-
Cybersecurity researchers have discovered a fresh set of malicious packages across npm and the Python Package Index (PyPI) repository linked to a fake recruitment-themed campaign orchestrated by the North Korea-linked Lazarus Group. The coordinated campaign has been codenamed graphalgo in reference to the first package published in the npm registry. It’s assessed to be active since May 2025. “
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
Border patrol agents prompted the extraordinary U.S. airspace closure over El Paso Tuesday night and into Wednesday after using a high-powered laser to shoot down what was later revealed to be a party balloon that had drifted into the sky near the U.S.-Mexico border.Initially, Transportation Secretary Sean Duffy claimed the U.S. military was responsible and said the Federal Aviation Administration lifted its 10-day closure after “a cartel drone incursion” had been “neutralized.” That was far from the truth, as military and federal officials familiar with the incident later told media outlets.
Customs and Border Protection used the directed-energy weapon “near Fort Bliss without coordinating with the FAA,” the Associated Press reported Wednesday. Pentagon chief Pete Hegseth loaned the weapon to Homeland Security officials for a 30-day period that began last month, Fox reported. On Tuesday, “CBP officials thought they were firing on a cartel drone…but it turned out to be a party balloon,” the New York Times reported.
The incident occurred about a week before a planned meeting about the weapon’s safety. Some military officials reportedly believed “requirements governing the protection of certain facilities from unmanned aircraft had been met,” justifying the weapon’s use before it had been authorized by the FAA, according to CBS News. A meeting about the weapon’s safety was scheduled for Feb. 20, “but the Pentagon and DHS wanted to move forward more quickly, prompting the FAA to put the flight restrictions in place,” the Washington Post reported.
Drones can be “useful for pinpointing the location of US Border Patrol agents to assist the cartel in smuggling non-citizens across the border into the United States,” Ars Technica points out. However, nothing about alleged drone activity in this incident appears to have been out of the ordinary, Rep. Veronica Escobar, D-Texas, said at a news conference Wednesday. And that suggests it remains unclear whether the incident resulted from “genuine concern about air travelers, a show of force, a fit of pique, or something else,” as Eric Berger of Ars Technica writes.
Local reax: “This was a major and unnecessary disruption, one that has not occurred since 9/11,” El Paso Mayor Renard Johnson told reporters Wednesday. You cannot restrict airspace over a major city without coordinating with the city, the airport, the hospitals, the community leadership. That failure to communicate is unacceptable,” Johnson said.
“We have never seen something quite this extreme,” El Paso City Rep. Chris Canales said Wednesday. “No one from the local government or the local military base received any advance notice more than a few minutes, nor did the mayor.”
Additional reading:
- Update: An immigration judge dropped the deportation case against the father of three U.S. Marines detained last year while landscaping. He’s now been enrolled in the military’s “parole in place” program, which recruiters have been using in Minnesota and Oregon;
- Developing: Trump’s border czar announced Thursday the feds will end their immigration crackdown in Minnesota; the operation surged 3,000 agents to a city with just 600 police, resulting in more than 4,000 arrests as well as the deaths of two American citizens before multiple surveys showed voters souring on the administration’s immigration agenda;
- “CBP Signs Clearview AI Deal to Use Face Recognition for ‘Tactical Targeting,’” WIRED reported Wednesday;
- And in commentary, “ICE Is on a Dark Path. Congress Must Act Now,” the New York Times editorial board argued Thursday ahead of the Friday deadline for Congress to fund DHS.
Welcome to this Thursday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1988, Navy missile-cruiser USS Yorktown and the destroyer USS Caron were intentionally rammed and pushed by Soviet vessels in the Black Sea as the Soviets sought to push the American ships out of Soviet territorial waters and into international waters.
Around the Defense Department
Two U.S. Navy ships collided while attempting to refuel in the Caribbean Sea Thursday, the Wall Street Journal reports. The destroyer USS Truxtun was taking on fuel from the USNS Supply fast combat support ship, both part of the largest naval buildup in the region since the Cuban Missile crisis.
Two people were injured but they’re in stable condition, and both ships have moved on with their mission, officials said. The incident is under investigation.
Here’s an explainer video about the process of refueling at sea.
A Marine who fell overboard in the Caribbean Sea has been declared dead after search-and-rescue efforts were unsuccessful, Military Times reported Thursday. His name is Lance Cpl. Chukwuemeka E. Oforah, 21, and he fell from the amphibious assault ship USS Iwo Jima on Feb. 7. He was assigned to the 3rd Battalion, 6th Marines, which is based out of Camp Lejeune, N.C.
Developing: The Navy is preparing to send a second aircraft carrier to the Middle East, the Journal reported separately on Wednesday. The USS Abraham Lincoln carrier strike group is already in the region amid renewed tensions with Iran.
USS George H.W. Bush would likely be called for the job, though the call may not come for two weeks. The carrier and its crew are currently conducting “a series of training exercises off the coast of Virginia, and it could potentially expedite those exercises,” U.S. officials said.
“We have plenty of time,” Trump told reporters Friday. “If you remember Venezuela, we waited around for a while. And we’re in no rush. We have very good talks going with Iran.”
That’s not what he was saying last month. “Time is running out, it is truly of the essence!” the president posted in January. Why the turnaround? Nancy A. Youssef and Vivian Salama of The Atlantic explain how threats turned into talks, here.
Marines will use Air Force-tailored drone to help develop its robot wingman. General Atomics’ YFQ-42A will be used as a testbed for CCA concepts and gear, the company said on Tuesday. The work is part of the
Marine Corps Air-Ground Task Force Uncrewed Expeditionary Tactical Aircraft effort. Defense One’s Thomas Novelly has a bit more about that, here.
MUX TACAIR is one of the top priorities of the 2026 Marine Aviation Plan, also released on Tuesday. FYI: “Central to the AVPLAN is the active integration of AI/ML as a primary modernization effort,” a USMC press release says.
Russia still sees the U.S. as its top adversary, Estonian intelligence report says. Recent U.S.-Russian talks about ending Moscow’s war on Ukraine should not be taken as a sign that Russia poses less of a threat to the United States and Europe, according to a new report from Estonia’s foreign-intelligence agency. “Despite this illusory thaw, Russia continues to regard the U.S. as its principal global adversary,” says the report, which was released Tuesday.
Russian leader Vladimir Putin intends such talks to benefit him in two ways, it says: “First, by binding U.S. and Russian interests more closely together; second, by widening what Moscow perceives as existing rifts between the U.S. and Europe.” Defense One’s Patrick Tucker has more, here.
Developing: NATO launched a series of new exercises in the Arctic this week, the alliance said in a statement on Wednesday: “These activities include, among others, Denmark’s Arctic Endurance, a series of multi-domain exercises designed to enhance Allied ability to operate in the region, and Norway’s upcoming exercise Cold Response, where troops from across the Alliance have already begun to arrive.”
The drills come just weeks after Trump threatened to seize Greenland ahead of a speech before Europeans at the World Economic Forum in Davos, Switzerland. Trump later said he wouldn’t use military force to achieve that goal, but he has since posted on social media that he still aims to make Canada and Greenland U.S. territories. Since his speech at Davos, both Canada and France have opened consulates in Greenland.
Additional reading:
- “National Guard troops were quietly withdrawn from some U.S. cities,” the Washington Post reported Wednesday, following up on Trump’s social media post withdrawing troops from Los Angeles, Chicago and Portland in late December; Guard troops still remain—under a different legal framework—in Memphis, Washington, D.C., and New Orleans;
- And “Louisiana National Guardsman leaves M4 carbine in Bourbon Street bathroom,” Military Times reported Thursday.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
This week in cybersecurity from the editors at Cybercrime Magazine
Sausalito, Calif. – Feb. 12, 2026–Read the full story in The Motley Fool Australia
Tristan Harrison, one of the longest-serving writers at The Motley Fool Australia, highlights a cybersecurity growth theme for potential investors in the sector. He points out Cybersecurity Ventures predicted global spending on cybersecurity over the five-year period of 2021 to 2025 will be a cumulative total of $1.75 trillion USD, representing year-over-year growth of 15 percent. (Go here for the 2016 to 2031 spending predictions)
The Betashares Global Cybersecurity ETF (ASX: HACK) aka “Hack ETF” is an exchange-traded fund (ETF) that aims to give Australian investors access to the world’s leading cybersecurity companies. That includes both global cybersecurity giants as well as emerging players from different countries.
There are currently 32 businesses in the portfolio, which include names like Cisco Systems, CrowdStrike, Fortinet, and Okta. These companies are from a variety of countries, including the US, India, France, Israel, and Canada.
We don’t necessarily need to pick which of these businesses will be the biggest winners – it’s a diversified bet on the sector, according to Harrison.
The HACK ETF has done well for investors over the long term – since Aug. 2016, it has delivered an average annual return of 15.9 percent, which is a fantastic level of performance. But, past performance is not a guarantee of future returns, of course, Harrison cautions.
Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:
- SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
- NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
- HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
- VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
- M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
- BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
- PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
- PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
- RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.
Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.
The post Betashares Global Cybersecurity ETF (ASX: HACK): A Diversified Bet On The Sector appeared first on Cybercrime Magazine.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Operational Relay Box (ORB) networks are covert, mesh-based infrastructures used by advanced threat actors to hide the true origin of their cyberattacks. Built from compromised Internet-of-Things (IoT) devices, Small Office/Home Office (SOHO) routers, and rented Virtual Private Servers (VPS), these networks act like private residential proxy systems that blend malicious traffic with legitimate user activity. […]
The post ORB Networks Leverages Compromised IoT Devices and SOHO Routers to Mask Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new security investigation has uncovered 287 Chrome extensions that appear to secretly send users’ browsing data to remote servers, impacting an estimated 37.4 million installs. That is roughly 1%1% of the global Chrome user base, based on the researchers’ estimate. The researchers built an automated testing pipeline to catch “spying” behavior at scale. They ran Chrome inside a […]
The post 287 Malicious Chrome Extensions Steal Browsing Data from 37.4 Million Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
DragonForce is a ransomware group that has rapidly evolved into a cartel-style operation, extending its reach across the cybercrime ecosystem since late 2023. Operating under a Ransomware-as-a-Service (RaaS) model, the group now positions itself not just as a single gang, but as a platform for other threat actors and affiliate crews. Over time, the group shifted from […]
The post DragonForce Ransomware Group Targets 363 Companies, Expands Cartel-Like Operations Since 2023 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A DShield honeypot sensor recently recorded a complete compromise sequence involving a self-replicating SSH worm that exploits weak passwords to spread across Linux systems. The incident highlights how poor SSH hygiene and the use of default credentials remain among the most persistent threats to Internet-connected devices. Even in 2026, attackers continue leveraging automated credential stuffing […]
The post SSH Worm Exploit Detected by DShield Sensor Using Credential Stuffing and Multi-Stage Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Feiniu fnOS network-attached storage (NAS) devices have been pulled into a large Netdragon botnet after attackers exploited still-unpatched vulnerabilities, turning home and small‑business storage into infrastructure for DDoS attacks. The malware opens an HTTP backdoor on port 57132, letting attackers run arbitrary system commands remotely via crafted GET requests to the /api path. Using traffic fingerprints from […]
The post Feiniu NAS Devices Hit in Massive Netdragon Botnet Attack Exploiting Unpatched Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new hardware-based threat has emerged that disguises malicious code execution capabilities inside an ordinary computer mouse. Dubbed “EvilMouse,” this covert keystroke injector demonstrates how everyday peripherals can become powerful attack tools for just $44 in parts. EvilMouse operates similarly to the well-known USB Rubber Ducky penetration testing tool. However, with a crucial difference: it […]
The post $44 Evilmouse Malware Grants Attackers Full Control of Systems Upon Connection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Threat activity this week shows one consistent signal — attackers are leaning harder on what already works. Instead of flashy new exploits, many operations are built around quiet misuse of trusted tools, familiar workflows, and overlooked exposures that sit in plain sight. Another shift is how access is gained versus how it’s used. Initial entry points are getting simpler, while post-compromise
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


