After fighting malware for decades, this cybersecurity veteran is now hacking drones

Mikko Hyppönen is pacing backmost and distant connected the stage, with his trademark acheronian blonde ponytail resting connected an impeccable teal suit. A seasoned speaker, helium is trying to marque an important constituent to a country afloat of chap hackers and information researchers astatine 1 of the industry’s planetary yearly meet-ups.

“I often telephone this ‘cybersecurity Tetris’,” helium tells the assemblage with a superior face, reeling disconnected the rules of the classical video game. When you implicit a full enactment of bricks, the enactment vanishes, leaving the remainder of the bricks to autumn into a caller line.

“So your successes disappear, portion your failures heap up,” helium tells the assemblage during his keynote astatine Black Hat successful Las Vegas successful 2025. “The situation we look arsenic cybersecurity radical is that our enactment is invisible… erstwhile you bash your occupation perfectly, the extremity effect is that thing happens.”

Hyppönen’s work, however, has surely not been invisible. As 1 of the industry’s longest serving cybersecurity figures, helium has spent much than 35 years warring malware. When helium started successful the precocious 1980s, the word “malware” was inactive acold from mundane parlance; the presumption alternatively were machine “virus” oregon “trojans.” The net was inactive thing fewer radical had entree to, and immoderate viruses relied connected infecting computers with floppy disks. 

Since then, Hyppönen estimated helium has analyzed thousands of antithetic kinds of malware. And acknowledgment to his predominant talks astatine conferences each implicit the world, helium has go 1 of the astir recognizable faces and respected voices of the cybersecurity community.

While Hyppönen has spent overmuch of his beingness trying to support malware from getting into places it is not expected to, present helium is inactive doing overmuch of the same, albeit a somewhat antithetic tack: His caller situation is to support radical against drones. 

Hyppönen, who is Finnish, told maine during a caller interrogation that helium lives astir 2 hours distant from Finland’s borderline with Russia. An progressively hostile Russia and its 2022 full-scale penetration of Ukraine, wherever the bulk of deaths person reportedly travel from unmanned aerial attacks, person made Hyppönen judge helium tin person renewed interaction by warring drones.

For Hyppönen, it is besides a substance of recognizing that portion determination are inactive long-standing problems to lick successful the satellite of cybersecurity — malware is not going anyplace and determination are plentifulness of caller problems connected the skyline — the manufacture has made immense strides implicit the past 2 decades. An iPhone, Hyppönen brought up arsenic an example, is an highly unafraid device. The cybersecurity aspects of drone warfare, connected the different hand, stay astir uncharted territory.

Image Credits:courtesy of Mikko Hypponen

From viruses and worms to malware and spyware…

Hyppönen started aboriginal successful cybersecurity by hacking video games during the 1980s. His emotion for cybersecurity came from reverse engineering bundle to fig retired a mode to region anti-piracy protections from a Commodore 64 games console. He learned to codification by processing escapade games, and sharpened his reverse engineering skills by analyzing malware astatine his archetypal occupation astatine Finnish institution Data Fellows, which aboriginal became the well-known antivirus shaper F-Secure. 

Since then, Hyppönen has been connected the beforehand lines of the combat against malware, witnessing however it evolved.

In the aboriginal years, microorganism writers developed their malicious codification often exclusively retired of passionateness and curiosity to spot what was imaginable with codification alone. While immoderate cyberespionage existed, hackers had yet to observe ways to monetize hacking by today’s standards, similar ransomware attacks. There was nary cryptocurrency to facilitate extortion, nor a transgression marketplace for stolen data.

Form.A, for example, was 1 of the astir communal viruses successful the aboriginal 1990s, which infected computers with a floppy disk. A mentation of that microorganism did not destruct thing — sometimes conscionable displaying a connection connected the person’s screen, and that was it. But the microorganism travelled astir the world, including landing connected the probe stations astatine the South Pole, Hyppönen told me.

Hyppönen recounted the infamous ILOVEYOU virus, which helium and his colleagues were the archetypal to observe successful 2000. ILOVEYOU was wormable, meaning it dispersed automatically from machine to computer. It arrived via email arsenic a substance file, purportedly a emotion letter. If the people opened it, it would overwrite and corrupt immoderate files connected the person’s computer, and past nonstop itself to each their contacts. 

The microorganism infected implicit 10 cardinal Windows computers worldwide.

Malware has changed dramatically since then. Virtually nary 1 develops malware arsenic a hobby, and creating malicious bundle that self-replicates is practically a warrant that it volition get caught by cybersecurity defenders susceptible of neutralizing it quickly, and perchance catching its author.

No 1 does it for the emotion of the crippled anymore, according to Hyppönen. “The property of viruses is firmly down us,” helium said. 

Seldom bash we present spot self-spreading worms — with uncommon exceptions, specified arsenic the destructive WannaCry ransomware attack by North Korea successful 2017; and the NotPetya mass-hacking run launched by Russia aboriginal that year, which crippled overmuch of the Ukrainian net and powerfulness grid. Now, malware is astir exclusively utilized by cybercriminals, spies, and mercenary spyware makers who make exploits for government-backed hacking and espionage. Those groups typically enactment successful the shadows, and privation to support their tools hidden to proceed their activities and to debar cybersecurity defenders oregon instrumentality enforcement. 

The different differences contiguous are that the cybersecurity manufacture is present estimated to beryllium worthy $250 billion. The manufacture has professionalized, successful portion arsenic a necessity, to combat the summation successful malware attacks. Defenders went from giving distant their bundle for free, to turning it into a paid work oregon product, said Hyppönen. 

Computers and newer inventions similar smartphones, which began to instrumentality disconnected during the aboriginal 2000s, person go overmuch harder to hack. If the tools to hack an iPhone oregon the Chrome browser outgo six-figures oregon adjacent a fewer cardinal dollars, Hyppönen argued, this efficaciously makes an exploit truthful costly that lone the highly resourced, similar governments, tin usage them, alternatively than financially motivated cybercriminals. That’s a immense triumph for consumers, and for the cybersecurity manufacture that’s a occupation good done.

Image Credits:courtesy of Mikko Hypponen

From warring spies and criminals… to countering drones

In mid-2025, Hyppönen pivoted from cybersecurity to a antithetic benignant of antiaircraft work. He became the main probe serviceman astatine Sensofusion, a Helsinki-based institution that develops an anti-drone strategy for instrumentality enforcement agencies and the military. 

Hyppönen told maine that was motivated to get into a processing caller manufacture due to the fact that of what helium saw happening successful Ukraine, a warfare defined by drones. As a Finnish citizen, who serves successful the subject reserves (“I can’t archer you what I do, but I tin archer you that they don’t springiness maine a firearm due to the fact that I’m overmuch much destructive with a keyboard,” helium tells me), and with 2 grandfathers who fought the Russians, Hyppönen is acutely alert of the beingness of an force conscionable implicit his country’s border.

“The concern is very, precise important to me,” helium tells me. “It’s much meaningful to enactment warring against drones, not conscionable the drones that we spot today, but besides the drones of tomorrow,” helium said. “We’re connected the broadside of humans against machines, which sounds a small spot similar subject fiction, but that’s precise concretely what we do.”

The cybersecurity and drone industries whitethorn look leagues isolated from 1 another, but determination are wide parallels betwixt warring malware and warring drones, according to Hyppönen. To combat malware, cybersecurity companies person travel up with mechanisms, known arsenic signatures, to place what is malware and what is not and past observe and artifact it. In the lawsuit of drones, Hyppönen explained, defenses impact gathering systems that tin find and jam vigor drones, and by recognizing frequencies that are being utilized to power the autonomous vehicles. 

Hyppönen explained that it’s imaginable to place and observe drones by signaling their vigor frequencies, known arsenic their IQ samples. 

“We observe the protocol from determination and physique up signatures for detecting chartless drones,” helium said. 

He besides explained that if you observe the protocol and frequencies utilized to power the drone, you tin besides effort to behaviour cyberattacks against it. You tin origin the drone’s strategy to malfunction, and clang the drone into the ground. “So successful galore ways, these protocol level attacks are much, overmuch easier successful the drone satellite due to the fact that the archetypal measurement is the past step,” Hyppönen said. “If you find a vulnerability, you’re done.”

The strategy successful warring malware and warring drones is not the lone happening that hasn’t changed successful his life. The cat-and-mouse crippled of learning however to halt a threat, and past the force learning from that and devising caller ways to get astir defenses, and connected and on, is the aforesaid successful the satellite of drones. And then, there’s the individuality of the enemy.  

“I spent a large portion of my vocation warring against Russian malware attacks,” helium said. “Now I’m warring Russian drone attacks.”