The FBI and tech expert Kurt the CyberGuy are issuing an urgent warning about a troubling new form of cyberattack—one involving so-called “time-traveling hackers.”

While this doesn’t involve literal time travel, the threat is very real. Hackers are now manipulating internal system clocks to bypass modern cybersecurity defenses.

What Are “Time-Traveling Hackers”?

The phrase “time-traveling hackers” describes a cyberattack technique that allows threat actors to manipulate a device’s system clock.

By setting a device’s date back to a time when expired security certificates were still valid, attackers can reactivate malicious software as if it were trusted.

This tactic was used in attacks by the Medusa ransomware gang, a group notorious for targeting critical infrastructure.

Kurt the CyberGuy explained in an article published on April 27 that this method is particularly insidious because it allows outdated, signed malware to pass through defenses like Windows Defender, simply by tricking the system into thinking it’s operating in the past.

According to the FBI’s March 12 cybersecurity advisory (AA25-071A), over 300 critical infrastructure targets have already been affected. The attackers often pair this technique with social engineering and unpatched software vulnerabilities to devastating effect.

Why This Attack Works

The core of this threat lies in exploiting how digital systems trust expired security certificates. A certificate that expired in 2020, for example, could be used again if the system clock is rolled back to 2019. Since systems use certificate dates to validate software, this trick can make malware appear completely legitimate.

As Kurt explains, “This kind of strategy challenges the way we think about security. It is not just about building stronger defenses but also about questioning the default assumptions built into the technology we use every day.”

5 Ways to Defend Against Time-Traveling Hackers

To guard against these sophisticated attacks, both the FBI and Kurt the CyberGuy recommend several key strategies:

• Use strong antivirus software
  “A strong antivirus isn’t just for catching old-school viruses anymore,” Kurt writes. It can block malicious downloads, stop ransomware, and detect phishing links. Since groups like Medusa use fake updates and clever tricks, antivirus software provides a critical first line of defense. Check Kurt’s picks for top antivirus programs of 2025.
• Enable two-factor authentication (2FA)
  The FBI specifically advises turning on 2FA, especially for critical systems like VPNs and webmail. 2FA greatly reduces the chance of unauthorized access, even if a hacker has your credentials.
• Use strong, unique passwords
  Many attacks rely on reused or weak passwords. A password manager can generate and store complex, unique passwords for each account. Kurt notes, “Get more details about my best expert-reviewed password managers of 2025 here.”
• Monitor for suspicious system time changes
  Since these attacks rely on rolling back the system clock, detecting and logging such changes is essential. Organizations should implement monitoring tools that flag unexpected clock modifications.
• Keep systems updated and patch known vulnerabilities
  Medusa’s campaigns often target systems with outdated software or unpatched bugs. Regularly installing updates for your operating system, drivers, and applications is one of the most effective defenses.

A New Era of Cyber Threats

This type of attack represents a shift in how hackers operate. Rather than brute-force or traditional exploitation, they’re now targeting the foundational logic that computer systems rely on.

“It’s something as simple as the system clock,” Kurt says, “but it can completely compromise your defenses.”

The FBI is urging all organizations, especially those in critical infrastructure, to harden their systems, patch software vulnerabilities, and implement policies that detect unusual behavior such as system clock rollbacks.

For more tech security details, check out: Kurt the CyberGuy