The Cybersecurity Stories We Were Jealous of in 2021

We have finally gotten to the end of 2021, the year that was supposed to be better than 2020 but ended up being kinda the same and now ends with the looming threat of yet another COVID variant. Not everything about this year sucked though. As usual, there was a lot of cyber. And there were a lot of good cybersecurity stories that we were jealous of, so much so that we wished we had written them ourselves. 

Here's the annual Motherboard’s Cyber Jealousy list. 

The Fall Of The Billionaire Gucci Master

By Evan Ratliff

Ramon Abbas, aka Hushpuppi, used to be a celebrity in his homeland Nigeria. Living in Dubai, he showed off his wealth and luxurious lifestyle to more than 2 million Instagram followers. That was before the FBI accused him of stealing millions of dollars from countless companies around the world with targeted and complex phishing campaigns known as “business email compromise,” or BEC. In this profile, Evan Ratliff—the author of the must-read book The Mastermind—paints a vivid portrait of the man behind the influencer and hacker, and delivers a thorough explainer of BEC scams and how dangerous they are.  

How China turned a prize-winning iPhone hack against the Uyghurs 

By Patrick Howell O'Neill

In August of 2019, Google revealed that someone was hacking iPhones “en masse” using five different zero-days, which the company’s researchers caught in the wild. One of those, as  Patrick Howell O'Neill reveals in this deep dive, was showcased at Tianfu Cup, a Chinese hacking competition. This revelation means some exploits shown at Chinese conferences then get repurposed by the government. In this case, to target Uyghurs, a muslim minority that has been systematically oppressed by the central government in Beijing. 

Google’s Top Security Teams Unilaterally Shut Down A Counterterrorism Operation 

By Patrick Howell O'Neill

In one of the year’s most shocking scoops, this story—also by Patrick Howell O'Neill—revealed that Google’s premier cybersecurity research team, Project Zero, had shut down an anti-terrorist espionage operation led by a Western government. Something like this does not happen very often. Tech and cybersecurity companies usually don’t interfere with Western cyberoperations. Google defended itself saying its Project Zero researchers “don’t perform attribution,” but the article highlights how that may be a half truth, given that another Google team, the Threat Analysis Group or TAG, which also was involved in this research, does do attribution. 

U.S. State Department Phones Hacked With Israeli Company Spyware - Sources 

By Christopher Bing and Joseph Menn

This year has been filled with revelation of abuses by customers of the infamous Israeli spyware seller NSO Group. Over the summer, several news organizations working with Amnesty International and French NGO Forbidden stories detailed a series of cases where NSO customers used the company’s tools to go after dissidents, journalists, and even heads of state. But in this case, the victims were American diplomats abroad, a shocking case that may explain why the US government blocklisted NSO. 

Colonial Pipeline Paid Hackers Nearly $5 Million in Ransom

By William Turton, Michael Riley, and Jennifer Jacobs

The ransomware attack on Colonial Pipeline, the operator of the largest gas pipeline in the United States, was perhaps the most influential and talked about cyberattack of the year. It caused gas shortages and long lines at stations, and pushed ransomware to the forefront as a national security issue. One of the most shocking details of this story was the fact that the company chose to pay the hackers the ransom, in this case $5 million. Perhaps we wouldn’t know this crucial detail if it wasn’t for this scoop by a team of Bloomberg reporters. 

The Opportunities—and Obstacles—for Women at NSA and Cyber Command

Lily Hay Newman

Cybersecurity is very unfriendly, to say the least, toward women. There’s sexual harassment at conferences, gatekeeping, and salary disparity. So it’s more important than ever to highlight these issues giving voices to the women in the industry. Lily Hay Newman does that here, speaking on the record with three women at the NSA, who talk about the hurdles and problems they had to face, and how the industry and the intelligence community have evolved. 

A Hospital Hit by Hackers, a Baby in Distress: The Case of the First Alleged Ransomware Death

By Kevin Poulsen, Robert McMillan,and Melanie Evans

For years, rivers and rivers of ink have been spilled speculating about the day a cyberattack would result in loss of life. For years, it was just a theoretical scenario, one that sounded unlikely. How could hackers kill someone? This story shows that, perhaps, that red line has already been crossed. This is the story of Nicko Silar, a child who was born at an Alabama hospital that was in the midst of a disruptive ransomware attack. His mom has since sued the hospital, alleging that it failed to take care of her child, who died nine months after being born due to complications that arose at birth, when hospital staff was overwhelmed, and key devices did not work as normal.

Evil Corp: 'My hunt for the world's most wanted hackers' 

By Joe Tidy

Ransomware was the cybersecurity story of the year. But ransomware stories seldom have a face. In this at times bizarre story, a BBC reporter travelled to Russia with the goal of actually meeting hackers working for ransomware gangs in person. He didn’t succeed, but he got awfully close, meeting a hacker’s dad, who defended his son. Joe Tidy and his colleagues at the BBC certainly deserve credit for their persistence and for thinking outside of the box. 

Hacker Risks Jail to Out Middlebury College Employee for Alleged Child Porn

By Shannon Vavra and Seamus Hughes

There are very few feel good stories in the world of cyber. This is one of them. A hacker came across a stash of child exploitation material owned by a college employee—by hacking into his computer. The hacker was then faced by a quandary: should they report the man and risk getting arrested for hacking into their computer? Or just pretend they never saw what they saw? The hacker chose to call law enforcement. In the end, the hacker got immunity from the prosecutors, and the college employee got arrested.  

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.