In this CognectCon2025 briefing, Matthew Rosenquist outlines a sophisticated nation‑state cyber campaign that blends large‑scale misinformation, social‑engineering, and a malicious applet/loader to launch a self‑propagating worm against Western critical infrastructure. The operation begins with a seemingly benign click‑bait campaign targeting empathetic Western audiences through influencers and media partners, encouraging users to share a link that installs a small, heavily encrypted applet. The loader is timed to remain dormant for 7–9 days, evading early analysis, before it activates a worm that contacts pre‑programmed IP addresses, domains, and backdoors sourced from dark‑web password lists. The worm spreads across all 16 critical‑infrastructure sectors—telecommunications, power, water, transport, etc.—causing cascading failures that cripple communications and utilities, thereby sending a political message that deters coalition military action. Rosenquist emphasizes the strategic intent: using cyber‑destruction as a deterrent, exploiting the vulnerability of non‑technical, well‑meaning users, and demonstrating that the West’s infrastructure is susceptible to coordinated, state‑sponsored attacks.
Chapters
So this is how it breaks down. They use the resources they've already established, infrastructure resources for communications, for misinformation campaigns, and they are going to build a bigger campaign and they are going to target empathetic Westerners, right? Who, who really see the plight of this troubled region in the world. And all they're asking for is a click. And that click— no, no, no, it's, it's, it's okay, right? Because it, it simply installs a small little applet. And it tracks how many other people also care about this plight, also want freedom and peace. Finally, peace in the Middle East. So this applet runs, and you can see, obviously, there's going to be millions, right? So you are part of a community, and you should share this link with your friends and your family. Okay, so what's happening in the background? You've probably figured it out. This link is malicious. This applet is malicious. But given the history and the expertise that these attackers have. And now without the restraints of not going after critical infrastructure in the West, what this simple loader does is it's timed because timing is everything. Right? You want a lot of people to click on it, at least tens or hundreds of thousands of people, but you'll take tens of thousands of Westerners on their systems, on their phones. Right, but at the same time, you get these pesky security researchers and so forth that like to really look into things. So it's a matter of time. This particular applet will run for about 7 to 9 days, and the encryption on it is pretty good from the compilers that they've used. It's gonna take Microsoft and a few other companies, some dedicated resources. And here's something new. They're going to hire Western media companies. They're going to hire influencers to help support peace in the Middle East. Just one click, one click. And at the designated time before it can truly— its nefarious background can be determined. It loads a self-propagating worm and initiates an attack based on pre-programmed IP addresses, web domains, backdoors that have already been established, dark web lists of passwords targeting all 16 critical infrastructures. Because we know if one is targeted, We can recover it. We can recover it pretty fast, actually. Matter of days or weeks. But when you start taking out the ability for those sectors to communicate, because you took out telecommunications, you took out their ability to have stable power. Now the complexity compounds. So the gloves are off. They're going after all 16, not in a region. Western nations, the United States, Israel, and allies, the very companies and targets who build the weapons who are oppressing their people. That's who they're going after. And it's a destructive virus. I'm sorry, destructive war. Self-propagating war. Everybody loves Stuxnet and Code Red and Sequel Slammer. Because once it gets inside, it doesn't stop there. It continues to propagate, and then it does permanent destructive damage to brain systems. And that is the message to the West. That there are consequences. And you have vulnerability. You are weak. We don't need all of our critical infrastructures. You can bomb us and we can still reach out. That level of destruction, that level of message? Because the one thing they don't want— they don't want a coalition of Western nations to use military force. They're already seeing what's happening to them with a small nation with a good military force. They don't want a coalition, so they're not going to use military force. They're going to use cyber, and they're going to use it to convince empathetic people, good-natured, but maybe not well trained, maybe not cognitively resilient to these types of attacks, to be the avenue and the pathway for their message and their political objectives.
