• NATIONAL HARBOR, Md.—Special operations airmen are ready for potential missions focused on Venezuela amid President Donald Trump’s controversial campaign against alleged narco-terrorims groups in the region, the leader of Air Force Special Operations Command said Wednesday.

    While Lt. Gen. Michael Conley declined to specifically disclose if they are supporting operations in Venezuela, he told reporters that his airmen have strike, surveillance, and mobility assets that “any combatant commander would love.” 

    “We are prepped to go where the nation needs us,” he said during a media roundtable at the Air & Space Force Association’s Air, Space, and Cyber Conference. “We are doing things that you'd expect out of special operations, just in the sense that we need to be ready to go.”

    Conley’s remarks come amid congressional uproar over the U.S. military’s airstrike on an alleged drug-running boat in the Caribbean Sea and backlash from the Venezuelan government. 

    Conley also said he supports more training exercises in the region as part of the Trump administration’s new defense priorities.

    Just days before the first deadly airstrike on an alleged drug boat in the Caribbean Sea, AFSOC held a long-planned exercise on St. Croix in which air commandos conducted a mock takeover of an airport, demonstrating the Air Force’s Agile Combat Employment concept—which was originally designed for use against adversaries such as China or Russia.

    Conley said the training’s timing was coincidental, but added he wants to have his airmen do more exercises in the region—a notable departure from a decades-long focus on the Middle East and Africa.

    “We are very good at the AFRICOM and CENTCOM operations,” Conley said. “When we get into new theaters and training in new places, it's all goodness for us.”

    Since the inaugural boat strike, which the White House said killed 11 people aboard, the military has increased its presence in the Caribbean Sea. Air Force MQ-9 Reaper drones and Marine Corps F-35Bs have been placed in Puerto Rico alongside C-5 and C-17 military transports, open source intelligence accounts report.

    Venezuelan president Nicolás Maduro sent a letter, which was later shared on Telegram, to President Donald Trump asking to meet with his special envoy and to stop the increased military build up and presence.

    "The military threat against Venezuela, the Caribbean and South America must cease, and the proclamation of a Zone of Peace must be respected,” the letter read.

    Last week, Venezuela held a military exercise dubbed “Sovereign Caribbean 200” that included a display of warships, aircraft ,and troops. Venezuelan military forces have also been training civilians on how to use weapons.

    White House press secretary Karoline Leavitt told reporters Monday that the administration “viewed the Maduro regime as illegitimate, and the president has clearly shown that he is willing to use any and all means necessary to stop the illegal trafficking of deadly drugs from the Venezuelan regime into the United States.”

    The Pentagon’s new priority is the homeland, and the administration aims to “restore our neglected position in the Western Hemisphere,” according to a memo obtained by Defense One last month. Conley told reporters he plans to follow the administration’s priorities and wants to see future AFSOC training reflect that.

    “I look at where the national defense strategy has us going, the interim one, where the administration is placing that priority, and I want to train in those places,” Conley said. “The first time we go there, if called upon for real, I don't want it to be the first time we've operated in those environments.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Phishing campaigns are getting harder to spot, sometimes hiding in files you’d never suspect. ANY.RUN’s cybersecurity analysts recently uncovered one such case: a malicious SVG disguised as a PDF, hosted on a legitimate domain and packed with hidden redirects. By mid-September, it scaled into a full spam wave with Microsoft-themed lures.

    Let’s look at how it worked, and how analysts can gather the full chain of intel in a safe sandbox environment.

    Inside the Recent SVG Attack

    Here’s a sandbox session that shows the full behavior. Check the real case to watch the redirects and payload extraction live:

    View the sandbox session (SVG attack)

    ANY.RUN’s sandbox session revealing malicious SVGs in phishing attack

    Delivery & disguise: The file arrives looking like a PDF attachment but is an SVG (XML) file. Because SVG supports scripts, attackers embed active content instead of static pixels.

    Malicious SVG file sent using Sharesync

    Uncover hidden threats, cut investigation time from hours to minutes, and stay ahead of evolving attack techniques.Try ANY.RUN now

    Fake prompt shown: Opening the file in a browser displays a “protected document” message to social-engineer the user into clicking or waiting.

    Social engineering employed by attackers

    Script execution (XOR decoder): The embedded JavaScript runs an XOR decode routine that reconstructs the true redirect code and then executes it (via eval). 

    You can see this directly in ANY.RUN’s static/HEX view: the decoder variables, the hex/escaped bytes (for example ‘\x65′,’\x76’,…) and the reconstructed script are all exposed in the session. That view lets analysts dump the decoded payload and review the exact commands the SVG runs.

    ANY.RUN’s static view showing script execution

    Layered redirects: The decoded code pushes the browser through multiple intermediary domains, obfuscating the trail. Examples observed in this chain include:

    1. loginmicrosft365[.]powerappsportals[.]com
    2. loginmicr0sft0nlineofy[.]52632651246148569845521065[.]cc

    Final phishing page: The user lands on a Microsoft-branded credential page that even uses a Cloudflare Turnstile widget to look legitimate and bypass cursory checks. With ANY.RUN’s automated interactivity, these verifications are handled automatically, so analysts don’t waste time clicking through manually.

    Cloudflare Turnstile widget used by attackers, exposed inside ANY.RUN sandbox

    Credential collection & persistence: Entered credentials are captured and forwarded to attacker-controlled infrastructure built for scale (PhaaS-like), enabling mass harvesting.

    Fake Microsoft page for credentials collection

    What the sandbox reveals: The interactive session shows every redirect and HTTP transaction, exposes the decoded JavaScript in HEX/Text, and captures runtime artifacts.

    Exportable IOCs and reports can be directly integrated with SIEM, EDR, and threat-intel platforms, so analysts get the data inside the tools they already use, saving time and cutting extra steps.

    Well-structured report generated by ANY.RUN sandbox

    The Sandbox Advantage: Fast Detection of New Attacks

    As you can see, interactive sandboxes are especially valuable for spotting new and evasive attacks. Instead of waiting on static signatures or delayed alerts, they run the file in a live environment and surface malicious behaviors in real time.

    With ANY.RUN, analysts can:

    • Get malicious verdicts in under 60 seconds: 88% of threats are detected this quickly.
    • Reveal the full attack chain instantly: every redirect, script, and payload mapped out without guesswork.
    • Accelerate triage and response: teams report up to 94% faster triage and 3× higher SOC performance.
    • Turn findings into action: export IOCs and TTPs directly into SIEM, EDR, or TI platforms to update detections and launch hunts immediately.

    By transforming hours of manual work into minutes of automated visibility, sandboxes give analysts the speed, clarity, and context needed to stay ahead of new attack techniques.

    Request your 14-day trial and see how fast you can catch new attacks with ANY.RUN’s sandbox.

    The post Malicious SVGs in Phishing Campaigns: How to Detect Hidden Redirects and Payloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco has disclosed a zero-day vulnerability, CVE-2025-20352, in its widely used IOS and IOS XE software, confirming it is being actively exploited in the wild.

    The flaw exists in the Simple Network Management Protocol (SNMP) subsystem and can allow a remote attacker to achieve remote code execution (RCE) or cause a denial-of-service (DoS) condition on vulnerable devices.

    The vulnerability was first identified during the investigation of a Cisco Technical Assistance Center (TAC) support case.

    The vulnerability is rooted in a stack overflow condition (CWE-121) within the SNMP subsystem of both Cisco IOS and IOS XE software. An attacker can trigger this flaw by sending a crafted SNMP packet over an IPv4 or IPv6 network to an affected device.

    The advisory, published on September 24, 2025, confirms that all versions of SNMP (v1, v2c, and v3) are susceptible.

    The severity of the exploit depends on the attacker’s privilege level:

    • A low-privileged but authenticated remote attacker can cause the affected device to reload, leading to a DoS condition. This requires access to an SNMPv2c read-only community string or valid SNMPv3 user credentials.
    • A high-privileged attacker with administrative or privilege 15 credentials can execute arbitrary code as the root user on devices running IOS XE, effectively gaining full control of the system.

    Active Exploitation and Affected Devices

    Cisco’s Product Security Incident Response Team (PSIRT) has confirmed successful exploitation of this vulnerability in the wild.

    According to the advisory, the attackers leveraged the flaw after first compromising local administrator credentials, demonstrating a chained attack methodology.

    This highlights the critical need for strong credential management alongside patching.

    The vulnerability impacts a broad range of Cisco devices running vulnerable releases of IOS and IOS XE software where SNMP is enabled. Specific products mentioned include the Meraki MS390 and Cisco Catalyst 9300 Series Switches.

    ProductAffected VersionsFixed Release
    Cisco IOS & IOS XE SoftwareAll releases with SNMP enabled prior to the first fixed software release are considered vulnerable.Customers should use the Cisco Software Checker to determine the appropriate patched release for their specific software train.
    Meraki MS390 SwitchesMeraki CS 17 and earlier.The vulnerability is addressed in Cisco IOS XE Software Release 17.15.4a.
    Cisco Catalyst 9300 Series SwitchesMeraki CS 17 and earlier.The vulnerability is addressed in Cisco IOS XE Software Release 17.15.4a.

    Any device with SNMP enabled is considered vulnerable unless specific configurations are in place to block the malicious traffic. Administrators can use show running-config commands to determine if SNMP is active on their systems.

    Cisco has released software updates to fix this vulnerability and strongly recommends that all customers upgrade to a patched software release to fully remediate the issue. The advisory, identified as cisco-sa-snmp-x4LPhte, clarifies that there are no workarounds available.

    For organizations that cannot immediately apply the updates, Cisco has provided a mitigation technique. Administrators can configure an SNMP view to exclude the affected object IDs (OIDs), preventing the vulnerable code path from being triggered.

    However, Cisco cautions that this mitigation may disrupt network management functionalities, such as device discovery and hardware inventory monitoring. As a general security measure, Cisco also advises restricting SNMP access to only trusted users.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cisco IOS 0-Day RCE Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NATIONAL HARBOR, Md.—Expanding and strengthening U.S. military ties with space-capable nations will be key to staying ahead in the global competition for space dominance, officials said Tuesday. 

    “Space warfare is a complex and difficult type of warfare in general, and not a type of warfare that one country can do by themselves. And so we know that we need partners to be able to help us to do the things that we need to do, to be able to cover all the space terrain and the challenges that we have,” Col. Frank Brooks, the Air Force’s deputy director for space international affairs, said Tuesday during a panel at the Air and Space Forces Association’s Air, Space, Cyber conference. 

    One example is the trilateral Deep-Space Advanced Radar Capability, or DARC, which tracks activity including space debris and adversarial behavior, shared between the U.S., Australia, and the United Kingdom. 

    Reliance on space for everything from tracking illegal fishing, to GPS, and coordinating weapons has increased even as threats proliferate, underscoring the need to forge new relationships globally—particularly in Africa, where China is already laying groundwork

    “Technology is great. But the biggest capability you have is teaming with our partners and allies. And especially in Africa and in different areas. I think that is the foundational challenge that we're facing,” Brig. Gen. Jacob Middleton, commanding general for U.S. Space Forces in Europe and Africa, told reporters Tuesday. “What I hope to do, specific to EUCOM and AFRICOM, is create a situation during peace time that through partnerships and allies and working together, that teamwork provides a deterrence.”

    Middleton said the U.S. wants to partner with anyone who is willing.

    “Some folks are surprised that there are some African spacefaring nations—which there are. I'd say the most important competition we're in is for hearts and minds,” Middleton said during a panel. “At the end of the day, what we're really competing for is a certain international border, and that really means partnership, allies and people on our team…who's gonna be our side versus who's gonna be on our competitors’ side.”

    So far, Middleton has visited the Egypt-based African Space Agency and Morocco, and hopes to kindle talks with Nigeria, Angola, and Kenya

    “This is a competition, so just because China has visited doesn't mean I won't,” he told reporters.

    And building strong alliances—which can be fraught due to conflicting policies and roles—can go a long way. 

    “Focus on the alliance, and if that is strong regionally, you're going to be strong, and then you don't have to worry about your national sovereignty. And so that is a discussion that we need to have, that I continue to have,” Middleton said. “But that starts with understanding [a country’s] national security objectives, giving them reasonable advice on how to get after those objectives. Then training them, educating them on what's in the inventory and what's in the realm of the possible. Then, once you pull that plan together, exercising it so we work as one team. And so there's a capability increase that we're working on to get after that, that we're pulling in our partners and allies on.”

    In an interview at the AMOS conference in Maui last week, Canadian Brig. Gen. Ryan Deming, the deputy commander for operations, plans, training and force development for Space Operations Command, compared the need for partners to a hockey game. 

    “So when you've watched a hockey game, for the opposing teams, they're actually made up of different players. … You can't have a hockey team that's just one person. They could be the best player in the world; they can't do it all themselves because of the dynamic, fast pace of the game, right? So look at U.S. Space Forces in that same sort of analogy. You need those international partners and that collaboration, that strategy and that engagement, and that, you know, sharing of how the plays are going to work,” he said. 

    “Because it's so fast-paced, you don't take a timeout, right? You only get one timeout in hockey—we don't have that in space, to be able to take a timeout. So the more that we understand how each other operates, what I can bring to the table, what another ally can bring to the table, I think it actually allows us to figure out, how do we best employ this to ensure that we can try and maintain that space superiority, and that we can make sure that we're outpacing our adversary.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A suspected cyber espionage activity cluster that was previously found targeting global government and private sector organizations spanning Africa, Asia, North America, South America, and Oceania has been assessed to be a Chinese state-sponsored threat actor. Recorded Future, which was tracking the activity under the moniker TAG-100, has now graduated it to a hacking group dubbed RedNovember.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Seven months after telling Ukraine’s president, “You don’t have the cards right now” to fend off Russia’s ongoing invasion, U.S. President Donald Trump surprised observers when he said Tuesday on social media, “I think Ukraine, with the support of the European Union, is in a position to fight and WIN all of Ukraine back in its original form.”

    Trump did not emphasize direct U.S. support to Ukraine, instead adding with an apparent note of indifference, “We will continue to supply weapons to NATO for NATO to do what they want with them.” He continued, “With time, patience, and the financial support of Europe and, in particular, NATO, the original Borders from where this War started, is very much an option.” 

    “Putin and Russia are in BIG Economic trouble, and this is the time for Ukraine to act,” Trump said, and concluded, “In any event, I wish both Countries well.”

    Context: Trump’s pivot comes after Russian aircraft violated NATO airspace several times this month, including episodes involving Poland, Romania, and Estonia—as well as Finland, Latvia, Lithuania, and Norway, NATO said in a Tuesday statement. “Allies will not be deterred by these and other irresponsible acts by Russia from their enduring commitments to support Ukraine, whose security contributes to ours, in the exercise of its inherent right to self-defence against Russia’s brutal and unprovoked war of aggression,” the alliance’s North Atlantic Council said. 

    Notable: “[T]here was no sign that Trump's words would be matched by a change in U.S. policy, such as a decision to impose the heavy new sanctions on Moscow,” Reuters reports, writing that Trump’s new position “would ostensibly require Kyiv to expel Russian forces from 20% of its territory, including the Crimean peninsula Moscow has held since 2014, in what would be an extraordinary reversal.” 

    Capitol Hill reax: “President Trump is delusional,” said Massachusetts Democratic Sen. Ed Markey, writing on social media Tuesday. “Without stronger US support, which Trump has refused to provide, Ukraine will die a slow death,” he said, alleging without elaboration, “Make no mistake: Trump is siding with Putin’s dictatorship over Ukraine’s democracy.”

    Second opinion: “Over a month after inviting Putin to the United States with a red carpet welcome, President Trump has nothing to show for it and Putin is actively testing NATO’s resolve,” said Sen. Jeanne Shaheen, D-New Hampshire, in her own statement Tuesday. “President Trump has also yet to deliver on his campaign promise of quickly ending devastating conflicts in Ukraine, Gaza and elsewhere…America needs less bluster and more constructive action from this President to finally bring these conflicts to a close.”

    European reax: “[T]he cards are clear for us. We know what we should be doing,” one official told Reuters. And Germany’s top diplomat said Tuesday, “We can achieve much more; not all European states have delivered what they promised Ukraine.” 

    “It's dawning on Trump, the fact that Putin has been stringing him along,” Jaroslava Barbieri of the Chatham House told the wire service. “I think Trump is also looking for an off-ramp to maintain this image of being an effective peace broker by trying to shift the blame to Russia and the Europeans.” 

    Frontline dispatch:To Understand Ukraine at War, Stop by a Gas Station,” Constant Méheut, Olha Konovalova and Brendan Hoffman reported Tuesday for the New York Times (gift link).

    Update: Ukrainian attacks on Russian oil refineries have dropped Russian fuel exports close to their lowest level since 2020, with Ukrainian drone attacks disrupting more than one million barrels of oil per day from Russia’s refining capacity, the Financial Times reported Tuesday. “Sixteen of Russia’s 38 refineries have been hit since the start of August, some of them multiple times, including one of Russia’s largest fuel-processing facilities, the 340,000 barrel-a-day plant at Ryazan, close to Moscow,” FT’s Chris Miller reports. 

    Russia’s new war tax? “Russia's finance ministry proposed raising the rate of value-added tax on Wednesday to 22% from 20% in 2026 to fund military spending in what would be the fifth year of the war in Ukraine,” Reuters reported Wednesday from Moscow. 

    In an apparent first, Ukraine reportedly used hot-air balloons to attack targets in Russia. “They weren’t very precise,” a Russian defense official told Russia's RBK Wednesday, who said the inflatable Ukrainian drones were spotted or shot down over several Russian regions after midnight Wednesday, including Belgorod, Bryansk, Kaluga, Kursk, Rostov, Ryazan, Samara, Saratov regions, Crimea, and Moscow.

    Britain’s top spy said recently that around 250,000 Russian troops have died fighting for Putin’s Ukraine invasion, and Moscow has taken “more than a million casualties” overall, according to Sir Richard Moore’s speech Friday in Istanbul. 

    In May, the U.S. military’s intelligence agency estimated that 170,000 Russian troops had died, while some 530,000 more had been wounded, Mike Eckel of Radio Free Europe / Radio Liberty noted on social media Sunday. 

    Happening today: NATO Secretary General Mark Rutte is visiting the U.S. for meetings with world leaders and high-level officials during the UN’s General Assembly this week in New York. Rutte also has a dinner planned with Secretary of State Rubio this evening followed by a scheduled address to cadets at the U.S. Military Academy on Thursday.


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1968, prime-time news show “60 Minutes” debuted on CBS. 

    Around the world

    “What kind of world do we choose to build together?” United Nations Secretary-General António Guterres asked attendees from around the globe during his remarks Tuesday at the UN’s annual General Assembly in New York City. 

    The UN, which formed from the ruins of World War II, was established in a spirit of “cooperation over chaos, law over lawlessness, peace over conflict,” Guterres said. But 80 years later, “we have entered an age of reckless disruption,” when “the principles of the United Nations…are under siege,” he warned. 

    In the days ahead, UN members can choose “a world of raw power—or a world of laws,” he said. “A world that is a scramble for self-interest” and “where might makes right—or a world of rights for all.”

    Trump’s message to world leaders: “Your countries are going to hell” because of lax immigration policies, the U.S. president said during his hourlong Tuesday address before the General Assembly. “It’s time to end the failed experiment of open borders. You have to end it now. It’s — I can tell you. I’m really good at this stuff. Your countries are going to hell,” he said. 

    POTUS: “You’re destroying your countries. They’re being destroyed. Europe is in serious trouble. They’ve been invaded by a force of illegal aliens like nobody’s ever seen before. Illegal aliens are pouring into Europe, and nobody’s doing anything to change it, to get them out. It’s not sustainable.”

    “I’ve been right about everything,” Trump told the UN as the New York Times reports he spent much of his time “making and repeating a slew of misleading and false claims” about U.S. manufacturing, renewable energy, electricity prices in the U.S., and Sharia law in London. CNN annotated select portions of the speech in a separate fact check, here

    Historian’s reax: “The speech was a dark fantasy of narcissism and Christian nationalism that struck at the heart of the very concept of the United Nations,” Heather Cox Richardson wrote after Trump’s UNGA remarks. His speech also “depict[ed] a fantasy world in which he had single-handedly saved the world,” with Trump boasting that just last year, “our country was in deep trouble. But today, just eight months into my administration, we are the hottest country anywhere in the world and there is no other country even close.” 

    Also: One senior foreign diplomat at the UN texted Ishaan Tharoor of the Washington Post, “This man is stark, raving mad. Do Americans not see how embarrassing this is?”

    China’s missiles on parade: showpieces or showstoppers? John S. Van Oudenaren and Peter Singer judge five of the weapons debuted earlier this month: new ICBMs, hypersonic missiles, and SAMs. Read that, here.

    Iran is rebuilding its missile sites, but lacks crucial rocket-fuel mixers, AP reports off its analysis of satellite photos. “Reconstituting the missile program is crucial for the Islamic Republic, which believes another round of war with Israel may happen. The missiles are one of Iran’s few military deterrents after the war decimated its air defense systems — something that Tehran long has insisted will never be included in negotiations with the West.” Read on, here

    Additional reading: 

    Around the Defense Department

    Has Space Force cracked the code on faster acquisition? Acquisition reform legislation may be on the way, but Space Force officials say they’re ahead of the curve. “A lot of the concepts and ideas and structure and authorities and processes, we’re already doing,” Lt. Gen. Philip Garrant, leader of Space Systems Command, said in an interview on the sidelines of the AMOS conference in Hawaii. 

    The service is amid an organizational transformation, aligning acquisition programs with mission areas under units it calls systems deltas. The change, along with the commercial strategy signed in 2024, has changed how the service’s program executives and program directors look at acquisition and commercial providers, Garrant said. Defense One’s Jennifer Hlad reports, here.

    Space Force leaders are prepping a threat guide to shape plans and procurement. The document—“a game changer”—will outline expected enemy trends through 2040, Chief of Space Operations Gen. Chance Saltzman said Tuesday at Air & Space Force Association’s Air, Space and Cyber Conference. Defense One’s Tom Novelly has more from Saltzman’s speech, here.

    RTX, Shield AI to make the “brains” for the Air Force’s robot wingmen, Aviation Week reports: “The RTX mission autonomy software suite will be integrated into the General Atomics Aeronautical Systems Inc. (GA-ASI) YFQ-42, and Shield AI’s Hivemind-branded system will control the Anduril YFQ-44, sources tell Aviation Week.” More, here.

    CENTCOM has a new “innovation task force.” Led by U.S. Central Command’s chief technology officer, the new Rapid Employment Joint Task Force is meant to outfit deployed forces with cutting-edge capabilities, the command announced on Tuesday.

    Double-reversal on DACOWITS: Defense Secretary Pete Hegseth has decided to eliminate the Defense Advisory Committee on Women in the Services, just three weeks after sending a memo directing the 75-year-old advisory group to continue operating.

    Hegseth now believes the group is “advancing a divisive feminist agenda,” Pentagon spox Kingsley Wilson said Tuesday.

    Context: “The former Fox News host, who has previously questioned the role of women in combat, has also shut down a program that boosts the number of women in peace building and conflict prevention efforts, calling it “woke” and “divisive,” Politico reports.

    And lastly, here’s the latest reax to the Pentagon’s demand that journalists report only what officials tell them: 

    • NYT’s David Sanger: “Coming amid a broader push by the administration to clamp down on criticism of Mr. Trump, the scope of Mr. Hegseth’s effort stunned news organizations, which are considering how best to keep the policy from coming into effect, including potential legal challenges.”
    • Military Reporters and Editors: “MRE condemns in the strongest possible terms any attempt by this Pentagon or any other entity to curb the press’ freedoms and leave the American public in the dark on what its military is doing at home and abroad,” writes the non-profit journalists’ organization. “The Secretary of Defense and the military are accountable to the American people. A hollowed press corps in the Pentagon will only ensure that fewer answers are provided to the public about how the government spends its taxpayer dollars, where America’s sons and daughters are deploying on behalf of our country and the welfare of military families.” 
    • Sen. Jack Reed, D-R.I.: “This is an ill-advised affront to free speech and freedom of the press. This goes beyond attempting to suppress criticism—Mr. Hegseth’s goal appears to be eliminating a critical check on government corruption, unlawful practices, and the misuse of taxpayer dollars.”

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Three sophisticated malware families have emerged as significant threats to telecommunications and manufacturing sectors across Central and South Asia, representing a coordinated campaign that exploits legitimate system processes to deliver powerful backdoor capabilities.

    RainyDay, Turian, and a new variant of PlugX have been systematically abusing DLL search order hijacking techniques to execute malicious loaders, establishing persistent footholds within targeted networks since 2022.

    The convergence of these malware families reveals a sophisticated operation that leverages shared infrastructure and methodologies, suggesting potential collaboration between previously distinct threat actors.

    All three malware variants exploit the same legitimate Mobile Popup Application for DLL sideloading, employ identical RC4 encryption keys, and utilize the XOR-RC4-RtlDecompressBuffer algorithm for payload decryption.

    This technical overlap indicates either shared development resources or coordinated distribution among the operating groups.

    The campaign primarily targets organizations within the telecommunications and manufacturing sectors, focusing on countries throughout Central and South Asia.

    The strategic selection of these industries and geographic regions aligns with espionage objectives, particularly given the critical infrastructure and sensitive communications these sectors handle.

    Comparison between the Naikon and the BackdoorDiplomacy by using the diamond model (Source – Cisco Talos)

    The sustained nature of the campaign, active since at least 2022 with some components tracing back to 2016, demonstrates the persistent and patient approach characteristic of advanced persistent threat operations.

    Cisco Talos analysts identified this campaign through extensive hunting efforts that revealed the interconnected nature of these seemingly separate malware families.

    The discovery emerged during investigations into RainyDay backdoor activities, where researchers uncovered the shared abuse of legitimate applications and consistent encryption methodologies across all three families.

    This finding enabled attribution assessments linking the activities to known threat groups, specifically Naikon and potentially BackdoorDiplomacy.

    The technical sophistication of these attacks extends beyond simple malware deployment, incorporating advanced evasion techniques and persistence mechanisms that allow for long-term network compromise.

    Keylogger components embedded within the PlugX variant have demonstrated successful persistence spanning nearly two years in victim environments, highlighting the effectiveness of these tools in maintaining covert access.

    The malware families share not only technical implementation similarities but also targeting patterns and operational methodologies that suggest coordinated planning and execution.

    DLL Search Order Hijacking Exploitation Mechanism

    The core infection mechanism employed by RainyDay, Turian, and the PlugX variant centers on exploiting Windows DLL search order vulnerabilities to achieve code execution through legitimate processes.

    RainyDay malware flow (Source – Cisco Talos)

    This technique involves placing malicious DLL files in locations where Windows will load them instead of legitimate libraries, effectively hijacking the normal application loading process.

    The malware families achieve this by abusing legitimate applications, specifically targeting the Mobile Popup Application as their primary vehicle for DLL sideloading operations.

    When these legitimate applications attempt to load required DLL files, the Windows loader follows a predetermined search order to locate the necessary libraries.

    The attackers exploit this behavior by placing their malicious DLL loaders in directories that are searched before the legitimate library locations.

    Once the malicious DLL is loaded by the legitimate process, it gains execution context within a trusted application, allowing it to operate with reduced suspicion from security monitoring systems.

    The technical implementation involves three distinct loader files, each corresponding to their respective malware families.

    New PlugX variant malware flow (Source – Cisco Talos)

    The RainyDay loader targets and decrypts data from “rdmin.src” files, while the PlugX variant processes “Mcsitesdvisor.afx” files, and Turian handles “winslivation.dat” files.

    Each loader utilizes XOR encryption as the initial decryption layer before proceeding to more complex payload processing stages.

    The shared codebase among these loaders reveals sophisticated development coordination, with all three implementations using the GetModuleFileNameA API to obtain executable paths and reading encrypted data from hardcoded filenames within the infection directory.

    The decrypted shellcode follows identical formatting standards, containing RC4-encrypted and LZNT1-compressed data that undergoes a multi-stage unpacking process.

    This process ultimately deploys the final malware payload into memory through CALL or JMP instruction execution.

    Analysis of Program Database (PDB) paths embedded within the loader samples provides insight into the development process and naming conventions used by the threat actors.

    Turian malware flow (Source – Cisco Talos)

    The Turian loader contains paths referencing “icmpsh-master” with Chinese text translating to “provide web version,” suggesting modifications for web-based command and control infrastructure.

    These technical artifacts demonstrate the methodical approach taken in developing and customizing these tools for specific operational requirements, while maintaining shared functionality across the different malware families.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Companies in the legal services, software-as-a-service (SaaS) providers, Business Process Outsourcers (BPOs), and technology sectors in the U.S. have been targeted by a suspected China-nexus cyber espionage group to deliver a known backdoor referred to as BRICKSTORM. The activity, attributed to UNC5221 and closely related, suspected China-nexus threat clusters, is designed to facilitate

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In recent months, a sophisticated threat actor leveraging North Korean IT worker employment fraud has surfaced, demonstrating how social engineering can bypass traditional security controls.

    The adversary’s modus operandi involves posing as remote software engineers, submitting legitimate-looking résumés, completing coding assessments, and ultimately blending into corporate environments.

    Initial signs were subtle: benign emails, genuine code submissions, and standard hiring communications that raised no immediate alarms.

    Early in the campaign, a candidate using the alias “Kyle Lankford” applied for a Principal Software Engineer role at a major U.S. healthcare provider.

    The recruitment process proceeded normally, with all interactions routed through common platforms such as Gmail and CodeSignal. No malicious URLs were shared, and no malware-laced attachments appeared.

    Trellix analysts noted that the complete absence of technical anomalies in these communications enabled the attacker to advance deeper into the organization’s network without triggering endpoint defenses.

    Upon completing the coding assessment on July 16, 2025, the applicant sent a polite follow-up email on August 4. Hidden in plain sight, the message contained no unusual headers or attachments:-

    From: Kyle Lankford <kyle12lank@gmail.com>
    To: recruiter@healthprovider.com
    Subject: Re: CodeSignal Assessment—Principal Software Engineer
    Date: Mon, 4 Aug 2025 09:19:34 -0400
    
    Hi [Recruiter Name],
    
    I hope you had a great weekend. I wanted to follow up regarding the Principal Software Engineer position.
    I completed the CodeSignal assessment on 7/16 and was wondering if there are any updates or next steps.
    I look forward to hearing from you.
    
    Thank you,
    Kyle

    Despite the innocuous nature of the emails, Trellix researchers identified the campaign during a proactive threat hunt driven by open-source intelligence.

    By correlating over 1,400 email addresses linked to DPRK-operated accounts with internal email telemetry, the security team detected an account that matched multiple risk indicators.

    Further analysis confirmed that the job applicant had established legitimate corporate credentials, granting access to internal systems and sensitive data repositories.

    Infection Mechanism: Credential-Based Network Infiltration

    Unlike traditional malware campaigns that rely on malicious payloads, this threat actor exploits credential-based infiltration to establish a foothold.

    Once the imposter’s corporate account was provisioned, the attacker employed standard remote access protocols—such as Secure Shell (SSH) and Remote Desktop Protocol (RDP)—to explore the network.

    Using legitimate administrative tools, they mapped out directory structures, harvested service account credentials stored in accessible repositories, and exfiltrated sensitive project files without deploying any detectable malware.

    Wanted by the FBI (Source – Trellix)

    This approach not only evades signature-based detection but also leverages existing trust relationships within the environment, making it exceedingly difficult to distinguish the attacker from a genuine employee.

    By exploiting the organization’s hiring processes, the adversary bypassed perimeter defenses and insider-threat monitoring.

    This case underscores the necessity of integrating behavioral analytics, continuous identity validation, and rigorous background checks into security workflows to mitigate such non-malware–centric attacks.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New North Korean IT Worker With Innocent Job Application Get Access to Organization’s Network appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed two security flaws in Wondershare RepairIt that exposed private user data and potentially exposed the system to artificial intelligence (AI) model tampering and supply chain risks. The critical-rated vulnerabilities in question, discovered by Trend Micro, are listed below – CVE-2025-10643 (CVSS score: 9.1) – An authentication bypass vulnerability that

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶