Forward Edge-AI, Inc today announced two major milestones in advancing quantum-resistant communications: the United States Patent and Trademark Office (USPTO) has issued a Notice of Allowance for its patent application covering attack-resilient, trust-verified communications, and the company has successfully delivered its Isidore Quantum® One-Way Data Diode to National Central University (NCU) in Taiwan.
Breakthrough Deployment to National Central University
The delivery of Isidore Quantum® to National Central University marks a significant milestone in cross-national research collaboration on next-generation cyber defense technologies. The deployment advances quantum-resistant data security research and demonstrates the operational readiness of Forward Edge-AI’s technology in critical infrastructure environments. Traditional one-way diodes, which rely on fiber optic hardware isolation, cannot support encryption, encryption typically requires two-way exchanges for key negotiation. Isidore Quantum achieves a breakthrough: it enables true one-way data flow while simultaneously supporting NIST-approved post-quantum encryption using AES-256 GCM and ML-KEM.
This capability is unique and addresses a critical vulnerability: traditional one-way diodes prevent unauthorized network access but do not protect data in flight from Harvest Now, Decrypt Later (HNDL) attacks. Without encryption, data flowing through conventional diodes remains vulnerable to interception and future decryption. Isidore Quantum solves this by combining unidirectional enforcement with quantum-resistant encryption, ensuring captured data remains protected even against future quantum computers.
Additionally, unlike traditional diode systems that require expensive fiber optic infrastructure, Isidore Quantum operates seamlessly on both fiber and copper networks. This means organizations can deploy quantum-safe, one-way data protection without costly infrastructure replacement, dramatically reducing deployment time and capital expense.
The patent, U.S. Patent No. 12,452,301 B2, titled “Methods, Systems, Apparatuses, and Methods for Facilitating Attack-Resilient Communications Between Devices,” secures Forward Edge-AI’s leadership in developing hardware-based cryptographic resilience for critical communications, a foundational advance for post-quantum security. The patented system introduces a trusted network switch architecture that maintains secure communications between devices, even under attack or when exposed to compromised networks. Unlike traditional encryption, which relies solely on software protocols, Forward Edge-AI’s solution embeds cryptographic verification and isolation directly into the network hardware layer. This ensures message integrity, authenticity, and confidentiality, even in environments where adversaries have advanced computational capabilities.
The innovation enables:
- Tamper-resistant encryption relays between trusted elements
- Dynamic re-encryption and authentication of data packets in transit
- Hardware-enforced trust boundaries that isolate compromised components
- Cryptographic switching as low as sub-millisecond when under attack—a critical breakthrough for operational continuity
Traditional security requirements mandate cryptographic failover within 30 seconds or less during attack scenarios. Forward Edge-AI’s patented architecture achieves switching as low as sub-millisecond under attack conditions, exceeding government specifications by orders of magnitude. While switching times can vary based on network conditions, ranging from sub-millisecond to as high as six seconds, the system consistently performs well below the 30-second threshold that no competing solution has yet met.
This innovation was made possible through U.S. Government support under Agreement Number FA8075-23-C-0003, awarded by the U.S. Air Force Research Laboratory (AFRL). The government retains certain rights in this invention, underscoring its national security relevance.
Preparing for Q-Day and the HNDL Threat
As global cybersecurity leaders warn of Q-Day, the moment quantum computers can break today’s encryption, Forward Edge-AI’s technology addresses the urgent need to defend against Harvest Now, Decrypt Later (HNDL) attacks. Isidore Quantum encrypts data unidirectionally using AES-256 ML-KEM and ML-DSA post-quantum algorithms, ensuring that data captured today remains protected well into the future of quantum computing, a capability traditional one-way diodes cannot provide. “Q-Day isn’t a distant risk; it’s a certainty,” said Eric Adolphe. “Our patented Switch Isidore architecture provides the trust fabric needed to secure command, control, and communications across defense, finance, and critical infrastructure sectors in the quantum era.”
Isidore Quantum has been tested and validated in 23 pilots across the U.S. Army, Air Force, Navy, Space Force, and Microsoft, achieving <0.5 millisecond latency and up to 2 Gbps throughput. The device consumes less than 8 watts of power, operates silently without fans, and is exportable under license exception ENC (ECCN 5A002). “Every competitor still has something in the lab. We have something in the field,” said Ross Coffman, President of Forward Edge-AI and retired U.S. Army Lieutenant General. “Given the federal mandate to begin the post-quantum transition by December 2025, only proven solutions like ours can meet the deadline.”
The White House’s Executive Order 14144 requires all federal agencies to begin the post-quantum transition by December 2025 and complete it by 2030. Isidore Quantum allows organizations to comply instantly, without disruption, re-certification, or re-architecture.
Iran’s MuddyWater targets critical infrastructure in Israel and Egypt, masquerades as Snake game
Posted in Commentary with tags ESET on December 2, 2025 by itnerdESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. The victims in Israel were in the technology, engineering, manufacturing, local government, and educational sectors. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its persistent targeting of government and critical infrastructure sectors, often leveraging custom malware and publicly available tools, and has links to the Ministry of Intelligence and National Security of Iran. In this campaign, the attackers deployed a set of previously undocumented, custom tools with the objective of improving defense evasion and persistence. New backdoor MuddyViper enables the attackers to collect system information, execute files and shell commands, transfer files, and exfiltrate Windows login credentials and browser data. The campaign leverages additional credential stealers. Among these tools is Fooder, a custom loader that masquerades as the classic Snake game.
In this campaign, initial access is typically achieved through spearphishing emails, often containing PDF attachments that link to installers for remote monitoring and management (RMM) software hosted on free file-sharing platforms such as OneHub, Egnyte, or Mega. These links lead to the download of tools including Atera, Level, PDQ, and SimpleHelp. Among the tools deployed by MuddyWater operators is also the VAX One backdoor, named after the legitimate software which it impersonates: Veeam, AnyDesk, Xerox, and the OneDrive updater service.
The group’s continued reliance on this familiar playbook makes its activity relatively easy to detect and block. However, in this case, the group also used more advanced techniques to deploy MuddyViper, a new backdoor, by using a loader (Fooder) that reflectively loads MuddyViper into memory and executes it. Several versions of Fooder masquerade as the classic Snake game, hence the designation, MuddyViper. Another notable characteristic of Fooder is its frequent use of a custom delay function that implements the core logic of the Snake game, combined with “Sleep” API calls. These features are intended to delay execution in an attempt to hide malicious behavior from automated analysis systems. Additionally, MuddyWater developers adopted CNG, the next-generation Windows cryptographic API, which is unique for Iran-aligned groups and somewhat atypical across the broader threat landscape. During this campaign, the operators deliberately avoided hands-on-keyboard interactive sessions, which is a historically noisy technique often characterized by mistyped commands. Thus, while some components remain noisy and easily detected, as is typical for MuddyWater, overall this campaign shows signs of technical evolution – increased precision, strategic targeting, and a more advanced toolset.
The post-compromise toolset also includes multiple credential stealers: CE-Notes, which targets Chromium-based browsers; LP-Notes, which stages and verifies stolen credentials; and Blub, which steals login data from Chrome, Edge, Firefox, and Opera browsers.
MuddyWater was first introduced to the public in 2017 by Unit 42, whose description of the group’s activity is consistent with ESET’s profiling – a focus on cyberespionage, the use of malicious documents as attachments designed to prompt users to enable macros and bypass security controls, and primarily targeting entities located in the Middle East.
Notable past activities include Operation Quicksand (2020), a cyberespionage campaign targeting Israeli government entities and telecommunications organizations, which exemplifies the group’s evolution from basic phishing tactics to more advanced, multistage operations; and a campaign targeting political groups and organizations in Türkiye, demonstrating the group’s geopolitical focus, its ability to adapt social engineering tactics to local contexts, and reliance on modular malware and flexible C&C infrastructure.
ESET has documented multiple campaigns attributed to MuddyWater that highlight the group’s evolving toolset and shifting operational focus. In March and April 2023, MuddyWater targeted an unidentified victim in Saudi Arabia, and the group conducted a campaign in January and February 2025 that was notable for its operational overlap with Lyceum (an OilRig subgroup). This cooperation suggests that MuddyWater may be acting as an initial access broker for other Iran-aligned groups.
For a more detailed analysis of the latest MuddyWater campaign, check out the latest ESET Research blogpost “MuddyWater: Snakes by the riverbank” on WeLiveSecurity.com.
Leave a comment »