• After the largest buildup of warships and aircraft in the Middle East in decades, American and Israeli military forces launched a massive assault on Iran on Feb. 28, 2026. President Donald Trump has called the attacks “operations” and has urged regime change in Tehran.

    To better understand what this means for the U.S. and Iran, Alfonso Serrano, a U.S. politics editor at The Conversation, interviewed Donald Heflin, a veteran diplomat who now teaches at Tufts University’s Fletcher School.

    Widespread attacks have been reported across Iran, following weeks of U.S. military buildup in the region. What does the scale of the attacks tell you?

    I think that Trump and his administration are going for regime change with these massive strikes and with all the ships and some troops in the area. I think there will probably be a couple more days’ worth of strikes. They’ll start off with the time-honored strategy of attacking what’s known as command and control, the nerve centers for controlling Iran’s military. From media reporting, we already know that the residence of Supreme Leader Ayatollah Ali Khamenei was attacked.

    What is the U.S. strategic end game here?

    Regime change is going to be difficult. We heard Trump today call for the Iranians to bring the government down. In the first place, that’s difficult. It’s hard for people with no arms in their hands to bring down a very tightly controlled regime that has a lot of arms. 

    The second point is that U.S. history in that area of the world is not good with this. You may recall that during the Gulf War of 1990-1991, the U.S. basically encouraged the Iraqi people to rise up, and then made its own decision not to attack Baghdad, to stop short. And that has not been forgotten in Iraq or surrounding countries. I would be surprised if we saw a popular uprising in Iran that really had a chance of bringing the regime down. 

    Do you see the possibility of U.S. troops on the ground to bring about regime change?

    I will stick my neck out here and say that’s not going to happen. I mean, there may be some small special forces sent in. That’ll be kept quiet for a while. But as far as large numbers of U.S. troops, no, I don’t think it’s going to happen. 

    Two reasons. First off, any president would feel that was extremely risky. Iran’s a big country with a big military. The risks you would be taking are large amounts of casualties, and you may not succeed in what you’re trying to do.

    But Trump, in particular, despite the military strike against Iran and the one against Venezuela, is not a big fan of big military interventions and war. He’s a guy who will send in fighter planes and small special forces units, but not 10,000 or 20,000 troops. 

    And the reason for that is, throughout his career, he does well with a little bit of chaos. He doesn’t mind creating chaos and figuring out a way to make a profit on the other side of that. War is too much chaos. It’s really hard to predict what the outcome is going to be, what all the ramifications are going to be. Throughout his first term and the first year of his second term, he has shown no inclination to send ground troops anywhere. 

    Speaking of President Trump, what are the risks he faces?

    One risk is going on right now, which is that the Iranians may get lucky or smart and manage to attack a really good target and kill a lot of people, like something in Jerusalem or Tel Aviv or a U.S. military base. 

    The second risk is that the attacks don’t work, that the supreme leader and whoever else is considered the political leadership of Iran survives, and the U.S. winds up with egg on its face. 

    The third risk is that it works to a certain extent. You take out the top people, but then who steps into their shoes? I mean, go back and look at Venezuela. Most people would have thought that who was going to wind up winning at the end of that was the head of the opposition. But it wound up being the vice president of the old regime, Delcy Rodríguez.

    I can see a similar scenario in Iran, if Khamenei and a couple of other leaders were taken out. But the only institution in Iran strong enough to succeed them is the army, the Guards in particular. Would that be an improvement for the U.S.? It depends on what their attitude was. The same attitude that the vice president of Venezuela has been taking, which is, “Look, this is a fact of life. We better negotiate with the Americans and figure out some way forward we can both live with.”

    But these guys are pretty hardcore revolutionaries. I mean, Iran has been under revolutionary leadership for 47 years. All these guys are true believers. I don’t know if we’ll be able to work with them.

    Any last thoughts?

    I think the timing is interesting. If you go back to last year, Trump, after being in office a little and watching the situation between Israel and Gaza, was given an opening, when Israeli Prime Minister Netanyahu attacked Qatar.

    A lot of conservative regimes, who didn’t have a huge problem with Israel, essentially said “That’s going too far.” And Trump was able to use that as an excuse. He was able to essentially say, “Okay, you’ve gone too far. You’re really taking risk with world peace. Everybody’s gonna sit at the table.”

    I think the same thing’s happening here. I believe many countries would love to see regime change in Iran. But you can’t go into the country and say, “We don’t like the political leadership being elected. We’re going to get rid of them for you.” What often happens in that situation is people begin to rally around the flag. They begin to rally around the government when the bombs start falling.

    But in the last few months, we’ve seen a huge crackdown in Iran. We may never know the number of people the Iranian regime killed in the last few months, but 10,000 to 15,000 protesters seems a minimum. 

    That’s the excuse Trump can use. You can sell it to the Iranian people and say, “Look, they’re killing you in the streets. Forget about your problems with Israel and the U.S. and everything. They’re real, but you’re getting killed in the streets, and that’s why we’re intervening.” It’s a bit of a fig leaf. 

    Now, as I said earlier, the problem with this is if your next line is, “You know, we’re going to really soften this regime up with bombs; now it’s your time to go out in the streets and bring the regime down.” I may eat these words, but I don’t think that’s going to happen. The regime is just too strong for it to be brought down by bare hands.

    This article is republished from The Conversation under a Creative Commons license. Read the original article.

    The Conversation

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hours after Iranian drones damaged U.S. Navy facilities in Manama, Bahrain, U.S. Navy Central Command told all servicemembers and contractors who live and work in and around the base that the area is no longer safe and they will receive money to stay in a hotel elsewhere. 

    An email obtained by Defense One titled “evacuation of Juffair”—the neighborhood in southern Manama that is home to Naval Support Activity Bahrain—says NAVCENT “has concluded that the Juffair boundaries are no longer assessed as safe for US personnel.” 

    The closure came Saturday night local time, after Iranian drones hit the base and multiple high-rise residential buildings in Bahrain in response to U.S. strikes on Iran. Videos posted on social media purport to show a drone nearing the Navy’s 5th Fleet headquarters building, striking a radar inside a large white bubble, and plumes of dark gray smoke billowing from the explosion. Other videos show apparent drone damage to residential high-rise buildings in several areas of Manama, as well as debris from intercepted drones and missiles.

    In a statement, the Bahrain Defense Force said it had shot down 45 incoming missiles and nine drones. 

    Air-raid sirens, followed by all-clear signals, sounded throughout the day, as the U.S. embassy there issued a shelter-in-place order and warned that “even if the incoming missile or drone is intercepted, falling debris represents a significant risk.”  

    No U.S. casualties have been reported; Fox News reported Thursday that the 5th Fleet headquarters had been operating under reduced staffing. Several hundred families of military and civilian employees live in Bahrain, which has no base family housing and limited barracks facilities. An evacuation of dependents was authorized after the first U.S. strikes on Tehran, Stars & Stripes reported, but the evacuation was not mandatory. Though one flight did depart, further flights are on hold. 

    Bahrain International Airport was hit by a drone early Sunday local time. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Overnight, robot-vs.-robot warfare spread from Europe to the Red Sea. 

    The U.S.-made LUCAS, a low-cost attack drone modeled on the Iranian Shahed-136, made its combat debut in Saturday’s strikes on Iran, and drew a wave of Shahed attacks in return.

    “CENTCOM's Task Force Scorpion Strike—for the first time in history—is using one-way attack drones in combat during Operation Epic Fury. These low-cost drones, modeled after Iran's Shahed drones, are now delivering American-made retribution,” U.S. Central Command said in a statement.

    In response to the strikes, Iran used Shaheds to strike U.S. Fifth Fleet headquarters in Bahrain, a CENTCOM official confirmed to Defense One

    “A few did get through” but caused no casualties and inflicted only “minimal damage” to the base, which remains operational, they said. 

    Last July, Arizona-based drone maker Spectreworks showed off the LUCAS at an event in the Pentagon courtyard, just a month before the Air Force began seeking an “exact replica” of the Iranian Shahed-136. In December, CENTCOM announced that they had deployed a “squadron” of the LUCAS drones to the region for testing and experimentation. 

    On Saturday, the official said that the term “squadron” did not really denote the actual number of aircraft. 

    “Don’t think of it as a traditional squadron; it could be 100 or 2,000,” they said.

    While the LUCAS was originally developed to mimic the Shahed for training, its modular, open architecture enables it to carry a variety of payloads. In December, officials acknowledged that they were testing it for a wide variety of missions, including reconnaissance and intelligence collection, in addition to one-way attacks. On Dec. 16, a LUCAS was test-launched from the littoral combat ship Santa Barbara in the Persian Gulf. 

    The official would not say how many LUCAS drones were used in Operation Epic Fury, but said the strikes also included Tomahawk cruise missiles, which can also be fired from Navy warships. (Asked about reports that said 21 Tomahawks had been fired in the operation, the official said it was “way more” than that.)

    Iranian stocks

    The number of Shaheds that Iran can bring to bear depends on a number of factors. Its ability to manufacture the drone is limited. U.S.-led sanctions have forced the regime to turn to smuggling to obtain critical accelerometers and gyroscopes for navigation, satellite-navigation receivers, and other components.

    In January, Iran’s Tasnim News Agency reported that its government had received a new batch of 1,000 drones, but those numbers are impossible to verify by Western sources. 

    Tehran’s stockpile also depends on how many Shaheds it has exported to Russia, its strategic ally, which has for several years used the drone heavily to strike targets in Ukraine.

    A CNA report from January 2025 said Iran was “struggling to meet Russia’s demand.”

    So Russia has been building up its ability to produce Shaheds under license. Last July, U.S. satellite photos showed that Russia greatly expanded its Alabuga SEZ facility and was aiming to produce 25,000 Shahed-136 drones a year, the Institute for Science and International Security noted, adding that the actual figure is likely closer to 18,540 per year. 

    In 2024, RUSI estimated that Russia was making the drones for $80,000 apiece. 

    Moscow’s willingness to build up Iranian stockpiles is unclear, but the two countries have been collaborating to improve their drones and related tactics.

    “The Iranians and their Russian allies had four years of target practice on Ukrainian cities to improve their Shahed drones. And most of the world smiled politely and thought it is just the Ukrainians’ unfortunate problem,” noted Wall Street Journal chief financial correspondent Yaroslav Trofimov on X., adding, “New Shaheds are much more difficult to intercept and are very accurate.”

    U.S. production

    But the U.S. ability to produce the Shahed clones is also limited. While the Pentagon has expanded efforts to quickly produce large numbers of cheap one-way attack drones, they are still relatively new.

    The U.S. still has conventional missiles for both targeted strikes and potential defense against drones. But these are often orders of magnitude more costly than Shaheds. Here, too, the U.S. faces constraints an a growing number of potential deployments.

    “US destroyers launched Tomahawks at Iranian targets, but here’s the problem: America doesn’t have unlimited [Tomahawk Land Attack Missile, or TLAMs]. The Trump administration burned through big numbers in earlier strikes on Iran, Houthis, and Nigeria without replenishing stockpiles. TLAMs would be vital in a China fight,” Bloomberg defense analyst Becca Wasser posted on X on Saturday.

    The United States might try to turn to its European allies for help, and those relationships provide a possible picture of the robot war’s next scene. The most effective defense against Shahed-136 drones is a $2,500 interceptor made by Ukraine.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Coordinated U.S. and Israeli strikes on Iranian targets are putting renewed focus on how the United States integrates offensive cyber capabilities into the battlespace — and how prepared federal agencies are for retaliation at home.

    Iran has shown a tendency to respond to overseas threats with cyber means, from defacing websites to spying on U.S. and allied targets. Tracking such actions and alerting the U.S. government and public is a job of the Cybersecurity and Infrastructure Security Agency, which has been operating with sharply reduced staffing due to a funding lapse for its parent agency, the Department of Homeland Security.

    “This is a bad time for Washington’s cyber agency to be operating with limited staff,” said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, a national security think tank.

    That funding lapse comes after Trump-administration moves shrank CISA’s workforce by about one-third last year and degraded public-private collaboration mechanisms. This “limits the ability of the federal government to provide timely cyber threat information to the private sector,” Fixler said.

    In the wake of the U.S. and Israeli airstrikes, American companies could see a “barrage” of low-level attacks like website defacements and distributed denial-of-service attacks, said Fixler. “Iran might also see some limited success against targets that do not have proper cyber hygiene — exposed edge devices with default passwords, for example.”

    Other cyber experts said the U.S. should prepare for a mix of distributed denial-of-service campaigns, ransomware and hack-and-leak operations meant to send a message.

    “While it’s not operating at the same technical level as China or Russia, Iranian-linked groups have carried out disruptive attacks against U.S. financial institutions, infrastructure providers and private sector companies,” said Tom Pace, a former Marine intelligence specialist and CEO of NetRise, a cybersecurity supply chain firm.

    The conflict will likely see a surge in state-sponsored hacking activity, “specifically targeting operational technology and critical infrastructure through the exploitation of internet-facing industrial control systems and vulnerable [programmable logic controller] hardware,” said Brian Harrell, a former CISA official. 

    “Threat hunters should be working overtime right now. By combining disruptive attacks with psychological operations, Iran will seek to erode public trust in government institutions and project domestic strength during periods of heightened conflict,” he said.

    Elisity CEO James Winebrenner echoed that advice. “We should be vigilant in protecting exposed [industrial controls systems] and expect heightened retaliatory activity in the coming days and weeks,” he said. In late 2023, Iran-linked hackers digitally defaced U.S. water treatment equipment.

    Tehran may play up the effectiveness and scope of their cyberattacks, said Cynthia Kaiser, a former FBI cybersecurity deputy director who leads the Ransomware Research Center at Halcyon. Industry research has documented these theatrics.

    “They’ll turn [an intrusion] into an information operation, and say, ‘Look, we compromised this entire facility,’ even though they compromised just a machine,” Kaiser said. 

    Asked about the diminished DHS and CISA workforce, Kaiser said other national security elements across the government like the FBI and NSA are still able to track and respond to cyber threats in full. “People marshal themselves together to focus on a big threat” even if there are resource shortages, she said. 

    Matt Hayden, a former DHS infrastructure security official, said CISA would continue its standard threat-hunting procedures as if the government was fully operating. “While there are operators that are working without pay, they are still working,” he said. Hayden is now vice president of cyber and emerging threats at GDIT.

    Defense One has asked CISA and DHS for comment.

    The U.S. has likely deployed a powerful toolset of cyber and electronic operations against Iranian targets, said Charles Moore, a retired three-star general and former U.S. Cyber Command official who is now a distinguished visiting professor at Vanderbilt University’s Institute of National Security.

    “I would suspect that anything that Iran is using to communicate, anything they’re using to keep situational awareness or visibility on the battle space, and any systems they’re using to try to defend themselves, all those types of things — would be targets that would be of interest from a cyber perspective,” Moore said.

    The U.S. and Israel are also likely intercepting communications to aid in its operations. “In general, signals intelligence of any type, is something the United States is very interested in and is very adept at gathering. And so I have no doubt that those types of efforts will continue,” he said.

    Internet connectivity in Iran has also been heavily reduced. The exact cause of this decline is uncertain. While the U.S. or Israel may have played a role, Iran frequently restricts internet access during periods of unrest, such as anti-regime protests.

    In coming days, there may be public indications that Cyber Command played a role in U.S. components of the operation, said FDD’s Fixler.

    Influence operations have played a role in the efforts. Israel notably hacked a major Iranian prayer app, aiming to fuel uprising against the regime. But its effectiveness may be limited, said Maggie Feldman-Piltch, CEO of Iceberg Holdings, a firm that helps private-sector entities prevent IP theft. 

    The infiltration of a prayer app with those messages is “a wonderful example of not knowing your audience or understanding what happens when you don’t,” said Feldman-Piltch, who formerly led the digital and electronic portfolio at the Wilson Center. 

    A simple message finally calling for uprising ignores years of already documented protests against Iran that have resulted in civilian killings, she said.

    The U.S. and its allies will have to stay vigilant. The operation “has destroyed Iran’s conventional military options, making cyber operations the regime’s sole remaining instrument of asymmetric retaliation,” says a threat intelligence report sent to Defense One produced by cybersecurity firm Anomali. Iran-linked cyber units were “activated and retooling before the kinetic trigger,” it adds.

    “Geography provides no protection against a cyber-enabled adversary,” said Tatyana Bolton, principal and head of Monument Advocacy’s cybersecurity practice. “Iran possesses some of the most creative and dangerous cyber operators in the world, and with the current escalation, their incentive for restraint is significantly reduced.”

    “They don’t need to win a naval battle in the Gulf to hurt the U.S. — they can simply hold our power grids, water systems, and hospitals hostage from halfway around the world to force our hand at the negotiating table,” Bolton said. “We must recognize that in 2026, the front line isn’t just in the Middle East — it’s in our own backyard.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • After U.S. and Israeli missiles struck Iran’s nuclear sites in June 2025, Tehran responded with a limited attack on the American airbase in Qatar. Five years before that, a U.S. drone strike against Qasem Soleimani, head of the powerful Islamic Revolutionary Guard Corps Quds Force, was met with followed by an attack on two American bases in Iraq shortly thereafter.

    Expect none of that restraint by Iran’s leaders following the latest U.S. and Israeli military operation currently playing out in the Gulf nation.

    In the early hours of Feb. 28, 2026, hundreds of missiles struck multiple sites in Iran. Part of “Operation Epic Fury,” as the U.S. Department of Defense has called it, the strikes follow months of U.S. military buildup in the region. But they also come after apparent diplomatic efforts, in the shape of a series of nuclear talks in Oman and Geneva aimed at a peaceful resolution.

    Any such deal is surely now completely off the table. In scale and scope, the U.S. and Israel attack goes far beyond any previous strikes on the Gulf nation.

    In response, Iran has said it will use “crushing” force. As an expert on Middle East affairs and a former senior official at the National Security Council during the first Trump administration, I believe the calculus both in Washington and more so in Tehran is very different from earlier confrontations: Iran’s leaders almost certainly see this as an existential threat given President Donald Trump’s statement and the military campaign already underway. And there appears to be no obvious off-ramp to avoid further escalation.

    What we should expect now is a response from Tehran that utilizes all of its capabilities – even though they have been significantly degraded. And that should be a worry for all nations in the region and beyond.

    It is important to note that we are in the early stages of this conflict – much is unknown. 

    As of Feb. 28, it is unclear who has been killed among Iran’s leadership and to what extent Iran’s ballistic missile capabilities have been degraded. The fact that ballistic missiles have been launched at regional states that host U.S. military bases suggests that, at a minimum, Iran’s military capabilities have not been entirely wiped out.

    Iran fired over 600 missiles against Israel last June during their 12-day war, but media reporting and Iranian statements over the past month suggested that Iran managed to replenish some of its missile inventory, which it is now using.

    Clearly Washington is intent on crippling Iran’s ballistic program, as it is that capability that allows Iran to threaten the region most directly. A sticking point in the negotiations in Geneva and Oman was U.S. officials’ insistence that both Iran’s ballistic missiles and its funneling of support to proxy groups in the region be on the table, along with the longstanding condition that Tehran ends all uranium enrichment. Tehran has long resisted attempts to have limits on its ballistic missiles as part of any negotiated nuclear deal given their importance in Iran’s national security doctrine.

    This explains why some U.S. and Israeli strikes appear to be aimed at taking out Iran’s ballistic and cruise missile launch sites and production facilities and storage locations for such weapons.

    With no nuclear weapon, Iran’s ballistic missiles have been the country’s go-to method for responding to any threat. And so far in the current conflict, they have been used on nations including the United Arab Emirates, Qatar, Kuwait and Bahrain.

    But the Trump administration appears to have expanded its aims beyond removing Iran’s nuclear and non-nuclear military threat. The latest strikes have gone after leadership, too. 

    Among the locations of the first U.S.-Israeli strikes was a Tehran compound in which the Supreme Leader Ayatollah Ali Khamenei in known to reside, and Israel’s prime minister has confirmed that the 86-year-old leader was a target of the operation.

    While the status of the supreme leader and other key members of Iran’s leadership remains unknown as of this writing, it is clear that the U.S. administration hopes that regime change will follow Operation Epic Fury. “When we are finished, take over your government. It will be yours to take,” Trump told Iranians via a video message recorded during the early hours of the attack.

    Signaling a regime change operation may encourage Iranians unhappy with decades of repressive rule and economic woes to continue where they left off in January – when hundreds of thousands took to the street to protest.

    But it carries risks for the U.S. and its interests. Iran’s leaders will no longer feel constrained, as they did after the Soleimani assassination and the June 2025 conflict. On those occasions, Iran responded in a way that was not even proportionate to its losses – limited strikes on American military bases in the region. 

    Now the gloves are off, and each side will be trying to land a knockout blow. But what does that constitute? The U.S. administration appears to be set on regime change. Iran’s leadership will be looking for something that goes beyond its previous retaliatory strikes – and that likely means American deaths. That eventuality has been anticipated by Trump, who warned that there might be American casualties.

    So why is Trump willing to risk that now? It is clear to me that despite talk of progress in the rounds of diplomatic talks, Trump has lost his patience with the process.

    On Feb. 26, after the latest round of talks in Geneva, we didn’t hear much from the U.S. side. Trump’s calculus may have been that Iran wasn’t taking the hint – made clear by adding a second carrier strike group to the other warships and hundreds of fighter aircraft sent to the region over the past several weeks – that Tehran had no option other than agreeing to the U.S. demands.

    What we don’t know is whether the U.S. strategy is now to pause and see if an initial round of strikes has forced Iran to sue for peace – or whether the initial strikes are just a prelude to more to come.

    For now, the diplomatic ship appears to have sailed. Trump seems to have no appetite for a deal now – he just wants Iran’s regime gone. 

    In order to do that, he has made a number of calculated gambles. First politically and legally: Trump did not go through Congress before ordering Operation Epic Fury. Unlike 23 years ago when President George W. Bush took the U.S. into Iraq, there is no war authorization giving the president cover.

    Instead, White House lawyers must have assessed that Trump can carry out this operation under his Article 2 powers to act as commander in chief. Even so, the 1973 War Powers Act will mean the clock is now ticking. If the attacks are not concluded in 60 days, the administration will have to go back to Congress and say the operation is complete, or work with Congress for an authorization to use force or a formal declaration of war.

    The second gamble is whether Iranians will heed his call to remove a regime that many have long wanted gone. Given the ferocity of the regime’s response to the protests in January, which resulted in the deaths of thousands of Iranians, are Iranians willing to face down Iran’s internal security forces and drive what remains of the regime from power?

    Third, the U.S. administration has made a bet that the Iranian regime – even confronted with an existential threat – does not have the capability to drag the U.S. into a lengthy conflict to inflict massive casualties.

    And this last point is crucial. Experts know Tehran has no nuclear bomb and only has a limited stockpile of drones and cruise and ballistic missiles.

    But it can lean on unconventional capabilities. Terrorism is a real concern – either through the Islamic Revolutionary Guard Corps’ Quds Force, which coordinates Iran’s unconventional warfare, or through its partnership with Hezbollah in Lebanon. Or actors like the Houthis in Yemen or Shia militias in Iraq may seek to conduct attacks against U.S. interests in solidarity with Iran or directed to do so by the regime. 

    A mass casualty event may put political pressure on Trump, but I cannot see it leading to U.S. boots on ground in Iran. The American public doesn’t have the appetite for such an eventuality, and that would necessitate Trump gaining Congressional approval, which for now has not yet materialized.

    No one has a crystal ball, and it is early in an operation that will likely go on for days, if not longer. But one thing is clear: Iran’s regime is facing an existential threat. Do not expect it to show restraint.

    This article is republished from The Conversation under a Creative Commons license. Read the original article.

    The Conversation

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take over control. “Our vulnerability lives in the core system itself – no plugins, no marketplace, no user-installed extensions – just the bare OpenClaw gateway, running exactly as documented,” Oasis

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors are executing sophisticated phishing campaigns that impersonate Zoom and Google Meet to silently deploy Teramind onto Windows devices. While Teramind is a legitimate enterprise endpoint monitoring product, scammers are abusing its stealth features to conduct unauthorized surveillance. The Infection Chain and Delivery Mechanism The attack relies on fabricated landing pages that mimic official […]

    The post Fake Zoom and Google Meet Phishing Campaigns Deploy Teramind Surveillance Software appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Stop the 75% failure rate. Learn which device vulnerabilities stall deployments and the exact fixes that get IoT projects to production.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher’s home. This post examines what is knowable about Dort based on public information.

    A public “dox” created in 2020 asserted Dort was a teenager from Canada (DOB August 2003) who used the aliases “CPacket” and “M1ce.” A search on the username CPacket at the open source intelligence platform OSINT Industries finds a GitHub account under the names Dort and CPacket that was created in 2017 using the email address jay.miner232@gmail.com.

    Image: osint.industries.

    The cyber intelligence firm Intel 471 says jay.miner232@gmail.com was used between 2015 and 2019 to create accounts at multiple cybercrime forums, including Nulled (username “Uubuntuu”) and Cracked (user “Dorted”); Intel 471 reports that both of these accounts were created from the same Internet address at Rogers Canada (99.241.112.24).

    Dort was an extremely active player in the Microsoft game Minecraft who gained notoriety for their “Dortware” software that helped players cheat. But somewhere along the way, Dort graduated from hacking Minecraft games to enabling far more serious crimes.

    Dort also used the nickname DortDev, an identity that was active in March 2022 on the chat server for the prolific cybercrime group known as LAPSUS$. Dort peddled a service for registering temporary email addresses, as well as “Dortsolver,” code that could bypass various CAPTCHA services designed to prevent automated account abuse. Both of these offerings were advertised in 2022 on SIM Land, a Telegram channel dedicated to SIM-swapping and account takeover activity.

    The cyber intelligence firm Flashpoint indexed 2022 posts on SIM Land by Dort that show this person developed the disposable email and CAPTCHA bypass services with the help of another hacker who went by the handle “Qoft.”

    “I legit just work with Jacob,” Qoft said in 2022 in reply to another user, referring to their exclusive business partner Dort. In the same conversation, Qoft bragged that the two had stolen more than $250,000 worth of Microsoft Xbox Game Pass accounts by developing a program that mass-created Game Pass identities using stolen payment card data.

    Who is the Jacob that Qoft referred to as their business partner? The breach tracking service Constella Intelligence finds the password used by jay.miner232@gmail.com was reused by just one other email address: jacobbutler803@gmail.com. Recall that the 2020 dox of Dort said their date of birth was August 2003 (8/03).

    Searching this email address at DomainTools.com reveals it was used in 2015 to register several Minecraft-themed domains, all assigned to a Jacob Butler in Ottawa, Canada and to the Ottawa phone number 613-909-9727.

    Constella Intelligence finds jacobbutler803@gmail.com was used to register an account on the hacker forum Nulled in 2016, as well as the account name “M1CE” on Minecraft. Pivoting off the password used by their Nulled account shows it was shared by the email addresses j.a.y.m.iner232@gmail.com and jbutl3@ocdsb.ca, the latter being an address at a domain for the Ottawa-Carelton District School Board.

    Data indexed by the breach tracking service Spycloud suggests that at one point Jacob Butler shared a computer with his mother and a sibling, which might explain why their email accounts were connected to the password “jacobsplugs.” Neither Jacob nor any of the other Butler household members responded to requests for comment.

    The open source intelligence service Epieos finds jacobbutler803@gmail.com created the GitHub account “MemeClient.” Meanwhile, Flashpoint indexed a deleted anonymous Pastebin.com post from 2017 declaring that MemeClient was the creation of a user named CPacket — one of Dort’s early monikers.

    Why is Dort so mad? On January 2, KrebsOnSecurity published The Kimwolf Botnet is Stalking Your Local Network, which explored research into the botnet by Benjamin Brundage, founder of the proxy tracking service Synthient. Brundage figured out that the Kimwolf botmasters were exploiting a little-known weakness in residential proxy services to infect poorly-defended devices — like TV boxes and digital photo frames — plugged into the internal, private networks of proxy endpoints.

    By the time that story went live, most of the vulnerable proxy providers had been notified by Brundage and had fixed the weaknesses in their systems. That vulnerability remediation process massively slowed Kimwolf’s ability to spread, and within hours of the story’s publication Dort created a Discord server in my name that began publishing personal information about and violent threats against Brundage, Yours Truly, and others.

    Dort and friends incriminating themselves by planning swatting attacks in a public Discord server.

    Last week, Dort and friends used that same Discord server (then named “Krebs’s Koinbase Kallers”) to threaten a swatting attack against Brundage, again posting his home address and personal information. Brundage told KrebsOnSecurity that local police officers subsequently visited his home in response to a swatting hoax which occurred around the same time that another member of the server posted a door emoji and taunted Brundage further.

    Dort, using the alias “Meow,” taunts Synthient founder Ben Brundage with a picture of a door.

    Someone on the server then linked to a cringeworthy (and NSFW) new Soundcloud diss track recorded by the user DortDev that included a stickied message from Dort saying, “Ur dead nigga. u better watch ur fucking back. sleep with one eye open. bitch.”

    “It’s a pretty hefty penny for a new front door,” the diss track intoned. “If his head doesn’t get blown off by SWAT officers. What’s it like not having a front door?”

    With any luck, Dort will soon be able to tell us all exactly what it’s like.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identified by the prefix “AIza”) embedded in client-side code to provide Google-related services like

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶