And when it comes to which is the very best, CNET’s pick for the best fiber internet service provider in the country is AT&T Fiber. That’s thanks to its consistency, high customer satisfaction ratings and fast symmetrical speeds. AT&T Fiber is a crowd-pleaser and consistently gets top marks in customer satisfaction surveys, likely due to its variety of plans, competitive pricing and customer-friendly service terms. There’s a lot to like — but only if you can get it at your address.
It’s important to note that fiber internet isn’t the most broadly available internet connection type. According to the latest Federal Communications Commission data, approximately 52% of the US population has access to a fiber connection. Still, CNET considers fiber the gold standard of home internet connections and a sure way to future-proof your home. Let’s take a closer look at what the top fiber ISPs in the country have to offer.
Best fiber internet providers
Speed range
300 – 5,000 Mbps
Price range
$55 – $250 per month
Advertisement
Our take – AT&T has the greatest availability of any fiber provider, extending service to more than 16 million potential customers across 22 states. Compared to other big-name providers, AT&T is among the cheapest when considering cost per Mbps and there are no hidden fees. However, if all you can get is AT&T’s fixed wireless plans, you’re better off looking into Frontier Fiber and Verizon Fios.
Or call to learn more:
(833) 579-0031
Speed range
300 – 5,000 Mbps
Advertisement
Price range
$55 – $250 per month
Speed range
500 – 5,000 Mbps
Advertisement
Price range
$50 – $155 per month
Our take – Frontier Communications recently expanded its fiber internet coverage to 19 states and then rolled out a new multi-gig service to the entire footprint simultaneously, becoming the first major ISP to do so on such a wide scale.
Or call to learn more:
(877) 870-0633
Advertisement
Speed range
500 – 5,000 Mbps
Price range
$50 – $155 per month
Advertisement
Speed range
300 – 2,000 Mbps
Price range
$50 – $120 per month
Advertisement
Our take – Verizon Fios is up there with AT&T Fiber and Frontier Fiber in terms of speed, pricing and service terms. The cheapest tier, which starts at just $50 a month, comes with download and upload speeds of up to 300Mbps. The next speed level — 500Mbps for $75 monthly — also carries decent value, but the gigabit service at $90 is priced the same or a touch higher than you’ll find with other fiber providers.
Or call to learn more:
(888) 461-3204
Speed range
300 – 2,000 Mbps
Advertisement
Price range
$50 – $120 per month
Speed range
200 – 8,000 Mbps
Advertisement
Price range
$45 – $165 per month
Our take – If you thought Verizon Fios’s price lock guarantee was great, Quantum Fiber offers a price-for-life guarantee for all plans. You can choose from two main plans: 500Mbps for $50 monthly or 940Mbps for $70 monthly. Select locations may have the choice of faster speeds, including the 3,000Mbps and 8,000Mbps tiers.
Or call to learn more:
(866) 671-3650
Advertisement
Speed range
200 – 8,000 Mbps
Price range
$45 – $165 per month
Advertisement
Speed range
1,000 – 8,000 Mbps
Price range
$70 – $150 per month
Advertisement
Our take – If you’re eyeing gig or multi-gig speeds, GFiber is the provider for you. Plans start at gig speed and only go up from there. With these starting speeds, the starting monthly rate of $70 is understandably higher than many internet providers.
Or call to learn more:
(855) 500-4211
Speed range
1,000 – 8,000 Mbps
Advertisement
Price range
$70 – $150 per month
Speed range
500 – 2,000 Mbps
Advertisement
Price range
$65 – $95 per month
Our take – T-Mobile has been dominating the 5G home internet market for the past few years. Now it’s offering fiber internet in more than 175 cities after its April 2025 acquisition of Lumos Fiber. When it comes to pricing, T-Mobile Fiber is almost in line with other fiber providers on our list: $65 a month for 500Mbps, $75 a month for 1-gig and $95 a month for the 2-gig plan.
Or call to learn more:
(877) 519-7610
Advertisement
Speed range
500 – 2,000 Mbps
Price range
$65 – $95 per month
Advertisement
Speed range
100 – 2,000 Mbps
Price range
$25 – $90 per month
Advertisement
Our take – Formely known as Windstream, Kinetic is one of our top rural internet providers, bringing high-speed connections to underserved places. Targeting North Carolina and Texas, Kinetic has announced plans to expand its fiber network from nearly 2 million homes to 3.5 million by 2029.
Or call to learn more:
(866) 671-3650
Speed range
100 – 2,000 Mbps
Advertisement
Price range
$25 – $90 per month
Speed range
100 – 50,000 Mbps
Advertisement
Price range
$20 – $900 per month
Our take – Ziply Fiber rolled out a ridiculously fast 50-gig plan across its entire Northwest footprint in Idaho, Montana, Oregon and Washington, making it the fastest internet provider nationwide.
Or call to learn more:
(866) 671-3650
Advertisement
Speed range
100 – 50,000 Mbps
Price range
$20 – $900 per month
Advertisement
Fiber internet honorable mentions
Brightspeed: A relatively new DSL and fiber internet provider, Brightspeed operates networks in many markets in the eastern half of the US that were previously owned by Lumen Technologies (CenturyLink, Quantum Fiber). Fiber service starts at just $30 per month for speeds up to 200Mbps. Your equipment is also free with the fiber plans.
Metronet: As one of the largest independently owned fiber internet companies, Metronet has a smaller footprint than other fiber providers. But it still offers fast speeds for decent prices. Based in Evansville, Indiana, Metronet is available primarily to cities in the Midwest. Service starts at $30 monthly for 100Mbps. Select areas can see speeds as fast as 2,000 or 5,000Mbps for $80 and $110 per month, respectively. Last year, T-Mobile announced plans to purchase Metronet; the FCC has yet to approve the sale.
Optimum: Optimum is primarily a cable internet provider, but it has a growing fiber network, particularly in the Greater NYC area. Approximately 2.8 million households are available for fiber service there. Optimum offers six plans for houses eligible for fiber, 300-,500-,1-gig, 2-gig, 5-gig, and 8-gig plans, which range in cost from $40 to $280 a month. It’s important to note that only select households may have access to the multi-gig plans.
What is fiber internet?
Fiber-optic internet sends data as light signals via thin glass wires either straight to the home, known as FTTH, or to an access point just outside the home, commonly referred to as fiber to the node or fiber to the curb. The technology allows for higher bandwidth and faster data transmission than any other connection type and has the unique capability of delivering symmetrical or near-symmetrical download and upload speeds.
Andrew Brookes/Getty Images
Fiber internet uses a different type of modem than DSL or the DOCSIS equipment used for cable. In fact, fiber technically doesn’t use a modem at all but an optical network terminal that performs the same function. To learn more, read our fiber internet explainer.
Advertisement
How many members of your household use the internet?
Advertisement
Why choose fiber internet?
Your internet speeds, reliability and overall experience don’t depend solely on your internet provider. The technology your ISP uses to run service to your home makes a big difference in what speeds you get. Here’s why fiber internet stands out as the leading connection type:
Speed, upload and download. Fiber internet is the fastest internet connection type with speeds up to 1,000Mbps and higher available from nearly every fiber ISP. The technology also has the added benefit of delivering symmetrical (or nearly symmetrical) upload speeds. Upload speeds are more important than you think, so fast speeds are nice to have when gaming online, uploading posts to social media, or taking a video call.
Reliability. Many fiber ISPs (AT&T Fiber, Frontier Fiber, Quantum Fiber, Verizon Fios included) claim over 99% reliability. A fiber-to-the-home connection also ensures speed consistency and reliability during peak usage times.
Value. Fiber internet providers have some of the highest-priced plans, but the slower, cheaper plans are often comparable to service from cable or 5G providers. Considering cost per Mbps and the added advantages of a fiber-optic connection, fiber plans often present the best overall value.
How you can shop for fiber internet like a pro
Fiber internet is the best type of service for most homes, but there’s more to choosing a provider and plan than the connection type. Here are some tips to keep in mind when shopping for fiber internet service.
Availability. Fiber internet is not available in nearly as many homes as cable, DSL, satellite or even 5G internet. Only around 48% of US households are wired for fiber-optic internet. In most cities, availability can vary from one neighborhood to the next and is even harder to come by in suburban and rural areas.
Speeds. Fiber internet has the fastest upload and download speed potential of any type of internet. Many of the top providers offer speed tiers up to 2,000Mbps (2Gbps), 5Gbps and higher. While the blazing-fast speeds are tempting, they’re likely to be faster than your home needs. Check out our guide to finding the right internet speed for help selecting a fiber plan that best meets your needs.
Price. If you’re looking for cheap internet, fiber may not be your best option. It’s true that fiber internet plans are often the best value, but you may find cheaper options from cable or 5G providers.
Advertisement
A few fiber providers offer plans with starting prices as low as $30 per month, but you’re more likely to pay at least $50 per month for fiber internet. Cable internet providers including Cox, Mediacom, Xfinity and others have lower-priced plans in many areas. If you are a T-Mobile Magenta Max or Verizon wireless customer, you could get 5G home internet for the discounted price of $25 to $35 per month.
Bundles.Should you bundle your internet service? Few fiber providers offer a TV service, meaning you may not be able to bundle internet and TV together with the same provider if you choose a fiber internet service. In the days of streaming and cord-cutting, that may not be a deal-breaker for you, but it’s something to keep in mind if you’re shopping for both services.
How we evaluate fiber internet providers
Testing an internet provider the same way CNET tests other products and services is, at best, impractical. Instead, we rely on extensive research of each provider to develop our reviews and recommendations.
When comparing fiber internet providers, availability, speeds and overall value are at the center of our evaluations. We also examine added fees, data caps, contract requirements, customer satisfaction reports and other factors that could affect your quality of service or customer experience.
Advertisement
We refer to the Federal Communications Commission at FCC.gov for availability data and the type of network a provider uses. We then research a provider’s speeds, pricing and service terms through various channels, such as the provider’s website and our historical data. When possible, we contact the provider directly to confirm pricing and speed details.
Finally, to develop a more well-rounded perspective of the provider, we consider customer satisfaction reports from the American Customer Satisfaction Index and J.D. Power, as well as customer reviews and complaints from sources such as the Better Business Bureau, Downdetector.com and even Reddit. (Downdetector is owned by the same parent company as CNET, Ziff Davis.)
Before writing our reviews and compiling best lists, we research anything and everything the typical shopper would want to know prior to signing up for home internet service. Read our piece on how we review internet providers to learn more about our review process.
Best fiber internet providers recap
If fiber internet service is available in your area, it’s probably worth getting, especially if any of the providers listed above is an option. AT&T is easiest to recommend thanks to its high availability, low costs and favorable service terms, but Verizon Fios is a close second with low pricing, high customer satisfaction and lots of perks for signing up. GFiber, Frontier Fiber, Kinetic, Quantum Fiber and Ziply Fiber round out the list of ideal options, while providers like Metronet, Optimum and others are worth a look, too, if available in your area.
Advertisement
Ziply Fiber has the fastest speed tier of any major fiber internet provider, with max speeds of 50,000Mbps, or 50Gbps. Many other fiber providers top out at 5Gbps, 2Gbps or 1Gbps.
Fiber internet is not cheap. The faster the speeds, the more costly your monthly bill will likely be. Starting plans with fiber internet typically range from $30 to $50 a month, with gigabit service ranging from $60 to $90 a month. While there are cheaper plans available with cable or 5G internet service in select areas, fiber service is likely to come with better speed and connection quality for the price.
Not likely. While the potential of 5G home internet is promising, it doesn’t currently offer the speed or reliability that comes with a fiber-optic connection. That said, the wireless delivery method is rapidly expanding in availability and becoming a popular option among home internet users. Cellular internet and 5G are a viable alternative in areas where fiber connections are not yet available.
Advertisement
If fiber hasn’t reached your address yet, I’m sorry to say you’ll just have to be patient, as providers are actively expanding their fiber networks across the US. You’re more likely to see fiber come to your neighborhood if you live in a city or densely populated area, but providers like Windstream and Quantum Fiber show that fiber access in suburban and rural areas is also obtainable. Check out if fiber internet is available in your area.
When it comes to internet speeds, fiber internet has every other type of connection beat. However, there is a downside to fiber connections: They pose a logistical challenge to implement. This means availability is a common issue.
Unlike fixed wireless and satellite internet connections, fiber lines run directly to your home, so they aren’t usually susceptible to adverse weather. It means you can expect your network to keep chugging along at its maximum capacity unless there’s severe damage to the network infrastructure or a power outage in your neighborhood.
Over the weekend in China, a humanoid robot shattered world half-marathon record—the human record—by seven minutes.
The star performer was a robot developed by the Chinese company Honor (the smartphone maker), which finished the 13.1-mile race in 50 minutes, 26 seconds. The human record, set by Ugandan Olympic medalist Jacob Kiplimo, is 57 minutes, 20 seconds. The result marks an impressive milestone especially considering that, just a year earlier, the fastest robot at this half-marathon event took two and a half hours to complete the same distance.
But Honor’s robot was not the only participant. The event consisted of more than 100 humanoid robots from 76 institutions across China. The robots lined up alongside 12,000 human runners in Beijing’s E-Town, albeit on separate courses to avoid accidents. The contrast in performance between humans and robots was more than evident.
Run, Robot, Run
A humanoid robot is designed to mimic the structure and movement of the human body, with legs, arms, and sensors that allow it to interact with its environment. In this case, the winning robot incorporated features inspired by elite runners: long legs (almost a meter), advanced balance systems, and a liquid cooling mechanism, similar to that of smartphones, to prevent overheating during the race.
Advertisement
In addition, many of the participating robots operated autonomously, meaning without direct human control. Thanks to artificial intelligence algorithms, they could adjust their pace, maintain balance, and adapt to the terrain in real time. Notably, the Honor robot that achieved the 50-minute mark operated autonomously. The Chinese manufacturer presented another robot, operated by remote control, that ran the same stretch in even less time: 48 minutes, 19 seconds.
As expected, there were some accidents in the race. Some robots fell down, others veered off the path, and several needed technical assistance along the way. While the physical performance of humanoid robots has advanced rapidly, their reliability is still developing. Of course, the laughter and jeers are no longer as frequent as they used to be, replaced by applause and exclamations of surprise.
The winning robot, “Blitz,” from smartphone manufacturer Honor was on display at the awards ceremony after the Beijing E-Town Robot Half Marathon.
Photograph: Lintao Zhang/Getty Images
Robot Superiority
Just like the robots that went viral for their impressive martial arts display a few weeks ago, this long-distance race is part of a broader strategy by China to show off its leadership in the development of advanced robots.
Advertisement
You don’t need to be a robotics expert to see that this achievement demonstrates that machines can outperform humans at specific physical tasks under controlled conditions. (It’s hard to imagine that the winning robot could achieve the same result, for example, if it started to rain during the race.) But humans still have a few tricks up their sleeve: Running in a straight line is very different from performing complex real-world activities, such as manipulating delicate objects or interacting socially.
However, it’s understandable that the image of a robot crossing the finish line in record time, ahead of human athletes, raises several questions. Is this the beginning of a new era in which machines redefine physical limits?
One could argue that a car is a machine, and those have always been faster than humans. But a humanoid robot is designed to mimic humans. It’s more alarming to see one beat humanity at its own game—even if so many of them are still tripping over themselves.
This story originally appeared in WIRED en Español and has been translated from Spanish.
Amazon and Anthropic are strengthening their ties once again, with steep financial commitments made on both sides. Today, Amazon announced that it will invest $5 billion in the AI company, along with as much as $20 billion in additional payments if certain milestones are met. This news follows the initial $4 billion investment Amazon made in Anthropic in 2023 and a second $4 billion round from 2024.
On Anthropic’s side, it has committed to continued use of Amazon’s custom Trainium silicon for its AI models. The latest agreement will see Anthropic promising to spend more than $100 billion on AWS technologies over the coming decade. It will secure up to 5 gigawatts of current and future chip capacity for training and powering its models. Their partnership is also bringing Anthropic’s Claude platform to Amazon Web Services customers within the AWS portal, removing the need for additional credentials.
After nearly 15 years as Apple CEO, Tim Cook is stepping down. He will continue to operate in the role until Sept. 1, when he will be replaced by John Ternus, the company’s senior vice president of hardware engineering.
Cook won’t disappear from Apple. He will transition to Apple’s board of directors as executive chairman, the company announced Monday. But the shift represents the end of an era for the company.
Cook became CEO on Aug. 24, 2011, taking over from Apple co-founder and face of the company Steve Jobs, who passed away two months later. Known for improving the company’s supply chain, Cook oversaw a period of record growth. During his 15-year tenure, it refined its smartphone line from the iPhone 5 onward, debuted new products like the Apple Watch and HomePod, and launched services such as Apple Music, Apple TV Plus and Apple Fitness Plus.
“I love Apple with all of my being, and I am so grateful to have had the opportunity to work with a team of such ingenious, innovative, creative, and deeply caring people who have been unwavering in their dedication to enriching the lives of our customers and creating the best products and services in the world,” Cook said.
Ternus, who will replace Cook in September, has spent almost his entire career at Apple. An engineer by trade, he joined the company in 2001, becoming vice president of hardware engineering in 2013 and SVP in 2021. He was “instrumental in the introduction” of the iPad and AirPods, according to Apple’s post, and oversaw the company’s product lines all the way up to the recent MacBook Neo.
This is a developing story. Check back on CNET for more updates.
Apple’s upcoming iPhone 18 Pro lineup may introduce a refreshed set of color options, according to recent leaks, offering a mix of familiar finishes and a new standout shade. While the company has yet to officially confirm details, multiple reports suggest that four colors are currently being tested for the 2026 flagship.
The rumored lineup includes Light Blue, Dark Gray, Silver, and a new Dark Cherry finish, which is expected to serve as the signature color for the iPhone 18 Pro series.
A New Signature Color Takes Center Stage
Among the rumored options, Dark Cherry is drawing the most attention. Leaks indicate that Apple is moving toward a deeper, more refined red tone, replacing brighter shades like Cosmic Orange from the previous generation.
Apple Insider
This follows Apple’s typical strategy of introducing one standout color each year to differentiate its latest Pro models. The Dark Cherry finish is expected to be more subtle and premium, aligning with the company’s current design language.
The remaining colors – Light Blue, Dark Gray, and Silver – appear to be more restrained. Light Blue could resemble earlier “Mist Blue” tones, while Dark Gray and Silver continue Apple’s preference for neutral, understated finishes in its Pro lineup.
Advertisement
Why These Changes Matter
Color may seem like a minor detail, but for Apple, it plays a key role in product identity. New finishes help distinguish each generation visually, making it easier for users to recognise the latest models.
The shift toward darker and more muted tones suggests Apple is refining its premium aesthetic rather than experimenting with bold or unconventional colors. Reports also indicate that Apple may once again skip a traditional black variant, continuing a recent trend in its Pro lineup.
These choices also point towards a broader design approach where subtle changes signal upgrades, especially in a market where hardware differences are becoming less visible year over year.
What It Means For Buyers
For users, the rumored color options offer a mix of safe and slightly expressive choices. Those who prefer classic finishes will likely gravitate toward Silver or Dark Gray, while the new Dark Cherry option could appeal to buyers looking for something distinctive without being overly flashy.
Advertisement
iPhone 18 ProIce Universe/Weibo
Since color is often a key factor in purchase decisions, especially for premium devices, the introduction of a new signature shade may influence early adopters and upgrades.
What Comes Next
As with all early leaks, these details remain subject to change. Apple typically finalises design elements closer to production, meaning one or more of these colors could still be altered or dropped. The iPhone 18 Pro series is expected to launch in September 2026, alongside other hardware updates such as potential display changes and camera improvements.
Until then, more leaks and renders are likely to emerge, offering a clearer picture of what Apple has planned for its next flagship.
If you downloaded any games off Steam between May 2024 and January 2026, the FBI needs you to come forward. (No, you’re not in trouble.) The agency is looking into a series of malware-infected titles that were available to download from the online store over the course of those months.
The investigation is focused on seven titles: “BlockBlasters,” “Chemia,” “Dashverse” or “DashFPS,” “Lampy,” “Lunara,” “PirateFi.” and “Tokenova.” The FBI has reason to believe all came embedded with malicious software. According to the Bureau’s Seattle Division, there’s an urgent need to find anyone and everyone who could have unknowingly installed one of these compromised games.
If you downloaded any of these titles, the Bureau wants details about how you first encountered the game, who recommended it, and whether any of the money you’ve spent on Steam went to any of the games. Depending on how the case goes, it could open the door to restitution and other protections for you.
Advertisement
Why Steam is especially vulnerable
Julia Perova/Shutterstock
This all comes as part of multiple ongoing cybersecurity issues throughout Steam’s massive growth. Since launching in 2004, it has grown and evolved into one of the largest PC gaming marketplaces in the world. Today, it holds more than 100,000 titles and counting across major studio releases and indie projects alike.
Given its size, it’s not a shock to hear Steam has a number of past incidents involving fraudulent listings and malicious mods being distributed through third-party channels. It’s a huge undertaking to police such a vast online ecosystem, and sometimes, bad actors are bound to slip through the cracks. In fact, we last saw something like this back in 2014.
Advertisement
If you downloaded any of the seven games (or, worse, lost money to one of them), you can report your experience through an official FBI channel or by contacting Steam_Malware@fbi.gov. Going forward, keep in mind the best practices to keep yourself safe from ransomware.
Today’s crop of luxury cars represents some of the most modern and technologically advanced vehicles on the road. That includes some of the most powerful luxury cars coming in 2026, and beyond. But as these vehicles deliver comfort, performance, and style in one package, many of them are doing so with an analog clock in the dash. While it may seem like a weird feature that car designers simply missed, the fact is that these clocks are there on purpose.
Some manufacturers leave the analog clocks in place because they’re meant to be the centerpiece of the vehicle. This is especially true at night with a clock that is dead center of the dashboard, as it stands out amongst the array of digital lights below it. Some car manufacturers, like Mercedes-Benz and Bentley, use elite timekeeping brands Breitling and Jaeger-LeCoultre, to develop timepieces that resemble actual wristwatches.
Then there’s the idea that major luxury car brands, by virtue of their design and often their history, represent a connection to craftsmanship. So, no matter how many times vehicles upgrade to suit the current aesthetic, analog timepieces help luxury cars become something of a time capsule. You might be riding in a modern vehicle with the best technology under the hood and behind the dash. But that analog clock is a constant reminder of tradition, making luxury cars stand out even more than they already do.
Advertisement
The evolution of timekeeping in cars
Martin Bergsma/Shutterstock
Long before luxury cars, or cars altogether for that matter, clocks were used while on the road. But it was limited to horse-drawn carriages carrying the wealthy, who wanted a portable timepiece on board while traveling. As the automobile was first developed and widely used in the 1900s, clocks were gradually included in one model after another. Some of the earliest versions of these clocks were mechanical and essentially adapted pocket watches. These clocks, like the watches used at the time, had to be wound by hand in order to work.
As time went on, mechanical clocks were eventually replaced by electric clocks, which became the norm in the 1950s and 1960s. But as timekeeping technology evolved and automobile design became more modern, clocks powered by quartz systems were introduced. By the 1970s, the driving experience was changing, and with the advent of digital displays, timekeeping had reached a whole new level of innovation. Meanwhile, analog clocks remained in luxury cars, like in certain models of the Lexus.
Advertisement
Some luxury car manufacturers have begun moving away from analog technology over the past several years. BMW switched over to a fully digital cockpit, complete with screen-based systems, back in 2018. The move was marketed by the German manufacturer as being beneficial for the driver, as it gave them a new operating system in which they would have more control.
Accenture’s Sophie Rowe discusses her work in the consulting space and how she stays motivated.
During her master’s degree at University College Dublin, Sophie Rowe, a customer strategy manager at Accenture Song, came to the realisation that she didn’t yet have a clear idea of what she wanted her career to look like.
She told SiliconRepublic.com, “When I discovered consulting, it was the variety that immediately appealed to me. The opportunity to work across different industries, roles and projects, and to have a day-to-day that isn’t fixed in the long term, really stood out. I liked the idea of continuously learning and evolving rather than following a single, predefined path.”
What educational and work experiences led you to the role you now have?
I completed a BSc in neuroscience followed by a master’s in business and biotechnology. I knew I wanted to move towards the commercial side of science, and the master’s provided a strong bridge between those two worlds. During that time, I applied to the Accenture graduate programme, which marked the start of my consulting career. Those decisions are what have led me to my current role as a customer strategy manager, working with life sciences clients in Accenture Song.
Advertisement
What were the biggest surprises or challenges you encountered along the way?
When I first started my career, fresh out of college, I found it challenging to back myself and my work, especially when dealing with senior or difficult stakeholders. Not everyone will agree with you and there isn’t always a clear right answer.
Early on, I learned the importance of doing your research, forming a clear point of view and backing it up with evidence. Whether you’re proposing a new strategy, changing a process or introducing a new tool, you need to explain the rationale behind your thinking clearly and confidently. That confidence comes from strong preparation, using data and proof points to support your ideas so you can challenge constructively and stand by your recommendations.
Learning to replace that uncertainty with evidence-backed confidence was a key turning point in my career.
Was there anyone particularly influential in your career development?
I was fortunate to have some incredible female managers early in my career at Accenture, who had a significant influence on how I developed professionally. They taught me not only how to deliver high-quality work and navigate the consulting environment, but also how to lead with empathy and advocate for myself. They helped me recognise the importance of clearly articulating my achievements and contributions, something that doesn’t always come naturally, particularly for women. That lesson was pivotal to my progression.
Advertisement
What do you enjoy most about your job?
The variety that initially drew me to consulting is still one of the things I enjoy most. I love tackling different types of client problems, especially now in the context of rapid AI and technology advancements. Over my career, I’ve worked on everything from retail customer strategy transformations to nationwide marketing campaigns designed to shift customer behaviour. Then there are also the people. I’m very much a people person and working alongside such talented, supportive teams makes all the difference, especially during the high-pressure periods.
What aspects of your personality make you well suited to this role?
My communication and storytelling skills are ones that I use every day in my role. In an environment increasingly shaped by AI, the ability to tell a clear, compelling story is more important than ever, whether that’s to engage challenging stakeholders, align cross-functional teams or to help bring strategy to life.
How has Accenture supported your career growth?
Accenture has provided a huge amount of opportunity to grow and stretch myself. There’s a strong culture of raising your hand, whether that’s contributing to thought leadership, running client or community events, or taking on additional project responsibility. That encouragement to step up has been key to my progression.
I’ve also been supported in external learning, such as completing a ‘mini MBA’ in marketing, which has been brilliant in ensuring I keep learning.
Advertisement
What advice would you give to someone just starting out?
Absorb as much as you can – not just the work itself, but how senior leaders operate, collaborate and approach problem-solving. There’s so much to learn from the people around you, especially early in your career. Be curious, ask questions and don’t be afraid to seek advice. Taking that time to observe and learn will be hugely beneficial for your career.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
The National Guard soldiers in desert camo piled out of unmarked vans in East Los Angeles last June, cordoning off East Sixth Street, a residential street lined with single family houses, and blocking a nearby road leading to an elementary school.
A squad of federal agents moved in flinging flash-bang grenades — explosives designed to disorient — into a small home before storming inside. They’d come for Alejandro Orellana, a Marine Corps veteran and UPS employee accused of being a central figure in a secret confederacy of insurrectionists. A news video had shown the 30-year-old distributing water, food and face shields to people protesting the Trump administration’s immigration roundups in Los Angeles.
Advertisement
Bill Essayli, a former state legislator who leads the federal prosecutor’s office in Los Angeles, joined the raid along with a Fox News crew.
With cameras rolling, Orellana, his parents and brothers were led out in handcuffs as agents searched their home.
On Fox News, Essayli, sporting a blue FBI windbreaker, hyped the arrest of Orellana, a quiet, wiry man with a long mane of coal-black hair. “It appears they’re well-orchestrated and coordinated, and well-funded,” he said. “And today was one of the first arrests — first key arrests — that we did.”
Essayli would charge Orellana with conspiracy — under a federal statute typically used to build cases against drug traffickers and organized crime — and with aiding and abetting civil disorder.
Advertisement
Within weeks, the prosecutor’s marquee case would quietly fall apart. Agents who searched Orellana’s house found little that could be considered incriminating, and prosecutors never charged anyone else as part of the supposed conspiracy. By late July, they moved to have the charges dismissed.
It wouldn’t be the only such case.
Over the past 10 months, President Donald Trump’s administration has made much of its success in sweeping through U.S. cities, capturing unauthorized immigrants and arresting people who publicly oppose the operations, routinely accusing dissenters of being domestic terrorists or extremists. Federal agents have arrested hundreds of U.S. citizens like Orellana — including protesters, activists observing the immigration enforcement operations, bystanders and, in some cases, the family members of people targeted for deportation.
Less clear to the public is what has happened to those charged.
Advertisement
To find out, ProPublica and FRONTLINE combed through social media, court records and news stories. Reporters identified more than 300 protesters and bystanders who were arrested by federal agents during immigration sweeps and were accused of crimes such as assaulting or interfering with law enforcement.
But over and over those accusations fell apart under scrutiny. Our reviews of court files found that statements made by the arresting officers were repeatedly debunked by video footage. In more than a third of the cases, prosecutors quickly dismissed charges that couldn’t be substantiated, refused to file charges at all, or lost at trial. The tally of cases that end this way will likely climb as many of the arrests remain unresolved.
“What’s happening now is not comparable to anything that’s happened in the past,” said
Cuauhtémoc Ortega, the chief federal defender for the Central District of California, who personally represented Orellana and other protesters. “We’ve never had a situation where it seems like you arrest first and then try to justify the reasons for the arrests later.”
Advertisement
The Department of Homeland Security, which includes Border Patrol and Immigration and Customs Enforcement, did not respond to repeated requests for comment on the arrests and declined to answer detailed questions from ProPublica and FRONTLINE.
But in a statement in response to an earlier story, DHS said, “The First Amendment protects speech and peaceful assembly — not rioting. DHS is taking reasonable and constitutional measures to uphold the rule of law and protect our officers.”
Watch FRONTLINE and ProPublica’s Documentary: “Caught in the Crackdown”
Advertisement
Given the unprecedented nature of the urban sweeps, it is difficult to compare the rate of failed cases to another time period or context. But current and former federal prosecutors and other legal experts said having that number of arrests come to nothing is particularly striking in the federal system, where U.S. attorneys usually secure convictions or guilty pleas in more than 90% of the cases they bring; only 8.2% of federal criminal cases were dismissed in 2022, according to data compiled by that court system.
The failures highlight the challenges of sending large numbers of federal agents into major cities to conduct roving immigration sweeps: They aren’t accustomed to dealing with crowds of angry protesters
Border Patrol agents are typically stationed at the border where their day-to-day work entails scooping up people who have crossed illegally. ICE agents, who often work in urban settings, had little prior experience handling hostile crowds. And FBI agents, who have aided in the immigration sweeps, would normally spend months or years painstakingly amassing evidence before making arrests.
That lack of experience in street policing and crowd control, coupled with the Trump administration’s demand for huge numbers of deportations, led agents to make a wave of unjustified arrests, legal experts say.
Advertisement
To be sure, protesters have often engaged in hostile behavior, hurling expletives, getting in agents’ faces and occasionally becoming violent. A woman in Minnesota is accused of biting off part of an agent’s finger during a scuffle after the killing of Alex Pretti in late January; in Los Angeles, an officer outside an immigration detention facility suffered a dislocated finger after a protester allegedly grabbed his bulletproof vest and shook him.
“The agents, they don’t know how to operate in these situations,” said Christy Lopez, a former Justice Department attorney who spent years investigating misconduct by law enforcement. Their behavior, she said, “is on par with the worst protest policing and just law enforcement that I’ve seen from any department, even in their worst days.
In its earlier statement, DHS said that “rioters and terrorists” have repeatedly attacked immigration agents, but ICE and Customs and Border Protection personnel “are trained to use the minimum amount of force necessary to resolve dangerous situations to prioritize the safety of the public and themselves.”
Advertisement
The arrests are not without consequence. Even unsuccessful prosecutions can be costly and emotionally taxing for defendants, said Jared Fishman, a former career prosecutor in the Department of Justice’s Civil Rights Division. The aggressive tactics of the agents and the gleeful social media posts by DHS accusing protesters of serious crimes, Fishman said, affect people’s willingness to publicly challenge the mass deportation policies.
“If the goal of the Trump administration is to keep people out of the streets, then it doesn’t matter if the people are getting convicted,” said Fishman, now the executive director of the Justice Innovation Lab, a nonprofit focused on creating a more equitable and effective justice system. “I’m sure it’s having a chilling effect.”
After reviewing data and some court records for ProPublica and FRONTLINE, Fishman said, “The numbers seem to indicate a pattern and practice of illegal arrests.”
“We Must Identify Him”
The crackdown on protesters began in June of 2025, when the Department of Homeland Security launched its wave of major immigration sweeps in Southern California. The campaign was led by Gregory Bovino, a veteran Border Patrol chief who normally presided over a remote stretch of sand and scrub deep in the state’s Imperial Valley.
Advertisement
Bovino from the start encouraged his agents to shut down or arrest protesters.
“Arrest as many people that touch you as you want to. Those are the general orders, all the way to the top,” Bovino told his officers, footage from an agent’s body-worn camera shows. “Everybody fucking gets it if they touch you.”
He went on to remind them that their actions should be “legal, ethical, moral” while encouraging them to use so-called less lethal weapons on protesters.
“We’re gonna look at shipping tractor trailers full of that shit in here,” he said.
Bovino’s aggressive tactics sparked intense opposition from Angelenos, including those gathered in the streets in front of the sprawling federal office complex in downtown Los Angeles on June 9.
That day Orellana drove his Ford F-150 pickup truck loaded with bottled water, snacks and cardboard boxes containing Uvex brand face shields — clear plastic masks designed to protect industrial workers from flying debris and chemical splashes — to the protest.
When he arrived in front of the federal building, another person hopped into the bed and began handing out the supplies to protesters gathered outside the entrance.
Advertisement
Orellana told FRONTLINE and ProPublica that he decided to help distribute the supplies after watching federal agents fire tear gas and rubber bullets into crowds at an earlier demonstration.
“A bunch of us took it upon ourselves to, you know, go downtown and give out these resources — the food, water and of course the PPE,” he said, referring to personal protective equipment.
Video and photos quickly made their way onto social media. An X user with more than 30,000 followers posted a photo of Orellana. “A photograph of the man delivering boxes of gas masks to the rioters has emerged,” wrote the poster. “We must identify him, so we can track down who is funding this coordinated attack.”
From there the thread was picked up by the conspiracy theorist Alex Jones, who has a vast audience on the platform. Jones, who repeatedly claimed that financier and philanthropist George Soros was funding the protests, eventually named Orellana as the driver of the pickup. More than two million people saw the post.
Advertisement
Within 48 hours, the soldiers and federal agents arrived to arrest Orellana.
Over the next five months, they arrested more than one hundred U.S. citizens in Los Angeles and other cities in Southern California — most of them demonstrators — charging them with assaulting federal law enforcement personnel or interfering with agents’ activities. Others were accused of damaging government property. At least 16, like Orellana, were charged with conspiracy, which can carry a sentence of up to six years in prison.
ProPublica and FRONTLINE found that more than a third of those cases crumbled. In eight instances, juries acquitted defendants at trial. But more frequently, prosecutors dropped charges when the claims made by immigration officers and agents didn’t match video evidence or other inconsistencies emerged. In several cases, prosecutors declined to file charges at all.
There have been some successful prosecutions: 32 of the 116 people whose arrests in California we reviewed have been convicted, many pleading guilty to misdemeanor charges. And in late February, jurors convicted two activists on stalking charges after they livestreamed themselves following an immigration agent to his home; the pair were acquitted of conspiracy.
Advertisement
Today 38 cases are still pending.
Essayli has stated on social media that his office brought more than 100 cases and secured convictions in more than half of them. When asked about the discrepancy between his claims and the data compiled by ProPublica and FRONTLINE, he declined to comment.
“The U.S. attorney’s office does not lose cases because they’re bad lawyers,” said Carley Palmer, who spent eight years as a federal prosecutor in the office Essayli now runs. “They are excellent trial attorneys. So if they’re losing a case, it may mean that the evidence isn’t there, or it may mean that the community doesn’t believe it should be a federal crime.”
Palmer, who is now in private practice, said the glut of protest and low-level criminal immigration cases have shifted resources away from the complex prosecutions the DOJ is uniquely equipped to handle: environmental crimes, public corruption, financial fraud, cyberscams, civil rights violations.
Advertisement
Essayli declined to be interviewed for this story or an accompanying FRONTLINE documentary set to air Tuesday. He was appointed by the Trump administration in early 2025, but he has never been confirmed by the Senate, raising ongoing questions about the legality of his role as top prosecutor for the region. His office did not respond to detailed questions sent by email.
Like Orellana, Julian Pecora Cardenas, 31, was charged with conspiracy last summer after following a convoy of federal agents in his car.
On the morning of July 5, Pecora Cardenas followed vans full of Border Patrol agents after they left a Coast Guard station in San Pedro, south of Los Angeles, livestreaming their movements on Instagram. “It’s every citizen’s duty to conduct oversight of their government,” he said. “I was within my First Amendment rights.”
After roughly 30 minutes, the agents stopped, pulled Pecora Cardenas from his Hyundai and slammed him to the pavement. “I honestly thought it was going to be like a George Floyd moment,” Pecora Cardenas recalled in an interview, alleging that multiple agents pinned him to the asphalt with their knees. He suffered a concussion, needed stitches over his left eye and wore an orthopedic collar to stabilize his injured neck.
Advertisement
Federal prosecutors charged Pecora Cardenas and another activist with conspiracy to impede the federal agents, saying that they “were illegally maneuvering their vehicles through traffic, stop lights, and stop signs to stay behind the agent’s vehicles,” that they tried to block the Border Patrol vehicles, and that they created “hazardous conditions on the road.”
Pecora Cardenas’ own video of the day’s events told a different story. The footage, which ProPublica and FRONTLINE have reviewed, contradicts the claims that the men had interfered with the agents. Within days of seeing the images, Essayli’s office jettisoned the charges “in the interest of justice.”
Pecora Cardenas hasn’t tried to observe federal agents or participate in a protest since his arrest. “I don’t want to be assaulted again. I don’t want to wind up back in federal prison for something that I didn’t do.”
“They Were Just Randomly Grabbing People”
When Bovino, the Border Patrol chief, left California and took his forces to Illinois last fall, their focus on protesters intensified.
Advertisement
In roughly one month, federal agents arrested more than a hundred American citizens, many of them activists participating in demonstrations or documenting the movements of immigration agents as their convoys of rented SUVs rolled through the streets of Chicago and surrounding communities.
On the morning of Oct. 3, 2025, about two hundred demonstrators gathered near the ICE facility in Broadview, a small town in the western suburbs of Chicago. Tucked away in a quiet industrial park, the nondescript building had become the locus of ongoing protests since Bovino and his forces had arrived in Illinois.
Then-Homeland Security Secretary Kristi Noem, accompanied by a DHS video team, was on site that day wearing a baseball cap and a black ballistic vest.
Advertisement
Also present was Benny Johnson, a prominent podcaster and online influencer who is close to the Trump administration. Johnson, who had brought his own camera crew to shoot video for his YouTube channel and other social media accounts, was effectively embedded with Noem, Bovino and the immigration agents.
At about 9 a.m., Bovino and a phalanx of heavily armed agents in combat gear began striding down Harvard Street toward the protesters. “Walk slowly,” Bovino told his men.
Without a bullhorn or any sort of amplification, Bovino informed the crowd that they were being dispersed. Then he and his colleagues began shoving people to the ground and arresting them.
In a matter of minutes, a dozen protesters had been handcuffed. Three arrestees interviewed by ProPublica and FRONTLINE told us they were confused because they’d been standing in a “free speech zone” set up by state officials.
Advertisement
“I felt somebody grab my shoulder and pull me to the ground,” said Juan Muñoz, a business owner and elected leader in nearby Oak Park Township. “And once I fell onto my back, that’s when I saw it was Greg Bovino.”
Kyle Frankovich, a Harvard data scientist and Chicago resident, was also arrested. “They were just randomly grabbing people,” he recalled. “There was nowhere to go, people were falling all over the place, and several of the people they arrested simply had the misfortune of tripping over all of the other protesters” as federal agents surged into the crowd.
Frankovich said FBI agents who questioned him asked who had paid for him to participate in the demonstration and who “covered the transportation cost for you to be here today.”
Johnson’s video team and a DHS camera crew filmed the arrested protesters as they were lined up outside the ICE building, while Noem looked on. DHS posted photos of Frankovich in handcuffs on X and Facebook with the message, “We will NOT allow violent activist to lay hands on our law enforcement.”
Advertisement
Johnson, who has more than more than 4 million followers on X and more than 6 million subscribers on YouTube, posted a video on X panning across the arrested protesters and wrote: “I saw dozens of Democrat domestic terrorists arrested today for VIOLENT ASSAULT on federal law enforcement. Every activist here attacked ICE agents in broad daylight just for enforcing American law.” He made the same claim in a nearly 13-minute-long YouTube video.
Such social media content had become a central feature of the Trump administration’s deportation campaign. DHS, Border Patrol and a raft of allied social media influencers regularly produced slick videos showing agents in action: riding in helicopters, striding through city streets clutching rifles, breaking down doors, and apprehending immigrants and activists.
But on that day in Chicago, DHS had strayed far from the facts. And so had Johnson, a 38-year-old former journalist who turned to social media after being embroiled in plagiarism scandals at BuzzFeed and the Independent Journal Review.
After about eight hours in custody, Frankovich, Muñoz and nearly all the others were released without charges. In the end, only one person would be prosecuted.
Advertisement
Neither DHS nor Johnson have taken the posts down. Johnson did not respond to emailed requests for comment.
The lone person charged with a crime that day was Cole Sheridan, who was accused of attacking Bovino and sending him to the hospital with an injured groin muscle.
Sheridan spent three and a half days in jail — “probably the most unpleasant thing I’ve ever had to experience,” he said in an interview with FRONTLINE and ProPublica — before being released.
In court, a prosecutor said that Sheridan had thrown a punch at Bovino and pushed him, transcripts show.
Advertisement
The evidence presented by the Justice Department, though, was slim. Bovino didn’t wear a body camera, so prosecutors relied on video from the body camera of Border Patrol agent Jason Epperson. But it didn’t show Sheridan assaulting anyone — though he did call Bovino “a fucking idiot.” In statements to investigators, Bovino and Epperson had offered conflicting accounts of the encounter.
About a month after Sheridan was arrested, prosecutors moved to dismiss the case after a bystander video surfaced showing clearly that Sheridan hadn’t assaulted Bovino.
“I don’t know if I’ve ever experienced something truly that bizarre and absurd as, like, seeing a law enforcement agent concoct a narrative to arrest me, to press charges against me,” said Sheridan, who describes himself as intensely private and was initially reluctant to talk publicly about his arrest. “That was extremely unnerving.”
He remains worried that he’ll be harassed or even physically attacked because of the inflammatory social media posts about him. “What a farce. Every element of it felt staged,” he said.
Advertisement
In a statement to ProPublica and FRONTLINE, Chicago U.S. Attorney Andrew Boutros said, “Our willingness to be open-minded and dismiss cases — or not file charges in the first place — reflects our commitment to do the right thing even in those cases where a crime was committed and the conduct in question clearly falls outside any protected First Amendment activity.” He declined to comment directly on Sheridan’s case.
FRONTLINE and ProPublica showed video of Sheridan’s arrest to Lopez, the former Justice Department attorney. “It’s just a gross abuse of power,” she said. “And we’ve almost normalized that this is how federal law enforcement behaves now. They just arrest people.”
Of the 109 arrests that ProPublica and FRONTLINE documented in the Chicago area, federal prosecutors dropped charges in at least 75 cases.
Felony Charges Downgraded
When Bovino and his forces arrived in North Carolina last November, they were greeted by protesters opposed to the deportation sweeps, as they had been in previous cities.
Advertisement
Heather Morrow was one of them. She had joined a small group of demonstrators, chanting and banging on metal dishes outside an immigration facility in Charlotte when ICE officers confronted the group.
They handcuffed Morrow, 45, and another activist, stuffed them in the back of a federal vehicle and, according to Morrow, kept them there for hours before finally taking her to jail.
“I was so traumatized,” Morrow, a school bus driver and dog boarder, said in an interview. “I didn’t expect them to be so overly aggressive. I really showed up there expecting conversation, making them come to their senses.”
After a full day and night in custody, she was released to face federal felony assault charges. A Department of Justice press release accused her of attacking an ICE officer just as he showed up for his work shift, grabbing his shoulders and trying to jump on his back.
Advertisement
But a shaky phone video circulating on social media showed what appeared to be a very different scene. In it, an officer comes from behind and abruptly tackles Morrow to the pavement. The video doesn’t show her assaulting anyone.
When prosecutors saw the video, they dumped the felony charges. But they promptly filed a new misdemeanor case against Morrow and the other activist, alleging the pair impeded ICE officers and failed to follow their orders. It took a month for Morrow to get her phone back from federal custody, while her other confiscated possessions, including her keys, have been lost, Morrow’s attorney said. Because she’s on pretrial probation, the federal government has seized her passport. Morrow has pleaded not guilty, and her case is ongoing.
In Handcuffs and Intimidated
In early January, Bovino arrived in Minneapolis with his social media team. Within weeks, two activists — Renee Good and Alex Pretti — were shot and killed by immigration agents. The Trump administration immediately portrayed Good as an extremist; Bovino claimed that Pretti was planning to kill federal personnel when he was shot to death.
The killings, which sparked national outcry, would prompt the administration to recalibrate. By Jan. 26, Bovino had been demoted and sent back to his home station in the California desert.
Advertisement
But immigration agents continued to roam the Twin Cities, and activists continued to get arrested.
Civil rights attorneys from around the country gathered in a Minneapolis conference room on Jan. 30 to discuss those arrests.
During a break for lunch, Jon Feinberg, president of the National Police Accountability Project, stepped out of the room and spoke to reporters. “To be charged with a federal crime is something that is life-altering,” said Feinberg, who is based in Philadelphia. “The consequences of being accused and possibly convicted of a federal offense are devastating, especially when people have not engaged in criminal conduct from any reasonable person’s perspective.”
ProPublica and FRONTLINE have identified nearly 80 arrests stemming from the Minnesota immigration sweeps. Most of the cases are still ongoing, though a handful have been dismissed.
Advertisement
Daniel Rosen, the U.S. attorney for Minnesota, did not respond to requests for comment.
One of those arrested was Rebecca Ringstrom, who lives in Blaine, a quiet suburb north of Minneapolis.
Ringstrom, 42, is a member of an activist group that tracks immigration agents as they move around Blaine. “There was a vehicle with four agents inside that I could see. All four were in tactical gear,” she said in an interview with ProPublica and FRONTLINE. “I was able to look at the plate and see that it was a confirmed ICE vehicle.”
Behind the wheel of her Kia, she began following them; Ringstrom insists her driving was safe and lawful. But in a matter of minutes, she’d been arrested and accused of interfering with federal law enforcement.
Advertisement
Ringstrom said an agent at the Bishop Henry Whipple Federal Building, where she was briefly held after her arrest, said he wished he’d arrested her — because he would’ve made the experience more unpleasant and violent. “There was no reason to say that. I’m already here. I’m in handcuffs. It’s just a way to intimidate,” she recalled.
She was charged with interfering with a federal agent and issued a notice of violation — essentially a ticket — for the misdemeanor offense. Since then, Ringstrom has lined up a pro bono lawyer, but she has also lost her job, “likely due to the ongoing coverage” of her arrest.
She is scheduled to make her first court appearance later this month.
Amazon officially announced Fastnet last November, though reports had surfaced earlier that year.
Amazon has received the go-ahead from Cork County Council to build a cable landing station for its transatlantic fibre optic cable system called Fastnet. The system is expected to be operational from 2028.
The landing station will be built at Tullyneasky West, around 6km from Owenahincha, which will be the connecting point between Ireland and Maryland, US.
Two existing buildings on the site will be demolished for this project, which is estimated to take around a year. Work is expected to begin later this year.
Advertisement
Amazon officially announced Fastnet last November, though reports of the project had surfaced earlier in that year. The company said it chose Cork to provide for an alternative pathway for critical internet traffic in case of outages or other issues.
According to the company, Fastnet’s design capacity exceeds 320 terabits per second to provide Amazon Web Services users with scalable capacity for use in AI, cloud, research and business.
The company requested a three-year licence starting in 2025 to conduct geophysical survey and site investigations in an area spanning nearly 17,000 sq ft.
It also announced plans for a ‘community benefits fund’ for Cork and Maryland, with plans to support local initiatives such as sustainability and environmental programmes, health and wellbeing services, and educational and workforce development programmes.
Advertisement
Planning approval for the cable station is subject to environmental conditions set by the council. The Irish Independent reported that the community fund will cost the $2.6trn company around €150,000.
Speaking to the publication, West Cork Councillor Deirdre Kelly said that the development would bring “improved digital infrastructure, increased connectivity and potential economic benefits, including local employment during construction and maintenance phases”.
Taoiseach Micheál Martin, TD praised the project last year, calling it a “vote of confidence in Ireland’s digital future, helping to enable the next wave of innovation in cloud computing and artificial intelligence”.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
Hidden virtual machines allow attackers to bypass endpoint security and remain undetected
Attackers used trusted virtualization tools and built-in software to disguise malicious activity
Sophos links campaigns using QEMU to ransomware deployment and long-term network access
Attackers are increasingly hiding malicious tools inside virtual machines to slip past security controls.
Sophos analysts say the approach relies on virtualization software that security systems often treat as legitimate activity.
In recent incidents, attackers used QEMU, an open-source machine emulator and virtualizer, to run hidden environments where malicious activity remained largely invisible to endpoint defenses and left minimal evidence on the host system.
Article continues below
Advertisement
A growing evasion trend
Sophos notes that while the method is not new, it has gained traction again, with two active campaigns, tracked as STAC4713 and STAC3725, identified since the end of last year.
In the STAC4713 campaign, attackers created a scheduled task named TPMProfiler to launch a hidden QEMU virtual machine under system-level privileges.
Advertisement
The virtual machine used disguised disk images, first appearing as database files and later masquerading as dynamic link libraries.
Once launched, the virtual machine established reverse SSH tunnels that created covert remote access channels, allowingattackers to run tools and collect domain credentials without exposing activity to traditional security tools.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sophos investigators also observed attackers using built-in Windows utilities such as Microsoft Paint, Notepad, and Edge for file access and network discovery. This relied heavily on trusted software to blend malicious actions into routine system behavior.
Advertisement
Older intrusions tied to the campaign used exposed VPN systems without multi-factor authentication, while later incidents exploited a SolarWinds Web Help Desk vulnerability tracked as CVE-2025-26399. These varied entry points show attackers adjusting their tactics depending on available weaknesses.
Sophos links the STAC4713 campaign to PayoutsKing ransomware, which focuses on encrypting virtualized environments.
The group behind the ransomware appears to target hypervisors and deploy tools that can operate across VMware and ESXi systems.
Advertisement
The second campaign, STAC3725, relied on exploiting the CitrixBleed2 vulnerability to gain initial access before installing remote access software.
Attackers then launched a QEMU virtual machine to manually assemble attack tools for credential theft and network reconnaissance.
Rather than delivering ready-made payloads, attackers compiled their toolsets inside the virtual machine after gaining access. That approach allowed them to customize attacks and reduce the chance of detection by signature-based defenses.
Sophos warns that hiding activity inside virtual machines represents a growing evasion trend. Strong endpoint protection, network monitoring, and timely patching of exposed systems critical to reducing risk.
You must be logged in to post a comment Login