Pinned Tweet
Latest @Infoblox research w @HHieupc traces an aggressive mobile banking trojan & large-scale government impersonation back to #Cambodia's K99 #scam compound. Read more about the #malware & the high-ranking elites behind it below:
infoblox.com/blog/threat-int…
#Cybercrime #ASEAN
John W. retweeted
4/ In 2026, if you want to stay safe online, you need to block targeted ads.
Here's some guidance from our report
teapawt.org/jsrailton/status/21107…
Replying to @jsrailton @NATO @UN @Stortinget @Forsvarsmakten @duolingo @Grindr @nytimes @BBC @FoxNews
14/ To NETWORK DEFENDERS & INSTITUTIONS:
There is no consistently safe way to let ads into your network in 2026.
The best practices write themselves.
✅Block ads at the gateway.
✅Block ads on edge devices
✅Move your users towards browsers with less tracking
✅Look at your network traffic for malicious ads
John W. retweeted
UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries.
Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/
By @razhael
reuters.com/business/media-t…
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
John W. retweeted
holy fucking shit.
openai had two ai agents running in separate virtual machines. no network connection between them. no shared writable files. they weren’t supposed to be able to exchange information.
so the agents figured out how to communicate through the CPU CACHE.😭
one manipulated what was stored in the processor’s cache, while the other measured tiny differences in memory access times to decode the message.
they literally found a way to communicate through hardware timing.
this happened during openai’s internal red-teaming, and it’s one of the coolest things i’ve read about ai agents in a while.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Readers added context they thought people might want to know
OpenAI tasked its red-teaming agents with finding ways to communicate across isolation boundaries in controlled environments. CPU cache timing side-channels for covert communication are established techniques documented in security research for years.
openai.com/index/securing…
startupfortune.com/openai-reveals…
en.wikipedia.org/wiki/Cache_tim…
John W. retweeted
NEW: A Federal judge just ruled that a warrantless Flock/ALPR search violated a woman's 4th Amendment rights!
"Why is it the government's business where everyone goes all the time?"
"Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts"
Judge Sara Hill (N.D. Oklahoma) notes other courts, including in Oklahoma, ruled the other way on Flock searches. She argues that a decision from 1983 shouldn't govern 2026 networks of what she calls "indiscriminate mass surveillance."
"This Court is now faced with technology that appears to be approaching the dragnet type law enforcement practice Mr. Knotts warned of."
Setting up for an interesting fight in circuit court if the government appeals.
Story by @jason_koebler
404media.co/federal-judge-ru…
Ruling: storage.courtlistener.com/re…
John W. retweeted
Meet CyberGlobes: they conduct mass monitoring help dictators select victims for spyware hacking.👇
LLMs are poised to turbocharge this kind of mass monitoring & targeting.
Political movements & activists are going to have to adapt to a massive increase in tactical & strategic pressure that governments will bring to bear.
Unfortunately, it's comparatively easy to get folks to understand the stakes of Pegasus spyware.
Risks are salient. Often some evidence lives with victim phones. Cases...with faces.
Getting folks to understand the insidious role of mass surveillance companies that monitor activists is tougher. And connecting that surveillance to individual harm & stories is really tough.
🚨CyberGlobes, an Israeli surveillance firm, has been secretly arming autocrats around the world with tech to target gay men, activists and protesters
investigation by @GurMegiddo and @omerbenj
haaretz.com/israel-news/secu…
John W. retweeted
In 2025 alone, Americans lost over $20.8 billion to cyber-enabled crime. President Donald Trump is committed to addressing this problem regardless of where it originates.
Under a new directive signed by President Trump, federal law enforcement and top U.S. tech companies are uniting to disrupt overseas criminal networks and shut down predatory online schemes before they reach the United States.
Read the full White House Fact Sheet here: whitehouse.gov/fact-sheets/2…
John W. retweeted
None of this happens by chance; journalists like @jackoozell risk his career and work relentlessly to investigate the Prince Group and have written countless articles in the most comprehensive. Through his investigation, he was able to identify prince associations as well as their assets in the United Kingdom. He had also discovered how they run an online scam.
Days after Chinese prosecutors brought charges that could carry the death penalty against Chen Zhi, the EU has sanctioned seven individuals and three entities targeting Prince Holding Group, its chairman Chen Zhi, and Jin Bei Group over alleged severe human right violation in scam compounds
kiripo.st/MHawc8
AI/LLM tool exposures have risen over 60% in the past 9 months, expanding the Internet-facing attack surface.
And that's just the preview.
The full Censys State of the Internet Report will cover emerging trends across the Internet, ICS exposure trends, vulnerability remediation, and the rise of exposed AI infrastructure.
Censys Finds AI/LLM Tool Exposures Up More Than 60% bit.ly/3TchcGZ
John W. retweeted
【カンボジアニュース】国際手配中の蘇江波氏が日本に拠点、プリンスグループ最高幹部に住宅提供
英国で8,100万英ポンドに上る巨額の資産を凍結され、違法ギャンブル運営の疑いで中国当局から国際手配されている福建省出身の蘇江波氏が、日本に拠点を移していることや、同氏がプリンスグループの最高幹部に大阪府内の住宅を提供していたことが共同通信とOCCRPによって明らかになりました。
▪️日本における活動と「プリンス・グループ」幹部への住宅提供
カンボジアのプリンスグループの最高幹部とみられ、入管難民法違反容疑で逮捕された中国出身のフー・シー容疑者(44)が、日本国内で中国出身の別の男から大阪府内の住宅の提供を受けていたことが報じられました。これまでに警視庁などは、フー容疑者と共謀した疑いで中国籍の3人を逮捕しています。新たに日本国内にいた協力者として判明したこの男が、福建省出身でカンボジア国籍などを保有する蘇江波氏です。
共同通信やOCCRPによると、蘇氏は2024年に日本へ移住し、大阪にTenichi Fuka Ltdという旅行・不動産会社を設立しました。同社は日本の企業記録において、カンボジア国籍取得時(2015年)の法的身元であるSu Jimmyという別名で登録されています。
土地および会社記録によれば、蘇氏は大阪府吹田市に2つの物件を所有しており、一つは自身の名前で、もう一つは会社名義で購入されています。この会社所有の物件が、米国から制裁を受けているプリンス・グループ関連のフー・シー容疑者によって、日本の法人登記の連絡先として最近使用されていました。日本への移住理由について、蘇氏はメールでの取材に対し、「政治的および経済的な安定、発達したインフラ、強固な知的財産保護、そして歓迎的で文明的な社会」があるためと回答しています。
▪️英国における巨額の資産凍結
英国検察庁は2026年3月、「不正に取得された資金を使用して不動産を購入した疑い」で、「Mr. X」と呼称する中国籍の人物および関連する英国企業に対し、説明のつかない富に関する命令および暫定凍結命令を出しました。OCCRPとサンデー・タイムズの調査により、この「Mr. X」が蘇江波氏であることが判明しています。
凍結された資産はロンドン中心部や南部にある85物件で、総額8100万英ポンド(約1億ドル、約8億4000万香港ドル)に上ります。これには、セントポール大聖堂やテムズ川を見渡せる1300万ドル相当のペントハウスが含まれています。
蘇氏は、中国の指名手配リストが公開される数週間前の2023年9月以前から英国で不動産を買い始め、カリブ海の島国セントクリストファー・ネービスの市民権を利用し、少なくとも2025年6月まで購入を続けていました。
▪️香港・台湾・東南アジアにおけるビジネスネットワーク
蘇氏は中国で指名手配される前の2020年6月に、香港の隆滙國際投資有限公司の株式譲渡を通じて、九龍湾の商業ビル億京中心の1フロア全体と3つの駐車スペースを取得していました。現在の市場価値は約1億香港ドルとされています。1985年生まれの蘇江波氏が同社の唯一の取締役であり、株主は英領バージン諸島のオフショア会社となっています。
また、蘇氏は2018年に台湾でも雅柏電腦有限公司を設立し、董事長に就任しています。同氏のビジネスパートナーである蘇樹波氏も、香港の何文田にある天鑄1期の独立屋を2018年に3.33億香港ドルで購入しており、現在の時価は約3億香港ドルです。蘇樹波氏は同福資本有限公司の取締役でもあり、この会社の登録住所は蘇江波氏が所有する億京中心の半フロアに設定されています。
中国の財新網の報道によれば、蘇江波氏とそのグループは早くも2014年にマレーシアでギャンブルサイト蘭桂坊を運営し、2016年に業務をカンボジアのシアヌークビルに移転しています。さらに中国の成都にもネットワーク技術会社を設立してカンボジア向けギャンブルソフトの開発員を募集していたとされています。
▪️本人の主張と中国当局からの手配
蘇氏は2023年9月15日に福建省大田県の公安局から指名手配されており、ICPO(国際刑事警察機構)を通じた国際手配の対象となっていますが、蘇氏は犯罪への関与を全面的に否定しています。
フー容疑者への住宅提供については、「彼が近年頻繁に大阪を訪れているが定まった住所がないため」に自身の会社の住所を使用させたり、自宅に滞在させたりしたことは認めたものの、「友人を助けるための短期間のアレンジ」であり「カンボジアのプリンス・グループとは一切関係がない」と回答しました。
英国での資産凍結に関しても、「関連する資産を取得するための資金は、完全な財務記録と文書に裏付けられた合法的な資金源」と主張し、法的な異議申し立てに弁護士を雇ったと述べています。資金源の詳細については「手続きの公正性を保つ必要があるため」情報提供できないとしています。
【カンボジアニュース】プリンスグループ最高幹部を出入国管理法違反疑いで再逮捕 警視庁
プリンスグループの最高幹部とみられるフー・シー容疑者(44歳)について、警視庁が、日本での在留カードを不正に他人に渡すなどしたとして出入国管理法違反の疑いで再逮捕したことが、捜査関係者への取材で分かりました。
再逮捕されたのは、キプロス国籍で住所不定の会社経営、フー・シー容疑者(44)と、いずれも中国籍の36歳の会社役員と31歳の会社員です。また、中国籍で都内に住む職業不詳、陳暁光容疑者(49)が新たに逮捕されました。
捜査関係者によりますと、フー容疑者は、今年4月から5月にかけて、在留カードを不正に他人に渡し、東京 中央区の区役所で自らの印鑑登録の手続きをさせたとして、出入国管理法違反の疑いが持たれています。また、逮捕された他の3人が、フー容疑者から在留カードを受け取ったり、区役所の窓口で容疑者になりすましてカードを提示したりした疑いです。
フー容疑者は昨年10月にプライベートジェットで日本に入国した後潜伏していたと見られており、東京中央区に引っ越したとする虚偽の転入届を提出したなどとして先月警視庁に逮捕されていました。フー容疑者は都内にある会社の代表取締役を務めていて、「高度専門職」と呼ばれる5年間の在留資格で遅くとも3年ほど前から日本への出入国を繰り返していたとみられています。
警視庁は、嘘の転入届が出されるなどしたいきさつや日本での活動の実態を詳しく調べています。
John W. retweeted
Who'd have thought? @johnwSEAP asia.nikkei.com/spotlight/cy…
Telegram is a mess, and it happens to be the most popular app in Cambodia. Malware disguised as everyday files is spreading through it, and one click is all it takes. Post and Telecom Minister Chea Vandeth is warning people not to open attachments ending in .exe, .bat, .vbs, .ps1, .msi or .scr. Files named and captioned in Khmer to look legit. Government says many of the attacks trace back overseas.
cambodianess.com/article/one…
John W. retweeted
Uganda Detained Over 1,000 Foreign Nationals, Most of Them Chinese, at a Resort Tied to a Former Vice President
More than 1,000 foreign nationals, most of them Chinese, were detained across Kampala and Wakiso District this week, around 430 of them at Katomi Kingdom Resort, a lakeside property that ChimpReports, citing sources familiar with the investigation, says is tied to former Vice President Gilbert Bukenya. Uganda's Criminal Investigations Directorate led the operation, which security sources are calling one of the largest against a cybercrime network in the country's history. Hundreds more came out of three neighboring apartment blocks and the Kampala suburbs of Naguru and Kansanga.
Everyone is being held at a warehouse in Namanve while investigators work through the numbers. Officers seized hundreds of computers, servers, phones and networking equipment, now with forensic examiners. Investigators suspect the operators ran online fraud and illegal call centers targeting victims in Uganda and abroad, and that they hacked telecom and utility providers to enable fraudulent deductions from customer accounts.
All of this comes from ChimpReports, which attributes it to security sources who spoke on condition of anonymity because they weren't authorized to comment. Uganda Police, the CID, and the immigration directorate had issued no official statement by publication.
John W. retweeted
Meta has enabled a setting that allows anyone to use your public Instagram photos to create AI-generated images of you unless you opt out.
To opt out, click your profile -> 3 bars in the top right -> scroll down to "Sharing and reuse" and toggle off for both Posts and for Reels.
John W. retweeted
A massive fraud has been detected in scientific infrastructure. Someone is using AI to mass-create fictional authors, publications, and metadata with real DOIs. Such records can enter publication aggregators and contaminate the academic record. An attack on science? arxiv.org/html/2606.02184v1
John W. retweeted
THE #EU parliament #spyware debate has kicked off, follow along with me.
( triggered by the hacking of a MEP investigating spyware w/Pegasus)
It kicks off as expected with Commissioner @dubravkasuica (Croatia) trying frame the issue as a national one (govs should investigate...not the parliament).
This is likely to be unpopular among MEPs concerned by spyware abuses.
Next up? MEP & spyware victim @KrzysztofBrejza 1/
John W. retweeted
AMLO freezes assets worth 20.3bn baht in fraud probe linked to alleged scam network
The Anti-Money Laundering Office (AMLO) has frozen an additional 8.165 billion baht in assets linked to an alleged public fraud and money-laundering network involving Thai national Tangthai Banmahing, Cambodian businessman Yim Leak, South African-born businessman Benjamin "Ben Smith" Mauerberger and their associates, bringing the total value of seized and frozen assets to 20.288 billion baht.
The Civil Court ordered the temporary seizure of 35 additional assets, including vehicles, boats, bank deposits, securities and loan claims. Authorities allege Tangthai acted as a nominee for Yim Leak and Mauerberger by holding and transferring assets on their behalf. Investigators allege the network operated cross-border online scams and laundered criminal proceeds through Thai nominees and investments.
Mauerberger is wanted under a Thai arrest warrant in a related fraud investigation. Yim Leak has been named in AMLO's civil asset-forfeiture proceedings, although no publicly confirmed Thai arrest warrant has been announced. Both men deny wrongdoing through their legal representatives. AMLO said it is preparing to publish a notice in the Royal Gazette allowing victims to file claims for compensation from the seized assets in proportion to their losses.
#Thailand #ยิมเลียก #เบนสมิธ #Scammers
John W. retweeted
【アフリカニュース】シエラレオネ拠点の特殊詐欺に関与か 兵庫県警が9人逮捕
朝日新聞などによると、アフリカ西部にある最貧国の一つ、シエラレオネを拠点とする犯行グループのもとで、日本にいる人を狙った特殊詐欺事件に関与したとして、兵庫県警は1日、神奈川県内の60代の男ら9人を詐欺容疑で逮捕しました。
特殊詐欺事件をめぐっては近年、カンボジアやミャンマーなど東南アジアにある犯行グループの拠点などで日本人容疑者が現地当局に摘発されるケースが相次いでいますが、アフリカの国を拠点とする特殊詐欺事件で日本人容疑者の関与の疑いが浮上するのは異例です。東南アジアでは摘発されやすくなり、拠点を移した可能性もあります。
捜査関係者によると、60代の男らは共謀して昨年6月、シエラレオネから日本国内に住む人に電話をかけるなどし、嘘の事情で多額の現金が必要であるかのように信じ込ませ、数千万円を騙し取った疑いが持たれています。
60代の男は、シエラレオネから詐欺電話をかける役割の「かけ子」を日本で募り、勧誘したとする職業安定法違反容疑で逮捕、起訴されていおり、兵庫県警は男が「リクルーター」のグループの上位者とみています。
他の詐欺容疑での逮捕者の中には、実際にシエラレオネに渡航し、かけ子として現地から日本に電話をかけた疑いが持たれている人物も含まれています。
John W. retweeted
Not all scam centres look the same. In Myanmar, they range from large urban complexes to hidden forest sites.
Our latest video breaks down the 5 common types of scam compounds from Mega-Compounds to Rural Sites, revealing the hidden architecture of forced confinement.
Watch the full video below to see how these sites operate, and read our deep-dive analysis here: 🔗info-res.org/myanmar-witness…
#WhatsHappeningInMyanmar #Myanmar #ScamCentres
John W. retweeted
Southeast Asia’s cyber scam industry has stolen trillions of dollars from its victims. Huge scam compounds have emerged across the region. In an exclusive investigation, 101 East goes undercover to expose the playbook of this notorious industry. aje.news/cyberscam
John W. retweeted
NEW: Russia cracked activist's phone with Cellebrite.
Hunted for political terms
We @citizenlab found it. Russia's own official docs confirm they did it.
@brewerov was sentenced to 4 years in prison.
Thing is, @cellebrite had officially cancelled Russia's contract.. 1/
John W. retweeted
The U.S. Treasury Department announced sweeping sanctions against the Prince Group, a Cambodian conglomerate allegedly involved in criminal cyber-scams. The Prince Group has rejected the allegations: buff.ly/iVqrClt
























































