countries that acquire these systems must respect their commitments stipulated in the license.
However, a consortium of international media outlets revealed that many countries have used Pegasus for other purposes. They have monitored various people, including politicians, journalists, human rights activists and political opponents. This raises many questions about the protection of privacy and human rights in the digital age. It also exposes the vulnerabilities and challenges of cybersecurity in a world where surveillance technologies are becoming more powerful and discreet.
Pegasus works by exploiting security flaws in the operating systems of phones, such as iOS or Android. It can infect a phone in two ways: either by sending a malicious link to the target phone, which must click on it to be infected; or by using a technique called “zero-click”, which allows to infect a phone without any interaction from the user.
Pegasus is a very sophisticated and discreet software. It can self-destruct or camouflage itself to avoid being detected. It can also adapt to security updates of operating systems to continue working. According to NSO Group, Pegasus is able to target more than 50,000 phone numbers in the world.
Unveiling Pegasus Attack Vectors: Stealth and Subterfuge in Cyber Espionage
In the Shadows of Cyber Espionage: Pegasus Strikes Unseen
In the realm of cyber espionage, Pegasus has mastered the art of covert infiltration, employing a spectrum of attack vectors designed to leave its targets unaware and defenseless. As a specialized journalist in the field of espionage, we delve into the clandestine world of Pegasus, shedding light on the methods it employs to breach digital fortresses.
Email: The Trojan Horse
Pegasus’s espionage campaign often commences with a seemingly innocuous email. The target receives a carefully crafted message, concealing a malicious payload. This deception operates with remarkable subtlety, bypassing traditional safeguards. Victims unknowingly execute the payload, granting Pegasus a foothold into their digital lives.
SMS Intrigue: Texts That Betray
SMS messages can become instruments of betrayal when wielded by Pegasus. Crafted to exploit vulnerabilities in messaging apps, these seemingly harmless texts harbor malicious intent. Clicking on a compromised message can be all it takes for Pegasus to silently infiltrate a device.
Web of Deceit: Navigating Vulnerabilities
Pegasus’s reach extends into the very fabric of the internet. Web browsers, portals to information and connectivity, can become gateways for intrusion. By exploiting unpatched browser vulnerabilities, Pegasus sidesteps user interaction, infiltrating systems silently.
WhatsApp’s Vulnerable Connection
Even encrypted platforms like WhatsApp are not impervious to Pegasus’s advances. The spyware capitalizes on vulnerabilities in this widely used messaging app. A simple call on WhatsApp can translate into a gateway for Pegasus’s covert surveillance.
Zero-Click: A Stealthy Intrusion
The pinnacle of Pegasus’s subterfuge is the “Zero-Click” attack vector. Unlike other methods, “Zero-Click” requires no user interaction whatsoever. It preys upon deep-seated operating system vulnerabilities. Pegasus slips in unnoticed, operating in the shadows, and evading all user alerts.
The Stealth Within Pegasus: An Unseen Hand
Pegasus’s ability to infiltrate devices without leaving a trace raises profound concerns regarding detection and defense. Victims may remain oblivious to their compromised status, and traditional security measures struggle to counteract this stealthy foe.
Pegasus Continues to Threaten iPhone User Privacy and Security
In the ever-evolving landscape of digital security, the Pegasus spyware remains a significant threat to iPhone users’ privacy and security. Despite Apple’s rigorous efforts to enhance iOS safeguards, the sophisticated surveillance tool developed by the Israeli firm NSO Group has continually adapted, finding new ways to infiltrate the defenses of one of the world’s most popular smartphones.
Apple’s Proactive Measures Against Pegasus
Apple has been at the forefront of the battle against cyber threats, releasing timely security updates and patches aimed at thwarting Pegasus’s advanced techniques. The company’s commitment to user privacy has led to the development of new security features designed to protect sensitive information from unauthorized access. However, the dynamic nature of cyber threats, exemplified by Pegasus, poses an ongoing challenge to even the most secure platforms.
The Impact on iPhone Users
For iPhone users, the threat of Pegasus spyware is more than just a privacy concern; it’s a direct attack on their freedom of expression and the security of their personal data. The ability of Pegasus to covertly monitor conversations, access encrypted messages, and even activate cameras and microphones without consent has raised alarms worldwide. This level of surveillance capability not only endangers individual users but also threatens the integrity of global communications networks.
Recent Revelations in Jordan Amplify Global Pegasus Concerns
In 2024, shocking reports emerged, spotlighting Jordan’s use of Pegasus against journalists and activists. This development underscores the pervasive reach of NSO Group’s spyware. Allegedly, the Jordanian authorities targeted individuals crucial to civil society. These actions have stoked fears about privacy invasions and press freedom suppression. Amidst Israel-Jordan tensions, this move signals a worrying trend of using cyberweapons to stifle dissent. Consequently, global watchdogs are calling for stringent controls on spyware sales and usage. This incident not only highlights the urgent need for robust digital rights protections but also raises significant ethical questions about surveillance technologies’ global impact.
India’s Pegasus Scandal: A Deep Dive into Surveillance and Democracy
The year 2023 brought to light India’s alleged surveillance of journalists and opposition figures using Pegasus. This revelation has sparked a nationwide debate on privacy, press freedom, and democratic values. High-profile journalists and political dissenters reportedly fell victim to this covert tool, leading to widespread condemnation. Despite government denials and a lack of cooperation with Supreme Court probes, the issue remains unresolved. Such use of Pegasus not only threatens individual freedoms but also undermines the very fabric of democratic societies. As countries grapple with the dual use of surveillance technologies, the call for transparent, regulated, and ethical practices has never been louder. This situation serves as a crucial reminder of the delicate balance between national security and personal liberties.
How Pegasus spied on the Catalan independence movement and the Spanish government
Pegasus, a powerful spyware designed by the NSO Group, has the capability to clandestinely monitor and steal data and activities from mobile phones. A consortium of international media outlets exposed the fact that numerous countries have employed Pegasus to conduct surveillance on various individuals, including political figures, journalists, human rights activists, and political opponents.
In Spain, the Pegasus scandal unfolded, implicating over 60 individuals associated with the Catalan independence movement. According to a report from Citizen Lab, Pegasus was utilized to target these individuals between 2017 and 2020. In an alarming twist, the Spanish government itself accused Pegasus of spying on its own officials in 2021.
The Catalan independence movement under surveillance
The Catalan independence movement represents a political and social endeavor that aims to secure Catalonia’s independence from Spain. This movement gained significant momentum in 2017 when the Catalan government conducted an unauthorized referendum on self-determination. In response, the Spanish government took action by suspending Catalonia’s autonomy and apprehending several of its leaders.
Citizen Lab’s report revealed that Pegasus had specifically targeted more than 60 individuals associated with the Catalan independence movement from 2017 to 2020. This list includes notable figures such as three presidents of the Generalitat of Catalonia: Artur Mas, Quim Torra, and Pere Aragonès. These individuals have taken legal action, filing a complaint against Paz Esteban and the NSO Group. Paz Esteban serves as the director of CNI, Spain’s intelligence service.
Additional alleged victims encompass Members of the European Parliament, lawyers, journalists, and activists. For example, Carles Puigdemont, the former president of Catalonia who sought refuge in Belgium following the referendum, was also subjected to Pegasus surveillance. The list further includes Roger Torrent, the former speaker of the Catalan parliament, and Jordi Cañas, a pro-union Member of the European Parliament.
The Spanish government under attack
The situation escalated in significance when the Spanish government disclosed that Pegasus had also surveilled its own officials in 2021. The government attributed this to an “external attack” but refrained from identifying the perpetrators. Various media outlets hinted at the possibility of Moroccan involvement, occurring against the backdrop of a diplomatic standoff between the two nations.
Prime Minister Pedro Sánchez and Defense Minister Margarita Robles were among the primary targets. In February 2021, while on an official visit to Morocco, their mobile phones fell victim to Pegasus infections8. This compromise allowed the spyware access to their messages, calls, contacts, photos, videos, location, microphone, and camera.
Additionally, Foreign Minister Arancha González Laya and Interior Minister Fernando Grande-Marlaska faced Pegasus surveillance in May 2021. This intrusion occurred during their management of a migration crisis in Ceuta, a Spanish enclave in North Africa that witnessed a mass influx of Moroccan migrants.
The outcry of the victims
Those who have potentially or definitively fallen victim to Pegasus expressed their outrage and concerns surrounding this spying scandal. They vehemently decried it as a grave infringement upon their fundamental rights and vociferously demanded both explanations and accountability. Furthermore, they sought access to the findings of the judicial investigation and the data collected by the spyware.
For example, Quim Torra expressed feeling “violated” and “humiliated” by the intrusive spying. He squarely pointed fingers at the Spanish state and demanded an apology from Prime Minister Sánchez. Torra also declared his intent to pursue legal action against NSO Group and CNI.
Likewise, Pedro Sánchez conveyed his profound worry and anger regarding the spying. He committed to seeking clarifications from Morocco and Israel while simultaneously reinforcing his government’s cybersecurity measures.
- 1
- 2