ADMIN.FOUNDATION

  • Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala to Its Board of Directors

    ·

    Defy Security, a leading provider of cybersecurity solutions and services, today announced the appointment of Gary Warzala to its Board of Directors. Warzala is a highly regarded cybersecurity executive with more than 20 years of leadership experience, having served as Chief Information Security Officer (CISO) at Visa Inc., PNC Bank, Fifth Third Bank, Aon Corporation, […]

    The post Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala to Its Board of Directors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala to Its Board of Directors

    ·

    Defy Security, a leading provider of cybersecurity solutions and services, today announced the appointment of Gary Warzala to its Board of Directors.

    Warzala is a highly regarded cybersecurity executive with more than 20 years of leadership experience, having served as Chief Information Security Officer (CISO) at Visa Inc., PNC Bank, Fifth Third Bank, Aon Corporation, and GE Aviation. Most recently, he was an Executive Partner with Gartner, Inc., where he advised CISOs across the globe. He is currently Managing Principal at CyberRisk, LLC.

    As a member of Defy Security’s Board, and a former customer of Defy Security, Warzala will provide oversight, governance, and strategic counsel to the executive leadership team. He will also meet with existing and prospective customers, serving as a trusted partner to help them realize the full value of Defy Security’s offerings and support Defy’s focus on customer experience and a customer-centric strategy.

    In addition to his new role with Defy Security, Warzala serves on the Board of Directors for First Financial Bank in Cincinnati, OH, and the Indiana Golf Foundation (IGF) in Indianapolis, IN. In 2022, he was inducted into the Chief Information Security Officer (CISO) Hall of Fame. He holds an MBA from Xavier University and a BS from Utica College of Syracuse University.

    “Gary has been a trusted partner to me and to Defy Security for many years. His reputation in the cybersecurity industry is unmatched – not only for his depth of expertise, but for his integrity and ability to build lasting, trusted relationships with CISOs across industries,” said Justin Domachowski, Founder and CEO of Defy Security.

    “Having Gary join our Board is a natural extension of our long-standing relationship, and I could not be more excited to officially welcome him. His experience, perspective, and leadership will help us continue to strengthen the unique culture of partnership that defines Defy Security and deliver even greater value to our clients.”

    “As a CISO, I always valued true partnerships, and Defy Security consistently stood out as a company I could rely on,” commented Warzala. “Justin and his team have built an organization deeply committed to client success, and I am proud to join the Board to continue that mission in a new and meaningful way.”

    About Defy Security

    Defy Security is a trusted cybersecurity partner for organizations nationwide, delivering tailored solutions and services that align with business goals and strengthen security posture. With a culture built on commitment, partnership, and measurable outcomes, Defy Security empowers clients to navigate complex security challenges with confidence. www.defysecurity.com

    Contact

    Head of Marketing and Partnerships
    Monicka Mann
    Defy Security
    mmann@defysecurity.com

    The post Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala to Its Board of Directors appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Want to Validate Alerts Faster? Use Free Threat Intel from 15K SOCs 

    ·

    , ,

    Alex sighed at his third energy drink of the night shift, watching another batch of security alerts flood his SIEM dashboard.

    As a Level 2 threat analyst at a mid-sized financial firm, he was drowning in false positives and spending precious hours manually investigating each suspicious hash, IP address, and domain.  
     
    Then everything changed during one particularly brutal 3 AM investigation. While researching a suspicious executable that had triggered multiple endpoint alerts, Alex stumbled upon a threat intelligence lookup service that connected him to insights from thousands of other security operations centers.

    Within seconds, the verdict was clear: sophisticated banking trojan, multiple C2 communications, credential harvesting capabilities. 

    What would have taken Alex two hours of painstaking analysis was resolved in under five minutes. More importantly, he had the confidence and evidence needed to escalate immediately to the incident response team. By morning, a potential breach had been contained. 
     

    Why Speed is the Key: How Faster Alert Management Transforms Analyst’s World 

    In the high-stakes arena of cybersecurity, speed isn’t a luxury. It’s survival. Threat actors evolve in hours, not days, and every delayed response risks escalation. But mastering alerts and artifacts at lightning speed doesn’t just fend off attacks; it supercharges your efficiency, effectiveness, KPIs, and career trajectory while safeguarding the business and nailing SOC/MSSP goals:   

    1. Boosts Personal Efficiency: Rapid triage means handling 2-3x more alerts per shift without the mental fog of endless rabbit holes. Solutions that deliver instant context, like Threat Intelligence Lookup, free up brainpower for creative hunting, not rote googling.  
     
    See how it works: a domain search returns an instant “Malicious” verdict, a last-seen date to evaluate a threat’s relevance, a list of additional IOCs, and a selection of sandbox analyses of malware samples featuring the domain.  

    domainName:”randomuser.me” 

    Domain lookup results with contextual data 

    Try TI Lookup to make quick actionable decisions on possible threats.  
    Just sign up to start 

    2. Enhances Effectiveness in Threat Hunting: Quick IOC validation uncovers hidden patterns across incidents, turning isolated pings into proactive takedowns. You’ll spot campaigns early, disrupting attackers before they burrow deep. 

    3. Skyrockets KPIs Like MTTR and Resolution Rates: Shave minutes off each investigation and watch metrics soar. MTTR drops by up to 10x, resolution rates climb, and alert fatigue plummets. With ANY.RUN’s TI Lookup 88% of threats are detected within 60 seconds of analysis. Happy metrics mean rave performance reviews. 

    4. Accelerates Career Growth: Analysts who resolve threats faster stand out. Faster validations lead to high-impact contributions, mentorship opportunities, and that senior role you’ve eyed. Speed builds reputation as the go-to expert. 

    5. Fortifies Business Protection: Swift artifact checks minimize dwell time, reducing breach costs. Early detection prevents data leaks, downtime, and regulatory fines, keeping the C-suite smiling. 

    See how it works: a quick lookup shows a strong correlation of an IP with Lumma, one of the most dangerous malware families.  

    destinationIP:”195.82.147.188″ 

    IP search results: now we know that it’s a symptom of Lumma stealer in the system 

    6. Drives SOC Team Morale and Retention: When alerts aren’t a Sisyphean slog, burnout fades. Teams collaborate better on validated intel, fostering a culture of wins over exhaustion since this is the key for retaining top talent in a field desperate for skilled hands. 

    7. Achieves SOC/MSSP KPIs with Ease: Hit SLAs on response times, exceed client expectations, and scale services without ballooning headcount. Faster ops mean more billable hours and glowing testimonials, fueling business growth. 90% companies report higher threat detection rates after integrating TI Lookup. 

    See how it works: if your logs contain a suspicious PowerShell command, just submit it to LI Lookup. 
     
    imagePath:”powershell” AND commandLine:”$codigo” 

    Malware samples with steganography, with sandbox analyses showing attack chains 

    This search results expose malware that utilizes steganography: the practice of hiding malicious code in the source code of images or other benign objects to avoid detection. 

    Upgraded to the Premium plan, Threat Intelligence Lookup supports over 40 search parameters, additional search operators, and an assortment of wildcards. Comprehensive queries for deeper research become available. 

    Uncover TI Lookup full potential for rapid threat detection, escalation, and mitigation: choose you plan.  

     
    Speed isn’t about rushing — it’s about precision. When speed meets accuracy, both the analyst and the business win. 
     

    ANY.RUN’s Threat Intelligence Lookup: Your Window into 15,000 SOCs 

    The breakthrough Alex experienced wasn’t luck, it was the power of community-driven threat intelligence. ANY.RUN’s Threat Intelligence Lookup provides instant access to analysis results from over 15,000 security operations centers worldwide who use ANY.RUN’s Interactive Sandbox for malware analysis. 

    Every day, security professionals across the globe upload suspicious files, URLs, and other artifacts to ANY.RUN’s Interactive Sandbox for analysis. These investigations happen in real-time, creating a constantly updated database of threat intelligence from actual security incidents and investigations. 

    When you query an IOC through the Threat Intelligence Lookup, you’re not just getting static reputation data. You are accessing fresh insights from recent sandbox sessions where other analysts investigated the same indicators you’re seeing in your environment. When a hash shows up in your alerts, you can instantly see: 

    • Whether other SOCs have recently analyzed this file 
    • What behaviors were observed during sandbox analysis 
    • Network communications and C2 infrastructure 
    • File system modifications and persistence mechanisms 
    • Screenshots and process trees from actual execution 
    • IOCs associated with the same campaign or threat actor 

    Interactive sandbox sessions capture the complete attack chain, helping you understand not just what you’re dealing with, but how it operates and what additional IOCs to hunt for in your environment. 
     

    Conclusion  

    Validating alerts no longer has to be a slow, painful process. With threat intelligence from a global community of SOC analysts, you can turn alert overload into actionable security insights. 
     
    For threat analysts striving to excel in an ever-evolving cyber landscape, ANY.RUN’s Threat Intelligence Lookup offers an unparalleled opportunity to transform investigative efficiency and impact.  
     
    By integrating it into your workflow, you can significantly reduce mean time to respond (MTTR), enhance detection accuracy, and achieve KPIs with greater consistency, directly bolstering your professional reputation and career trajectory. 

    The post Want to Validate Alerts Faster? Use Free Threat Intel from 15K SOCs  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Eurojust Arrests 5 in €100M Cryptocurrency Investment Fraud Spanning 23 Countries

    ·

    Law enforcement authorities in Europe have arrested five suspects in connection with an “elaborate” online investment fraud scheme that stole more than €100 million ($118 million) from over 100 victims in France, Germany, Italy, and Spain. According to Eurojust, the coordinated action saw searches in five places across Spain and Portugal, as well as in Italy, Romania and Bulgaria. Bank accounts

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nimbus Manticore Attacking Defense and Telecom Sectors With New Malware

    ·

    , ,

    The Iranian threat actor known as Nimbus Manticore has intensified its campaign targeting defense manufacturing, telecommunications, and aviation sectors across Western Europe with sophisticated new malware variants.

    This mature advanced persistent threat group, also tracked as UNC1549 and Smoke Sandstorm, has evolved its tactics to include previously undocumented techniques for evading detection and maintaining persistence on compromised systems.

    Nimbus Manticore’s recent operations demonstrate a strategic shift toward European targets, particularly in Denmark, Sweden, and Portugal.

    The threat actor has refined its social engineering approach by impersonating legitimate aerospace giants including Boeing, Airbus, and Rheinmetall, as well as telecommunications companies like flydubai.

    Their deceptive career portal websites utilize React-based templates that closely mimic authentic hiring platforms, complete with pre-shared credentials for each targeted victim.

    The attack methodology begins with tailored spear-phishing campaigns where alleged HR recruiters direct victims to fake career portals.

    Each target receives unique URLs and login credentials, enabling the threat actors to track victim engagement and maintain controlled access throughout the infection process.

    This approach demonstrates sophisticated operational security measures and credible pretexting capabilities that align with nation-state tradecraft.

    Check Point analysts identified the malware’s deployment through an intricate multi-stage infection chain that exploits legitimate Windows processes.

    Infection chain (Source – Check Point)

    The initial payload, disguised as hiring-related software such as “Survey.zip,” contains multiple components including a legitimate Setup.exe file that initiates the sideloading sequence.

    The malware leverages a Windows Defender component called SenseSampleUploader.exe to execute its payload through DLL hijacking techniques.

    Multi-Stage DLL Sideloading Mechanism

    The infection chain employs a novel technique that manipulates the Windows DLL search order through undocumented low-level APIs.

    When the victim executes Setup.exe, the malware uses RtlCreateProcessParameters to modify the DllPath parameter in the RTL_USER_PROCESS_PARAMETERS structure.

    This manipulation enables the malicious xmllite.dll to be loaded from the archive directory rather than the expected system location.

    The contents of malicious ZIP archive (Source – Check Point)

    The userenv.dll component checks the executing process name to determine the infection stage. During initial setup, it uses low-level ntdll API calls to launch the Windows Defender binary located at C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe.

    The malware exploits this legitimate executable’s vulnerability to DLL hijacking, forcing it to load the malicious xmllite.dll from the same folder as the archive.

    Once loaded, the xmllite.dll creates a working directory at %AppData%\Local\Microsoft\MigAutoPlay\ and copies the backdoor components for persistence.

    The malware establishes a scheduled task to execute MigAutoPlay.exe, which then sideloads the malicious userenv.dll containing the primary backdoor functionality.

    This technique effectively bypasses traditional security controls by leveraging trusted Windows processes.

    The evolution of the malware, now tracked as MiniJunk, incorporates substantial compiler-level obfuscation techniques that render samples nearly irreversible for standard static analysis.

    The threat actors have implemented custom LLVM passes that introduce junk code insertion, control-flow obfuscation, opaque predicates, and encrypted strings. Each string receives individual encryption with unique keys, while function calls undergo arithmetic operations to obscure their actual destinations.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Nimbus Manticore Attacking Defense and Telecom Sectors With New Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Penetration Testing Companies in 2025

    ·

    , ,

    Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by identifying vulnerabilities in their systems, applications, and networks. These firms simulate real-world cyberattacks to uncover weaknesses that could be exploited by malicious actors, helping businesses implement proactive security measures. They provide services tailored to various industries, including web application security, […]

    The post Top 10 Best Penetration Testing Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Weaponizing SVG Files to Stealthily Deliver Malicious Payloads

    ·

    , ,

    Cybercriminals have embraced a new deceptive technique that transforms seemingly harmless vector graphics into dangerous malware delivery systems.

    A recent campaign targeting Latin America demonstrates how attackers are exploiting oversized SVG files containing embedded malicious payloads to distribute AsyncRAT, a potent remote access trojan capable of comprehensive system compromise.

    The campaign begins with carefully crafted phishing emails impersonating legitimate institutions, particularly judicial systems, to create urgency around fictitious legal proceedings or court summons.

    Victims receive messages claiming lawsuits or official documents require immediate attention, compelling recipients to open attached SVG files without proper scrutiny.

    Unlike traditional malware campaigns that require external command-and-control infrastructure, these weaponized SVG files contain complete malicious packages within themselves.

    The technique, known as SVG smuggling, leverages the XML-based nature of Scalable Vector Graphics to embed scripts, interactive elements, and encoded payloads directly into what appears to be an innocent image file.

    XML file used in the campaign (Source – Welivesecurity)

    Welivesecurity analysts noted that these files often exceed 10 MB in size, far larger than typical graphics, and immediately render fake government portals when opened in web browsers.

    The attackers appear to utilize artificial intelligence tools to generate customized files for individual targets, with each victim receiving uniquely crafted SVG files stuffed with randomized data to evade signature-based detection systems.

    Infection Mechanism and Payload Deployment

    The infection process unfolds through a sophisticated multi-stage workflow designed to maintain victim engagement while downloading malicious components.

    When users click the SVG attachment, their default web browser renders an elaborate fake portal mimicking Colombia’s judicial system, complete with official logos, government styling, and dynamic progress indicators.

    The malicious SVG file contains embedded JavaScript that simulates document verification processes, displaying realistic progress bars and status messages like “Verificando documentos oficiales” and “30% completado” to create authenticity.

    During this theatrical display, the script quietly assembles and deploys a password-protected ZIP archive containing the final AsyncRAT payload.

    The embedded code includes base64-encoded binary data that gets decoded and assembled on-the-fly:-

    const payloadData = "UESDBBQACQgIAGxD+VpRqIWSufYYACn8GAAxAAAAMDFfREVNQU5EQSBQRU5BTCBQT1IgRUwgSlVaR0FETyAwMS...";
const binaryString = atob(payloadData);
const bytes = new Uint8Array(binaryString.length);

    The campaign employs DLL sideloading techniques where legitimate applications load malicious libraries, allowing the final AsyncRAT payload to blend with normal system processes and evade detection.

    Detection telemetry reveals systematic deployment patterns, with attack spikes occurring mid-week throughout August 2025, primarily targeting Colombian users.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Weaponizing SVG Files to Stealthily Deliver Malicious Payloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Secret Service Seizes 300 SIM Servers, 100K Cards Threatening U.S. Officials Near UN

    ·

    The U.S. Secret Service on Tuesday said it took down a network of electronic devices located across the New York tri-state area that were used to threaten U.S. government officials and posed an imminent threat to national security. “This protective intelligence investigation led to the discovery of more than 300 co-located SIM servers and 100,000 SIM cards across multiple sites,” the Secret

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: China’s global challenge; NATO on Russian incursions; Estonia’s requests; Germany’s big arms plan; And a bit more.

    ·

    China’s accumulation of military facilities and partnerships beyond the Indo-Pacific region mean U.S. forces must innovate more urgently, air and space intelligence officials said Monday. 

    “The China challenge is not just a challenge for INDOPACOM,” Lt. Gen. Max Pearson, Air Force deputy chief of staff for intelligence, said during a panel discussion at AFA’s Air, Space, and Cyber conference. “In addition to the support base in Djibouti … the PLA continues to pursue military installations, [cooperative agreements], and partnerships in a lot of places. I mean, we're seeing this across Asia, in the Middle East, Africa, across the Pacific. And we're seeing the PLA partnering with others: strategic bomber patrols with Russia, naval patrols with Russia, as well as exercises—PLA, Russia and Iran.” 

    Meanwhile, the Chinese navy launched next-generation fighter and early warning aircraft on test flights from its Fujian aircraft carrier Monday, weeks after Beijing rolled out new weapons at a giant military parade earlier this month.

    Related: “Marines showcase ship-killing NMESIS missile system in Japan,” as part of island-defense exercises, Task & Purpose reported Sunday.

    Anduril blames CCA delay on push for ‘semi-autonomous’ first flight. The Air Force had anticipated that Anduril’s prototype collaborative combat aircraft, dubbed YFQ-44 Fury, would fly this summer, but only General Atomics’ rival YFQ-42A actually took off. “The goal is to also get to a semi-autonomous first flight, which means takeoff and landing will be done via push of a button,” Anduril vice president Diem Salmon told reporters at the AFA show on Monday. A General Atomics spokesman noted that their YFQ-42A is also designed for semi-autonomous flight, although its August test did not use it. Defense One’s Thomas Novelly has a bit more, here.

    ICYMI: F-47’s first flight expected in 2028, a year earlier than officials had previously suggested. Novelly reported off Monday’s keynote by Air Force Chief of Staff Gen. David Allvin, here.

    Update: The U.S. Army released the names of four soldiers who perished in an MH-60 helicopter crash Wednesday in Washington state. They include: 

    • Chief Warrant Officer Three Andrew Cully, 35, from Sparta, Missouri;
    • Chief Warrant Officer Three Andrew Kraus, 39, from Sanibel, Florida;
    • Sgt. Donavon Scott, 24, from Tacoma;
    • And Sgt. Jadalyn Good, 23, from Mount Vernon, Washington. 

    All four were assigned to the 160th Special Operations Aviation Regiment, based at Joint-Base Lewis-McChord, just outside Tacoma. It’s unclear how the crash occurred, but officials from Fort Rucker’s Army Combat Readiness Center have been sent to investigate, Stars and Stripes reports. 

    Additional reading: 

    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1957, President Dwight D. Eisenhower ordered the 101st Airborne Division to Little Rock, Arkansas, and federalized the Arkansas National Guard to support and protect the integration of Little Rock Central High School.

    Americas

    First indication of evidence from Trump’s war on drug cartels? U.S. and Dominican Republic officials have pulled 13 bales containing more than 370 packages of “suspected cocaine” from the waters of the Caribbean Sea near a site where the U.S. military recently destroyed a boat suspected of trafficking drugs, several outlets—including the New York Times, Associated Press, and the Wall Street Journal—reported Monday (gift link). 

    Video of the recovered packages can be seen in a Sunday press conference from Dominican authorities, here. 

    It’s unclear when the boat was destroyed, but President Trump has claimed to have ordered the military to attack at least three such alleged drug-trafficking boats this month—the first on Sept. 2, the next on Sept. 15, and the latest on Sept. 19. 

    Context: “Human rights groups have said the strikes on the boats amount to extra judicial killings, and on Friday two Democratic senators introduced a resolution in Congress that seeks to block the administration from carrying out further strikes,” AP writes. 

    “The speedboat was en route to the Dominican Republic and those on board planned to use the country as a bridge before smuggling the drugs to the U.S.,” the Journal reports, citing officials from the Dominican Republic’s National Directorate for Drug Control. The newspaper did not disclose how the officials made that determination, nor did Dominican officials share any new information on those on the boat when they were killed by the U.S. military. 

    A new report says China’s military diplomacy is taking off in Latin America. That includes an increase in students from the region “enrolled in Chinese military colleges, which was more than five times the number in the United States starting in 2020,” researchers from the Washington-based Center for Strategic and International Studies write in a report published Monday. 

    Russia, meanwhile, has leaned more on its “soft power” in the region, since the majority of its military is bogged down in a Ukraine invasion that has turned into a grinding war of attrition. 

    Still, “For now, Washington remains the preferred defense partner for many [Latin American] countries,” the report says. But more could be done, like “Working with Major Non-NATO Allies like Argentina, Brazil, and Colombia to streamline arms procurement processes and encourage greater interoperability with U.S. forces can help to minimize the appeal of Beijing or Moscow’s offers.” Read the rest, here. 

    Less than two weeks after Brazil’s former president Jair Bolsonaro was convicted of attempting a coup in 2022, the U.S. Treasury Department on Monday announced sanctions against Viviane Barci de Moraes—who is the wife of Alexandre de Moraes, the Brazilian Supreme Court justice who oversaw Bolsonaro’s prosecution. 

    Trump’s State Department alleges Justice Moraes “weaponize[d] courts, authorize[d] arbitrary pretrial detentions, and suppress[ed] freedom of expression” in Brazil.  

    Brazil’s POV: The U.S. sanctions are “a new attempt of undue interference in Brazilian internal affairs,” Brazil’s government said in a statement. It also alleges “the U.S. government tried to justify the adoption of the measure with falsehoods” in an effort to “politicize” and “distort…the Brazilian judiciary’s efforts to defend democratic institutions and uphold rule of law.” 

    Reuters: “The new sanctions underline Trump's use of financial penalties for political ends.”

    Europe

    NATO officials met Tuesday to discuss Russia’s violation of Estonia’s airspace on Friday when three armed Russian MiG-31 aircraft flew over the eastern European nation for more than ten minutes amid Moscow’s ongoing invasion of Ukraine. Estonia requested the alliance meeting, in accordance with Article 4, a move Poland also requested when a similar development involving Russian drones occurred less than two weeks ago. 

    “Several other Allies—including Finland, Latvia, Lithuania, Norway, and Romania—have also recently experienced airspace violations by Russia,” NATO’s North Atlantic Council said in a statement Tuesday. “Russia bears full responsibility for these actions, which are escalatory, risk miscalculation and endanger lives. They must stop.”

    “Allies will not be deterred by these and other irresponsible acts by Russia from their enduring commitments to support Ukraine, whose security contributes to ours, in the exercise of its inherent right to self-defence against Russia’s brutal and unprovoked war of aggression,” the council members added. 

    Estonia calls on NATO to expand air patrols and other defense measures under the alliance's new Eastern Sentry effort, Defense One’s Patrick Tucker reported Monday from Tallinn. 

    Germany’s 80-billion-euro rearmament plan mostly skips U.S. weapons, Politico reports off budget documents submitted to the German parliament. Just 8 percent of the total is slated to buy U.S.-made arms, with the lion’s share headed to European companies. “That's a blow for Donald Trump, who has been putting pressure on European countries to continue buying U.S. arms despite the geopolitical turmoil emanating from the White House,” Politico reported Tuesday. More details, here.

    Trump 2.0

    President Trump wants to prosecute Americans who openly oppose fascism in a new executive order entitled, “DESIGNATING ANTIFA AS A DOMESTIC TERRORIST ORGANIZATION.” 

    According to Trump, “Antifa is a militarist, anarchist enterprise that explicitly calls for the overthrow of the United States Government, law enforcement authorities, and…uses illegal means to organize and execute a campaign of violence and terrorism nationwide to accomplish these goals.” 

    He also claims its members “obstruct enforcement of Federal laws through armed standoffs with law enforcement, organized riots, violent assaults on Immigration and Customs Enforcement and other law enforcement officers, and routine doxing of and other threats against political figures and activists.” Trump’s new order directs federal agencies to “investigate, disrupt, and dismantle” Antifa and its financial supporters wherever they can be found. 

    For the record: Trump “issued a domestic terrorism designation that doesn’t exist under U.S. law,” the New York Times reported after the order was made public Monday. The Times calls the group “a diffuse and sometimes violent protest culture of left-wing activists who want to stop the far right” after taking “its name and iconography from the antifascist movement that opposed the Nazi Party and other far-right political parties in the 1920s and 30s.”

    Another consideration: “Antifa does not have a leader that could be targeted, a roster of known members, bank accounts to freeze or a centralized structure,” the Times reports. The BBC has more, here. 

    Related reading/viewing: 

    Why is there no Coast Guard commandant yet? At least partly because Homeland Security Secretary Kristi Noem lives in the commandant’s house and “she doesn’t want to get kicked out,” Ben Terris of New York Magazine reminded readers in a lengthy Monday profile of the Homeland Security Department under Noem, with an eye on her influential chief of staff and alleged romantic partner Corey Lewandowski. 

    Reminder: Adm. Kevin Lunday has been acting commandant since Trump’s inauguration.

    Reminder: Noem is “overseeing a massive influx of some $170 billion that Republicans set aside for combating illegal immigration, money that will go toward expanding DHS’s detention capacity to 100,000 beds (ICE is currently holding more than 58,000 detainees), increasing the size of ICE (in part by offering up to $50,000 in signing bonuses and eliminating the age cap on new hires), bolstering law-enforcement border support, and underwriting a propaganda campaign that has clogged social media with everything from Zero Dark Thirty–style PSAs to paeans to white-nationalist mythology,” Terris reports. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tata-Owned Jaguar Land Rover Delays Factory Reopening Following Major Cyber Attack

    ·

    , , ,

    Jaguar Land Rover (JLR), the United Kingdom’s largest automotive manufacturer, has announced an additional delay in resuming production at its factories following a significant cyber-attack that occurred earlier this month.

    The company has extended its current production pause until Wednesday, October 1, 2025, as it continues to manage the fallout from the security incident and carefully plans for a secure resumption of its manufacturing lines.

    The decision to prolong the shutdown was communicated to employees, suppliers, and partners to provide them with clear guidance for the week ahead.

    In a recent statement, JLR explained that this extension is crucial for developing a detailed timeline for the “phased restart of our operations.”

    The company is using this period to advance its ongoing investigation into the breach, aiming to understand the full scope of the attack and fortify its systems against future threats.

    This methodical approach underscores the complexity of recovering from a sophisticated cyber intrusion that has impacted a major global manufacturing operation.

    In response to the crisis, JLR has mobilized its internal teams to work around the clock. They are collaborating closely with external cybersecurity specialists, the UK’s National Cyber Security Center (NCSC), and law enforcement agencies.

    The primary objective of this joint effort is to ensure that when production does restart, it is done in a “safe and secure manner.”

    The incident highlights the growing threat of cyber-attacks on critical industrial sectors, where operational technology and IT systems are increasingly interconnected, creating a broader attack surface for malicious actors.

    Throughout this challenging period, JLR has emphasized its commitment to its network of stakeholders. The company stated, “Our focus remains on supporting our customers, suppliers, colleagues, and our retailers, who remain open.”

    While production lines are idle, the customer-facing parts of the business, including sales and service, continue to operate.

    JLR acknowledged the strain the situation has placed on everyone connected with the company, expressing gratitude for their “continued support and patience.”

    The full financial and operational impact of the prolonged shutdown is yet to be determined, but the incident serves as a stark reminder of the significant disruption cyber threats can inflict on the automotive industry.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Tata-Owned Jaguar Land Rover Delays Factory Reopening Following Major Cyber Attack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶