China's APT cyberspies are some of the best in the business. But how did the hackers get their start? Turns out many were "Honkers" - patriotic hackers in their teens and 20s who, in the late 90s, launched nationalistic cyberattacks against countries they deemed disrespectful to China. But as the Honkers developed their skills over time, the PLA and MSS came calling. In recent years they have been tied to prolific APT groups responsible for hundreds of intrusions in the US and around the world; and some have been indicted. Some of them also launched companies, like i-Soon, that have played an integral role in China's state hacking operations. Here's my story, based on great research from Eugenio Benincasa and Adam Kozy.
WIRED
How China’s Patriotic ‘Honkers’ Became the Nation’s Elite Cyberspies
A new report traces the history of the early wave of Chinese hackers who became the backbone of the state's espionage apparatus.
The UAE has been trying to recruit Pentagon workers displaced by DOGE to move to Abu Dhabi to work on AI for the UAE's military. A UAE brigadier general met last month with two former staffers of the Defense Digital Service who have worked on US classified projects and tried to recruit them and their entire DDS team to move to Abu Dhabi. The general was apparently given permission by the Pentagon to recruit the members of Defense Digital Service -- who resigned enmasse from their jobs last month due to DOGE --- despite warnings last year from US spy agencies and federal lawmakers that the UAE could share AI tech with China and despite the UAE's disturbing history of recruitment of US workers. Remember Dark Matter when the UAE recruited former NSA operators/analysts to work on cybersecurity jobs only to have them help UAE spy agencies hack other nations, members of the royal family and dissidents and journalists? One of the people from the UAE who assisted with the recruiting of DDS workers has ties to Dark Matter. Here's my story:
ZERO DAY
UAE Recruiting US Personnel Displaced by DOGE to Work on AI for its Military
A UAE brigadier general received permission from the Pentagon to recruit former members of the Defense Digital Service to work on artificial intell...
Chris Krebs has quit his job at SentinalOne to launch a legal and public relations fight against Trump and the presidential memo Trump he signed against Krebs last week. "Krebs said he understood why some have kept a low profile and tried not to further anger the president. But he said he disagreed with that approach. "I don’t think this lay-low-and-hope-this-blows-over approach is the right one for the moment we’re in." Miles Taylor who was also targeted by Trump said "the memos targeting him and Krebs were 'punishment for dissent' and that he too planned to fight back.... 'How we respond will set the tone inevitably for how others targeted by these EOs decide to respond.” https://www.wsj.com/politics/policy/chris-krebs-trump-cybersecurity-executive-action-31cb99cb
I wanted to let everyone know that I've updated my story about the "stand down" order a few times since I first published it yesterday. The most recent update includes a statement from a former Cyber Command general counsel who says that "Ordering Cyber Command to stop operating below the use of force is tantamount to ordering Cyber Command to stop operating." I don't always post my stories or updates to my stories here, so the best way to follow anything I publish at Zero Day is to become a subscriber there. You can subscribe for free or -- if you'd like to support my work (which is only funded by readers) -- you can become a paid subscriber.
ZERO DAY
Did Trump Admin Order U.S. Cyber Command and CISA to Stand Down on Russia? (Story updated)
Two blockbuster stories published on Friday that appear to confirm what many Americans suspected would occur under the Trump administration – tha...
Two seemingly blockbuster stories published on Friday that reported that the Trump admin had ordered US Cyber Command and CISA to "stand down" on their work to detect and counter Russian cyber threats. But new info has come out to contradict the stories or qualify them. I dug into what we know and don't know. As always, if anyone has any additional information related to these stories, please contact me on Signal at KimZ.42.
ZERO DAY
Did Trump Admin Order U.S. Cyber Command and CISA to Stand Down on Russia? (Story updated)
Two blockbuster stories published on Friday that appear to confirm what many Americans suspected would occur under the Trump administration – tha...
The National Science Foundation fired nearly 170 workers this morning in Zoom call. This included workers who had already cleared their one-year probationary period only to have it changed to two years earlier this month, putting them in line for termination. It also included at-will permanent workers -- the latter were not among those designated for firing by the Trump administration; instead NSF decided on its own to eliminate them. Here's my story:
WIRED
National Science Foundation Fires 168 Workers as Federal Purge Continues
Firings at the NSF included permanent employees who had already completed their one-year probationary period, as well as at-will workers.
DHS fired more than 400 employees today, including 130 people from CISA. If you work or worked for CISA or have information about what's going on there, you can reach me on Signal at KimZ.42
ABC News
DHS cuts at least 405 employees from workforce
The Department of Homeland Security has cut 405 employees from its workforce, a DHS official first told ABC News on Friday.
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury payment systems, including which systems he accessed, security measures Treasury IT staff took to limit his access and activity, and whether he really did have the ability to change source code on production systems as previously reported. The new documents, signed affidavits filed in court by career executives at the Treasury department not political appointees, suggest that the situation inside the Treasury department is more nuanced than previously reported. Here's my story. If you find the piece valuable, please consider becoming a paid subscriber to my Zero Day publication, which is reader supported.
ZERO DAY
Court Documents Shed New Light on DOGE Access and Activity at Treasury Department
New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury Department payment systems, including what Tr...
Have tips? Story ideas? Something you think I should know about? Reach me on Signal at KimZ.42 I cover cybersecurity and national security, writing about: nation-state hacking, espionage, cyber warfare, cybercrime, and policy. I don't write about companies - unless they've done something wrong.