Loading story…
A 23-year-old university student in Taiwan was arrested after allegedly using radio spoofing to disrupt Taiwan High Speed Rail by transmitting a false high-priority General Alarm signal over the railway’s TETRA communications system. The spoofed alert forced train drivers in the affected sector to enter manual emergency stop mode, halting three to four trains and causing delays of roughly 48 minutes to nearly an hour during the Qingming Festival travel period. Investigators said the attacker cloned or decoded radio parameters from a legitimate TETRA mobile device and generated the alarm externally rather than from any authorized railway handset.
Authorities said the suspect used software-defined radio gear, handheld radios, and other electromagnetic interference and wireless broadcasting equipment, allegedly exploiting a computer-system weakness and communication parameters that had reportedly not been rotated for 19 years. A 21-year-old alleged accomplice was reported to have supplied key Taiwan High Speed Rail parameters. Investigators traced the activity through railway network logs to the suspect’s residence, seized communications equipment, and referred the case to prosecutors; the suspect was later released on NT$100,000 bail and faces charges tied to endangering public transportation and using illegal signal-interference equipment.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Authorities arrested and questioned the 23-year-old suspect over the rail disruption, alleging he exploited communication-system weaknesses and used illegal signal-interference equipment. He was charged under Taiwan law, brought before the Taoyuan District Prosecutors' Office, and released on NT$100,000 bail.
Investigators used THSR network logs to trace the false signal activity to a 23-year-old university student's residence and identified a 21-year-old alleged accomplice who reportedly supplied key rail communication parameters. Authorities seized communications gear, including software-defined radio and related wireless equipment.
After the disruption, Taiwan High Speed Rail reviewed its communications equipment, found no authorized devices missing, and concluded the alarm had been generated externally. The company reported the incident to the Railway Police Bureau and the Criminal Investigation Bureau's Telecommunications Investigation Division.
On the final night of the Qingming Festival holiday, an attacker transmitted a false high-priority General Alarm signal on Taiwan High Speed Rail's TETRA radio network, forcing trains into emergency stop mode. Reports indicate the disruption halted three to four trains for roughly 48 minutes to nearly an hour.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetomshardware.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcertl-sdr.com
Open sourcetaipeitimes.com
Open sourcenewtalk.tw
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious actors have exploited unsecured US radio transmission equipment to hijack broadcasts, injecting profanity-laden and offensive content by abusing the Emergency Alert System (EAS) tones. The Federal Communications Commission (FCC) issued a warning after a series of incidents in Texas and Virginia, where attackers targeted Barix network audio devices, reconfiguring them to stream attacker-controlled audio that included simulated or real EAS alert tones followed by explicit material. Some stations, such as HTX Media in Houston, confirmed their broadcasts were overtaken, with listeners reporting repeated emergency tones and vulgar tracks during live programming. The FCC attributed these intrusions to unsecured studio-to-transmitter links and default or weak device configurations, allowing unauthorized access to critical broadcast infrastructure. In response, the FCC published a checklist of best practices for broadcasters, urging immediate firmware updates, replacement of default passwords, network segmentation, and vigilant monitoring of equipment logs. The agency also referenced prior guidance and encouraged direct engagement with equipment manufacturers to ensure robust security measures are in place, particularly for Barix hardware commonly used in the affected systems.
Jun 29, 2026
Toronto Police arrested three men and laid 44 charges over an alleged **SMS blaster** operation in the Greater Toronto Area that used rogue cellular base stations mounted in vehicles to impersonate legitimate towers and push phishing texts to nearby phones. Investigators said the campaign, dubbed **Project Lighthouse**, began drawing scrutiny after suspicious activity was reported in downtown Toronto in November 2025, with searches in Markham and Hamilton later leading to the seizure of multiple custom-built blasters and other electronic devices; two suspects were arrested during the searches and a third later surrendered. Authorities said the devices forced tens of thousands of phones to connect automatically, enabling spoofed messages that appeared to come from banks, government agencies, and other trusted organizations and directing victims to fraudulent sites designed to steal credentials, passwords, and banking information. Police estimate the scheme caused roughly **13 million network disruptions** or instances of mobile network entrapment, temporarily knocking affected devices off legitimate service and potentially blocking access to **911**, and described the case as the first known detection of this type of threat in Canada while warning that conventional smishing remains an ongoing risk.
Jun 29, 2026
Taiwanese authorities have charged two local executives for allegedly helping China-linked cyber operators run a social-engineering and espionage campaign against Taiwanese officials, academics, journalists, NGO workers, and civil society figures. Investigators said the men obtained Taiwanese `LINE` accounts and leased them to Xiamen Empress Information Technology Co. Ltd., a company authorities say is tied to China’s cyber forces, allowing operators to impersonate journalists associated with the **International Consortium of Investigative Journalists** and approach targets with phishing messages and other deceptive outreach. The case aligns with earlier findings from **ICIJ** and **Citizen Lab**, which documented a broader Beijing-linked operation that used fake journalist personas, LinkedIn messages, paid article offers, phishing emails, and malware disguised as secure communications software to steal information from people of interest to the Chinese government. Reporting on the wider campaign said the infrastructure included more than 100 malicious domains and targeted dissidents, democracy activists, and Uyghur, Tibetan, Hong Kong, and Taiwanese communities, underscoring how commercial intermediaries allegedly supported state-linked cyber espionage.
Jul 8, 2026