Global Law Enforcement Dismantles Four Major IoT Botnets Behind Record-Breaking DDoS Attacks An international law enforcement operation has successfully dismantled the command-and-control infrastructure of four highly destructive IoT botnets Aisuru, KimWolf, JackSkid, and Mossad responsible for some of the largest Distributed Denial of Service (DDoS) attacks on record, peaking at 30 terabits per second (Tbps). By March 2026, the botnets had enslaved over three million devices worldwide, including hundreds of thousands in the U.S. The threat actors primarily targeted vulnerable IoT hardware such as digital video recorders, web cameras, and home Wi-Fi routers. Notably, KimWolf and JackSkid employed advanced techniques to compromise devices behind traditional firewalls, bypassing perimeter security. Operating under a "cybercrime-as-a-service" model, the botnet administrators leased access to their infected networks to other criminals, who then launched extortion-driven DDoS attacks. Victims included the U.S. Department of Defense Information Network (DoDIN) and private sector organizations, resulting in significant financial losses and operational disruptions. The takedown involved a coordinated effort by U.S. agencies (FBI, Defense Criminal Investigative Service), German authorities (BKA, ZAC NRW), and Canadian law enforcement (RCMP, OPP, SQ). Over a dozen private sector partners, including Cloudflare, Akamai, Amazon Web Services, and The Shadowserver Foundation, provided critical support. By seizing command-and-control servers, authorities severed the attackers’ access to millions of compromised devices, neutralizing the immediate threat.

Cybersecurity & Privacy Roundup: AI Flaws, ICE Surveillance, FBI Raids, and Military Cyber Ops This week’s cybersecurity developments highlight critical vulnerabilities, government surveillance practices, and high-stakes digital warfare with implications for privacy, national security, and AI-driven risks. ### ICE & CBP’s Controversial Face Recognition App A WIRED investigation revealed that U.S. Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) are deploying Mobile Fortify, a facial recognition app used nationwide to identify individuals. However, the app was not designed to verify identities and was approved for DHS use only after relaxing the agency’s own privacy rules. The report also exposed the militarized tactics of ICE and CBP units, including agents linked to shooting deaths of U.S. citizens in Minneapolis. Meanwhile, a Public Service Alliance report warned that data brokers are fueling threats against public servants, whose personal information remains largely unprotected under state privacy laws. ### AI-Generated Code Exposes Major Security Flaw Security firm Wiz uncovered a critical vulnerability in Moltbook, a social network for AI agents billed as a "Reddit-like" platform. The flaw, stemming from mishandled private keys in AI-generated JavaScript code, exposed thousands of user email addresses and millions of API credentials, enabling full account impersonation and access to private AI communications. Moltbook’s founder, Matt Schlicht, admitted the site was "vibe-coded" entirely by AI raising concerns about the security risks of AI-written software. While the flaw has been patched, it underscores the dangers of over-reliance on AI for critical infrastructure. ### FBI Raid Highlights iPhone Security Safeguards The FBI’s raid on *Washington Post* reporter Hannah Natanson’s home, part of an investigation into alleged leaks by a federal contractor, demonstrated how biometric authentication can be exploited to access devices. However, Apple’s Lockdown Mode designed to block spyware like NSO Group’s Pegasus prevented the FBI’s Computer Analysis Response Team (CART) from extracting data from Natanson’s iPhone. The incident, detailed in a court filing reported by *404 Media, reveals how Lockdown Mode’s peripheral-blocking feature can thwart forensic tools like Graykey and Cellebrite*. ### Starlink Disrupts Russian Military Communications In a major win for Ukraine, SpaceX’s Starlink disabled Russian military access to its satellite network, causing a communications blackout for frontline troops. The move followed a request from Ukraine’s defense minister and dealt a severe blow to Russia’s drone operations, with one Ukrainian adviser calling it a "catastrophe" for enemy forces. The development adds another layer to Starlink’s complex role in the war, which has previously seen Elon Musk’s company restrict Ukrainian drone strikes over concerns about escalation. ### U.S. Cyber Command Disables Iranian Missile Defenses A 2023 U.S. Cyber Command operation, revealed by The Record, used digital weapons to disrupt Iran’s air missile defense systems during a kinetic strike on Iran’s nuclear program. The cyberattack, leveraging NSA intelligence, exploited a vulnerability to prevent Iran from launching surface-to-air missiles at American warplanes. A Cyber Command spokesperson confirmed the operation, stating the unit is "fully equipped to execute the orders of the commander-in-chief" in any theater. From AI-generated security flaws to government surveillance overreach and cyber warfare, these incidents underscore the evolving threats in digital security and the high stakes of getting it wrong.