A 19-year-old dual United States and Estonian citizen arrested in Finland earlier this month faces federal charges in the U.S. alleging he was a prolific member of the notorious Scattered Spider hacking collective.

According to temporarily unsealed court records obtained by the Chicago Tribune, the suspect (who used the online alias “Bouquet”) helped extort millions of dollars from multiple large corporations worldwide.

The suspected Scattered Spider member, who was allegedly arrested by Finnish law enforcement at Helsinki’s airport on April 10 while attempting to board a flight to Japan, is facing wire fraud, conspiracy, and computer intrusion charges.

In a six-count complaint filed under seal in December, prosecutors say that Bouquet was involved in at least four Scattered Spider breaches (including a March 2023 hack of an online communication platform, conducted when he was 16 years old) that forced the victim companies to pay millions of dollars in ransoms.

The list of companies breached with Bouquet’s help also includes an unnamed multibillion-dollar “luxury item retailer” in May 2025, when the hackers allegedly called the company’s IT helpdesk posing as employees to reset authentication credentials, then gained access to administrator accounts.

The group later sent a ransom demand, claiming to have 100 gigabytes of stolen data, and eventually demanded $8 million. However, even though the company refused to pay, it still incurred more than $2 million in disruption and remediation costs.

BleepingComputer reached out to the Department of Justice and the Office of the Attorney General for more details, but a response was not immediately available.

The Scattered Spider cybercrime collective

Scattered Spider (also tracked as 0ktapus, Scatter Swine, Octo Tempest, Starfraud, UNC3944, and Muddled Libra) surfaced in 2022 and is a loosely knit, financially motivated hacking collective composed largely of teenagers and young adults from the U.S. and Great Britain.

According to the FBI, they are known for using a blend of social engineering, targeted multi-factor authentication (MFA) bombing (aka MFA fatigue), and SMS credential phishing attacks to steal user credentials and sensitive documents for extortion leverage after breaching their targets’ networks.

Scattered Spider’s list of victims includes many high-profile companies, such as Caesars, MGM Resorts, Riot Games, MailChimp, Twilio, DoorDash, Reddit, Allianz Life, UK retailers Co-op, Marks & Spencer (M&S), and Harrods, and, more recently, WestJet and Jaguar Land Rover (JLR).

Earlier this month, 24-year-old Tyler Robert Buchanan, believed to be one of Scattered Spider’s leaders, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Amazon has today announced a software update for both the Kindle Colorsoft and Kindle Scribe Colorsoft which will bring dark mode to both e-readers. Even better, users will be able to toggle the settings for specific menus on both devices, so if they want their library dark and their notebook light, they can. Given the option is available on plenty of other Kindle devices, its omission here always felt like something Amazon was just getting around to addressing.

In addition, the update brings Smart Shapes to notebooks, enabling users to add pre-drawn lines, arrows, circles, triangles and rectangles from the toolbar. In addition, a hold-to-snap tool lets you draw a shape freehand, after which point it’ll pull itself into a nice tidy design. Both should help folks who want to add some graphical zing to their note taking who can’t do all those fancy journal designs on their own.

The update is rolling out across the ecosystem across the next few days, further empowering would-be journal scribes using these tablets. For tablets like the Kindle Scribe Colorsoft, it’s clear Amazon needs to build out the Scribe half of the equation, which looks like a poor relative compared to its competition. As Cherlynn Low wrote in her review, it’s a fine e-reader, but one that’s sorely lacking in many areas.

Considering how integral it is to our modern way of life, you could be excused for thinking that the Global Positioning System (GPS) is a product of the smartphone era. But the first satellites actually came online back in 1978, although the system didn’t reach full operational status until April of 1995. While none of the active GPS satellites currently in orbit are quite that old, several of them were launched in the early 2000s — and despite a few tweaks and upgrades, their core technology isn’t far removed from their 1990s era predecessors.

But in the coming years, that’s finally going to change. Just last week, the tenth GPS III satellite was placed in orbit by a SpaceX Falcon 9 rocket. Once it’s properly configured and operational, it will join its peers to form the first complete “block” of third-generation GPS satellites. Over the next decade, as many as 22 revised GPS III satellites are slated to take their position over the Earth, eventually replacing all of the aging satellites that billions of people currently rely on.

So what new capabilities do these third-generation GPS satellites offer, and why has it taken so long to implement needed upgrades in such a critical system?

GPS Is Good, But Could Be Better

To understand the future of GPS, it’s helpful to look at its past. Developed by the United States military during the Cold War, what we now call GPS was originally known as Navigation System with Timing and Ranging (NAVSTAR). While the intent was always to allow civilian use of NAVSTAR, the equipment necessary to receive the signal and get a position was cumbersome and expensive.

There was little public interest in the system until Korean Air Lines Flight 007 was shot down in 1983 after mistakenly entering the Soviet Union’s airspace. With the lifesaving potential of NAVSTAR clearly evident, pressure started building on the industry to develop smaller and more affordable receivers — GPS as we know it was born.

That the development of such devices was possible in the first place was thanks to the design of NAVSTAR. Each satellite in the constellation broadcasts a timed radio signal which receivers on the ground use to compute their distance from the source. By comparing the signals from multiple satellites, a receiver can plot its position without the need for any local infrastructure. Since the process is entirely one-way, the can could be freely used by any device can can receive and decode the signal.

But while this operational simplicity was key to the proliferation of cheap ubiquitous GPS receivers, there’s certainly room for improvement given more modern technology. When NAVSTAR was designed knowing where a receiver was located within a radius of a few meters was more than sufficient, but today there’s a demand for greater accuracy by both civilian and military users. Given the essentially incalculable value of GPS to the global economy, improving reliability is also paramount. Not only has GPS jamming and spoofing become trivial, but even without the involvement of bad actors, legacy GPS struggles in urban environments.

Plans to deliver improved performance in these areas have been in the works for decades, with the United States Congress first authorizing the work on what would become GPS III all the way back in 2000. But when working on a system so critical that even a few minutes of downtime could put the entire planet into turmoil, such changes don’t come easy.

Can You Hear Me Now?

While modern GPS receivers are more sensitive than those in the past, there’s simply no getting over the fact that signals coming from a satellite more than 20,000 kilometers away will be by their very nature weak. So not only is it relatively easy for adverse environmental conditions to block or hinder the signal, but it doesn’t take much to override the signal with a local transmitter if somebody is looking to cause trouble.

As such, one of the key goals of the GPS III program was to deliver higher transmission power. This will lead to better reception for all GPS users across the board, but the new satellites also offer some special modes that offer even greater performance.

In addition to the backwards compatible signals transmitted by GPS III satellites, there’s also a new “Safety of Life” signal. This signal is transmitted at a different frequency, 1176 MHz, and at a higher power, so compatible receivers should hear it come in at approximately 3 dB above the “classic” signal. It’s intended primarily for high-performance applications such as aviation, but as compatible receivers get cheaper, it will start to show up in more devices.

These improvements should be enough for civilian use, but the military has higher expectations and operates under more challenging conditions. In such cases, future GPS III satellites will come equipped with a high-gain directional antenna that can project a “spot beam” signal anywhere on Earth. For receivers located within the beam, which is estimated to be a few hundred kilometers in diameter, the received signal from the satellite will be boosted by up to 20 dB. In contested environments, this should make it far more resistant to jamming and spoofing.

Speaking New Languages

The new signals being transmitted by GPS III satellites won’t just be louder than their predecessors, they’ll gain some new features as well.

For one thing, GPS III satellites will transmit a standardized signal known as L1C which offers interoperability with other global navigation systems such as Europe’s Galileo, China’s BeiDou, the Indian Regional Navigation Satellite System (IRNSS), and Japan’s Quasi-Zenith Satellite System. In theory a compatible receiver will be able to process signals from any combination of these systems simultaneously, improving overall performance.

The new satellites will also support the L2C signal. While this signal was technically available on earlier generation satellites, it’s still not considered fully operational and its adoption is expected to accelerate as more GPS III satellites come online. Compared with the legacy GPS protocol, L2C offers improved faster acquisition of signal, better error correction, and a more capable packet format.

To make GPS III transmissions even more secure, the military is also getting their own signal known as M-code. As you might expect, little is publicly known about M-code currently, but it’s a safe bet that it utilizes encryption and other features to make it more difficult for adversaries to create spoofed transmissions. For what it’s worth, a recent press release from the US Space Force claims that the use of M-code makes the next-generation GPS satellites “three-times more accurate and eight times more resistant to jamming than the previous constellation.”

Testing Out New Toys

Although all ten GPS III satellites are now in orbit, that doesn’t mean the constellation is complete. Starting in 2027, a new fleet of revised satellites known as GPS IIIF will start launching. They will take the lessons learned from the initial GPS III deployment to create a smaller, lighter, and more efficient platform that should have a service life of at least 15 years.

They’ll also include new in-development equipment that wasn’t quite ready for deployment when the current GPS III satellites were being assembled. This includes optical reflectors that will allow ground stations to more accurately track the position of each satellite, laser data links that will allow high-speed communication between satellites, and an improved atomic clock known as the Digital Rubidium Atomic Frequency Standard (DRAFS).

Of course, the vast majority of the people who use GPS every day will never be aware of all the changes and improvements happening behind the scenes. When they get a new phone with a GPS III-compatible receiver, they may notice that their navigation app locks on a bit faster or that the position shown on the screen is a little closer to where they are actually standing, but only if they are particularly attentive. But that’s entirely by design — the most important aspect of implementing GPS III is making the whole process as invisible as possible.

from the cybersecurity-shakedown dept

Late last month we noted how the Trump FCC under Brendan Carr announced a new “ban” on all routers made overseas (which means pretty much all of them). At the time, we also noted how this was less of a ban and more of a shakedown, with router manufacturers required to beg the Trump FCC for conditional waivers (fees, favors, whatever) to continue doing business in the States.

Not long after, Netgear, which does a lot of work with the U.S. government, announced it had received an exemption from the Trump FCC, though neither Netgear or the government transparently indicated what Netgear had to do to get the exemption. Pay a bribe? Host Brendan Carr for a game of golf? Install a surreptitious backdoor for CIA and ICE access? Nobody knows.

Now Amazon is the latest to get an exemption for both its Eero consumer routers and its Leo low Earth orbit (LEO) routers. Amazon showed up on the exemption list, but again there’s absolutely no indication of what the company had to actually do to get it, or the standards the Trump FCC is using to determine what hardware can be trusted. An Amazon announcement is painfully vague:

“We’re pleased to share that the U.S. government has recognized eero as a trusted and secure provider of routers.”

How did this happen? Does anybody trust the Trump administration to make this determination? Are there concerns about backdoors in exchange for being allowed to continue to do business? Nobody knows, though the FCC has indicated the ban has been expanded to include personal hotspots.

This would all likely be less alarming if the Trump administration wasn’t aggressively transactional, unethical, and authoritarian. Little to nothing Brendan Carr and Donald Trump do is genuinely for the public interest; and while this ban is being proposed as an act to protect national security, with their other hand they’ve taken countless steps to ensure consumers are less secure than ever.

That’s ranged from firing of officials responsible for online election security and investigating hacks, or to the relentless “deregulation” (real, the elimination of corporate oversight) of a U.S. telecom sector that was just the target of one of the worst cybersecurity incidents in U.S. history (in large part because telecom executives failed to change default router admin passwords).

Most press coverage of this new router ban acts as if the Trump FCC is still a trusted actor when it comes to the public interest, but that’s a pretty broad assumption given all the dodgy, unethical, and illegal behavior we’ve seen from the agency and administration more generally.

I don’t think most U.S. journalism is journalism. It’s some weird simulacrum designed to not offend. Why would you not at least include one sentence or paragraph on how nothing about this is transparent? Or that the administration has a bad track record on ethics and transparency?

Similarly, no outlets have been inclined to mention that the Trump administration’s open corruption and mindless dismantling of corporate oversight and consumer protection have most certainly endangered national security and consumer cybersecurity and privacy in ways we’ve not yet begun to calculate. “You can trust us on this,” isn’t something anybody, especially media outlets, should be accepting as an answer.

Filed Under: backdoors, cybersecurity, extortion, fcc, hardware, hotspots, privacy, routers

Companies: amazon

The next gadget you put on your head could scan your brain. Neurable, a Boston-based company that embeds its noninvasive brain-scanning technology into hardware to monitor a person’s focus levels, announced on Tuesday that it is transitioning to a licensing platform model. By certifying third parties, Neurable expects its tech to be in a “flood” of consumer gadgets this year and next.

Neurable has until now focused its efforts on a pair of consumer-grade headphones—made in partnership with audio brand Master & Dynamic. It also has a contract with the US Department of Defense to see how its technology can monitor blast overpressure and potentially help diagnose mild traumatic brain injuries in soldiers. With the licensing model, we could see more of Neurable’s tech in everyday head-based wearables.

The headphones use built-in electroencephalography (EEG) sensors to monitor brain waves. That information is sent to a companion app and lets wearers know when they need a “brain break,” nudging them to take a breather before they feel burnt out to maximize productivity. The app also lets users discover their cognitive readiness for the day, their brain age, and other metrics, such as mental recovery, cognitive strain, and anxiety resilience. WIRED staff writer Emily Mullin tested the original headphones in 2024, though she found it difficult to verify the accuracy of Neurable’s algorithms.

Now, HP-owned gaming brand HyperX is releasing a gaming headset with Neurable’s technology, and it’s all about improving human performance while esports gaming. The headphones are purported to help wearers ease into the right state of mind for the best performance. Ramses Alcaide, Neurable cofounder and CEO, tells WIRED that the company has published a white paper showing improved performance among gamers using Neurable’s tech, with reduced response times in first-person shooter games and a small increase in accuracy.

The improvements may sound minor, but milliseconds are precious in the fast-paced world of esports gaming. And Alcaide says it could translate similarly to other fields: It could help a student reduce anxiety before an exam, while athletes could condition their nerves ahead of a race or game. Neurable is hardware-agnostic; Alcaide says it can be embedded in headphones, smart glasses, hats, or helmets. “There’s a whole landscape of technology that touches your head that’s yet to be embedded with our platform,” he says.

He likens it to when Fitbit made the idea of a wrist-worn heart-rate tracker popular. In the beginning, no one knew how fitness wearables would be received, but now no one blinks an eye at one on a wrist. Soon, no one will think twice about brain-scanning tech in headphones—or, at least, that’s the idea. Neurable’s tech is “invisible” in these types of gadgets.

Companies licensing Neurable’s tech can integrate it into existing hardware, Alcaide says, and will control the entire experience from product design to the software experience; these products will be advertised as “Powered by Neurable AI.” The user data still flows to Neurable’s servers for processing, but Neurable sets the data privacy protections. User identifiers are separated from the data, and while partner companies host the user-facing layer, Neurable says it keeps control of the underlying system and data handling. Neurable has previously said its business model is not to sell user data.

“Any time there’s a new transition to technology, there’s always going to be some anxiety,” Alcaide says. “We’ve been very careful when it comes to that transition. We’re protecting the data, being as ethical as possible.”

Neurable is one of many brain-computer interface (BCI) companies in the growing category. Elemind uses EEGs to improve sleep quality, and Sabi wants to turn thoughts into text. Even Apple filed a patent for EEG-sensing AirPods, though they’re not yet available.