LONDON: The FBI has put a spoke in the wheel of a major Russian digital disruption operation potentially aimed at causing havoc in Ukraine, evidence pieced together from researchers, Ukrainian officials and US court documents indicates.
On Wednesday, network technology company Cisco Systems and antivirus company Symantec warned that a half-million Internet-connected routers had been compromised in a possible effort to lay the groundwork for a cyber-sabotage operation against targets in Ukraine.
Court documents simultaneously unsealed in Pittsburgh the same day show the FBI has seized a key website communicating with the massive army of hijacked devices, disrupting what could have been — and might still be — an ambitious cyber attack by the Russian government-aligned hacking group widely known as Fancy Bear.
“I hope it catches the actors off guard and leads to the downfall of their network,” said Craig Williams, the director of outreach for Talos, the digital threat intelligence unit of Cisco that cooperated with the bureau. But he warned that the hackers could still regain control of the infected routers if they possessed their addresses and the right resources to re-establish command and control.
FBI Assistant Director Scott Smith said the agency “has taken a critical step in minimizing the impact of the malware attack. While this is an important first step, the FBI’s work is not done.”
Much about the hackers’ motives remains open to conjecture. Cisco said the malicious software, which it and Symantec both dubbed VPNFilter after a folder it creates, was sitting on more than 500,000 routers in 54 countries but mostly in Ukraine, and had the capacity to render them unusable — a massively disruptive move if carried out at such a scale.
“It could be a significant threat to users around the world,” said Williams.
The US Justice Department said the malware “could be used for a variety of malicious purposes, including intelligence gathering, theft of valuable information, destructive or disruptive attacks, and the mizattribution of such activities.”
Ukraine’s cyberpolice said in a statement that it was possible the hackers planned to strike during “large-scale events,” an apparent reference either to the upcoming Champions League game between Real Madrid and Liverpool in the capital, Kiev, on Saturday or to Ukraine’s upcoming Constitution Day celebrations.
Ukraine has been locked in a years-long struggle with Russia-backed separatists in the country’s east and has repeatedly been hit by cyberattacks of escalating severity. Last year witnessed the eruption of the NotPetya worm, which crippled critical systems, including hospitals , across the country and dealt hundreds of millions of dollars in collateral damage around the globe. Ukraine, the United States and Britain have blamed the attack on Moscow — a charge the Kremlin has denied.
Cisco and Symantec both steered clear of attributing the VPNFilter malware to any particular actor, but an FBI affidavit explicitly attributed it to Fancy Bear, the same group that hacked into the Democratic National Committee in 2016 and has been linked to a long series of digital intrusions stretching back more than a decade. The US intelligence community assesses that Fancy Bear acts on behalf of Russia’s military intelligence service.
An FBI affidavit — whose existence was first reported by The Daily Beast — said the hackers used lines of code hidden in the metadata of online photo albums to communicate with their network of seeded routers. If the photo albums disappeared, the hackers turned to a fallback website — the same site whose seizure the FBI ordered Tuesday.
An email sent to the website’s registered owner was returned as undeliverable.
When asked why the FBI specifically named Fancy Bear where Cisco did not, Williams noted that while attribution was extremely tricky based on malware analysis alone, “if you combine that knowledge with a traditional intelligence apparatus interesting things can come to light.”
In any case, he said, “we have a high degree of confidence that the actor behind this is acting against the Ukraine’s best interest.”
Cisco said in a research note that the malware affected devices geared for small and home offices from manufacturers including Netgear, TP-Link and Linksys and had the potential to disable “Internet access for hundreds of thousands of victims worldwide or in a focused region.”
The malware’s principal capabilities, the company said, included stealthy intelligence-collecting, monitoring industrial-control software and, if triggered, “bricking” or disabling routers. It also persists on the infected routers after they are rebooted.
FBI may have disrupted major cyber attack on Ukraine
FBI may have disrupted major cyber attack on Ukraine
- Ukraine has been locked in a years-long struggle with Russia-backed separatists in the country’s east and has repeatedly been hit by cyberattacks of escalating severity. Last year witnessed the eruption of the NotPetya worm, which crippled critical system
- Network technology company Cisco Systems and antivirus company Symantec have warned that a half-million Internet-connected routers had been compromised in a possible effort to lay the groundwork for a cyber-sabotage operation against targets in Ukraine.
Freed Palestinian student accuses Columbia University of inciting violence
“Columbia University is participating in the destruction of the democratic system,”
NEW YORK: A Palestinian student arrested as he was about to finalize his US citizenship accused Columbia University on Thursday of eroding democracy with its handling of campus protests against the Israel-Hamas war.
Mohsen Mahdawi, 34, who led anti-war protests at the Ivy League school in New York in 2023 and 2024, spent 16 days in a Vermont prison before a judge ordered him released on April 30.
On Friday, an appeals court in New York denied the government’s request to halt that order, saying the Trump administration’s jurisdictional arguments were unlikely to succeed and that it hadn’t shown that Mahdawi’s release has caused irreparable harm.
“Individual liberty substantially outweighs the government’s weak assertions of administrative and logistical costs,” wrote the three-judge panel at the 2nd US Circuit Court of Appeals.
The Trump administration has said Mahdawi should be deported because his activism threatens its foreign policy goals, but the judge who released him on bail ruled that he has raised a “substantial claim” that the government arrested him to stifle speech with which it disagrees.
Mahdawi spoke to The Associated Press on Thursday, a day after pro-Palestinian protesters clashed with campus security guards inside the university’s main library. At least 80 people were taken into custody, police said.
Mahdawi said instead of being a “beacon of hope,” the university is inciting violence against students.
“Columbia University is participating in the destruction of the democratic system,” Mahdawi said in the interview. “They are supporting the initiatives and the agenda of the Trump administration, and they are punishing and torturing their students.”
A spokesperson for Columbia University, which in March announced sweeping policy changes related to protests following Trump administration threats to revoke its federal funding, declined to comment Thursday beyond the response of the school’s acting president to Wednesday’s protests.
The acting president, Claire Shipman, said the protesters who had holed up inside a library reading room were asked repeatedly to show identification and to leave, but they refused. The school then asked police in “to assist in securing the building and the safety of our community,” she said in a statement Wednesday evening, calling the protest actions “outrageous” and a disruption to students for final exams.
Mahdawi, a legal permanent resident, was born in a refugee camp in the Israeli-occupied West Bank and moved to the United States in 2014. At Columbia, he organized campus protests and co-founded the Palestinian Student Union with Mahmoud Khalil, another Palestinian permanent resident of the US and graduate student who was arrested in March.
On April 14, Mahdawi had taken a written citizenship test, answered verbal questions and signed a document about the pledge of allegiance at an immigration office in Colchester when his interviewer left the room. Masked and armed agents then entered and arrested him, he said. Though he had suspected a trap, the moment was still shocking, he said, triggering a cascade of contrasting emotions.
“Light and darkness, cold and hot. Having rights or not having rights at all,” he said.
Immigration authorities have detained college students from around the country since the first days of the Trump administration, many of whom participated in campus protests over the Israel-Hamas war. Mahdawi was among the first to win release from custody after challenging his arrest.
In another case, a federal appeals court ruled Wednesday in favor of Tufts University student Rumeysa Ozturk, upholding an order to transfer her from a Louisiana detention center back to New England to determine whether her rights were violated and if she should be released.
Mahdawi said his message to the Turkish student and others was “stay positive and don’t let this injustice shake your belief in the inevitability of justice.”
“People are working hard. Communities are mobilizing,” he said. “The justice system has signaled to America with my case, and with Rumeysa’s yesterday with the Second Circuit, that justice is functioning and checks and balances is still in function.”
Mahdawi’s release, which is being challenged by the government, allows him to travel outside of his home state of Vermont and attend his graduation from Columbia in New York later this month. He said he plans to do so, though he believes the administration has turned its back on him and rejected the work of a student diplomacy council he served on alongside Jewish, Israeli and Lebanese students.
“I plan to attend the graduation because it is a message,” he said. “This is a message that education is hope, education is light, and there is no power in the world that should take that away from us.”
Migrants told of Libya deportation waited hours on tarmac, attorney says
- A Vietnamese worker was among the migrants woken in the early morning hours and bused from an immigration detention center
- He was told on Monday to sign a document agreeing to be deported to Libya
WASHINGTON: Migrants in Texas who were told they would be deported to Libya sat on a military airfield tarmac for hours on Wednesday, unsure of what would happen next, an attorney for one of the men told Reuters.
The attorney, Tin Thanh Nguyen, said his client, a Vietnamese construction worker from Los Angeles, was among the migrants woken in the early morning hours and bused from an immigration detention center in Pearsall, Texas, to an airfield where a military aircraft awaited them.
After several hours, they were bused back to the detention center around noon, the attorney said on Thursday.
The Department of Homeland Security, the Pentagon and the State Department did not respond to requests for comment.
Reuters was first to report that US President Donald Trump’s administration was poised to deport migrants to Libya, a move that would escalate his immigration crackdown which has already drawn legal backlash.
Officials earlier this week told Reuters the US military could fly the migrants to the North African country as soon as Wednesday, but stressed that plans could change.
A US official told Reuters the flight never departed. As of Friday, it was unclear if the administration was still planning to proceed with the deportations.
A federal judge in Boston ruled on Wednesday that any effort by the Trump administration to deport non-Libyan migrants to Libya without adequate screenings for possible persecution or torture would clearly violate a prior court order.
Lawyers for a group of migrants pursuing a class action lawsuit had made an emergency request to the court hours after the news broke of the potential flight to Libya.
SOLITARY CONFINEMENT
Nguyen, who declined to name his client, said the man was told on Monday to sign a document agreeing to be deported to Libya. The man, who does not read English well, declined to sign it and was placed in solitary confinement and shackled along with four or five other men, the attorney said.
The man was never provided an opportunity to express a fear of being deported to Libya as required under federal immigration law and the recent judicial order, Nguyen said.
“They said, ‘We’re deporting you to Libya,’ even though he hadn’t signed the form, he didn’t know what the form was,” Nguyen said.
Nguyen said his client, originally from Vietnam, has lived in the US since the 1990s but was detained by US Immigration and Customs Enforcement earlier this year during a regular check-in.
Vietnam declines to accept some deportees and processes deportation paperwork slowly, Nguyen said, making it harder for the US to send deportees there.
Activists hold ‘die-in’ protest at Soviet monument in Warsaw
- They chanted “terrorists” as Russia’s ambassador to Poland made his way to the monument
- A handful of people also showed up to lay flowers at the cemetery away from the protests
WARSAW: Pro-Ukrainian activists held a protest at a Soviet memorial in Warsaw where Moscow’s ambassador placed a wreath on Friday, as Russia celebrates World War II Victory Day.
Some two dozen protesters wrapped in white sheets, their clothes and faces splattered with a red substance imitating blood, lay at the foot of a monument at the cemetery for Soviet soldiers in Poland’s capital.
They chanted “terrorists” as Russia’s ambassador to Poland, Sergei Andreyev, made his way to the monument with a wreath to commemorate the Soviet defeat of Nazi Germany.
“The idea was that the path the ambassador would take to reach the monument would be lined with the graves of people who died innocently during the war” in Ukraine, Miroslaw Petryga, 70, who participated in the lie-in, told AFP.
Poland is a staunch ally of Kyiv, supporting Ukraine with military and political aid as it fends off a Russian invasion that is grinding through its fourth year.
“It was the gait of a man pretending not to see anything, with tunnel vision,” Petryga, a Ukrainian engineer who has lived in Poland for decades, said of Andreyev.
The ambassador walked past the protesters amid a heavy police presence and with a handful of supporters and security guards around him.
The activists also scattered children’s toys at the entrance to the cemetery. The teddy bears, balls and other items were also splattered with a blood-like liquid to symbolize child victims of Russia’s war in Ukraine.
Some were wearing t-shirts with the slogan “Make Russia small again” and were collecting signatures under a petition to expel the Russian ambassador from Poland.
At the site, around a dozen people also gathered at a counter protest, wearing the St. George ribbon, a historical symbol of Russian and Soviet military successes.
Minor scuffles and verbal altercations broke out between the groups.
A handful of people also showed up to lay flowers at the cemetery away from the protests.
“We should honor the memory of those soldiers who died in the World War,” said Natalia, a 67-year-old who held a black-and-white photo that she said showed her father who had fought in the war.
The Russian citizen and longtime Polish resident declined to give her full name.
In 2022, the year Russia launched the full-scale war, protesters at the Soviet mausoleum threw a red substance at Moscow’s envoy.
A year later Andreyev was blocked by activists from laying flowers at the monument.
The Kremlin is using its annual Victory Day parade in Moscow — marking 80 years since the end of World War II — to whip up patriotism at home and project strength abroad as its troops fight in Ukraine.
But for Natalia Panchenko from the pro-Ukrainian organization Euromaidan, the day should serve as a reminder of Russia’s ongoing war.
“It is important to us that today, when people remember that there is a country called Russia, they do not remember Russia through Russian propaganda, but remember the real Russia,” Panchenko told AFP.
“And Russia is a terrorist state,” she said.
Cyprus court jails Hungarians brokering property sales in Turkish-held north
- The two women were convicted of advertising and finding buyers for coastal properties
- Friday’s verdict highlights the complexity and sensitivity over territory in Cyprus
NICOSIA: A court in Cyprus sentenced two Hungarian nationals to prison on Friday for brokering sales of properties in the Turkish-held north of the island seized from fleeing Greek Cypriots in a 1974 war.
The two women were convicted of advertising and finding buyers for coastal properties without the consent of the registered owners in the territory, which is a Turkish Cypriot state recognized only by Turkiye.
Friday’s verdict, likely to draw the ire of Turkish Cypriots, highlights the complexity and sensitivity over territory in Cyprus, where thousands of people lost property and homes from internal displacement and a 1974 Turkish invasion triggered by a brief Greek-inspired coup.
Those properties have since been re-distributed, and bought and sold many times. The territory has recently seen a surge in high-end investment.
Cyprus’s Criminal Court passed down sentencing of 2.5 years and 15 months jail to the two women, the semi-official Cyprus News Agency (CNA) reported. They had pleaded guilty to a number of charges, and prosecutors suspended others.
The court is based in the southern part of Cyprus run by its internationally recognized Greek Cypriot government. The women were arrested late last year after arriving in the south.
Greek Cypriot authorities have increasingly pursued legal action against foreign nationals investing in disputed properties in north Cyprus in recent years, and the issue is known to have caused friction in attempts to relaunch peace talks.
Two other cases are pending before the courts.
Jordanian Deputy Prime Minister highlights importance of ties with Japan
- Chief Cabinet Secretary Hayashi stated that Japan is committed to continuing its efforts toward a two-state solution for Palestine
- Iwaya stated that Jordan is playing an important role amid the fluid international situation
TOKYO: Jordanian Foreign Minister and Deputy Prime Minister Ayman Al Safadi met with Japanese Foreign Minister Iwaya Takeshi and Chief Cabinet Secretary Hayashi Yoshimasa in Tokyo on Friday and highlighted the importance of the partnership between Jordan and Japan, Japan’s Foreign Ministry reported.
Chief Cabinet Secretary Hayashi stated that Japan is committed to continuing its efforts toward a two-state solution for Palestine and establishing peace and prosperity in the region in coordination with Jordan, which, he said, was a vital part of stability in the region.
Iwaya welcomed his Jordanian counterpart and appreciated the visit to Japan and the Osaka-Kansai Expo of Crown Prince Hussein, who had “fruitful discussions” with Prime Minister Ishiba Shigeru on Thursday.
Iwaya stated that Jordan is playing an important role amid the fluid international situation and added that he hopes to work closely with Jordan toward achieving a “two-state solution” for Palestine and establishing long-term peace and stability in the region.
The two foreign ministers met previously in Munich and Iwaya said the high-level visits and meetings “symbolize the strategic partnership between our two countries.”
He also offered condolences for those affected by the flooding in Petra.
Foreign Minister Safadi said he appreciated support from Japan in various fields, including economic reforms. He also congratulated Japan on the success of the Osaka-Kansai Expo.
He explained the latest regional situation and Jordan’s diplomatic efforts and stated that Jordan attaches great importance to cooperation with “close partner” Japan. He also expressed his gratitude for the assistance Japan has extended to Jordan thus far.
He added that he was looking forward to “in-depth discussions about the challenges we face in the region, particularly efforts to stop the Israeli aggression in Gaza and to confront the massive humanitarian disaster it is suffering, in addition to discussing the situation in Syria and the situation in the region in general.”
“We emphasize the importance of Japan’s role,” he said. “Japan is highly respected in our region, and Japan’s policies are aimed at achieving security, stability, peace and development. These are also the goals of our policies in Jordan.”
Discussions centered on bilateral cooperation and various issues in the Middle East.
