• Cybersecurity researchers have discovered a JScript-based command-and-control (C2) framework called PeckBirdy that has been put to use by China-aligned APT actors since 2023 to target multiple environments. The flexible framework has been put to use against Chinese gambling industries and malicious activities targeting Asian government entities and private organizations, according to Trend Micro

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft on Monday issued out-of-band security patches for a high-severity Microsoft Office zero-day vulnerability exploited in attacks. The vulnerability, tracked as CVE-2026-21509, carries a CVSS score of 7.8 out of 10.0. It has been described as a security feature bypass in Microsoft Office. “Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Arizona Democratic Sen. Mark Kelly’s lawyers on Monday urged a federal judge to block the Defense Department from downgrading his retirement rank as a Navy captain and his pay for telling U.S. troops they aren’t required to follow illegal orders. 

    Paul J. Fishman wrote in a 35-page filing that Defense Secretary Pete Hegseth’s attempt to punish Kelly for appearing in the video alongside other members of Congress violates several constitutional rights.  

    “As a decorated combat veteran and member of the Senate Armed Services Committee, Senator Kelly is deeply committed to the necessity of good order and discipline in the armed forces,” Fishman wrote. “He asks this Court to reinforce, not degrade, those principles. 

    “His speech—simply reminding servicemembers of their fundamental obligation not to follow unlawful orders— promotes good order. And discipline does not demand silence —particularly from those no longer serving on active duty.”

    Fishman firmly rejected the Department of Justice’s assertion in a brief filed last week that the federal court system has no authority over the Defense Department’s actions in this instance. 

    “Defendants begin from the premise that questions of ‘military discipline’ lie beyond judicial review,” Fishman wrote. “Their claim that this Court is ‘not permitted to address’ Senator Kelly’s challenge disregards reams of precedent reviewing military disciplinary actions and demands an untenable level of deference.”

    Senior Judge Richard J. Leon, who was nominated to the bench by President George W. Bush, had scheduled a hearing on the issue for Wednesday, but postponed that until Feb. 3 due to the snowstorm. 

    Hegseth pursues penalties

    Defense Secretary Pete Hegseth announced earlier this month that he had started the process to downgrade Kelly’s retirement rank and pay, writing in a social media post that his “status as a sitting United States Senator does not exempt him from accountability, and further violations could result in further action.”

    The Defense Department letter of censure to Kelly alleged that his participation in the video undermined the military chain of command, counseled disobedience, created confusion about duty, brought discredit upon the Armed Forces and included conduct unbecoming of an officer. 

    The video at the center of the debate featured Kelly, Michigan Sen. Elissa Slotkin, Colorado Rep. Jason Crow, Pennsylvania Reps. Chris Deluzio and Chrissy Houlahan, and New Hampshire Rep. Maggie Goodlander, all Democrats with backgrounds in the military or intelligence community.

    They said that Americans in those institutions “can” and “must refuse illegal orders.”

    “No one has to carry out orders that violate the law or our Constitution. We know this is hard and that it’s a difficult time to be a public servant,” they said. “But whether you’re serving in the CIA, in the Army, or Navy, or the Air Force, your vigilance is critical.”

    Kelly lawyer’s arguments

    Fishman wrote in his brief that the Trump administration is asking the court to “embrace a novel rule” regarding the First Amendment: “that retired military veterans have no constitutional protection for their speech whenever the Secretary of Defense—in his sole discretion and without even identifying all of the speech at issue—concludes that it ‘risks undermining military discipline and good order.’” 

    The Justice Department's brief from last week, he wrote, erroneously argued that retired military officers can legally face punishment for speaking out against Defense Department policies they oppose.

    “From Alexander Hamilton denouncing President Adams’s fitness to command during the Quasi-War, to modern episodes in which retired generals publicly called for Secretary Rumsfeld’s resignation over the Iraq War, retired officers have long participated forcefully in public debate over military policy,” Fishman wrote. 

    “The same is true today: retired servicemembers, including Members of Congress, have openly criticized presidential decisions ranging from the Afghanistan withdrawal to vaccination requirements,” he added. “Many continue to serve with distinction as legislators, governors, and federal judges. Yet against that backdrop, Defendants assert the power to limit the First Amendment rights of more than two million retired servicemembers, all without judicial review.”

    This story was originally published by Stateline.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • White House press secretary Karoline Leavitt on Monday urged Senate Democrats to advance the government funding package that must become law before the weekend to avoid a partial shutdown, rejecting their proposal to remove the Homeland Security funding bill.

    Democrats in the upper chamber say they are ready to help pass five of the six bills, but insist the Homeland Security spending measure must be stripped and renegotiated to include more constraints on federal immigration enforcement after officers killed a second American citizen in Minnesota this weekend. 

    “We absolutely do not want to see that funding lapse and we want the Senate to move forward with passing the bipartisan appropriations package that was negotiated on a bipartisan basis,” Leavitt said. 

    Negotiators in Congress have reached bipartisan consensus on each of the dozen full-year government spending bills during the last few months, though the final bills still need to clear the Senate and become law.

    Funding for hundreds of programs in those measures lapses Friday at midnight, when the stopgap spending law Congress approved at the end of the last shutdown expires.  

    A partial shutdown would affect the Departments of Defense, Education, Health and Human Services, Homeland Security, Housing and Urban Development, Labor, State, Transportation and Treasury. The Executive Office of the President, Supreme Court and judicial branch would also go without funding if a solution cannot be reached in time. 

    Leavitt said during the briefing that “policy discussions on immigration in Minnesota are happening” and pointed to the phone call that President Donald Trump and Minnesota Democratic Gov. Tim Walz had earlier in the day. 

    “But that should not be at the expense of government funding for the American people, which would include FEMA funding,” Leavitt said. “And we are in the midst of the storm that took place over the weekend and many Americans are still being impacted by that.”

    The Homeland Security appropriations bill funds numerous programs in addition to Immigration and Customs Enforcement and Customs and Border Protection. The Coast Guard, Federal Emergency Management Agency, National Flood Insurance Fund, Secret Service and Transportation Security Administration are among the other agencies that rely on the bill for budget authority. 

    Schumer demands removal of DHS bill 

    Senate Minority Leader Chuck Schumer, D-N.Y., wrote in a statement that Majority Leader John Thune, R-S.D., should remove the Homeland Security funding bill from the larger package before the deadline to avoid a lapse in funding. 

    “The responsibility to prevent a partial government shutdown is on Leader Thune and Senate Republicans,” he wrote. “If Leader Thune puts those five bills on the floor this week, we can pass them right away. If not, Republicans will again be responsible for another government shutdown.”

    Senate Appropriations Chairwoman Susan Collins, R-Maine, in a brief floor speech urged lawmakers from both political parties to vote to advance the full funding package, calling the possibility of another shutdown “harmful, unnecessary and disastrous.”

    “I hope we can come together in a constructive way to get this done and to ensure that we do not lurch into a dangerous and detrimental government shutdown,” she said. 

    Collins did acknowledge the killing of Alex Pretti over the weekend, saying his “tragic death” had “refocused attention on the Homeland Security bill and I recognize that and share the concerns.” 

    “I do want to point out to my colleagues that there are many safeguards that have been put in this bill that I would encourage them to review,” Collins added without going into detail. “And that the vast majority of the funding in this bill, more than 80%, is for non-immigration and non-border security functions.” 

    A Senate Republican aide, who wasn’t authorized to speak publicly, said GOP leaders are “determined to not have another government shutdown.” 

    “We will move forward as planned and hope Democrats can find a path forward to join us,” the aide added. 

    A Senate Democratic leadership aide said that “Republicans and the White House have reached out but have not yet raised any realistic solutions.”

    ‘Government shutdowns do not help anyone’

    Senate Homeland Security Appropriations Subcommittee Chairwoman Katie Britt, R-Ala., wrote in a social media post that the array of programs in that bill “are critical to keeping Americans safe and must be funded.”

    “We know from recent history that government shutdowns do not help anyone and are not in the best interest of the American people,” Britt wrote, referring to the shutdown of historic length that ended Nov. 12. “As we approach a government funding deadline, I remain committed to finding a pathway forward.”

    Senate Homeland Security Appropriations Subcommittee ranking member Chris Murphy, D-Conn., said Sunday on CNN’s “State of the Union with Jake Tapper & Dana Bash” that he couldn’t “vote to fund this lawless Department of Homeland Security.” 

    “And remember, it's not just in Minnesota. They're violating the law all over the country,” Murphy said. “I spent last week in Texas where they are locking up 2-year-old and 3-year-old kids who are here in the United States legally, just for the purpose of traumatizing them.”

    Fetterman, Shaheen part ways

    Pennsylvania Democratic Sen. John Fetterman appeared to be the only member of his party in that chamber to support the entire package, writing in a statement he “will never vote to shut our government down, especially our Defense Department.”

    “I reject the calls to defund or abolish ICE. I strongly disagree with many strategies and practices ICE deployed in Minneapolis, and believe that must change,” Fetterman wrote. “I want a conversation on the DHS appropriations bill and support stripping it from the minibus. It is unlikely that will happen and our country will suffer another shutdown.”

    New Hampshire Democratic Sen. Jeanne Shaheen backed the strategy of pulling out the Homeland Security spending bill and allowing the other five government funding bills to become law before the shutdown deadline.

    “The Senate then needs to have a real bipartisan discussion about what additional reforms we need to put in place to prevent tragedies like Minneapolis from happening across the country,” Shaheen wrote in a social media post. “I will vote against DHS’s funding until additional reforms are in place.”

    This story was originally published by Stateline.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • House and Senate appropriators backed the White House’s shipbuilding goals with an additional $6.5 billion in funding for fiscal year 2026—including adjustments to fix accounting errors resulting from last year's budget reconciliation. 

    The compromise bill, released last week, allots a total $27.2 billion for shipbuilding, with increases across several efforts. 

    That $27.2 billion topline covers 17 ships, including “one Columbia-class ballistic missile submarine, two Virginia-class fast attack submarines, three Medium Landing Ships, and one T-AGOS [Surveillance Towed-Array Sensor System] ship for anti-submarine warfare,” House appropriators wrote in their bill summary.

    There’s also $1.5 billion in maritime industrial base funding to boost supplier capacity, technology and infrastructure, outsourcing, and workforce training. 

    But last year’s budget reconciliation bill—and the accounting quagmire it created—is what makes this minibus bill different from other spending bills. 

    “The bill addresses more than $4.6 billion in dangerous budget shortfalls created [by] the president’s decision to request a portion of critical fiscal year 2026 defense capabilities through a partisan and highly uncertain legislative process, coupled with poor decisions made by congressional Republicans in drafting their reconciliation bill last summer,” Democrat Senate appropriators wrote in a bill summary. 

    Appropriators referred to the discrepancies as “reconciliation funding incongruence.” Here’s a list of some shipbuilding programs that got increases in the bill:

    • $1.92 billion increase for Virginia-class submarines, to “support infrastructure and wage enhancements at the prime shipyards”—a $2.74 billion total
    • $23 million increase for outfitting
    • $100 million increase for auxiliary vessels (plus a $145 million program increase for a $290 million total—six times the amount requested) 
    • $462 million for completion of prior year shipbuilding programs

    The bill also includes increases for destroyers and “$1.9 billion to fully fund the Navy’s ship operations, previously noted shipbuilding impacts totaling several billion dollars,” senators wrote in the bill summary. 

    Other notable, but not reconciliation related, program increases:

    • $242 million to procure long lead-time material for the FF(X)-Frigate
    • $800 million for two Medium Landing ships (none were requested in the budget but others were funded by reconciliation)
    • $100 million for frigate workforce support
    • $320 million for two ship-to-shore connectors (an unfunded requirement and increase from a $238 million mandatory requirement)

    There were also program funding reductions, particularly compared to the requests, due to “reconciliation funding incongruence”. 

    Congress zeroed out a $54.5 million budget request for small and medium UUVs due to sizable funding in the reconciliation bill. But the program received $7 million for “deep seabed scanning and over-the-horizon sensors.”

    Under other procurement for the Navy, appropriators reduced funding  for “spares and repair parts” from a $585.9 million budget request to $159.1 million due to “excess growth” and “reconciliation misalignments” but provided $2.1 million for a resistance welding pilot program. 

    Also, the budget request for advanced undersea prototyping was more than halved for reasons including reconciliation discrepancies and XLUUV delivery delays, but received $60 million for “commercially available extra large unmanned underwater vehicle technology.” 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Scammers are abusing Microsoft Teams invitations to send fake billing notices, with 12,866 emails reaching around 6,135 users in a phone-based phishing campaign.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have discovered an ongoing campaign that’s targeting Indian users with a multi-stage backdoor as part of a suspected cyber espionage campaign. The activity, per the eSentire Threat Response Unit (TRU), involves using phishing emails impersonating the Income Tax Department of India to trick victims into downloading a malicious archive, ultimately granting the threat

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Minnesota authorities have activated the state National Guard at the request of the Hennepin County sheriff, Gov. Tim Walz announced Saturday. 

    The soldiers were issued reflective vests so they would not be mistaken for federal agents. They were filmed Sunday at a federal building passing out donuts, coffee, and hot chocolate to citizens protesting Immigration and Customs Enforcement operations throughout Minneapolis. Walt activated the Guard after the sheriff cited “the potential for continuing and growing conflict” following the second fatal shooting of an American citizen by federal agents in Minneapolis in just over two weeks.  

    Alex Jeffrey Pretti, a 37-year-old intensive-care-unit nurse with the Veterans Affairs Department, was killed Saturday after filming federal agents during an arrest Saturday in Minnesota. 

    Pretti held a phone in his right hand as the confrontation began when he was shoved by an immigration agent, then pepper-sprayed and tackled to the ground by other agents as they struck him with a spray can. The immigration officials then spotted an undrawn handgun on Pretti’s waistline and removed it before shooting him to death with 10 shots in the span of about six seconds. 

    Observers filmed the shooting from multiple angles, which have been closely analyzed by visual forensics teams from several major news outlets, including the New York Times, Bellingcat, the Washington Post, the Associated Press and Reuters.  

    Pretti was a legal gun owner with a permit to carry; at no time did video show that he had drawn his weapon. Instead, he is shown with a phone in his right hand, with his left hand open to defend against the pepper spray before the federal agents pulled him to the ground. The Times reports Pretti appeared to physically resist as the agents worked to pin him as another agent struck him repeatedly. That’s when they spotted his gun, removed it from his waist, and shot him to death. 

    The encounter lasted 25 seconds from the moment he was sprayed to the sound of the first shots. The agents then walked away, abandoning Pretti’s body and the scene of the crime. Bystanders then took it upon themselves to secure the site, cordoning off the bloody space with several large trash cans nearby. 

    “If an 18-year-old Marine did that in the middle of a war zone, he would be court-martialed, because it is murder,” said former Marine and Iraq-war veteran Rep. Seth Moulton in a video posted Saturday. “It looked like an execution,” observed historian Heather Cox Richardson. 

    • By the way: Homeland Security officials have shot 12 people during immigration enforcement operations since September, NBC News reported Sunday, with a list of the names. 

    The Trump administration quickly began denigrating Pretti, and released “a torrent of claims that are either contradicted by video footage or unsupported by any evidence presented so far,” as CNN’s fact-checker Daniel Dale reported Sunday. Stephen Miller, President Trump’s deputy chief of staff, was particularly aggressive—referring to Pretti as “an assassin” and a “domestic terrorist [who] tried to assassinate federal law enforcement.” Border Patrol commander Gregory Bovino claimed Pretti “assaulted federal officers,” and “wanted to do maximum damage and massacre law enforcement.” Homeland Security Secretary Kristi Noem and FBI Director Kash Patel alleged Pretti “attacked” officers. 

    Noem also claimed Pretti was “brandishing” a gun, though he is not seen doing so at any point during the roughly 30-second encounter. However, “I don’t have any evidence that I’ve seen that suggests that the weapon was brandished,” Minneapolis Police Chief Brian O’Hara told CBS on Sunday. 

    FBI Director Patel also claimed, “You cannot bring a firearm loaded with multiple magazines to any sort of protest that you want,” and, “No one who wants to be peaceful shows up at a protest with a firearm that is loaded with two full magazines.” Online observers found this to be puzzling if not disingenuous, as Sarah Longwell of the conservative news site The Bulwark noted while sharing at least 10 instances of Trump supporters appearing to do precisely what Patel was talking about at protests around the country going back to 2017.

    The National Rifle Association even pushed back on that sentiment, writing on social media Saturday, “Responsible public voices should be awaiting a full investigation, not making generalizations and demonizing law-abiding citizens.”

    Defense Secretary Pete Hegseth weighed in, tweeting, “Thank God for the patriots of @ICEgov — we have your back 100%. Shame on the leadership of Minnesota — and the lunatics in the street. ICE > MN”. Responded Tom Nichols of The Atlantic: “Hegseth’s apparent desire to get involved in the Minnesota debacle is dangerous not only to the lives of innocent Americans, but to American democracy itself. The military should not be involved in domestic policing. Cops and border agents and soldiers are different from one another, and they are kept separate in a democracy for good reason. And most important, the Pentagon’s top official should not use his office to identify elected leaders who disagree with the president as enemies who will destroy the nation.” 

    President Trump blamed Pretti’s death on “Democrat run Sanctuary Cities and States” that he said “are REFUSING to cooperate with ICE, and they are actually encouraging Leftwing Agitators to unlawfully obstruct their operations to arrest the Worst of the Worst People!” he said in a social media post Sunday afternoon. “Tragically, two American Citizens have lost their lives as a result of this Democrat ensued chaos,” Trump claimed. 

    Worth noting: The raids in Minnesota appear to be more about instilling compliance rather than deporting immigrants. Consider: Texas is reported to have just over 2 million undocumented immigrants, and Florida is believed to have about 1.6 million, according to 2023 data from the Pew Research Center. But Minnesota, which did not vote for Trump in the last three elections, had only about 130,000. Yet it’s Minnesota where DHS sent more than 2,000 federal agents on its aggressive deportation blitz, “Operation Metro Surge” in December 2025.  

    And in another move echoing America in the 1850s, Trump called on “Congress to immediately pass Legislation to END Sanctuary Cities, which is the root cause of all of these problems,” he said Sunday. “American Cities should be Safe Sanctuaries for Law Abiding American Citizens ONLY, not Illegal Alien Criminals who broke our Nation’s Laws.”

    Protests erupted inside an immigrant detention center in Texas where a five-year-old and his father were sent after being abducted in Minnesota. Families were heard inside shouting “Libertad!” or “Let us go,” according to a video taken Saturday by Eric Lee, an immigration attorney who was there to visit a client at the facility in the town of Dilley. “The message we want to send is for them to treat us with dignity and according to the law. We're immigrants, with children, not criminals,” one immigrant told the Associated Press in a phone interview after the video surfaced.

    Monitoring for possible invocation of the Insurrection Act: Despite Trump’s claims last week, demonstrations in Minneapolis after Pretti’s death “still fall far short of the mass violence that has historically justified invoking the Insurrection Act,” writes Elizabeth Goitein of the Brennan Center for Justice. “By way of comparison, riots in LA in 1992 killed 63 people and caused $1 billion in property damage, while riots in Detroit in 1967 killed 43 people and destroyed 400 buildings. Nothing that protesters in Minneapolis have done comes close to these examples. And in both LA and Detroit, the governors requested federal military assistance.” 

    “If Trump were to invoke the Insurrection Act in Minneapolis, it would undoubtedly be to enable ICE’s brutal operation, which is leaving a wake of destruction and death and poses an ongoing threat to public safety,” she says. “Far from keeping the peace, such a deployment would be sure to inflame tensions, leading to more protests—and thus more ICE violence. It would escalate rather than defuse the situation in Minneapolis.” 

    Can observing ICE agents land you on the Trump administration’s “domestic terrorist” list? One agent in Maine seemed to allege as much. He was recently asked why he was photographing a legal observer's car when he replied, “Because we have a nice little database and now you're considered a domestic terrorist. So have fun with that.” (Hat tip to Ken Klippenstein)

    Developing: Pretti’s death could have further implications for federal employees, raising the chances of a government shutdown by Friday. Senate Minority Leader Chuck Schumer, D-N.Y., said in response to the shooting that his party would not agree to a six-bill funding package next week if it contains DHS appropriations. 

    Half of the 12-annual must pass spending bills for fiscal 2026 have already cleared Congress, but the remaining six are still pending before the Senate, as Eric Katz of Government Executive reports. The House already approved them. In addition to DHS, those measures would fund the departments of Defense, Labor, Health and Human Services, Education, Transportation, Housing and Urban Development, State and Treasury, as well as other related agencies. They are currently operating under a stopgap continuing resolution that is set to expire Jan. 30. Lawmakers could opt to fund just those agencies and negotiate separately over DHS, though such an approach would require new votes in both the House and Senate.

    Additional reading: 


    Welcome to this Monday edition of The D Brief, a newsletter focused on developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so we’d like to take a moment to thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1942, elements of the Army’s 133rd Infantry Regiment landed at Belfast Harbor in Northern Ireland—the first U.S. troops to deploy for the defense of Europe during World War II.

    Around the Defense Department

    The Pentagon dropped the National Defense Strategy late on Friday, a time usually reserved for news that an organization wants to keep quiet. The 34-page document follows the release of a classified interim NDS rushed out last March, some two months after the new administration was sworn in. Work on the formal NDS began last May.

    Like the interim version, the new one reflects a huge shift from previous administrations’ strategies, which focused on Mideast-based terrorist groups, loosely organized authoritarian states, and peer competitors, particularly China. Instead, the NDS focuses on homeland defense and Western Hemisphere. And while the interim one appeared to drop focus entirely on Russia, according to Hegseth’s early-2025 testimony, Russia returns in the new version. Read the NDS here; and coverage of it from, e.g., WSJ, Politico, and Associated Press.

    Also on Friday: Air Force officials announced the revival of a deployment scheme abandoned three years ago. While the original Air Expeditionary Wing concept quickly assembled airmen and aircraft from across the service to deploy for conflicts, AEW 2.0 aims to give the team up to 18 months to train together, according to officials and a news release. The move is the latest Trump-administration shift away from Biden-era efforts to orient the force to confront China. Defense One’s Thomas Novelly reports, here.

    Space Force probably needs twice as many guardians, vice chief says. The service’s budget and the number of operational U.S. military satellites have doubled since its founding, Gen. Shawn Bratton noted. The Space Force, which consists of about 10,000 guardians and 5,000 civilians, is adding about 500 troops a year—but that’s not enough. “We’ve got to pick up the pace. We need to grow on the military side, probably around 1,000 a year, something like that, for the next decade,” Bratton said. “I think we really need to double the size.” Novelly has more, here.

    In case you missed it, Trump launched his “board of peace” club last week on the sidelines of the World Economic Forum. Representatives from 23 nations stood beside him during the “signing ceremony” Thursday in Davos, Switzerland. (We listed the participants in our Friday newsletter.) 

    However, “nearly half of the countries on it are banned from entering the US under his travel ban,” the UK’s Independent reported Friday. 

    Another detail we missed last week: Trump on Thursday floated invoking NATO’s Article 5 for the U.S. border to “free up” CBP agents for more crackdowns elsewhere stateside. The president reposted that threat over the weekend in the wake of Alex Pretti’s death. 

    Expert reax: “In watching Trump over the past year, I’ve come to realize that the usual tools international observers bring to foreign policy analysis—political science, economics, sociology, and the like—are not nearly as important as psychology, both individual and social,” American political scientist Francis Fukuyama wrote Saturday in an essay on Substack entitled, “After Davos.” 

    “I would liken Donald Trump to a ten-year-old boy who has discovered a flame thrower in his parents’ backyard, and has come to realize that he can burn up anything he wants with it. He’s now actively looking for other things he can set on fire.” Trump, Fukuyama said, “is a destroyer of institutions who wants to replace them with his own preferences, which inevitably benefit him personally.”

    “There is one big problem with this psychological evolution,” he cautions. “Trump has consistently overestimated the power of the United States relative to other countries,” Fukuyama writes. “His overestimation of American power may continue as he tries to run Venezuela by remote control and extract oil from it. What is not clear is how he would use the military against a big player like China.”

    Fukuyama adds: “Trump’s enduring legacy is not an institutional structure, but rather a highly toxic culture that has been adopted by many of the president’s followers and will live on after he is gone.” His advice? “In the wake of Davos, Europeans need to move in the opposite direction. They need to strengthen the European Union if it is to be taken seriously by the United States, China, Russia, or any other power. This will require two things.” Read on, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0, a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes. Both the FBI and Google say they are hunting for the people behind Badbox 2.0, and thanks to bragging by the Kimwolf botmasters we may now have a much clearer idea about that.

    Our first story of 2026, The Kimwolf Botnet is Stalking Your Local Network, detailed the unique and highly invasive methods Kimwolf uses to spread. The story warned that the vast majority of Kimwolf infected systems were unofficial Android TV boxes that are typically marketed as a way to watch unlimited (pirated) movie and TV streaming services for a one-time fee.

    Our January 8 story, Who Benefitted from the Aisuru and Kimwolf Botnets?, cited multiple sources saying the current administrators of Kimwolf went by the nicknames “Dort” and “Snow.” Earlier this month, a close former associate of Dort and Snow shared what they said was a screenshot the Kimwolf botmasters had taken while logged in to the Badbox 2.0 botnet control panel.

    That screenshot, a portion of which is shown below, shows seven authorized users of the control panel, including one that doesn’t quite match the others: According to my source, the account “ABCD” (the one that is logged in and listed in the top right of the screenshot) belongs to Dort, who somehow figured out how to add their email address as a valid user of the Badbox 2.0 botnet.

    The control panel for the Badbox 2.0 botnet lists seven authorized users and their email addresses. Click to enlarge.

    Badbox has a storied history that well predates Kimwolf’s rise in October 2025. In July 2025, Google filed a “John Doe” lawsuit (PDF) against 25 unidentified defendants accused of operating Badbox 2.0, which Google described as a botnet of over ten million unsanctioned Android streaming devices engaged in advertising fraud. Google said Badbox 2.0, in addition to compromising multiple types of devices prior to purchase, also can infect devices by requiring the download of malicious apps from unofficial marketplaces.

    Google’s lawsuit came on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by either configuring the products with malware prior to the user’s purchase, or infecting the device as it downloads required applications that contain backdoors — usually during the set-up process.

    The FBI said Badbox 2.0 was discovered after the original Badbox campaign was disrupted in 2024. The original Badbox was identified in 2023, and primarily consisted of Android operating system devices (TV boxes) that were compromised with backdoor malware prior to purchase.

    KrebsOnSecurity was initially skeptical of the claim that the Kimwolf botmasters had hacked the Badbox 2.0 botnet. That is, until we began digging into the history of the qq.com email addresses in the screenshot above.

    CATHEAD

    An online search for the address 34557257@qq.com (pictured in the screenshot above as the user “Chen“) shows it is listed as a point of contact for a number of China-based technology companies, including:

    Beijing Hong Dake Wang Science & Technology Co Ltd.
    Beijing Hengchuang Vision Mobile Media Technology Co. Ltd.
    Moxin Beijing Science and Technology Co. Ltd.

    The website for Beijing Hong Dake Wang Science is asmeisvip[.]net, a domain that was flagged in a March 2025 report by HUMAN Security as one of several dozen sites tied to the distribution and management of the Badbox 2.0 botnet. Ditto for moyix[.]com, a domain associated with Beijing Hengchuang Vision Mobile.

    A search at the breach tracking service Constella Intelligence finds 34557257@qq.com at one point used the password “cdh76111.” Pivoting on that password in Constella shows it is known to have been used by just two other email accounts: daihaic@gmail.com and cathead@gmail.com.

    Constella found cathead@gmail.com registered an account at jd.com (China’s largest online retailer) in 2021 under the name “陈代海,” which translates to “Chen Daihai.” According to DomainTools.com, the name Chen Daihai is present in the original registration records (2008) for moyix[.]com, along with the email address cathead@astrolink[.]cn.

    Incidentally, astrolink[.]cn also is among the Badbox 2.0 domains identified in HUMAN Security’s 2025 report. DomainTools finds cathead@astrolink[.]cn was used to register more than a dozen domains, including vmud[.]net, yet another Badbox 2.0 domain tagged by HUMAN Security.

    XAVIER

    A cached copy of astrolink[.]cn preserved at archive.org shows the website belongs to a mobile app development company whose full name is Beijing Astrolink Wireless Digital Technology Co. Ltd. The archived website reveals a “Contact Us” page that lists a Chen Daihai as part of the company’s technology department. The other person featured on that contact page is Zhu Zhiyu, and their email address is listed as xavier@astrolink[.]cn.

    A Google-translated version of Astrolink’s website, circa 2009. Image: archive.org.

    Astute readers will notice that the user Mr.Zhu in the Badbox 2.0 panel used the email address xavierzhu@qq.com. Searching this address in Constella reveals a jd.com account registered in the name of Zhu Zhiyu. A rather unique password used by this account matches the password used by the address xavierzhu@gmail.com, which DomainTools finds was the original registrant of astrolink[.]cn.

    ADMIN

    The very first account listed in the Badbox 2.0 panel — “admin,” registered in November 2020 — used the email address 189308024@qq.com. DomainTools shows this email is found in the 2022 registration records for the domain guilincloud[.]cn, which includes the registrant name “Huang Guilin.”

    Constella finds 189308024@qq.com is associated with the China phone number 18681627767. The breach tracking service osint.industries reveals this phone number is connected to a Microsoft profile created in 2014 under the name Guilin Huang (桂林 黄). The cyber intelligence platform Spycloud says that phone number was used in 2017 to create an account at the Chinese social media platform Weibo under the username “h_guilin.”

    The public information attached to Guilin Huang’s Microsoft account, according to the breach tracking service osintindustries.com.

    The remaining three users and corresponding qq.com email addresses were all connected to individuals in China. However, none of them (nor Mr. Huang) had any apparent connection to the entities created and operated by Chen Daihai and Zhu Zhiyu — or to any corporate entities for that matter. Also, none of these individuals responded to requests for comment.

    The mind map below includes search pivots on the email addresses, company names and phone numbers that suggest a connection between Chen Daihai, Zhu Zhiyu, and Badbox 2.0.

    This mind map includes search pivots on the email addresses, company names and phone numbers that appear to connect Chen Daihai and Zhu Zhiyu to Badbox 2.0. Click to enlarge.

    UNAUTHORIZED ACCESS

    The idea that the Kimwolf botmasters could have direct access to the Badbox 2.0 botnet is a big deal, but explaining exactly why that is requires some background on how Kimwolf spreads to new devices. The botmasters figured out they could trick residential proxy services into relaying malicious commands to vulnerable devices behind the firewall on the unsuspecting user’s local network.

    The vulnerable systems sought out by Kimwolf are primarily Internet of Things (IoT) devices like unsanctioned Android TV boxes and digital photo frames that have no discernible security or authentication built-in. Put simply, if you can communicate with these devices, you can compromise them with a single command.

    Our January 2 story featured research from the proxy-tracking firm Synthient, which alerted 11 different residential proxy providers that their proxy endpoints were vulnerable to being abused for this kind of local network probing and exploitation.

    Most of those vulnerable proxy providers have since taken steps to prevent customers from going upstream into the local networks of residential proxy endpoints, and it appeared that Kimwolf would no longer be able to quickly spread to millions of devices simply by exploiting some residential proxy provider.

    However, the source of that Badbox 2.0 screenshot said the Kimwolf botmasters had an ace up their sleeve the whole time: Secret access to the Badbox 2.0 botnet control panel.

    “Dort has gotten unauthorized access,” the source said. “So, what happened is normal proxy providers patched this. But Badbox doesn’t sell proxies by itself, so it’s not patched. And as long as Dort has access to Badbox, they would be able to load” the Kimwolf malware directly onto TV boxes associated with Badbox 2.0.

    The source said it isn’t clear how Dort gained access to the Badbox botnet panel. But it’s unlikely that Dort’s existing account will persist for much longer: All of our notifications to the qq.com email addresses listed in the control panel screenshot received a copy of that image, as well as questions about the apparently rogue ABCD account.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have discovered two malicious Microsoft Visual Studio Code (VS Code) extensions that are advertised as artificial intelligence (AI)-powered coding assistants, but also harbor covert functionality to siphon developer data to China-based servers. The extensions, which have 1.5 million combined installs and are still available for download from the official Visual Studio

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶