Kim Zetter

Journalist - cybersecurity/national security. Author COUNTDOWN TO ZERO DAY: Stuxnet and the Launch of the World's First Digital Weapon. Speaker/Signal. Newsletter is called Zero Day. Find it here: https://www.zetter-zeroday.com/. Become a paid subscriber to help support my independent journalism.

Book: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/077043617X/ref=tmm_hrd_swatch_0?_encoding=UTF8&qid=&sr=
Zero Day news site: https://www.zetter-zeroday.com/
Twitter: https://twitter.com/KimZetter

Public Key

npub1gxm0237r4hgj2jj5tsy7prkwdeuz2389fdgxheyl6wp5phytlmxs0yhhnu

NIP-05 Address

kimzetter_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsyrdh4glp6m5f9ff29cz0q3m8xu7p9gnj5k5rtuj0a8q6qmj9langprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy8hwumn8ghj7mn0wd68ytnddakspe93ue

Publishing to

relay.momostr.pink

nostr.mom

nos.lol

Author Public Key

npub1gxm0237r4hgj2jj5tsy7prkwdeuz2389fdgxheyl6wp5phytlmxs0yhhnu

Show more details

Last Notes

2026-07-31 12:23:13 UTC

Exclusive: Guess who designed this year's Defcon badges? None other than famed hardware hacker Andrew "bunnie" Huang. The badges feature a new, secure and open-source chip that Huang created (the Baochip), which doubles as a security token after the con. Hardware hackers will love the specs
@npub1dqd…8xy4
https://www.wired.com/story/defcon-34-badge-baochip-andrew-bunnie-huang/

2026-07-15 13:10:43 UTC

When Peter Stokes (Scattered Spider's "Bouquet") was arrested in Finland this month, people speculated that his real identity had been unmasked by Microsoft using the Windows GDID assigned to his computer. GDID *was* used to trace crimes to his computer, but Unit 221B's Allison Nixon tells me he had been unmasked in 2023, long before he committed the biggest crimes mentioned in his indictment. I spoke with her about tracking Stokes and other members of The Com, and why these cybercriminals brag about their crimes online and are so reckless about drawing attention to themselves and leaving a trail of evidence. We also talked about why, if Stokes had been identified in 2023, it took until 2026 to arrest him.
https://www.zetter-zeroday.com/tracking-peter-stokes-and-the-com-allison-nixon-and-her-work-unmasking-cybercriminals/

2026-05-18 16:00:38 UTC

RE: https://infosec.exchange/@kimzetter/116584486207385646
Published this on Saturday so just re-upping in case you missed it over the weekend
#note1h3y…9nyr

2026-05-16 13:28:03 UTC

Exclusive: Fast16 malware has raised questions about what it was designed to do. Researchers at Symantec finally confirm it was subverting software used to simulate nuclear weapons explosions. Nuclear experts also tell me Iran was the likely target and explain how it impacted nuclear weapons tests. Fast16 wasn't aimed at sabotaging nuclear weapons themselves, but was only designed to alter data being fed to engineers from software used to simulate nuclear explosions tests. The goal was to trick engineers into believing their tests were failing to create confusion and slow down weapons program. Fast16 and Stuxnet were similar in that they both fed false data to engineers. But Stuxnet also physically altered centrifuges while tricking engineers into believing the devices were fine. New analysis from me also shows the two codes were contemporaneous, not separated by years.
Here's my story, which contains a link to a timeline showing how they were being developed around the same time, likely as part of a multi-pronged operation to slow down Iran's nuclear program.
https://www.zetter-zeroday.com/experts-confirm-the-fast16-malware-was-sabotaging-nuclear-weapons-tests-likely-in-iran/

2026-05-08 15:39:09 UTC

Trenchant exec, Peter Williams, who stole zero-day exploits from his employer and sold them to a Russian buyer (known for selling exploits to the Russian government) has been ordered to pay $10 million in restitution to his former employer. My story about it is here:
https://www.zetter-zeroday.com/trenchant-exec-who-sold-zero-days-to-russian-buyer-ordered-to-pay-10-million-in-restitution-to-former-employers/

2026-04-25 12:08:41 UTC

The mystery around a cyberattack against Venezuela's state-run oil company last December deepens with the discovery this week of a "highly destructive" wiper that may have been used in the attack. Previous reports had indicated that the December attack was a ransomware incident. But the wipr found this week was compiled last September, and hard-coded into it is the domain for Petróleos de Venezuela (PDVSA) , the state-run oil company. The hard-coded domain means the attackers had designed their precision weapon to only destroy data on the oil company's systems, not on any other system outside the company's domain. My story is below. Please consider becoming a paid subscriber if you like my work.
https://www.zetter-zeroday.com/hwiper-targeting-venezuelas-state-oil-company-discovered/

2026-04-09 15:52:20 UTC

Former Trenchant exec who stole exploits from his employer and sold them to a Russian broker says he was suffering depression & money troubles when he decided to sell the exploits. Also, new info reveals the nature of the work he did for an Australian intel agency before joining Trenchant. My story is linked below. Please consider becoming a paid subscriber if you like my work on this piece. It's 4,000 words and I'm making it available for free to everyone. But I can only do that because some subscribers have generously become paid subscribers.
https://www.zetter-zeroday.com/trenchant-exec-says-he-had-depression-money-troubles-when-he-decided-to-sell-zero-days-to-russian-buyer-also-new-info-reveals-nature-of-his-work-for-australian-intelligence-agency/?ref=zero-day-newsletter

2026-03-11 17:14:45 UTC

Iranian hacktivists hit US medical device maker Stryker with a "severe" attack that wiped systems and shut down global operations for the company. The hacktivist group, Handala, claim they hit the company in retaliation for the US bombing of a girls' school in Iran and that they struck more than 200,000 of Stryker's servers, systems and devices and remotely wiped many of them. https://www.zetter-zeroday.com/iranian-hacktivists-strike-medical-device-maker-stryker-in-severe-attack-that-wiped-systems/

2026-02-17 20:45:42 UTC

When a hacker who goes by the names "Waifu" and "Judische" began posting death threats against security researcher Allison Nixon, she had no idea why he targeted her. So she set out to unmask him. The quest led her to uncover the identity of Connor Riley Moucka, a 25-yr-old Canadian who was ringleader of the infamous Snowflake/AT&T hacks as well as Cameron John Wagenius (aka Kiberphant0m
online), an active-duty US Army soldier, who both were arrested. Here's my story, as well as a free link below that.
https://www.technologyreview.com/2026/02/16/1132526/allison-nixon-hackers-security-researcher
https://archive.is/20260216131016/https://www.technologyreview.com/2026/02/16/1132526/allison-nixon-hackers-security-researcher

2026-01-27 14:04:33 UTC

The Booz Allen tech contractor behind Treasury Department's unprecedented decision yesterday to cancel all 31 of its contracts with the consulting firm, took the job with Booz Allen - much like Edward Snowden before him - specifically to get access to IRS tax records of President Trump and leak them. And not only Trump's records, he stole the tax records of more than 400,000 other individual and corporate taxpayers -- leaking some of these to the media as well. All of this contributed to the Treasury decision yesterday. https://www.zetter-zeroday.com/booz-allen-tech-contractor-took-irs-job-specifically-to-leak-trumps-tax-records/

2025-10-17 14:50:53 UTC

Yesterday prosecutors in Florida took the unusual move of charging voting machine vendor Smartmatic with violating Foreign Corrupt Practices Act for a bribery/money-laundering scheme aimed at winning contracts overseas (Smartmatic currently only supplies voting machines in the US to Los Angeles County). Previously the feds had charged only three executives of the company. Charging a company is rare, so it raises questions of why the feds have added the company to the indictment. Last February, Trump paused all enforcement of the FCPA and ordered Attorney General Pam Bondi to review all current cases being investigated/prosecuted under FCPA. Any cases allowed to continue after this have to be specifically authorized by the AG, suggesting that Bondi must have authorized adding Smartmatic to the indictment. I spoke with a former federal prosecutor who says charging Smartmatic may be political. Smartmatic is currently embroiled in lawsuits against Trump supporters after the President and allies accused the company of vote-rigging in the 2020 election to give Biden the win. Here's my piece about it.
[Note: I wrote this for my own Zero Day publication instead of a media outlet. If you appreciate my work, please consider becoming a paid subscriber to Zero Day.]
https://www.zetter-zeroday.com/voting-machine-company-smartmatic-charged-in-federal-indictment-that-previously-only-charged-executives/

2025-09-08 21:48:20 UTC

Posting this because the email address is so ridiculous (and yet people probably clicked on it anyway). WSJ published a story yesterday about hackers from China posing as House committee chair Rep. John Moolenaar to send a phishing email to trade groups, law firms and U.S. government agencies. I got hold of the email and the sender address is: johnmoolenaar.mail.house.gov@zohomail.com
https://www.wsj.com/politics/national-security/china-trade-talks-spy-5c4801ca

2025-08-07 18:53:25 UTC

Two years ago when researchers found and publicly exposed an intentional backdoor in a TETRA encryption algorithm used to secure radio communications for police/military/intel agencies around the world -- the algorithm involved a key advertised as one strength but secretly reduced to 32 bits -- the European organization that produced the algorithm told users that to secure their communications they could deploy an end-to-end encryption solution on top of the backdoor'd algorithm. Now the same researchers say they found a security problem with the end-to-end solution as well -- another reduced key. Here's my story for Wired:
https://www.wired.com/story/encryption-made-for-police-and-military-radios-may-be-easily-cracked-researchers-find/

2025-07-18 16:06:14 UTC

China's APT cyberspies are some of the best in the business. But how did the hackers get their start? Turns out many were "Honkers" - patriotic hackers in their teens and 20s who, in the late 90s, launched nationalistic cyberattacks against countries they deemed disrespectful to China. But as the Honkers developed their skills over time, the PLA and MSS came calling. In recent years they have been tied to prolific APT groups responsible for hundreds of intrusions in the US and around the world; and some have been indicted. Some of them also launched companies, like i-Soon, that have played an integral role in China's state hacking operations. Here's my story, based on great research from Eugenio Benincasa and Adam Kozy.
https://www.wired.com/story/china-honkers-elite-cyber-spies/

2025-05-20 13:09:20 UTC

- reply

DOGE comes in and designates projects to be canceled. In the early days, they were designating people to be eliminated and projects to be canceled without consulting with heads of agencies or cabinet secretaries. Weeks after that started occurring, cabinet secretaries began pushing back saying only they had the authority to do this. So now DOGE designates to agencies what needs to be cut, and agencies follow their direction

2025-05-20 12:04:13 UTC

- reply

Did you read the story? I didn't say DOGE fired them. I said they resigned enmasse after being displaced by DOGE

2025-05-20 11:30:53 UTC

The UAE has been trying to recruit Pentagon workers displaced by DOGE to move to Abu Dhabi to work on AI for the UAE's military. A UAE brigadier general met last month with two former staffers of the Defense Digital Service who have worked on US classified projects and tried to recruit them and their entire DDS team to move to Abu Dhabi. The general was apparently given permission by the Pentagon to recruit the members of Defense Digital Service -- who resigned enmasse from their jobs last month due to DOGE --- despite warnings last year from US spy agencies and federal lawmakers that the UAE could share AI tech with China and despite the UAE's disturbing history of recruitment of US workers. Remember Dark Matter when the UAE recruited former NSA operators/analysts to work on cybersecurity jobs only to have them help UAE spy agencies hack other nations, members of the royal family and dissidents and journalists? One of the people from the UAE who assisted with the recruiting of DDS workers has ties to Dark Matter. Here's my story:
https://www.zetter-zeroday.com/uae-recruiting-us-personnel-displaced-by-doge-to-work-on-ai-for-its-military/

2025-04-16 22:05:24 UTC

Chris Krebs has quit his job at SentinalOne to launch a legal and public relations fight against Trump and the presidential memo Trump he signed against Krebs last week. "Krebs said he understood why some have kept a low profile and tried not to further anger the president. But he said he disagreed with that approach. "I don’t think this lay-low-and-hope-this-blows-over approach is the right one for the moment we’re in."
Miles Taylor who was also targeted by Trump said "the memos targeting him and Krebs were 'punishment for dissent' and that he too planned to fight back.... 'How we respond will set the tone inevitably for how others targeted by these EOs decide to respond.”
https://www.wsj.com/politics/policy/chris-krebs-trump-cybersecurity-executive-action-31cb99cb

2025-03-05 21:47:00 UTC

I wanted to let everyone know that I've updated my story about the "stand down" order a few times since I first published it yesterday. The most recent update includes a statement from a former Cyber Command general counsel who says that "Ordering Cyber Command to stop operating below the use of force is tantamount to ordering Cyber Command to stop operating."
I don't always post my stories or updates to my stories here, so the best way to follow anything I publish at Zero Day is to become a subscriber there. You can subscribe for free or -- if you'd like to support my work (which is only funded by readers) -- you can become a paid subscriber.
https://www.zetter-zeroday.com/did-trump-admin-order-u-s-cyber-command-and-cisa-to-stand-down-on-russia/

2025-03-04 15:17:05 UTC

Two seemingly blockbuster stories published on Friday that reported that the Trump admin had ordered US Cyber Command and CISA to "stand down" on their work to detect and counter Russian cyber threats. But new info has come out to contradict the stories or qualify them. I dug into what we know and don't know. As always, if anyone has any additional information related to these stories, please contact me on Signal at KimZ.42.
https://www.zetter-zeroday.com/did-trump-admin-order-u-s-cyber-command-and-cisa-to-stand-down-on-russia/

2025-02-18 18:38:59 UTC

The National Science Foundation fired nearly 170 workers this morning in Zoom call. This included workers who had already cleared their one-year probationary period only to have it changed to two years earlier this month, putting them in line for termination. It also included at-will permanent workers -- the latter were not among those designated for firing by the Trump administration; instead NSF decided on its own to eliminate them. Here's my story:
https://www.wired.com/story/national-science-foundation-february-2025-firings/

2025-02-15 04:41:45 UTC

DHS fired more than 400 employees today, including 130 people from CISA. If you work or worked for CISA or have information about what's going on there, you can reach me on Signal at KimZ.42
https://abcnews.go.com/Politics/dhs-cuts-405-employees-workforce/story?id=118847047

2025-02-13 15:37:43 UTC

New court documents shed light on what a 25-year-old DOGE worker named Marko Elez did inside Treasury payment systems, including which systems he accessed, security measures Treasury IT staff took to limit his access and activity, and whether he really did have the ability to change source code on production systems as previously reported. The new documents, signed affidavits filed in court by career executives at the Treasury department not political appointees, suggest that the situation inside the Treasury department is more nuanced than previously reported. Here's my story. If you find the piece valuable, please consider becoming a paid subscriber to my Zero Day publication, which is reader supported. https://www.zetter-zeroday.com/court-documents-shed-new-light-on-doge-access-and-activity-at-treasury-department/

2025-02-06 20:14:57 UTC

Have tips? Story ideas? Something you think I should know about?
Reach me on Signal at KimZ.42
I cover cybersecurity and national security, writing about: nation-state hacking, espionage, cyber warfare, cybercrime, and policy. I don't write about companies - unless they've done something wrong.

2025-02-06 14:57:55 UTC

In a first-ever report from the intelligence community, the US government has revealed that it disclosed 39 zero day vulnerabilities to vendors/public to be patched rather than keep them for NSA/CIA/FBI to exploit in hacking operations. The report, however, doesn't say how many zero days the gov discovered in 2023 that it kept to exploit. And ten of the 39 it did disclose that year, it had already kept secret for an unknown number of years to exploit before deciding to disclose them in 2023. Here's my story: https://www.zetter-zeroday.com/u-s-government-disclosed-39-zero-day-vulnerabilities-in-2023-per-first-ever-report/

2025-01-08 18:16:48 UTC

Last month as drones over NY/NJ made headlines, a radiation-monitoring site reported spikes in radiation in NY, seemingly supporting a theory that the drones were tracking a dirty bomb on the loose there. Only the spikes were fake. I wrote about how the fake info got reported and how it spread on social media
https://www.zetter-zeroday.com/anatomy-of-a-nuclear-scare/

2024-11-02 15:41:42 UTC

Dutch researchers @midnightbluelab
found a critical zero-click vuln in a photo app enabled by default on Synology storage devices, putting millions of systems at risk of being hacked. They found Synology systems owned by police/law firms/critical infrastructure contractors online and all vulnerable to attack. Synology has called the vuln "critical" and issued a patch last week but apparently didn't notify customers. Synology devices don't have automated update capabilities. Here's my story: https://www.wired.com/story/synology-zero-click-vulnerability/

2024-09-18 12:25:02 UTC

Did a Chinese university host a hacking competition targeting a real victim for intelligence collection? On New Year's Eve in 2023, Northwestern Polytechnical University, one of the “Seven Sons” of national defense in China, hosted the Zhujian Cup, one of many hacking competitions held in China each year. But this one had some unusual characteristics. Researchers believe participants in the competition may have been targeting a real victim for intelligence purposes. Here's my story:
https://www.wired.com/story/china-hacking-competition-real-victim/