• A coalition of industry groups and former officials is asking Congress to preserve measures in the annual intelligence-community authorization bill that support the use of open-source intelligence by U.S. spy agencies, according to letters first seen by Nextgov/FCW.

    The missives are undersigned by firms such as Babel Street and ANDECO, which sell risk and threat intelligence services derived from commercially or publicly available information that’s not necessarily gathered through more covert means available to spy agencies. Graphika, which performs social media network analysis to identify disinformation campaigns, is also a signatory.

    The measures, housed in Title 6 of the House Intelligence Committee’s version of the fiscal year 2026 Intelligence Authorization Act, are also supported by the OSINT Foundation, a professional association of open-source practitioners in the U.S. intelligence community. Former officials are also signatories, including Kristin Wood, who served as a deputy director in the CIA’s Open Source Center. 

    Open-source intelligence—OSINT for short—is the collection and analysis of publicly available data such as social media posts, news reports or satellite imagery.

    The Title 6 measures aim to further legitimize the use of OSINT in day-to-day intelligence work; among other steps, they would require spy agencies to appoint senior officials responsible for managing and coordinating their OSINT activities.

    “The arrival of mission-relevant artificial intelligence (AI) systems within the past two years means the [U.S. intelligence community] is, for the first time, able to make use of large unclassified datasets at scale to deliver decision advantage to U.S. policymakers and warfighters,” one of the letters says.

    The House intelligence panel has zeroed in on OSINT this year, forming an open-source subcommittee. Last year, the Office of the Director of National Intelligence, under then-director Avril Haines, released an OSINT strategy that called for using artificial intelligence and machine learning.

    The missives are addressed to the Republican and Democratic leaders on the congressional intelligence panels. The sweeping intel bill is considered annually to authorize funding, programs and oversight of the U.S. spy community. 

    The letters come as the Senate and House are negotiating compromises over differences in the houses' legislation. The Senate’s version does not have the same OSINT provisions as the lower chamber's.

    The letters aim to motivate both chambers to keep the House measures, though not all elements of the U.S. intelligence enterprise are on board. The National Geospatial-Intelligence Agency, which uses satellites and imagery analysis to track targets from space, is looking for a carve-out, according to Brandon McKee, the senior director for government affairs at the Special Competitive Studies Project’s Action Program, which backs the OSINT language.

    A second person familiar with the matter, who requested anonymity because they were not authorized to speak publicly, also confirmed that NGA is not backing the measures at this time.

    “They were not an entity that I believed would have been against a provision like this,” McKee said in an interview with Nextgov/FCW. “This is something that would greatly benefit the agency.” 

    He argued that open-source intelligence can produce high-quality analysis for U.S. decisionmakers, often rivaling or complementing classified intelligence, while being faster to deliver and more affordable than other means.

    “If you’re looking to provide the best intelligence to policymakers and decisionmakers…this is another area that has to be there," he said.

    There may be broader opposition. A Senate aide, who requested anonymity to speak candidly, said the Defense Department writ large is also opposed, as well as some other IC components. The aide did not name those agencies. The DOD houses NGA, as well as other intelligence giants such as the National Security Agency and National Reconnaissance Office.

    It’s not entirely clear why these spy agencies aren’t on board, though the hesitancy could stem from institutional concerns about losing control over their traditional mission space, budgets, or legal authorities.

    Nextgov/FCW has asked ODNI for comment.

    “In the digital age, OSINT plays a critical role in real-time analysis, strategic warning and supporting tactical operations. We are proud that the HPSCI FY26 IAA, with the inclusion of the first-ever OSINT title, passed out of Committee overwhelmingly on a bipartisan basis,” a House Intelligence Committee spokesperson said. “Furthermore, we appreciate the letters of support from the nonprofit organizations and their recognition that the IC can more effectively and efficiently use open-source data.”

    Spy agencies aren’t new to the use of OSINT, and many are predominant users of open-source means. Still, the acquisition and use of such data has been deemed controversial in the past.

    Personal information on digital marketplaces like social media platforms is frequently packaged by data brokers, and spy agencies are among their customers. The dynamic has put the intelligence community on thin ice with some lawmakers and privacy advocates who call it an end-run around the Fourth Amendment, which bars unreasonable searches and seizures.

    Last year, the Office of the Director of National Intelligence issued new policies that aim to guide spy agencies on best practices for ethically using commercial data. But agencies were not mandated to obtain a warrant before procuring or searching through datasets, a requirement that civil liberties groups have long advocated for.

    OSINT has played a major role in recent armed conflicts, especially those in Gaza and Ukraine. Some groups argue that while open-source analysis has helped expose atrocities and verify battlefield developments, it also risks crossing ethical lines like revealing civilian locations, spreading unvetted or unverified data and operating in legal gray zones that aren’t immediately addressable under current humanitarian law.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated new threat has emerged in the cybersecurity landscape, leveraging the popular communication platform Discord to conduct covert operations.

    ChaosBot, a Rust-based malware strain, represents an evolution in adversarial tactics by hiding malicious command and control traffic within legitimate cloud service communications.

    This approach allows attackers to blend seamlessly into normal network traffic, making detection significantly more challenging for traditional security solutions.

    The malware operates through a carefully orchestrated infection chain that begins with either compromised VPN credentials or phishing campaigns using malicious Windows shortcut files.

    Once executed, ChaosBot establishes persistent access by validating its Discord bot token and creating a dedicated private channel named after the victim’s computer.

    This channel becomes an interactive command shell where attackers issue commands such as shell, download, and scr (screenshot), with results exfiltrated back as attached files through Discord’s API.

    Picussecurity researchers identified the malware’s sophisticated evasion capabilities, which include patching the Windows Event Tracing (ETW) function to blind endpoint detection systems and performing anti-virtualization checks against known MAC address prefixes for VMware and VirtualBox environments.

    These techniques demonstrate a deliberate effort to evade analysis in sandboxed security research environments.

    Discord-Based Command and Control Infrastructure

    ChaosBot’s technical implementation reveals a well-engineered C2 protocol built entirely on Discord’s API infrastructure.

    Written in Rust and utilizing the reqwest or serenity library, the malware maintains communication through standard HTTPS requests that appear identical to legitimate Discord traffic.

    Upon initial execution, ChaosBot validates its embedded bot token with a GET request to hxxps://discord[.]com/api/v10/users/@me.

    Following successful authentication, it creates a victim-specific channel using a POST request:-

    POST hxxps://discord[.]com/api/v10/guilds/<THREAT_ACTOR_GUILD_ID>/channels 
    {"name":"<VICTIM_COMPUTER_NAME>","type":0}

    Command execution relies on a continuous polling mechanism that checks for new messages in the victim’s channel.

    When operators issue shell commands, ChaosBot forces UTF8 encoding through PowerShell: powershell -Command "$OutputEncoding = [System.Text.Encoding]::UTF8; <SOME_COMMAND>".

    The command output, screenshots, or downloaded files are then uploaded back to Discord as multipart/form-data attachments, creating a fully functional remote access capability through a platform trusted by most corporate firewalls and security appliances.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New Rust-Based ChaosBot Malware Leverages Discord for Stealthy Command and Control appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • “Defending the homeland” has always been the point of the national defense strategy, experts argue, but the precursors to the forthcoming update hint that the way the U.S. practices homeland defense could be changing. 

    While deterring China—the top priority listed in the most recent strategies—is seen as part of the larger project of protecting the homeland, current defense planning guidance is more specific about operations on American soil playing a bigger role. 

    “We're already seeing that they view homeland defense in this administration as including border security, counter-drug operations, even domestic law enforcement, right?” Todd Harrison, a senior fellow at the American Enterprise Institute, said Thursday at a Center for a New American Security event. “And so if they are changing the definition of what is included in homeland defense—then, yeah, I think those are very different capability sets, things that the military is not used to doing, it's not necessarily that good at doing, or appropriate or legal to do in some cases.”

    The question is how the budget will reflect that shift in priorities. A CNAS report released Tuesday found that recent years’ defense spending has prioritized innovation over actual deterrence of adversaries, leaving a hole in near-term readiness.

    “So what we found is that there is a gap between what's available now and what's required now to maintain deterrence in the near- and medium-term, and the emphasis that's being placed on those long-term objectives,” said Carlton Haelig, a CNAS fellow who co-authored the report.

    To reverse that trend, the Pentagon can shift spending to less-expensive, quick-turn acquisitions, and away from exquisite systems that take decades to develop and won’t be ready in time to make a difference on the next battlefield.

    The current administration has made some headway on paper, changing policies to allow stockpiling of attritable drones while also standing up a task force to tackle the counter-drone threat.

    But with a shrinking defense budget, the Pentagon is on shaky ground to continue making investments in deterrence while also increasing operations stateside, which it professes to prioritize.

    “There's been a lot of reporting about the potential to elevate the homeland,” Philip Sheers, a CNAS research associate and the report’s co-author. “It's not necessarily a foregone conclusion at all that China cedes priority in that formulation, but there's rumbling that there will be a different formulation altogether of the strategic priorities of the department in the next strategy.”

    While this year’s reconciliation bill brought a one-time infusion of cash, hiking defense spending up to nearly $1 trillion, Harrison argued that this kind of budget trick isn’t sustainable. 

    “After the midterm elections, all bets are off,” he said, if party control changes in one or both hours of Congress. “If they want to actually keep advancing these, all of the different systems and programs within Golden Dome, it's got to be in the base budget. And if they're trying to keep the base budget flat at current levels, including that Golden Dome funding would require really catastrophic cuts.”

    But even with all that in mind, he said, it might be naive to look to the NDS as a guide for how the Defense Department spends money.

    “At the end of the day, the National Defense Strategy is a piece of paper, and it's not worth anything unless the administration actually intends to follow it, to use it as a guiding framework,” Harrison said. “I'm not sure that there is any strategy document that will actually frame or constrain or guide what the president chooses to do on a day-to-day basis, so I don't know that it'll end up being that important.”

    In his opinion, he added, the Office of Management and Budget has been driving the Pentagon’s current budget request more than the Defense Department itself. 

    “And I don't think OMB is going to feel constrained at all, or guided at all, by this piece of paper that Bridge Colby is going to produce,” he said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Salt Typhoon, a China-linked advanced persistent threat (APT) group active since 2019, has emerged as one of the most sophisticated cyber espionage operations targeting global critical infrastructure.

    Also tracked as Earth Estries, GhostEmperor, and UNC2286, the group has conducted high-impact campaigns against telecommunications providers, energy networks, and government systems across more than 80 countries.

    The threat actor leverages zero-day exploits in edge devices including Ivanti, Fortinet, and Cisco appliances to establish initial access, while employing DLL sideloading techniques to maintain stealth and evade traditional signature-based detection mechanisms.

    Recent intrusions demonstrate an alarming capability to compromise lawful intercept systems and exfiltrate metadata affecting millions of users.

    The group’s operations blend intelligence collection with geopolitical influence, exposing the strategic nature of state-sponsored cyber campaigns.

    DarkTrace analysts identified early-stage intrusion activity in a European telecommunications organization during July 2025, observing tactics consistent with Salt Typhoon’s known procedures.

    The intrusion began with exploitation of a Citrix NetScaler Gateway appliance, allowing the threat actor to pivot to Citrix Virtual Delivery Agent hosts within the organization’s Machine Creation Services subnet.

    Initial access originated from infrastructure potentially associated with the SoftEther VPN service, demonstrating infrastructure obfuscation from the outset.

    DLL Sideloading and Persistence Mechanisms

    The technical sophistication of Salt Typhoon’s operations becomes evident through their systematic abuse of legitimate software for malicious purposes.

    DarkTrace researchers observed the delivery of SNAPPYBEE backdoor, also known as Deed RAT, to multiple internal endpoints as DLL files accompanied by legitimate executable files from trusted antivirus solutions.

    The threat actor specifically targeted Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter executables to facilitate DLL side-loading operations.

    This technique enabled the group to execute malicious payloads under the guise of trusted security software, effectively bypassing traditional security controls.

    The backdoor established command-and-control communications through LightNode VPS endpoints, utilizing both HTTP and an unidentified TCP-based protocol.

    HTTP communications featured POST requests with distinctive URI patterns such as “/17ABE7F017ABE7F0”, connecting to the domain aar.gandhibludtric[.]com (38.54.63[.]75), recently linked to Salt Typhoon infrastructure.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Salt Typhoon Using Zero-Day Exploits and DLL Sideloading Techniques to Attack Organizations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A trio of nominees to replace inspectors general fired by President Donald Trump were pressed by Senate Democrats on Thursday about their propensity to act independently of the White House.

    Sen. Gary Peters, D-Mich., the ranking member of the Senate Homeland Security and Governmental Affairs Committee, started the hearing by asking the three nominees whether Trump violated the law when he fired 17 IGs at the beginning of his second term without providing advance notice or “substantive rationale” to Congress. 

    The trio, who would replace fired watchdogs at the departments of Defense and Labor as well as the Small Business Administration, generally declined to answer Peters’ question, saying the matter is currently being litigated. 

    Peters told the nominees, “It's clear that you folks don't understand the role of an IG and that basically disqualifies you.”

    A federal judge in September ruled that it was “obvious” the president broke federal law with respect to the removals, but she rejected a request by some of them to be reinstated after determining they could not show they suffered irreparable harm. Panel Democrats, in particular, criticized Labor IG nom Anthony D’Esposito, a former U.S. representative from New York. Last year, the New York Times reported that he may have violated House ethics rules by apparently hiring his fiancee’s daughter as well as a woman with whom he was alleged to have had an affair. 

    D’Esposito answered a question from Sen. Richard Blumenthal, D-Conn., about whether he would be a political candidate in the next election by saying, “As of today, my focus is to be confirmed as inspector general of the U.S. Labor Department. Having discussions about the future are questions that I can't answer.” 

    Blumenthal also pointed out that D’Esposito’s campaign website is still up, but the nominee said that he doesn’t use it. 

    “The campaign website that is still active is not being updated. It's not being used. There is no fundraising being done,” D’Esposito said. “There's not an active campaign.”

    On Oct. 9, the Senate Health, Education, Labor and Pensions Committee advanced D’Esposito’s nomination in a party-line 12-11 vote. Still, Sen. Lisa Murkowski, R-Alaska, said during that markup that she has concerns about his political history influencing his ability to be impartial in the position. 

    “I'm going to be looking to make sure that he executes his new responsibilities with the unbiased nature that he has committed to me,” Murkowski said. 

    The panel on Thursday also considered the nominations of Platte Moring to be DOD IG and William Kirk to lead the SBA IG office. 

    The Senate Armed Services Committee advanced Moring’s nomination on Oct. 9. Staff for the panel didn’t immediately respond to a question about how senators voted on the nominee.  

    Sen. Jack Reed, D-R.I., the ranking member of SASC, said during that committee’s confirmation hearing for Moring that his nomination was a “very wise choice.” Moring is a retired lieutenant colonel and served as deputy general counsel at DOD during Trump’s first term. 

    On Thursday, Moring promised to notify Congress if he believes an IG investigation is being improperly interfered with. 

    The DOD IG is currently evaluating Defense Secretary Pete Hegseth at the request of Reed and SASC Chairman Roger Wicker, R-Miss., over his use of Signal to inadvertently share information about military operations in Yemen with a journalist.

    Kirk’s nomination was advanced by the Senate Small Business and Entrepreneurship Committee on Oct. 8 in a 10-9 vote. According to his LinkedIn, he is the acting chief of staff in the Education Department’s general counsel office and has held multiple positions in the EPA OIG. 

    While the three IG nominees have already been approved by a Senate committee, HSGAC still held a hearing with them because the panel shares jurisdiction for almost all IGs. A committee aide told Government Executive that, while HSGAC can hold a separate vote on them, the nominees are automatically sent to the floor 20 days after being favorably reported by their primary committee. 

    Trump’s nominee to lead the Office of Special Counsel, Paul Ingrassia, was scheduled to be a part of Thursday’s hearing, but the White House on Tuesday pulled his nomination after Senate Republicans expressed concerns about reports that he has been accused of sexual harassment and sent racist text messages. 

    The president last week fired another IG — Parisa Salehi at the Export-Import Bank — without notifying Congress. While he did not provide a justification, an Office of Management and Budget spokesperson has previously said in a statement to Government Executive that IGs “have become corrupt, partisan and in some cases, have lied to the public.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a move to tighten defenses against credential theft, Microsoft has rolled out a significant change to Windows File Explorer starting with security updates released on and after October 14, 2025.

    The update automatically disables the preview pane for files downloaded from the internet, aiming to block a sneaky vulnerability that could expose users’ NTLM hashes sensitive credentials used for network authentication.

    This adjustment addresses a long-standing risk where malicious files, especially those embedding HTML elements like <link> or <src> tags pointing to external resources, could trigger unauthorized network requests during previews.

    Attackers have exploited this in the past to harvest hashes, potentially leading to lateral movement in networks or full account takeovers.

    By defaulting to a more cautious approach, Microsoft is prioritizing proactive security without requiring user intervention, a welcome step amid rising phishing and malware campaigns targeting Windows users.

    File Previews Turned Off

    The new behavior hinges on the “Mark of the Web” (MotW) attribute, which Windows applies to files from untrusted sources like the Internet or Internet Zone file shares.

    Once tagged, these files will not show previews in File Explorer. Instead, users will see a clear warning message: “The file you are attempting to preview could harm your computer. If you trust the file and the source from which you received it, you may open it to view its contents.”

    For everyday users, this means a minor workflow hiccup: previews are off for potentially risky files, but everything else, like local documents or trusted shares, remains unchanged. No extra setup is needed; the protection kicks in automatically post-update.

    IT admins and power users will appreciate that it applies broadly to downloaded files and remote shares, reducing the attack surface in enterprise environments where NTLMv2 weaknesses persist despite pushes toward modern auth like Kerberos.

    This isn’t a full lockdown, it’s a smart nudge toward safer habits. Previews still work for vetted files, and the change encourages verifying sources before diving in.

    If you’re dealing with a trusted download, overriding is straightforward but deliberate. Right-click the file in File Explorer, hit Properties, and check the “Unblock” box. Note that changes might not apply until your next login.

    For entire file shares in Internet Zones, head to Internet Options in the Control Panel, navigate to the Security tab, and add the share’s address to the Local Intranet or Trusted Sites zone. Be cautious: this lowers defenses for all files from that source, so reserve it for verified networks.

    Microsoft’s FAQ emphasizes trusting files only from known origins, underscoring that this tweak is about mitigation, not elimination of risks. As cyber threats evolve, such incremental updates help keep Windows resilient without overcomplicating daily use.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Enhances Windows Security by Turning Off File Previews for Downloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Eight months after Defense Secretary Pete Hegseth fired the Air Force’s top lawyer, the judge advocate general tasked with those duties has stepped down. No one has yet been nominated to permanently fill either of the service’s top legal jobs.

    Maj. Gen. Rebecca Vernon, who had served as deputy Air Force JAG since 2022, became acting JAG after Hegseth’s Feb. 21 announcement that he was firing Lt. Gen. Charles Plummer. Vernon’s last day on the job was Sunday and her retirement date is set for January 1, 2026, Air Force spokesperson Ann Stefanek said.

    Vernon, who joined the Air Force in 1996, has received several awards and decorations for her service and legal expertise, including the 2019 Air Force Association’s award for outstanding senior judge attorney, according to her service biography

    Reached by phone, Vernon declined to comment on her departure. 

    For now, at least, the role of acting Air Force JAG will be handled by Maj. Gen. Mitchel Neurock, who had served as Vernon’s and Plummer’s mobilization assistant. Neurock was appointed by Air Force Secretary Troy Meink, Stefanek said in an emailed statement. 

    The judge advocate general of each military service—TJAG for short—must be confirmed by the U.S. Senate. A former Air Force lawyer said the lack of a Senate-confirmed TJAG leaves the branch’s legal officers in limbo.

    “It’s tough to make any long-term plans without that position filled,” the lawyer said. “We’re in the middle of assignment season and the TJAG makes those decisions. There’s a ripple effect throughout the [JAG] Corps that hurts morale, retention, budgets, hiring, and every major policy decision.”

    The services are missing more than their top JAGs: the Pentagon has also been sending lower-level lawyers to the Justice Department to serve as temporary immigration judges. 

    This has raised concerns among legal experts. Margy O’Herron, a senior fellow in the Brennan Center’s Liberty and National Security Program, wrote in September that the administration’s plan will pull JAGs “away from the important work they are trained and assigned to do, risking military readiness.”

    Earlier this year, Hegseth said he fired the Air Force and Army TJAGs because they were "roadblocks to orders that are given by a commander in chief.” 

    JAGs often provide guidance to commanders and navigate them through U.S. and international laws relevant to military operations. John Richardson, a retired Navy officer and former chief of naval operations, praised the expertise JAGs offer the military at a Center For New American Security think tank event earlier this month.

    “I always wanted to have a very professional and knowledgeable and capable JAG corps,” Richardson said. “They need to win their case for the service and advise commanders how to do their jobs.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ukraine

    Trump lifts restrictions on Ukraine’s use of some long-range missiles. On Tuesday, Ukraine struck a Russian plant in Bryansk with a British Storm Shadow missile—and U.S. targeting data, the Wall Street Journal reported Wednesday. That signals a reversal in U.S. policy, which had barred helping Ukraine use long-range weapons to hit targets inside Russia. It follows a White House decision to transfer authority for such strikes from Defense Secretary Pete Hegseth to Gen. Alexus Grynkewich, Supreme Allied Commander Europe, NATO’s top military officer.

    President Trump called the story “FAKE NEWS!” but did not deny its central claim. “The U.S. has nothing to do with those missiles, wherever they may come from, or what Ukraine does with them!” he said. Read more from the WSJ, here.

    Gripens for Ukraine. On Wednesday, Ukrainian President Volodymyr Zelenskyy signed a letter of intent to buy “probably 100-150” Gripen fighter jets from Sweden’s Saab AB. “It is a clear and mutual statement of intent — the beginning of a journey over 10-15 years,” Swedish Prime Minister Ulf Kristersson announced. Deliveries of the Gripen E, the latest version, could start in three years. Breaking Defense has a bit more, here.


    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Patrick Tucker and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1983, a suicide bomber in a dump truck attacked the U.S. Marine barracks in Beirut, Lebanon, killing 220 Marines, 18 sailors and three soldiers. 


    Americas

    Boat-strike campaign spreads to the Pacific. CBS News: “The U.S. has struck two alleged drug vessels on the Pacific side of Latin America over the last two days, killing five people, Secretary of Defense Pete Hegseth confirmed Wednesday. The Trump administration has now carried out nine known strikes against alleged narcotics trafficking boats since last month, leading to at least 37 deaths. The first seven strikes were within the Caribbean Sea — but this week, the strategy broadened to the East Pacific.”

    Commentary: Deadly force needs more justification than “just trust us.” “President Trump says the strikes are legal, and that the boats were trafficking drugs, but he has not offered evidence to substantiate the claim. Nor has he explained how the deliberate, premeditated killing of civilians — what Colombian and Venezuelan leaders and some jurists have called “murder”— can possibly be reconciled with domestic and international law. The Justice Department’s Office of Legal Counsel has reportedly deemed the strikes lawful, but its analysis hasn’t been disclosed,” writes Jameel Jaffer, executive director of the Knight First Amendment Institute at Columbia, at the New York Times. “A quarter-century after the Sept. 11 attacks, then, we find ourselves in a familiar place: Our government is once again committing grave human rights abuses on the ostensible authority of a legal opinion that is being kept secret.” Read on, here.

    “Drums of war.” Back on the Caribbean side, the Washington Post totes up the ways that Trump’s surging of warships, planes, and other U.S. forces are setting up a possible “mission creep” scenario where the United States comes into direct conflict with the Venezuelan military. They include the boat strikes, a secret CIA memo targeting Venezuela’s Maduro regime (Trump acknowledged it in the Oval Office last week) and the declaration of an armed conflict with drug cartels such as the Venezuelan group Tren de Aragua. “At the end of the day if you have authority to take out cartel runners” at sea, “you can take out the cartel boss,” one source told the Post. Read on, here.

    Stage set for secret ops: February’s appointment of former AFSOC commander John “Dan” Caine as Joint Chiefs chairman and the firing of top service lawyers have set the stage of an increase in the use of clandestine and covert operations with little or no congressional oversight.

    More context: Adm. Alvin Holsey, the head of U.S. Southern Command, last week announced his intention to retire within months, less than a year into his tenure.

    Guard deployments to Chicago on hold. Associated Press: “National Guard troops won’t be deploying in the Chicago area anytime soon unless the U.S. Supreme Court intervenes because a judge on Wednesday extended her temporary restraining order indefinitely.” Trump’s unprecedented deployments of troops to U.S. cities have spawned a raft of lawsuits; AP has updates on several of the most significant ones, here.

    Shutdown

    Some U.S. service members aren’t getting paid despite Trump’s promises, advocacy group says. “Troops are having a difficult time getting answers about their paychecks after some soldiers, sailors and Marines say they were shorted after paychecks came out Oct. 15,” WHRO reported in Norfolk, Virginia, citing Raleigh Duttweiler of the National Military Family Association. “More than 150 members of the National Military Family Association report being underpaid last week, some by as much as $2,000. The average loss was more than $600.” Earlier this month, Trump ordered SecDef Hegseth to divert funds to pay troops, a move budget experts said is likely illegal. More, here.

    Danke. The German government has announced it will pay the salaries of the nearly 12,000 Germans employed by U.S. military bases in the country, three weeks into the shutdown of the U.S. federal government, Stars and Stripes reports

    Around the Defense Department

    “Interoperability” isn’t always what it’s cracked up to be, RAND report finds. Defense News: “In theory, the fact that the United States and Europe fly many of the same jets should be a blessing. Common aircraft models — such as the F-35 and F-16 — should mean common spare parts, ground support equipment and mechanics who can fix similar planes from different nations. “But the reality is more complicated. Different variants within the same model, incompatible support equipment and a lack of shared data and procedures create barriers to interoperability, researchers with the Rand Corporation think tank warned in a September report.” Read on, here.

    “Next generation” of the Pentagon press corps includes “mostly right-wing outlets, following the mass exodus of legacy outlets from the building who refused to sign the department’s restrictive new press policy,” The Hill reported Wednesday, following an announcement from Pentagon spokesperson Sean Parnell.

    The group includes a reporter for Timcast Media, run by Tim Pool, a podcaster who frequently pushes Russian talking points and accidentally accepted tens of thousands of dollars from the Kremlin last year; Jordan Conradson, a Gateway Pundit correspondent who suggested that large numbers of illegal aliens were “probably going to vote in this next election,” despite the lack of evidence of widespread voter fraud in either the 2020 or 2024 election; Jack Posobiec, who boosted the #pizzagate conspiracy theory and a Russian disinformation operation; and a correspondent from an outlet called LindellTV, founded by My Pillow CEO and convicted defamer Mike Lindell. We wish them peace and good health.

    Rewind: Why did the Pentagon press corps walk out? One of your D Briefers explained to Ward Carroll—a former F-14 RIO, military PAO, journalist, and YouTuber. Watch that, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat actors with ties to North Korea have been attributed to a new wave of attacks targeting European companies active in the defense industry as part of a long-running campaign known as Operation Dream Job. “Some of these [companies’ are heavily involved in the unmanned aerial vehicle (UAV) sector, suggesting that the operation may be linked to North Korea’s current efforts to scale up its

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • At Pwn2Own Ireland 2025, cybersecurity researchers Ben R. and Georgi G. from Interrupt Labs showcased an impressive achievement by successfully exploiting a zero-day vulnerability in the Samsung Galaxy S25.

    This allowed them to gain full control over the device, enabling them to activate the camera and track the user’s location.

    The exploit, revealed on the event’s final day, highlights ongoing security challenges in flagship Android smartphones despite rigorous testing by manufacturers.

    This breach underscores the high-stakes world of ethical hacking competitions, where vulnerabilities are disclosed responsibly to improve global device security.​

    The core issue exploited by the Interrupt Labs team stemmed from an improper input validation bug within the Galaxy S25’s software stack, allowing attackers to bypass safeguards and execute arbitrary code remotely.

    Samsung Galaxy S25 0-Day Vulnerability

    By crafting malicious inputs, the researchers demonstrated how an adversary could silently hijack the device without user interaction, a technique that evaded Samsung’s defenses during the live contest.

    This vulnerability, undisclosed prior to the event, enabled persistent access, turning the premium smartphone into a surveillance tool capable of capturing photos, videos, and real-time GPS data.

    Experts note that such flaws often arise in multimedia or system libraries, where rapid feature development outpaces security hardening.​

    For their sophisticated exploit chain, Ben R. and Georgi G. earned $50,000 in prize money along with 5 Master of Pwn points, contributing to the event’s massive $2 million total payout across 73 unique zero-days.

    Pwn2Own, organized by the Zero Day Initiative, rewards participants for responsibly disclosing flaws, ensuring vendors like Samsung receive detailed reports for patching.

    Samsung has yet to issue a specific statement on this Galaxy S25 exploit, but historical patterns suggest an imminent security update will address it, similar to recent fixes for other Android zero-days.

    Users are advised to enable automatic updates and monitor official channels for patches, as unmitigated exploits could expose sensitive data in real-world attacks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Exploited Samsung Galaxy S25 0-Day Vulnerability to Enable Camera and Track Location appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶