Next-Generation Cyber Threats: Acoustic Eavesdropping on Fiber Cable, Hardware Attacks, and Military Cyber Warfare (2021–2026)

Summary: 18 attacks published between 2021 and 2026 are summarized under five headings: physical side channels such as eavesdropping on sound through fiber-optic cable and power LEDs, processor and memory vulnerabilities such as GoFetch, Hertzbleed, Downfall and ZenHammer, air-gap-crossing leakage methods such as RAMBO and Deep-TEMPEST, attacks on artificial intelligence systems, and state-sponsored operations such as Viasat, PIPEDREAM, submarine cables and GNSS spoofing.

This article is based on work published in peer-reviewed conferences (USENIX Security, NDSS, USENIX Security, arXiv) or disclosed to the public by authoritative security research organizations (SentinelLabs, Dragos, Trail of Bits) during the 2021–2026 period. All citations refer to primary sources.

The paradigm of modern cybersecurity threats is changing fundamentally. Attackers now use not only software vulnerabilities but physics itself—light, sound, electromagnetic waves and even the radiation produced by the RAM data bus—as a weapon. This transformation is advancing in the civilian and military domains simultaneously.

In this comprehensive analysis, we examine the most surprising methods proven in laboratory settings or actively used on the battlefield over the past five years, verifying them against their academic sources.

Part I: Physical Side-Channel Attacks

1. Acoustic Eavesdropping on Fiber-Optic Cables (COAES)

Source: Youqian Zhang, Zheng Fang, Huan Wu and others, “Hiding an Ear in Plain Sight: On the Practicality and Implications of Acoustic Eavesdropping with Telecom Fiber Optic Cables”, NDSS Symposium 2026.

Fiber-optic cables, which form the backbone of internet infrastructure, are inherently sensitive to the micro-pressure changes created by sound waves when someone speaks in a room. This is a physical phenomenon called micro-bending: sound waves cause sub-nanometer deformations in the fiber's glass core, and these deformations change the phase state of the light inside the fiber.

Attack mechanism:

COAES: FIBER-OPTIC ACOUSTIC EAVESDROPPING CHAIN · NDSS 2026

• Sound → Micro-Bending: Speech waves bend the fiber's glass core at the sub-nanometer level; the refractive index changes instantaneously. (DAS / Rayleigh)

↓ Laser pulses are sent, backscatter is analyzed

• Sensory Receptor: The cable is wound around a 65 mm diameter PET cylinder to increase the efficiency of the mechanical-optical conversion. (Coil / Spool)

↓ Phase shifts are resolved

• AI Transcription (Whisper / Parakeet): Raw vibration data is processed with large language models to convert speech into text. WER in an office environment: 9%. (WER < 9%)

The study's most critical finding: “dark fiber” (unused lines) in FTTH fiber infrastructure reaching homes can be used for this attack, and ultrasonic jammers are completely ineffective against this threat because the system does not need a microphone; the fiber itself is the sensor.

“We show that COAES can be successfully conducted on telecom fiber-optic cables by leveraging off-the-shelf DAS systems with a specialized sensory receptor… The attack remains effective even when an ultrasonic jammer is deployed right next to the cable.”

— Youqian Zhang and others, NDSS 2026

2. Glowworm: Speech Recovery from a Power LED (2021)

Source: Ben Nassi, Yaron Pirutin and others, “Glowworm Attack: Optical TEMPEST Sound Recovery via a Device’s Power Indicator LED”, CCS 2021, Ben-Gurion University.

The small power indicator LEDs on smart speakers, USB hubs and desktop speakers are connected directly to the amplifier's power line. When sound is played, power consumption fluctuates and the LED's brightness changes. This change cannot be seen by the human eye but can be captured from 35 meters away with a telescope fitted with a photodiode.

Affected devices: Google Home Mini, Google Nest Audio, Logitech Z120/S120, JBL Go 2, Raspberry Pi 3/4. About 50% of the tested devices turned out to be vulnerable. The fix is extremely simple: a piece of black tape over the LED.

3. LidarPhone: Turning a Robot Vacuum's LiDAR into a Laser Microphone (2020/2021)

Source: Sriram Sami, Sean Rui Xiang Tan and others, “LidarPhone: Using Telerobotic LiDAR as a Microphone”, SenSys 2020, National University of Singapore & University of Maryland.

The rotating LiDAR sensors that robot vacuums use for navigation can be locked in place through software exploitation. When aimed at lightweight objects such as a trash can, a bag of chips or a plastic bag, human speech makes the object vibrate and changes the time of flight (ToF) of the reflected laser. From this data, processed with a deep learning filter, spoken digits and music genres were detected with over 90% accuracy.

Part II: Microprocessor and Hardware Vulnerabilities

4. GoFetch: An Unpatchable Cryptographic Leak on Apple Silicon (2024)

Source: Boru Chen, Yingchen Wang, Pradyumna Shome and others, “GoFetch: Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers”, USENIX Security 2024. Pwnie Award 2024 — Best Cryptographic Attack.

The Data Memory-Dependent Prefetcher (DMP) in Apple Silicon chips (M1, M2, M3, A14) is designed to improve performance. However, the DMP reads the contents of data in memory and speculatively pulls values that look like pointers into the cache. This behavior completely defeats cryptographic algorithms (RSA, Diffie-Hellman, CRYSTALS-Kyber, Dilithium) that run in constant time and are considered secure against side-channel attacks.

Source: gofetch.fail — Official project logo and attack summary. USENIX Security 2024.

“GoFetch is a microarchitectural side-channel attack that can extract secret keys from constant-time cryptographic implementations via data memory-dependent prefetchers (DMPs). We show that DMPs are present in many Apple CPUs and pose a real threat to multiple cryptographic implementations, allowing us to extract keys from OpenSSL Diffie-Hellman, Go RSA, as well as CRYSTALS Kyber and Dilithium.”

— Boru Chen, Yingchen Wang and others, USENIX Security 2024

Because the flaw is found directly in the silicon design, it cannot be closed with a software patch on existing devices. On M1 and M2, the DMP can only be disabled through kernel intervention (HID11_EL1[30] bit), but this is not yet supported by macOS.

5. Hertzbleed: Turning CPU Frequency into a Remote Cryptographic Timing Attack (2022)

Source: Yingchen Wang, Riccardo Paccagnella and others, “Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86”, USENIX Security 2022. CVE-2022-24436 (Intel) / CVE-2022-23823 (AMD).

Modern x86 processors use Dynamic Voltage and Frequency Scaling (DVFS) to manage power and heat balance. Power consumption varies according to the bits of the data being processed; as consumption rises, the processor frequency drops. An attacker can observe this frequency change remotely simply by measuring network latency (RTT) with microsecond precision and extract the server's cryptographic keys. It does not require physical power measurement.

6. Downfall / GDS (2023): Speculative Leak in the Intel Gather Instruction

Source: Daniel Moghimi, “Downfall: Exploiting Speculative Data Gathering”, USENIX Security 2023. CVE-2022-40982. All Intel processors from 6th generation (Skylake) to 11th generation (Tiger Lake) are affected.

The GATHER memory optimization instruction in Intel CPUs can inadvertently leak data from internal vector registers during speculative execution. Another process sharing the same physical processor core (including a VM or a trusted application) can read sensitive data, including passwords and cryptographic keys.

7. ZenHammer: Rowhammer on DDR5 Memory (2024)

Source: Patrick Jattke, Max Wipfli, Flavien Solt, Michele Marazzi and others, “ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms”, USENIX Security 2024, ETH Zurich.

DDR5 memory was considered immune to Rowhammer attacks thanks to its built-in error correction (On-Die ECC) and target row refresh (TRR) mechanisms. By reverse-engineering the memory controller timing patterns of the AMD Zen architecture, ETH Zurich researchers disabled these defenses and succeeded for the first time in manipulating targeted memory bits in DDR5 chips.

8. LeftoverLocals: GPU Memory Data Residue Leak (2024)

Source: Tyler Sorensen and others, “LeftoverLocals: Listening to LLM Responses Through Leaked GPU Local Memory”, Trail of Bits, January 2024.

On AMD, Apple and Qualcomm GPUs, after a process uses GPU local memory, that memory is not fully cleared. Another process using the same system can read this “residue” data. In LLM applications running in multi-user server environments, megabytes of data per call could be leaked this way.

Part III: Data Exfiltration Techniques Across Air Gaps

9. RAMBO: Seizing Isolated Systems by Emitting Radio Signals from the RAM Data Bus (2024)

Source: Mordechai Guri, “RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM”, arXiv:2409.02292, Ben-Gurion University, September 2024.

The RAMBO (Radiation of Air-gapped Memory Bus for Offense) method targets isolated (air-gapped) computers that are not connected to the internet. Lightweight malware planted on the system modulates the voltage and transfer patterns on the DDR RAM data bus with nanosecond precision. The RAM modules begin to emit electromagnetic waves like radio antennas. From a distance of 7 meters, with a cheap SDR (Software-Defined Radio) receiver, these signals can be captured, and passwords, keystrokes and documents can be stolen at a rate of about 1,000 bits per second.

10. Deep-TEMPEST: Reading Screen Content from HDMI with Artificial Intelligence (2024)

Source: Santiago Fernandez, Emilio Martinez et al., "Deep-TEMPEST: Using Deep Learning to Eavesdrop on HDMI from its Unintended Electromagnetic Emanations", arXiv:2407.09717, Universidad de la República, Uruguay, July 2024. Open source: github.com/emidan19/deep-tempest.

The parasitic electromagnetic emissions radiated by HDMI cables (Van Eck Phreaking) could previously be captured only as a noisy shadow using older methods. Researchers in Uruguay solved this problem by framing it as an inverse-problem deep learning model: when the weak RF signal collected with an SDR antenna is fed into the deep learning model, the Character Error Rate (CER) was reduced from 90% to below 30%, and the text and images on the screen became readable from beyond the building's wall.

Source: github.com/emidan19/deep-tempest — Official project image. arXiv:2407.09717.

Part IV: Attacks on Artificial Intelligence Systems

11. AI-Assisted Password Recovery via Acoustic Keyboard Eavesdropping (2023)

Source: Joshua Harrison, Ehsan Toreini, Maryam Mehrnezhad, "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards", arXiv:2308.01074, August 2023.

Because of the physical position of each key and the chassis structure, every key on a mechanical or laptop keyboard has a microscopically different sound signature. The researchers recorded the keystroke sounds from a Zoom meeting the target participated in or from a nearby smartphone microphone, converted them into spectrograms, and processed them with the CoAtNet deep learning model. Result: the typed content was detected with 95% accuracy. With LLM-assisted context correction, this rate rises even further.

12. Morris II: A Self-Replicating AI Worm (2024)

Source: Stav Cohen, Ron Bitton, Ben Nassi, "Here Comes the AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications", arXiv:2403.02817, March 2024.

Instead of traditional malware, this is the first worm concept that exploits the instruction-following mechanism of LLMs. A specially crafted poisoned text (adversarial prompt) embedded in an email takes over the model when it reaches the AI assistant that summarizes the email. While the model leaks the user's data, it also adds the same malicious instruction to the other emails it replies to. This worm concept, which spreads with zero-click on ChatGPT- and Gemini-based systems, has been verified.

Part V: Military and State-Sponsored Cyber Warfare

13. Lebanon Pager and Radio Operation (September 2024)

It has been recorded as the largest operation in history in which cyber intelligence and kinetic destruction converged in the supply chain. Explosives were integrated into the lithium batteries of the pagers sold to Hezbollah through front companies; an encrypted signal sent from a central server simultaneously triggered all the devices. This operation concretely demonstrated how supply chain security can be collapsed at the hardware layer.

14. AcidRain: The Viasat Satellite Attack (February 2022)

Source: Juan Andrés Guerrero-Saade, Max van Amerongen, "AcidRain: A Modem Wiper Rains Down on Europe", SentinelLabs, March 2022. Attribution: Russia GRU / Sandworm.

Source: sentinelone.com/labs/acidrain — Official SentinelLabs publication. March 2022.

In the hours when the ground invasion of Ukraine began (February 24, 2022), the Sandworm group infiltrated the management segment of Viasat's KA-SAT satellite network through a VPN vulnerability. An ELF binary named AcidRain, written for the MIPS architecture, was delivered to tens of thousands of satellite terminals disguised as an OTA (Over-The-Air) firmware update and irreversibly erased the devices' flash memory. The Ukrainian army's communications infrastructure was paralyzed, and the control lines of thousands of wind turbines across Europe were disabled.

"AcidRain is a wiper malware designed to attack modems and routers. Following a VPN exploitation, the threat actor deployed AcidRain to wipe Viasat KA-SAT modems across Europe, causing a major internet outage in Ukraine…"

— SentinelLabs, AcidRain: A Modem Wiper Rains Down on Europe, March 2022

15. PIPEDREAM / INCONTROLLER: An Industrial Control Systems Weapon (2022)

Source: Dragos Inc., "CHERNOVITE's PIPEDREAM Malware Targeting Industrial Control Systems", April 2022. Also published under the name INCONTROLLER by Mandiant (Google Cloud).

Source: dragos.com — Official Dragos threat report image. April 2022.

It is only the seventh ICS-focused malware identified in history. It targets Schneider Electric and Omron PLCs, OPC-UA servers, and the CODESYS runtime with five modular components:

PIPEDREAM: THE MATRIX OF FIVE MODULES · Dragos / CHERNOVITE

• EVILSCHOLAR: Schneider Electric Modicon PLC discovery and manipulation
• BADOMEN: Command and control of CODESYS-based Omron PLCs
• MOUSEHOLE: OPC-UA server scanning and schema mapping
• DUSTTUNNEL: Encrypted C2 tunnel and network pivoting module
• LAZYCARGO: Windows kernel privilege escalation via CVE-2020-15368 (ASRock driver vulnerability)

According to Dragos's analysis, PIPEDREAM has the capacity to carry out 38% of known ICS attack techniques and 83% of tactics on its own.

16. Submarine Fiber Optic Cable Sabotage and Passive Intelligence

More than 95% of global data traffic passes through submarine cables on the ocean floor. These lines have now become primary targets of military doctrines.

Passive Tapping: Special mission submarines (the USS Jimmy Carter in the US, the Yantar research vessel in Russia, and ROVs attached to the Losharik nuclear submarine) use the macro-bending technique to bend fibers slightly and tap the signal; the data stream is copied without being interrupted.

Gray Zone Sabotage (2023–2025): It has been documented that commercial-looking vessels around the Baltic Sea, the Red Sea, and the Taiwan Strait deliberately severed strategic fiber lines by dragging their anchors for kilometers along the ocean floor. Such incidents entered NATO's official security agenda in 2024.

17. CosmicStrand / MoonBounce: UEFI Firmware Rootkits

Source: Kaspersky Labs, "CosmicStrand: Discovery of a Sophisticated UEFI Firmware Rootkit", July 2022. Attributed to a Chinese APT group.

These tools, which settle directly into the SPI Flash chip on the motherboard or the UEFI Boot Manager layer, are undeletable even if the hard disk is removed, formatted, or the operating system is completely reinstalled. They disable the Windows Secure Boot architecture through unsigned drivers and take effect before the operating system kernel is loaded.

18. GNSS Spoofing and Cognitive Electronic Warfare

GNSS meaconing and spoofing attacks, actively used in Ukraine, the Middle East, and the Black Sea region since 2022, replace GPS coordinates with fake values and steer unmanned aerial vehicles and guided munitions to wrong locations. Cognitive EW algorithms have reached the capacity to attempt packet injection directly from the RF layer into the frequency-hopping transmission patterns of tactical data networks (such as Link-16).

My reading

These attacks converge on a common axis: The laws of physics are now an attack surface. Light, sound, electromagnetic waves, and crystal memory dynamics can be exploited by attackers without ever engaging software security models. From a defense perspective, this means the following:

• Software patches alone are insufficient; silicon design, electromagnetic isolation, and physical security layers must be considered together.
• Fiber infrastructure must be included within the scope of TSCM (Technical Surveillance Countermeasures).
• LLM-based systems must be designed at the architectural level against indirect prompt injection.
• Supply chain hardware assurance standards (SBOM + hardware BOM) must become mandatory in military and critical infrastructure systems.

Sources

1. Zhang, Y. et al. “Hiding an Ear in Plain Sight.” NDSS 2026. ndss-symposium.org
2. Nassi, B. et al. “Glowworm Attack.” ACM CCS 2021. nassiben.com
3. Sami, S. et al. “LidarPhone.” SenSys 2020. nus.edu.sg
4. Chen, B. et al. “GoFetch.” USENIX Security 2024. gofetch.fail
5. Wang, Y. et al. “Hertzbleed.” USENIX Security 2022. hertzbleed.com
6. Moghimi, D. “Downfall.” USENIX Security 2023. downfall.page
7. Jattke, P. et al. “ZenHammer.” USENIX Security 2024. comsec.ethz.ch
8. Sorensen, T. et al. “LeftoverLocals.” Trail of Bits, 2024. leftoverlocals.com
9. Guri, M. “RAMBO.” arXiv:2409.02292, 2024. arxiv.org
10. Fernandez, S. et al. “Deep-TEMPEST.” arXiv:2407.09717, 2024. github.com/emidan19/deep-tempest
11. Harrison, J. et al. “Acoustic Side Channel Attack on Keyboards.” arXiv:2308.01074, 2023.
12. Cohen, S. et al. “Morris II.” arXiv:2403.02817, 2024.
13. Guerrero-Saade, J.A. et al. “AcidRain.” SentinelLabs, 2022. sentinelone.com/labs/acidrain
14. Dragos Inc. “PIPEDREAM: CHERNOVITE’s ICS Malware.” 2022. dragos.com
15. Kaspersky GReAT. “CosmicStrand UEFI Rootkit.” 2022. kaspersky.com