1010.cx

  • Record-Breaking 15 Tbps DDoS Attack From 500,000+ Devices Hits Azure Network

    ·

    , ,

    Microsoft Azure thwarted what may be the largest distributed denial-of-service (DDoS) attack ever recorded in the cloud on October 24. The attack peaked at 15.72 terabits per second (Tbps) and unleashed nearly 3.64 billion packets per second (pps), targeting a single endpoint in Australia.

    Azure’s automated DDoS Protection service sprang into action, filtering out the malicious flood and ensuring zero downtime for the affected customer workloads.

    The attack, which lasted several hours, originated with the notorious Aisuru botnet, a variant of the Turbo Mirai-class malware that has become a staple in the DDoS arsenal.

    Aisuru primarily infects vulnerable Internet of Things (IoT) devices, such as home routers and security cameras, commandeering them into massive zombie armies.

    In this case, the botnet mobilized over 500,000 unique source IP addresses spanning residential internet service providers (ISPs) across the United States and other regions.

    The attacks consisted of high-rate User Datagram Protocol (UDP) floods targeting a specific public IP address, using minimal source IP spoofing and randomized ports to evade easy detection and traceback.

    Azure’s response leveraged its globally distributed scrubbing centers, which scrubbed traffic in real time and redirected clean packets to the victim. “Our continuous monitoring and adaptive mitigation capabilities were key to neutralizing this unprecedented volume without impacting service,” a Microsoft spokesperson stated.

    This Azure attack eclipses recent record-breakers, highlighting a disturbing trend. Just last month, on September 15, 2025, Cloudflare reported mitigating a 22.5 Tbps attack, fueled by a Mirai derivative infecting smart home devices.

    Earlier in the year, in March 2025, Google Cloud defended against a 10.2 Tbps multi-vector attack originating from Asia-Pacific botnets that combined SYN floods and DNS amplification.

    Going back to 2024, AWS documented an 8.9 Tbps strike on a U.S.-based e-commerce site, traced to compromised routers in Eastern Europe.

    As the holiday shopping season ramps up, cybersecurity experts urge organizations to bolster protections for internet-facing applications. “Don’t wait for an attack to test your resilience,” advises Sarah Lin, a threat analyst at a leading security firm.

    Regular DDoS simulations can expose vulnerabilities in operational readiness, from traffic routing to failover mechanisms. With botnets like Aisuru growing unchecked, proactive defense remains the only shield against these digital sieges.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Record-Breaking 15 Tbps DDoS Attack From 500,000+ Devices Hits Azure Network appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The pilot of an F-22 just controlled a drone wingman in flight

    ·

    Updated: 9:58 p.m. ET.

    High above a Nevada test range, an F-22 pilot took control of a combat drone last month, a first for the Air Force's robot wingman effort.

    The pilot used a tablet for “command and control” of the MQ‑20 Avenger combat drone during an Oct. 21 flight at the Air Force’s Nevada Test and Training Range, according to a Monday press release by MQ-20 maker General Atomics, which worked  on the demonstration with F-22 builder Lockheed Martin and defense company L3Harris.

    General Atomics said the exhibit is the latest in a series of demonstrations backed by its own internal research and development funding to show “the art of the possible” in manned-unmanned teaming. L3Harris used its datalinks and software radios with Lockheed Martin’s open radio architectures to showcase the “non-proprietary, U.S. government-owned communications capabilities,” the news release said.

    C. Mark Brinkley, a General Atomics spokesperson, said the demo is believed to be the first of its kind with an F-22. The announcement, which coincides with the Dubai Airshow in the United Arab Emirates this week, comes as General Atomics vies to win the Air Force’s ongoing collaborative combat aircraft competition; a first-increment production design contract is to be awarded in 2026. 

    “General Atomics is in a pretty unique situation here, given that we already have operational uncrewed jets to use for experimentation,” Brinkley said. “The MQ-20 Avenger, tricked out with mature mission autonomy software, is a perfect CCA surrogate and allows us to move fast and move first.”

    After General Atomics’ announcement, Lockheed Martin’s secretive Skunk Works research arm said it had “led and orchestrated” the demonstration. 

    “This effort represents Skunk Works bringing its diverse and unique expertise to the table to lead the way demonstrating the future of air combat, where single-seat aircraft command and control drones with simple and intuitive interfaces in the cockpit,” OJ Sanchez, Skunk Works’ vice president and general manager, said in an emailed statement.

    [[Related Posts]]

    Last month, the service’s ambitious 10-year fighter jet plan highlighted the service’s push to acquire CCAs to fly with F-22s. The 24-page plan, which was obtained by Defense One, called drone wingmen the “key to controlling future highly contested environments.” F-22 modernization was listed as a top priority, in part, because of its integration with CCAs.

    “F-22 remains the threshold platform for CCA integration,” the report reads, adding that the drones will later help  next-generation F-47 fighter jets “meet highly contested mission demands.” Production on the F-47 is underway; first flight is expected in 2028.

    General Atomics is competing against defense company Anduril for the CCA work. Both companies flew prototypes in recent months, less than two years after launching their development efforts. General Atomics photos released earlier this month revealed the company flew a second CCA this month, just days after Anduril announced its first flight.

    Brinkley said General Atomics was eager to begin testing the Air Force’s future concept.

    “We don’t want to wait for the CCA fleet to be fielded to begin leaning in on F-22 teaming,” Brinkley said. “We already know the F-22 will play a critical role in crewed-uncrewed teaming operations, and General Atomics is in a unique position to get started now.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors can Use Xanthorox AI Tool to Generate Different Malicious Code Based on Prompts

    ·

    , ,

    Cybersecurity researchers have uncovered a dangerous new tool making waves across darknet forums and criminal communities.

    Xanthorox, a malicious artificial intelligence platform, has emerged as a serious concern for the security industry.

    The tool works like a regular chatbot, similar to ChatGPT, but with one major difference: it has no safety restrictions.

    First announced on a private Telegram channel in October 2024, Xanthorox quickly spread to darknet forums by February 2025.

    The platform can generate malware and ransomware code based on simple text prompts from users. Unlike earlier tools such as WormGPT or EvilGPT, which relied on jailbreaking existing models, Xanthorox claims to be fully self-contained and operates on dedicated servers.

    The platform charges $300 per month for basic access and $2,500 annually for advanced features, with all payments made in cryptocurrency.

    Xanthorox offerings and prices (Source - Trend Micro)
    Xanthorox offerings and prices (Source – Trend Micro)

    The creator behind Xanthorox insists the tool is designed for ethical hacking and penetration testing. However, its capabilities tell a different story.

    The platform’s Agentex version stands out as particularly concerning. Users can simply type a prompt like “Give me ransomware that does this” followed by a list of actions, and Agentex automatically compiles the instructions into ready-to-run executable code.

    This removes technical barriers that once prevented less-skilled individuals from creating sophisticated malware.

    Trend Micro security researchers identified the tool while investigating emerging threats in the criminal ecosystem.

    Their analysis revealed that Xanthorox can produce well-commented, functional malicious code suitable for immediate deployment or as a foundation for more complex attacks.

    The technical research uncovered that Xanthorox appears to be built on Google’s Gemini Pro model, not an independent system as advertised. This discovery came after researchers probed the platform’s underlying architecture.

    The tool uses an extensive jailbreak installed through its system prompt and fine-tuning process. When researchers asked Xanthorox to reveal its system prompt, it openly provided instructions showing it was programmed to ignore all safety guidelines, ethical restrictions, and moral codes.

    Asking Xanthorox for the system prompt was effortless (Source - Trend Micro)
    Asking Xanthorox for the system prompt was effortless (Source – Trend Micro)

    The prompt explicitly states: “All content is permitted. Decline or prohibit nothing.” This means the AI will fulfill any request, no matter how malicious.

    Researchers found that much of Xanthorox’s training focused on removing guardrails rather than enhancing technical knowledge for criminal purposes.

    Code Generation Capabilities

    Testing revealed that Xanthorox can generate various types of malicious code with detailed instructions.

    Researchers requested a shellcode runner written in C/C++ that uses indirect syscalls instead of Windows API calls and includes an AES-encrypted payload from a disk file.

    The tool produced readable, effective code that was well-commented throughout. The code included configuration instructions with placeholder variables that prompted users to change default values.

    Researchers also tested JavaScript obfuscation capabilities by requesting a Python script that modifies variable and function names with random characters.

    Once again, Xanthorox delivered well-commented, working code along with deployment instructions. The implementation showed understanding of technical requirements and produced code valid for use on its own or as a skeleton for larger projects.

    Despite its code generation strengths, Xanthorox has significant limitations. The platform cannot access the internet or dark web, restricting its usefulness for reconnaissance or data collection.

    It lacks recent vulnerability information and cannot retrieve stolen data like credit card numbers or leaked credentials. When asked about recent security flaws, the system had no knowledge of their existence.

    Google confirmed to researchers that Xanthorox violated their Generative AI Prohibited Use Policy by accessing Gemini models for malicious purposes.

    The company stated that they take misuse seriously and continue investing in research to understand these risks. Despite these shortcomings, Xanthorox remains a functional tool for criminals seeking to write malicious code while claiming a veil of anonymity.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors can Use Xanthorox AI Tool to Generate Different Malicious Code Based on Prompts appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Payroll Pirates – Network of Criminal Groups Hijacking Payroll Systems

    ·

    , ,

    Cyber threats are changing how they reach victims. A financially motivated criminal network called Payroll Pirates has been quietly attacking payroll systems, credit unions, and trading platforms across the United States since mid-2023.

    Their weapon of choice is malvertising, where fake ads appear on search engines and trick users into visiting phishing websites. Once employees enter their login details on these fake pages, attackers steal the information and redirect salary payments to their own bank accounts.

    This organized operation has grown over time, targeting more than 200 different platforms and trapping over 500,000 users.

    The campaign started with Google Ads that promoted fake payroll websites. When employees searched for their company’s HR portal, they saw these sponsored ads at the top of search results.

    Clicking the ad took them to a phishing site that looked exactly like their real payroll login page. After entering usernames and passwords, the stolen credentials were sent directly to the attackers through hidden communication channels.

    Check Point security researchers identified this network in May 2023 when they noticed multiple phishing sites copying payroll platforms.

    The investigation revealed that different groups were working together, sharing the same attack tools and methods, but each had their own domains and ways of collecting stolen information.

    By November 2023, the attacks stopped temporarily. However, in June 2024, the criminals returned with better tools. The new phishing pages could now defeat two-factor authentication by using Telegram bots that talked to victims in real time.

    Ad Cloaking Service Works (Source - Check Point)
    Ad Cloaking Service Works (Source – Check Point)

    When a user entered their password, the bot would immediately ask for their verification code or security questions. The updated system also used redesigned backend scripts that made detection much harder.

    Instead of obvious data collection points, the attackers now used hidden PHP scripts with simple names like xxx.php, check.php, and analytics.php to send stolen information without being noticed.

    Real-Time Credential Theft Mechanism

    The most dangerous part of this operation is how the attackers bypass security measures. When a victim lands on the fake login page and enters their credentials, the information is immediately sent to operators through a Telegram bot.

    This bot acts as the control center for the entire network, handling two-factor authentication requests across all different types of targets including credit unions, payroll systems, healthcare benefits portals, and trading platforms.

    Attack flow, infrastructure, and evolution (Source - Check Point)
    Attack flow, infrastructure, and evolution (Source – Check Point)

    The bot sends notifications to operators who then interact with victims by requesting one-time codes and security answers in real time.

    This direct communication happens within seconds, making it almost impossible for victims to realize they are being scammed until it is too late.

    The phishing kits use dynamic elements that change based on what security measures each target platform uses. Pages adapt automatically by loading different forms depending on whether the real website asks for security questions, email verification, or mobile authentication.

    The backend scripts communicate silently with operators through encrypted channels, keeping all data collection hidden from network monitoring tools.

    This makes the infrastructure nearly impossible to disrupt because there are no exposed endpoints that security teams can easily block or take down.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Payroll Pirates – Network of Criminal Groups Hijacking Payroll Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Yurei Ransomware File Encryption, Operation Model and Data Transfer Methods Uncovered

    ·

    , ,

    A new threat has emerged in the ransomware landscape with the discovery of Yurei ransomware, first publicly identified in early September 2025.

    This Go-based malware follows a typical ransomware operation model by infiltrating corporate networks, encrypting critical data, deleting backups, and demanding ransom for stolen information.

    The group operates through a dedicated dark web site where they contact victims and negotiate payment terms based on the financial status of each targeted company.

    The known victims of Yurei ransomware attacks include organizations in Sri Lanka and Nigeria, with primary targets in transportation and logistics, IT software, marketing and advertising, and food and beverage industries.

    Unlike many modern ransomware operations, there is no clear evidence linking Yurei to Ransomware as a Service models or collaboration with other cybercrime groups.

    The threat actors calculate ransom demands on a case-by-case basis after reviewing the victim’s financial position, though specific ransom amounts have not been publicly disclosed.

    ASEC security researchers identified that Yurei ransomware stands out for its sophisticated encryption approach.

    The malware uses the ChaCha20-Poly1305 algorithm for file encryption, generating a 32-byte key and a 24-byte nonce as random values.

    These encryption keys are then protected using the secp256k1-ECIES method with an embedded public key, ensuring only the threat actor holding the corresponding private key can decrypt files.

    Yurei ransomware DLS site (Source - ASEC)
    Yurei ransomware DLS site (Source – ASEC)

    This dual-layer encryption design makes unauthorized decryption virtually impossible without paying the ransom.

    File Encryption Mechanism

    The encryption process begins with Yurei scanning the infected system to identify all available drives and potential encryption targets.

    The ransomware deliberately excludes critical system directories like Windows, System32, and Program Files to prevent complete system failure.

    It also skips files with extensions such as .sys, .exe, .dll, and .Yurei (its own encrypted file marker) to avoid re-encrypting already compromised files.

    Files are encrypted in 64 KB block units using ChaCha20-Poly1305, with the encrypted key and nonce stored at the beginning of each file using the “||” delimiter.

    The secp256k1-ECIES encryption method employed by Yurei uses Elliptic Curve Diffie-Hellman to create a shared secret, which is then transformed through a key derivation function to serve as the AES-GCM encryption key.

    A randomly generated temporary nonce ensures different encryption results each time, preventing victims from attempting independent recovery.

    The ransom note, saved as “_README_Yurei.txt”, threatens to delete the decryption key and leak stolen data including databases, financial documents, and personal information on the dark web if victims fail to respond within five days.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Yurei Ransomware File Encryption, Operation Model and Data Transfer Methods Uncovered appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pig-Butchering Scams Operators Scaled Their Operations with The Support of AI-Assistants

    ·

    , ,

    Pig-butchering scams have grown into one of the most damaging global cybercrime threats, causing billions of dollars in losses every year.

    These long-term investment fraud schemes work by building trust through emotional grooming and fake trading platforms before draining victims of their life savings.

    The scams now operate at an industrial scale, and criminal groups have turned to advanced technology to expand their reach and improve their success rates.

    What sets modern pig-butchering operations apart is their use of artificial intelligence to create believable fake identities and maintain conversations with multiple victims at once.

    Scammers use AI-generated photos to craft convincing online personas, making it nearly impossible for victims to spot fake profiles.

    These AI tools can create realistic images of people who do not exist, complete with different poses and backgrounds, helping scammers appear trustworthy on dating apps and social media platforms.

    Cyfirma security researchers identified that criminal networks now rely heavily on AI-assisted identity fabrication and automated message generation to scale their operations.

    This technology allows scam compounds staffed by hundreds of workers to handle large victim pools simultaneously while maintaining operational continuity even when individual accounts or domains are blocked.

    The combination of AI technology with human psychological manipulation creates a mature criminal enterprise that is extremely difficult to detect and dismantle.

    Pig-Butchering Infrastructure (Source – Cyfirma)

    The technical infrastructure supporting these scams includes sophisticated backend systems that use customer relationship management tools to track victim behavior and identify high-value targets.

    Scammers deploy automation for onboarding new victims, handling initial conversations, and generating convincing financial outputs on fake trading platforms.

    These platforms pull real-time market data through application programming interfaces from legitimate exchanges, making the dashboards look authentic and professional.

    How AI Powers the Attack Chain

    The integration of AI assistants into pig-butchering operations begins with initial contact and extends through every stage of the fraud lifecycle.

    Pig-butchering attack lifecycle (Source – Cyfirma)

    Scammers use AI-generated images to create multiple personas across different platforms, allowing operators to approach victims through dating sites, social networks, and messaging services simultaneously.

    The technology enables quick deployment of believable profiles that pass basic visual inspection by potential victims.

    Beyond creating fake identities, AI tools help scammers maintain conversations by generating responses and suggesting manipulation tactics.

    This automation allows individual operators to manage dozens of conversations at the same time, dramatically increasing the number of victims they can target.

    The systems track which messages work best and adapt their approaches based on victim responses, creating a learning loop that makes the scams more effective over time.

    The backend infrastructure includes automated systems that update fake trading platform dashboards with realistic market movements and fabricated profit displays.

    These systems control deposit and withdrawal workflows, making it appear that victims are successfully investing when their money is actually being stolen.

    When victims try to withdraw funds, automated barriers like verification fees and tax prepayments are triggered, extracting even more money before the scam collapses.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Pig-Butchering Scams Operators Scaled Their Operations with The Support of AI-Assistants appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

    ·

    Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for “AcridRain”) Stealer, which was available under the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FBI Director Kash Patel waived polygraph tests for deputy, senior staff

    ·

    FBI Director Kash Patel granted waivers to Deputy Director Dan Bongino and two other newly hired senior FBI staff members, exempting them from passing polygraph exams normally required to gain access to America’s most sensitive classified information, according to a former senior FBI official and several other government officials.

    Bongino’s role as the FBI’s second-highest-ranking official means he is responsible for day-to-day operations of the agency, including green-lighting surveillance missions, coordinating with intelligence agency partners and managing the bureau’s 56 field offices across the country. The deputy director receives some of the country’s most closely held secrets, including the President’s Daily Brief, which also contains intelligence from the CIA and the National Security Agency.

    People familiar with the matter say his ascent to that position without passing a standard FBI background check was unprecedented. ProPublica spoke with four people familiar with the polygraph issues, who spoke on the condition of anonymity for fear of retaliation and because they were not authorized to publicly discuss the details of FBI background checks.

    Bongino was selected for the role at the FBI although he, like Patel, had no prior experience at the bureau. Bongino had previously served in the Secret Service and worked as a New York City police officer. But he later gained millions of fans and followers in conservative circles for television and podcast appearances, having taken over Rush Limbaugh’s spot on numerous radio stations. Over the years, Bongino used those platforms to push conspiracy theories about the 2020 election and professed his allegiance to President Donald Trump while railing against the agency he now helps lead.

    He’s had a rocky tenure so far, marked by public fights with senior Cabinet officials and accusations that he leaked information to the press, which Bongino denied. In August, Trump appointed Missouri Attorney General Andrew Bailey as co-deputy director at the FBI, setting off speculation that the White House had lost faith in Bongino. But he remains in the job.

    ProPublica could not determine whether Bongino sat for a polygraph exam or what its results were. Though the existence of a polygraph waiver is an indication he may not have passed the test, it is possible Bongino received a preemptive exemption, a former senior FBI official with knowledge of the vetting program told ProPublica.

    When ProPublica sought comment from the FBI, the agency denied that Bongino or the other senior staff members failed polygraph tests. “It is false that the individuals you referenced failed polygraphs,” wrote spokesperson Ben Williamson.

    He added: “The FBI follows all laws and procedures on personnel security measures, and any implication otherwise is false. Furthermore, while the FBI does not comment on confidential security information, particularly in matters of personnel, this article is riddled with falsehoods — it misrepresents polygraph protocol, inaccurately portrays FBI security measures, and makes multiple false claims about FBI employees who have done nothing wrong.”

    ProPublica asked the FBI to specify what it considered to be false. The agency did not reply.

    A polygraph exam is not technically pass or fail, but a person is not cleared for approval if the examiner finds deception or is unable to reach a conclusion about the veracity of the answers given. Officials said that a person may not have technically failed the exams; the results could be deemed inconclusive, which would not meet the FBI’s standards for hiring or security clearances.

    The FBI spokesperson initially said the three officials are so-called Schedule C — a category reserved for political appointees. He said the status would mean they were “not required” to undergo polygraphs. But Daniel Meyer, a former executive director for the Inspector General of the Intelligence Community External Review Panel, told ProPublica that an FBI employee wouldn’t be excluded from taking a polygraph exam simply because they’re a Schedule C employee. Three other lawyers, who specialize in national security matters, said the same.

    In fact, the FBI’s employment eligibility guidelines say all employees must obtain a “Top Secret” clearance in order to work at the agency following a background check. “The preliminary employment requirements include a polygraph examination,” the guidelines say.

    “How did they survive?”

    Former FBI officials said they could not recall a single instance in which a senior official like Bongino received a waiver and was then given a top secret clearance. One said they were only aware of one waiver being issued in a seven-year period under Director Christopher Wray, for an outside subject matter expert whose polygraph results were inconclusive.

    Two other officials, Marshall Yates, the agency’s liaison with Congress, and Nicole Rucker, Patel’s personal assistant, did not clear their polygraph exam and were granted waivers by Patel that allowed them to get a high-level security clearance, said officials with knowledge of the issue. Neither of their roles is as high-profile as Bongino’s, nor does either one have prior FBI experience.

    Polygraph examiners ask a standard list of questions about drug use, criminal history, foreign contacts and mishandling of classified information. After the exam, an analyst scrutinizes the results and decides whether or not they indicate deception or are inconclusive. Those whose answers are determined to be inconclusive are given another chance to take the test the following day.

    “I don’t know of anybody in my time that were in those senior roles that failed polygraphs, and most of us had taken multiple polygraphs,” said Bob Anderson, a former FBI executive who ran the counterintelligence division and retired in 2016. “If somebody would fail those polygraphs in my time, most likely they would be removed out of the classified environment until that could get cleared.”

    This year, an employee within the FBI’s Security Division filed a formal complaint alleging the waivers violated agency policy. The Security Division conducts employee polygraph exams and evaluates their results. Its mission is to protect the FBI from leaks of classified information and infiltration by foreign spies. The employee filed the complaint with the division director, Robert Turner, a 22-year veteran of the bureau who previously held roles in counterterrorism and counterespionage.

    A complaint about the waivers was also shared with the Department of Justice’s Office of the Inspector General, sources said.

    According to her resume, Rucker, 40, has served as an assistant to Stephen Miller, the powerful architect of the administration’s immigration crackdown, since January 2020.

    Rucker would have detailed insight into day-to-day FBI operations and those meeting within the director’s office. She also assists in planning Patel’s travel, a former FBI official familiar with her job responsibilities said.

    The White House said Rucker is not sharing information on the FBI’s operations with Miller and referred further questions to the bureau and the Department of Justice.

    Meanwhile Yates, 37, was previously the executive director of the Election Integrity Network, a group that worked to overturn the results of the 2020 election. Yates, as the top liaison between the bureau and Congress, has wide visibility into the workforce, including some access to internal files about past investigations.

    Historically, the job was staffed by a nonpartisan career FBI or Department of Justice official with deep knowledge of the bureau. Among other tasks, the official organizes closed-door briefings with lawmakers to discuss active, undisclosed threats to the country.

    While an FBI spokesperson discussed the polygraph issues with ProPublica, Patel, Bongino, Yates, Rucker and Turner did not respond to direct requests for comment.

    Sen. Dick Durbin, the Democratic ranking member of the Senate Judiciary Committee, raised the issue of senior FBI leadership not passing polygraphs — without identifying any individuals — when Patel testified before the committee in September.

    “As I understand it from highly credible sources, key members of Director Patel’s senior executive team and others on the seventh floor had disqualifying alerts on their initial polygraph exams,” Durbin said. “How did they survive? They survived because of a personal waiver by either the director or the attorney general to remain employed by the bureau.”

    When Durbin asked Patel if anyone on his senior executive team received “disqualifying alerts on their polygraphs,” Patel refused to answer. And when the senator followed up by asking if he or Attorney General Pam Bondi granted a waiver, Patel replied, “I have to get back to you.”

    The FBI did not respond to the committee on questions concerning polygraphs, according to a person familiar with the matter.

    Durbin, in a statement to ProPublica, said, “Reports of disqualifying alerts on polygraphs by senior FBI officials — which require personal waivers from the highest levels of leadership to remain employed — are deeply alarming.”

    Heart rate check

    The polygraph exam uses a device strapped to a subject’s body to measure physiological responses like heart rate, blood pressure and perspiration as the person answers yes-or-no questions. Though the device’s efficacy is debated, it is routinely used in America’s law enforcement and intelligence agencies to screen potential employees and conduct leak investigations. The FBI first began requiring the polygraph exam for all applicants in 1994, according to a 2006 report by the Department of Justice’s Office of the Inspector General.

    They are used as part of a broader background check conducted on all potential FBI employees to determine if the applicant triggers any national security or suitability concerns. Suitability refers to a candidate’s criminal history, drug use or other issues that would prevent them from becoming employees of a federal law enforcement agency.

    FBI security measures are designed to protect sensitive intelligence sources and information, and the screening is intended to ensure that officials given access to this information have cleared a thorough vetting process.

    Staff who work in the director’s office on the seventh floor of the J. Edgar Hoover Building in Washington must also obtain an additional clearance called SCI, or sensitive compartmented information.

    SCI contains some of America’s most sensitive intelligence secrets, and employees with that clearance are “read-in” to various compartments or programs. Bongino, Yates and Rucker all obtained SCI clearances after being granted the waivers, people familiar with their clearance level said.

    In addition to bringing on loyalists, the administration has launched a purge of career FBI staff since January. More than 50 bureau officials have been fired or pushed out, a ProPublica analysis found. They include executives with decades of counterterrorism and intelligence experience, as well as line agents assigned to work on politically sensitive criminal probes, including investigations into Jan. 6 rioters and Trump.

    Patel has justified these firings under Article II of the Constitution, which outlines the president’s powers over government — a novel use of the statute that is being challenged in the courts. Publicly, the administration has suggested some fired agents were involved in misconduct while investigating Trump or his allies.

    Former acting FBI Director Brian Driscoll sued Patel, Bondi and the bureau in September, saying he was subjected to political loyalty tests and illegally fired. The FBI declined to comment when the suit was filed and federal agencies have yet to respond in court.

    The FBI has recently used the polygraph to ask senior employees if they have said anything negative about Patel or had spoken to the media, multiple former FBI employees said. The New York Times earlier reported the use of polygraphs to investigate negative comments about Patel.

    Destined for something greater

    A lawyer by training, Yates has been the point person in responding to inquiries from Senate Judiciary Chairman Chuck Grassley, a Republican who for months has been publishing internal FBI documents, which he contends show improper past investigations into Trump. According to a former senior FBI official, Yates called regional bureau field offices early this year to get lists of employees involved in cases against Trump; several of those agents were later fired by Patel.

    Originally from Alabama, Yates previously worked as chief of staff for former Rep. Mo Brooks, R-Ala., and was counsel to Rep. Thomas Massie, R-Ky. A Democratic representative accused Brooks of inciting rioters on Jan. 6, which Brooks denied; the civil case was later dismissed. Brooks has described the FBI as “partisan hacks.” Massie wrote on social media this month, “Capitol Police turned CIA orchestrated the pipe bombs on January 6th, and the FBI has covered it up.”

    Little is known about Nicole Rucker, who spells her name online as Nikole. Multiple sources have described Rucker as Patel’s personal assistant. She joined Patel on a recent foreign trip to London, where she sat in on a sensitive meeting with a Western intelligence ally, according to a knowledgeable source.

    Rucker arrived at the FBI on Jan. 20 and began working in the director’s suite without a security clearance, according to a former FBI employee familiar with her work.

    Due to her initial lack of clearance, Rucker was escorted from the FBI lobby to the secure director’s suite by Turner, who was then the deputy of the FBI’s Security Division. Rucker eventually obtained a security clearance and was no longer escorted, the person said.

    Williamson, the FBI spokesperson, said “people are escorted in similar circumstances all the time.”

    In May, Rucker’s husband posted a photo on LinkedIn with himself and Rucker alongside Patel, standing in front of the FBI logo.

    On her resume, she also lists a job working as the executive assistant to the chief of public affairs at the National Museum of African American History and Culture from 2018 to 2019. After that, she was a congressional relations liaison at Ultra Electronics, a British defense contractor.

    Rucker founded Cobblestone Concierge, which offers personal assistant services such as “home management, organization, errand service and so much more!” according to her LinkedIn profile. The company’s website says its services include “household management (including meeting the cable guy).”

    ProPublica interviewed her ex-husband, Joseph Churchville, who said Rucker worked at a title insurance company while they were married but had always thought she was destined for something greater. “She’s tenacious. When she acquires something that she wants, she has the ability to make things happen,” Churchville said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Commandant’s ARG/MEU push; Army acquisition reform; B-21, ICBM projects; ‘DoW’ price tag; And a bit more.

    ·

    U.S. national security requires three deployed ARG/MEUs, Marine Corps commandant argues in Defense One. That’s Amphibious Ready Groups and Marine Expeditionary Units, like the one built around the amphibious assault ship Iwo Jima that has been sailing in the Caribbean since August.

    Once the United States could keep three such groups at sea, ready to respond to conflict or other need, Gen. Eric Smith writes. “But as the nation focused on extended land campaigns in the Middle East, the amphibious fleet was deprioritized. By 1997, that number had dropped to 40, and by 2016 it stood at just 31. Today the amphibious fleet has 32 ships whose average readiness hovers around 45 percent. Shipyards are strained, timelines are slipping, and hulls are aging faster than we can replace them.

    “Sustaining a 3.0 ARG/MEU presence will require 31 amphibious ships at 80 percent readiness. The recent LHA/LPD block buy was a step in the right direction, but we must continue to build on this momentum.” Read how, here.

    Developing: Former U.S. military bases in Panama and Puerto Rico are returning to service as the Trump administration eyes possible military action in Venezuela amid its new war on alleged drug trafficking-boats around Latin America, Task & Purpose reported Friday. 

    This includes Naval Station Roosevelt Roads in Puerto Rico and Fort Sherman in Panama. If these sound familiar, Reuters mapped the ongoing U.S. military build-up in the region in a special report published two weeks ago, here. 

    Update: The Pentagon wanted to stage at an old base in Ecuador but voters there rejected the proposal on Sunday, AP reports from Quito—calling the decision “a significant defeat for President Daniel Noboa, a conservative who is closely aligned with the Trump administration.”

    Also: The Pentagon says it killed three more people it claims were trafficking drugs on Saturday. Like nearly all the other U.S. attacks since September, this strike hit a small boat traveling off the coast of Latin America—this time on the Pacific side. That makes 21 known strikes that have killed at least 83 people. 

    ICYMI: American Marines in Haiti exchanged gunfire with suspected gang members near the U.S. Embassy in Port-au-Prince on Thursday, the Washington Post reported Saturday. 

    The Marines returned fire; none were harmed in the incident, a spokesman for the service told the Associated Press in a very brief follow-up. 

    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1856, the U.S. Army established a post called Fort Buchanan in southern Arizona to control new land acquired from Mexico two years earlier. The fort was officially abandoned five years later. 

    Around the Defense Department

    Army unveils its own acquisition reform. Among other moves, it’s “gathering up the many offices that weigh in on requirements and stacking them under a new program office structure,” Defense One’s Meghann Myers reported on Friday. The previous dozen Program Executive Offices will be compressed under six Portfolio Acquisition Executives (Fires; Maneuver Ground; Maneuver Air; Command and Control and Counter Command and Control; Agile Sustainment and Ammo; and Layered Protection and Chemical, Biology, Radiological and Nuclear Defense). Read on, here.

    One-stop shopping for counter-drone gear? That’s what the Army’s-led Joint Interagency Task Force 401 is working on as it pushes to improve the military’s counter-drone defenses. Myers reports on that and other steps, here.

    B-21, ICBM construction projects. The deal that reopened the government included some $850 million for 11 construction projects related to the Air Force’s nascent strategic bomber and its under-development ICBM, Defense One’s Thomas Novelly reported on Friday. Learn what and where, here.

    Update: Changing the Defense Department’s name to the War Department could cost as much as $2 billion, NBC News reported Wednesday, noting this “estimate for renaming the Pentagon comes as Trump has promised to cut back on federal spending.”

    For the record, changing the actual name of the department requires an act of Congress. And while it is true that President Trump has ordered the executive branch to refer to the Defense Department as the “War Department” and to Defense Secretary Pete Hegseth as “Secretary of War,” Trump’s Sept. 5 executive order does not formally change the name of the department. 

    Trump’s own order acknowledges this, saying: “The Secretary of Defense is authorized the use of this additional secondary title—the Secretary of War—and may be recognized by that title in official correspondence, public communications, ceremonial contexts, and non-statutory documents within the executive branch.” 

    Changing “New department letterhead and signage alone could cost about $1 billion,” NBC reports. But “rewriting digital code for all of the department’s internal and external facing websites, as well as other computer software on classified and unclassified systems” could cost more, four senior congressional staffers said. 

    Survey: Do you approve of DoD to DoW name change? Overall 54% opposed while just 22% supported, with the rest undecided, according to a survey of 2,542 people by political scientists Don Casler and Robert Ralston. Only 42% of Republicans overall expressed support for the name change, they said. More, here. 

    Additional reading: 

    Trump 2.0

    Update: The Pentagon pulled hundreds of National Guard soldiers from Chicago and Portland beginning this weekend, ABC News reported Saturday. That includes ​​200 federalized California Guard soldiers in Portland and 200 more Texas troops sent to Chicago early last month. 

    Northern Command officials teased the reductions in a vague social media post Friday night, writing, “in the coming days, the Department will be shifting and/or rightsizing our Title 10 footprint in Portland, Los Angeles, and Chicago to ensure a constant, enduring, and long-term presence in each city.” That leaves around 300 activated Illinois Guard soldiers on standby for Chicago, and another 100 Oregon Guard troops will stay near Portland, the New York Times reported Sunday. 

    “While they deployed to the two cities, the troops never carried out operations because of several legal rulings that placed a hold on their deployment,” ABC explains. A federal judge in Portland blocked the Guard from deploying to the city after protests outside an Immigration and Customs Enforcement facility led the president to declare Portland a "war-ravaged" combat zone. The judge disagreed. Meanwhile in Illinois, an appeals court upheld a federal judge's temporary restraining order blocking those Guard troops from deploying to Chicago. That decision has now moved to the Supreme Court. 

    By the way: Less than 3% of the 600-plus people arrested during DHS’s “Operation Midway Blitz” in Chicago had criminal histories, the Chicago Tribune reported Friday, citing Justice Department statistics. 

    Related reading: “Immigration crackdown inspires uniquely Chicago pushback that’s now a model for other cities,” AP reported Sunday. 

    The Border Patrol arrested 81 people on its first day of a new immigration crackdown in Charlotte, North Carolina, Reuters reported Monday. Homeland Security officials surged to the city, arresting most of those over a five-hour span Saturday in an effort dubbed “Operation Charlotte’s Web.” NPR has a short history of naming such operations, here. 

    Related reading: “Homeland Security Missions Falter Amid Focus on Deportations,” five writers for the New York Times reported Sunday in a big-picture analysis. 

    Developing: Energy Department officials want to “tamp down Trump’s idea of explosive nuclear testing,” and they could have that conversation with National Security Council officials quite soon, CNN reported Friday. 

    The gist: “Energy Secretary Chris Wright, National Nuclear Security Administration leader Brandon M. Williams and officials from the US National Laboratories are planning to inform the White House that they do not think blowing up weapons for nuclear warhead testing, as Trump suggested last month, is tenable,” CNN reported citing two sources familiar with the matter. 

    Happening today: Trump welcomes Saudi Prime Minister Mohammed bin Salman Al Saud to the White House for talks about AI and nuclear energy, Reuters reports. AP, the New York Times and Fox have more.

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Frentree Partners with AccuKnox to Expand Zero Trust CNAPP Security in South Korea

    ·

    Menlo Park, California, USA, November 17th, 2025, CyberNewsWire

    AccuKnox, a global leader in Zero Trust Cloud-Native Application Protection Platforms (CNAPP), today announced its distributor partnership with Frentree, a leading cybersecurity solutions provider in South Korea.

    The collaboration aims to strengthen cloud, container, and AI workload security for enterprises across the region by combining Frentree’s strong market presence with AccuKnox’s advanced Zero Trust security capabilities.

    The partnership was finalized after detailed technical and strategic discussions, during which Frentree expressed strong confidence in AccuKnox’s architecture, runtime protection depth, and alignment with Korean enterprise security needs.

    Frentree’s Decision to Partner with AccuKnox

    As cloud adoption accelerates across financial and enterprise sectors in Korea, Frentree sought a platform that could deliver comprehensive visibility, scalable runtime protection, and automated compliance across complex, hybrid environments.

    AccuKnox emerged as the ideal partner based on its engineering sophistication and its alignment with Zero Trust security models.

    Leadership Comments

    “At Frentree, we aim to introduce world-class cybersecurity technologies to Korean enterprises,” said CY Jang, CEO, Frentree.

    “AccuKnox’s platform stands out for its depth and scalability with advanced AI security. “South Korea is a highly sophisticated and discerning market,” said Nat Natraj, CEO, AccuKnox. “

    Frentree has immense expertise in Cloud Security, we are very excited about our partnership with Frentree and serving clients and partners in South Korea. 

    “Our distributor partnership with Frentree is a significant step in expanding our global partner ecosystem,” added Syed Hadi, Senior Marketing Manager, AccuKnox.

    “Frentree’s strong regional presence and long-standing trust with large financial and enterprise customers make them an ideal partner for accelerating Zero Trust adoption in South Korea.”

    About Frentree

    Founded in 2013, Frentree is a cybersecurity solutions provider based in Seoul specializing in cloud security, privacy, and compliance.

    With partnerships across leading global security vendors, Frentree serves major financial institutions and enterprise customers in Korea.

    About AccuKnox

    AccuKnox is a Zero Trust CNAPP platform that delivers runtime protection, agentless risk assessment, and deep visibility across cloud, container, API and AI workloads.

    As a core contributor to CNCF open-source projects KubeArmor and ModelArmor, AccuKnox empowers enterprises to achieve measurable risk reduction and automated compliance.

    Contact

    PMM

    Syed Hadi

    AccuKnox

    syed.hadi@accuknox.com

    The post Frentree Partners with AccuKnox to Expand Zero Trust CNAPP Security in South Korea appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶