Check Point Research uncovered four critical vulnerabilities in Microsoft Teams that could allow attackers to impersonate executives, manipulate messages, alter notifications, and forge identities during video and audio calls. The research team discovered that both external guest users and malicious insiders could exploit these security flaws, fundamentally undermining the trust that 320 million monthly active […]
Acronis Threat Research Unit has analyzed recent activity linked to the DragonForce ransomware group and identified a new malware variant in the wild. The latest sample uses vulnerable drivers such as truesight.sys and rentdrv2.sys to disable security software, terminate protected processes and correct encryption flaws previously associated with Akira ransomware. The updated encryption scheme addresses […]
A critical security flaw in the WordPress Post SMTP plugin has left more than 400,000 websites vulnerable to account takeover attacks.
The vulnerability, identified as CVE-2025-11833, enables unauthenticated attackers to access email logs containing sensitive password reset information, potentially compromising administrator accounts and entire websites.
The flaw stems from a missing authorization check in the plugin’s core functionality, allowing threat actors to exploit logged email data without requiring any authentication credentials.
The Post SMTP plugin, designed to replace WordPress’s default PHP mail function with SMTP mailers, includes an email logging feature that inadvertently exposes critical security information.
Since November 1, 2025, attackers have actively targeted this vulnerability, with over 4,500 exploitation attempts already blocked by security systems.
The widespread use of this plugin across hundreds of thousands of WordPress installations has created a significant attack surface for cybercriminals seeking unauthorized access to websites.
Wordfence researchers identified the vulnerability through their Bug Bounty Program on October 11, 2025, just one day after its introduction.
Security researcher netranger discovered and responsibly reported the flaw, earning a bounty of $7,800 for the critical finding.
The WP Experts development team responded swiftly to disclosure, releasing patch version 3.6.1 on October 29, 2025, to address the security gap affecting all versions up to and including 3.6.0.
The vulnerability carries a CVSS score of 9.8, placing it in the critical severity category. Site administrators must immediately update to version 3.6.1 to protect their installations from ongoing exploitation attempts.
Wordfence Premium users received firewall protection on October 15, 2025, while free version users will receive the same safeguards by November 14, 2025.
Technical Exploitation Mechanism
The vulnerability resides within the PostmanEmailLogs class constructor, which displays logged email messages without performing capability checks on the __construct function.
Attackers can exploit this weakness by manipulating URL parameters to access arbitrary email logs through the plugin’s interface.
Vulnerability Details:-
Parameter
Details
CVE ID
CVE-2025-11833
CVSS Score
9.8 (Critical)
Vulnerability Type
Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
Affected Plugin
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
Affected Versions
All versions <= 3.6.0
Patched Version
3.6.1
Active Installations
400,000+
Discovery Date
October 11, 2025
Patch Release Date
October 29, 2025
Researcher
netranger (Wordfence Bug Bounty Program)
Bounty Awarded
$7,800.00
Exploitation Status
Active (4,500+ attacks blocked as of November 1, 2025)
The vulnerable code accepts GET requests with specific parameters including page, view, and log_id, allowing unauthorized users to retrieve stored email content directly from the database.
The exploitation process involves attackers triggering password reset requests for administrator accounts, then accessing the logged reset emails containing password reset links through the unprotected interface.
This two-step attack vector enables complete site takeover, granting malicious actors full administrative privileges to upload backdoors, modify content, and redirect users to malicious destinations.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A severe security vulnerability has been discovered in a widely used React Native development package, potentially exposing millions of developers to remote attacks. Security researchers from JFrog recently uncovered CVE-2025-11953, a critical remote code execution flaw affecting the @react-native-community/cli NPM package, which receives approximately two million weekly downloads. The vulnerability carries a maximum CVSS score […]
Security teams drown in alerts but starve for insight. Blocklists catch the obvious. SIEM correlation gives clues. But only context reveals what an alert really means, and what you should do about it.
Every SOC sees thousands of signals: odd domains, masquerading binaries, strange persistence artifacts. On their own, these indicators mean almost nothing. A suspicious process might be malware or a legitimate update from a vendor you barely know.
But the moment you add threat context — history, connected IOCs, malware family relations, sandbox behavior — the picture changes completely.
Meet TI Lookup: The Context Engine
ANY.RUN Threat Intelligence Lookup is a real-time investigation tool that lets analysts instantly understand what they’re dealing with — from domains and IPs to file hashes and URLs.
It’s powered by rich data crowdsourced from 15,000+ SOCs and researchers worldwide, continuously enriched by ANY.RUN’s sandbox detections. Instead of wasting time digging through multiple feeds, analysts get actionable context in seconds.
TI Lookup: query an IOC, get actionable intelligence for quick decision
You achieve:
Instant clarity: Quickly identify whether an IOC is malicious, suspicious, or benign;
Deeper context: View sandbox behavior, relations, and threat actor links in one place;
Smarter triage: Speed up incident response with verified data and fewer false positives.
Context turns data into decisions. And decisions stop breaches from happening.
Here are five highly practical ways SOC analysts use context to speed triage, reduce noise, and fight more effectively: powered by ANY.RUN’s Threat Intelligence (TI) Lookup.
Tactic 1: Domain Intelligence – From Suspicious to Confirmed Threat
The Alert:
Domain contacted: logrecovery[.]com
Without Context: Could be legitimate cybersecurity resource. Requires manual investigation across multiple platforms.
With TI Context:
Observed in AsyncRAT and Amadey sandbox executions;
Linked to active command-and-control infrastructure;
Associated with information-stealing campaigns and botnets.
Immediate Action: Block the domain at your proxy/firewall, tag it as a high-confidence IOC in your threat intelligence platform, and hunt retroactively for any historical connections in your network traffic logs.
Why It Matters: Stealer malware exfiltrates credentials, session tokens, and sensitive data. Every minute it remains unblocked is a window for data theft. Context lets you move from “investigate” to “contain” immediately.
Immediate Action: Add the file hash to your SIEM blocklist, check egress logs for any systems that may have already connected to associated C2 domains, and update mail gateway filters to catch variants.
Why It Matters: Tycoon 2FA can intercept user credentials and session cookies to bypass MFA, enabling unauthorized access to accounts even with additional security measures. Organizations using cloud services are at the most risk.
Recognizing campaign patterns helps you understand the scope: is this a targeted attack or part of a broader spray-and-pray operation? Context answers that question instantly.
Tactic 3: IP Address Intelligence – Understanding Payload Delivery
The Alert:
Outbound connection to: 45.155.205[.]11
Without Context: Could be legitimate software update checks. Requires manual investigation across multiple platforms.
With TI Context:
Observed in DBatLoader and GuLoader sandbox executions;
Linked to active command-and-control infrastructure;
Immediate Action: Block the domain at your proxy/firewall, tag it as a high-confidence IOC in your threat intelligence platform, and hunt retroactively for any historical connections in your network traffic logs.
Why It Matters: Stealer malware exfiltrates credentials, session tokens, and sensitive data. Every minute it remains unblocked is a window for data theft. Context lets you move from “investigate” to “contain” immediately.
Tactic 4: Process Behavior – Detecting Credential Theft
The Alert:
Unusual process detected: New Text Document mod.exe
Without Context: Can be a nonchalantly attributed document, but the .exe extension arouses suspicion. Manual verification required.
Immediate Action: Check all endpoints for this process name and file hash, flag any instances for immediate investigation, and monitor for suspicious authentication behavior patterns like impossible travel or unusual access times.
Malicious process poorly disguised as a document
Why It Matters: XRed is a backdoor designed for long-term system infiltration and control and stealing sensitive data. It combines elements of remote access Trojans (RATs), infostealers, and backdoors to execute a range of malicious activities.
Tactic 5: Registry Key Persistence – Finding the Foothold
The Alert:
Registry modification: \Software\Microsoft\update
Without Context: Registry changes happen constantly. Could be legitimate software, Windows updates, or persistence mechanism. Difficult to prioritize without additional information.
With TI Context:
Appears in known malware persistence mechanisms
Seen in stealer campaigns
Used to maintain access across system reboots
Indicator of established compromise, not initial infection
Immediate Action: Escalate immediately to incident response team, scan affected hosts for additional IOCs associated with notorious stealers, and check for lateral movement indicators across your environment.
Why It Matters: If you’re seeing persistence mechanisms, the attacker has already established a foothold. This isn’t prevention, it’s containment. Context tells you this is a critical escalation requiring full IR protocols, not just endpoint remediation.
The Context Advantage: From Hours to Minutes
Each of these scenarios represents a fork at the road of a SOC analysts. Without context, you’re stuck in investigation mode chasing down leads, correlating data points, and hoping you make the right call. With context, you skip directly to response.
Consider the time savings:
Manual TI gathering: 20-45 minutes per artifact across multiple platforms
TI Lookup with context: Seconds to retrieve comprehensive intelligence
Decision confidence: Immediate clarity on threat severity and appropriate response
For a SOC analyst triaging 50+ alerts per day, that’s the difference between constantly playing catch-up and staying ahead of threats.
How Threat Intelligence Delivers Context Automatically
TI Lookup doesn’t just tell you whether an artifact is malicious, it shows you the full picture:
Sandbox execution history: See how the artifact behaves in real, interactive malware analysis sessions
Associated campaigns: Understand which threat actors and malware families use this indicator
Infrastructure relationships: Map connections between domains, IPs, and file hashes
Temporal context: Know if this is an emerging threat or part of an established campaign
Instead of piecing together intelligence from multiple sources, you get a unified view that connects artifacts to actual malware behavior.
Start Making Context-Driven Decisions Today
Next time an alert hits your queue, ask yourself: do you have the context to act confidently, or are you about to spend the next thirty minutes hunting for it?
Context isn’t a luxury for SOC analysts. It’s the difference between reactive scrambling and proactive defense. The threats are already using automation and infrastructure at scale. Your intelligence should, too.
Ready to add context to your threat hunting workflow? Explore ANY.RUN’s TI Lookup and see how instant threat intelligence transforms the way you analyze and respond to security alerts.
XLoader remains one of the most challenging malware families confronting cybersecurity researchers.
This sophisticated information-stealing loader emerged in 2020 as a rebrand of FormBook and has evolved into an increasingly complex threat.
The malware’s code decrypts only at runtime and sits protected behind multiple encryption layers, each locked with different keys hidden throughout the binary.
Even automated sandbox analysis tools struggle against XLoader’s aggressive evasion techniques that block malicious execution when virtual environments are detected.
Check Point researchers identified a breakthrough approach to analyzing XLoader by leveraging generative artificial intelligence.
The latest XLoader version 8.0 sample presented significant obstacles with customized encryption schemes, obfuscated API calls, and extensive sandbox evasion techniques.
The malware authors release new versions regularly, changing internal mechanisms and adding anti-analysis methods that render previous research quickly outdated.
The research demonstrated how ChatGPT accelerated static reverse engineering from days to hours.
By exporting IDA Pro database contents and analyzing them through cloud-based artificial intelligence, researchers showed deep analysis could proceed without maintaining live disassembler sessions.
Integration of an LLM with the reverse engineering environment through MCP (Source – CheckPoint)
This approach removed dependency on heavy local tooling while making results reproducible and easier to share.
Decrypting XLoader’s Built-in Protection
XLoader version 8.0 implements sophisticated protection mechanisms through a built-in crypter that wraps the main payload in two rounds of RC4 encryption.
The first layer applies RC4 decryption to the entire buffer, followed by a second pass processing 256-byte chunks using a different key.
Each encryption round requires specific keys derived through complex algorithms scattered across multiple functions.
Check Point analysts noted the main payload undergoes this dual-layer encryption scheme, with Stage-1 and Stage-2 keys calculated through separate derivation processes.
The Stage-1 key (20EBC3439E2A201E6FC943EE95DACC6250A8A647) and Stage-2 key (86908CFE6813CB2E532949B6F4D7C6E6B00362EE) were successfully extracted through artificial intelligence-assisted analysis combined with runtime debugging validation.
The complete unpacking process traditionally consuming days of manual reverse engineering, was compressed into approximately 40 minutes, offering defenders fresher indicators of compromise.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The Tycoon 2FA phishing kit has emerged as one of the most sophisticated Phishing-as-a-Service platforms since its debut in August 2023, specifically engineered to circumvent two-factor authentication and multi-factor authentication protections on Microsoft 365 and Gmail accounts.
This advanced threat employs an Adversary-in-the-Middle approach, utilizing reverse proxy servers to host convincing phishing pages that perfectly replicate legitimate login interfaces while capturing user credentials and session cookies in real-time.
According to the Any.run malware trends tracker, Tycoon 2FA leads with over 64,000 reported incidents this year, making it one of the most prevalent phishing threats in the current landscape.
The attack spreads through multiple distribution vectors including malicious PDF documents, SVG files, PowerPoint presentations, and emails containing phishing links.
Threat actors have also leveraged cloud storage platforms such as Amazon S3 buckets, Canva, and Dropbox to host fake login pages, making detection more challenging for traditional security solutions.
What makes this campaign particularly dangerous is its ability to steal authentication codes even when two-factor authentication is enabled, effectively rendering this security measure useless against the sophisticated interception techniques employed by the kit.
Cybereason analysts identified that the phishing kit implements multiple pre-redirection checks as defense mechanisms against detection, including domain verification, CAPTCHA challenges, bot and scanning tool detection, and debugger checks that actively look for security researchers analyzing the code.
These checks ensure that only genuine victims reach the final phishing page while automated security tools and analysts are redirected to benign websites.
The kit also demonstrates an advanced understanding of organizational security policies by analyzing error messages from login attempts, allowing attackers to tailor their campaigns for maximum effectiveness.
The technical sophistication extends to the use of boilerplate templates that dynamically generate fake login pages based on actual responses from Microsoft servers, creating a seamless experience that prompts users to input their MFA codes, which are then relayed to legitimate servers in real-time, successfully bypassing this critical security layer.
Multi-Stage JavaScript Execution and Credential Harvesting
The attack unfolds through a complex multi-stage JavaScript execution chain designed to evade detection while harvesting credentials.
Attack chain (Source – Cybereason)
The initial HTML page contains a JavaScript file with a base64-encoded payload compressed using the LZ-string algorithm, which decompresses and executes the hidden payload in memory.
The second stage employs a technique called DOM Vanishing Act, where malicious JavaScript code removes itself from the Document Object Model after execution, leaving no visible trace for security tools inspecting the page code.
The script contains three different base64-encoded payloads, each designed to run under specific conditions.
The first payload uses XOR cipher obfuscation and executes only when window.location.pathname.split contains an exclamation mark or dollar sign, confirming that the user arrived via the intended malicious link rather than through automated scanning.
Email extraction (Source – Cybereason)
The email extraction process creates a custom string by appending “WQ” to the victim’s email address before exfiltrating it to the command-and-control server via POST request to /zcYbH5gqRHbzSQXiK8YtTbhpNSGtkZc6xbMyRBGazbWU8fjfq, where the server responds with AES-encrypted payloads decrypted using the CryptoJS library.
When victims enter credentials into the fake login page, the attacker acting as a middleman immediately receives the information and submits it to legitimate Microsoft servers.
The victim’s webpage is then dynamically updated based on server responses using webparts, making the phishing attempt appear seamless and highly convincing.
The final JavaScript payload collects browser information including navigator.userAgent and sends requests to geolocation services, encrypting the gathered data with a hardcoded key before transmission to the attacker’s endpoint at /tdwsch3h8IoKcUOkog9d14CkjDcaR0ZrKSA95UaVbbMPZdxe, successfully completing the credential theft operation.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A sophisticated evolution of the RondoDox botnet has emerged with a staggering 650% increase in exploitation capabilities, marking a significant escalation in the threat landscape for both enterprise and IoT infrastructure.
First documented by FortiGuard Labs in September 2024, the original RondoDox variant focused narrowly on DVR systems with just two exploit vectors.
The newly discovered RondoDox v2, however, demonstrates a dramatic expansion with over 75 distinct exploitation vectors targeting everything from legacy routers to modern enterprise applications.
This evolution represents a fundamental shift in botnet development strategy, bridging the gap between opportunistic IoT exploitation and targeted enterprise compromise.
The malware was detected on October 30, 2025, through honeypot telemetry when research infrastructure began receiving automated exploitation attempts from IP address 124.198.131.83 originating from New Zealand.
The attack pattern immediately distinguished itself through its volume and sophistication, deploying 75 distinct exploit payloads in rapid succession.
Each payload attempted command injection vectors targeting router and IoT vulnerabilities, with all payloads downloading malicious scripts from the command-and-control server at 74.194.191.52.
Unusually, the threat actor embedded an open attribution signature—bang2013@atomicmail.io—directly into User-Agent strings, marking a departure from the anonymous operational security typically employed by botnet operators.
Beelzebub analysts identified the malware through their AI-native deception platform, which captured the complete attack chain and enabled comprehensive technical analysis of the botnet’s capabilities.
RondoDox v2 targets an extensive range of vulnerable devices spanning multiple vendor ecosystems and spanning over a decade of CVE history.
The exploit arsenal includes critical vulnerabilities such as CVE-2014-6271 (Shellshock), CVE-2018-10561 (Dasan GPON routers), CVE-2021-41773 (Apache HTTP Server), and CVE-2024-3721 (TBK DVR systems).
The malware demonstrates cross-platform flexibility by deploying 16 architecture-specific binaries including x86_64, multiple ARM variants, MIPS, PowerPC, and even legacy architectures like m68k and SPARC.
This comprehensive architecture support ensures maximum infection potential across diverse embedded systems and enterprise servers.
The command-and-control infrastructure operates on compromised residential IP addresses distributed across multiple ASNs, providing resilience and evasion capabilities that make traditional blocking strategies less effective.
Technical Infrastructure and Obfuscation Mechanisms
The dropper script employed by RondoDox v2 showcases sophisticated evasion and persistence techniques designed to bypass security controls and eliminate competing malware.
Upon execution, the script immediately disables SELinux and AppArmor security frameworks using commands such as setenforce 0 and service apparmor stop, creating an environment conducive to malicious activity.
The script then proceeds with aggressive competitor elimination, systematically killing processes associated with cryptocurrency miners like xmrig and other known botnet families including redtail.
This behavior ensures resource monopolization on infected systems while reducing detection probability by eliminating noisy competing malware.
The binary payload itself employs XOR-based string obfuscation with a key value of 0x21 to conceal critical configuration data from static analysis tools.
Decoded strings reveal command-and-control protocol implementations including “handshake” for C2 initialization and “udpraw” indicating DDoS capabilities.
The malware demonstrates anti-analysis awareness by checking for exit code 137, which indicates SIGKILL termination commonly employed by automated sandbox environments.
Detection of this condition causes immediate script termination, effectively evading many automated malware analysis systems.
#!/bin/sh
# bang2013@atomicmail.io
exec > /dev/null 2>&1
[ -t 0 ] && exit 0
for p in /proc/[0-9]*; do pid=${p##*/}; [ ! -e "$p/exe" ] && kill -9 $pid 2>/dev/null; done
setenforce 0
service apparmor stop
mount -o remount,rw /||sudo mount -o remount,rw /
Attak execution (Source – Beelzebub)
Persistence mechanisms leverage cron-based scheduling with @reboot directives, ensuring automatic execution following system restarts.
The malware attempts installation across multiple filesystem locations including /tmp/lib/rondo, /dev/shm/lib/rondo, and /var/tmp/lib/rondo, demonstrating awareness of different system configurations and permission structures.
Network communication occurs over TCP port 345 using a custom binary protocol that initiates with a “handshake” message to the primary C2 server at 74.194.191.52.
The malware spoofs User-Agent strings to appear as legitimate iPhone iOS 18.5 devices, further obscuring malicious traffic within enterprise environments.
DDoS capabilities include HTTP flood attacks mimicking gaming traffic, UDP raw socket operations, TCP SYN flooding, and protocol mimicry for OpenVPN, WireGuard, and popular gaming platforms including Minecraft, Fortnite, and Discord.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A bipartisan group of lawmakers said on Tuesday they have made slight progress toward ending the government shutdown, which is poised to become the longest in U.S. history after another failed vote will drag it into its 36th day.
Senators are getting closer to an agreement on a package of full-year appropriations bills for certain agencies and an accompanying stopgap bill to reopen the rest of government until a to-be-determined date. Lawmakers in both parties suggested many details still needed to be ironed out and there was not yet any broad agreement, but suggested the two sides were having ongoing conversations that have proven productive.
Sen. Gary Peters, D-Mich., declined to discuss the nature of the negotiations, saying only that they are in a pivotal moment.
“I don't want to characterize conversations,” Peters said. “We're in a sensitive time right now. It's important to say we're still talking and hopefully progress will be made.”
In a note of barely perceptible optimism, Sen. Mark Kelly, D-Ariz., said the Senate has inched closer to a resolution.
“Maybe we're moving.” Kelly said. “We're closer to the end of this than we are to the beginning.”
Sen. Susan Collins, R-Maine, said progress has been made in those conversations.
“The talks are more productive,” Collins said. “It's still a challenge, and there are issues to be solved.”
The senators are considering three full-year appropriations bills—to fund the Veterans Affairs Department, the Agriculture Department and the legislative branch—marking one-fourth of the twelve spending bills Congress must pass each year. The Senate approved a package earlier this year, but negotiators are working on a version that could clear the House and, potentially, be attached to a continuing resolution to temporarily fund the rest of government.
Republican senators noted that issues on the three-bill “minibus” have mostly been ironed out, though details remained under wraps. The Senate and House have passed vastly different fiscal 2026 appropriations bills, with the latter measures introducing significant cuts that the upper chamber largely avoided in its bipartisan legislative proposals.
Senate Democrats held a lengthy, two-plus hour meeting Tuesday afternoon, though they did not announce any strategy once it concluded.
“We had a very good caucus, and we're exploring all the options,” Senate Minority Leader Chuck Schumer, D-N.Y., told reporters after the lunch.Peters said after the meeting that conversations on how to end the shutdown were “still a work in progress,” adding the meeting was so long because “there was a lot to discuss.”
While the Senate rejected the House-backed continuing resolution that would fund agencies through Nov. 21 for the 14th time on Tuesday, it appears the legislation is no longer operative. Senate Majority Leader John Thune, D-S.D., said a new CR—for agencies not otherwise funded by full-year spending bills, should such a deal come together—with a later expiration has become necessary.
“The Nov. 21 deadline no longer makes a lot of sense, so clearly it would need to be extended,” Thune said. He added the new deadline was still being discussed but the goal was to avoid another year-long CR.
HONOLULU—Nine months into the second Trump administration, an acting defense secretary from President Trump’s first term said he thought “we’d be a lot further along” toward a nimbler military.
“I’m seeing a lot of marketing coming out of the department, and not a lot of outcomes,” Chris Miller said during a panel at the AFCEA TechNet Indo-Pacific conference last week.
Miller, who served as acting defense secretary from November 2020 to January 2021, said today’s Pentagon leaders are taking “an approach where if you have experience inside the Beltway, somehow you’re suspect and not worthy. And what I’m seeing are a bunch of like, quote-unquote brilliant business people that do not understand the plumbing of the most bureaucratic, Byzantine organization, probably since [the] Byzantine [Empire], and we’re losing opportunities because there’s a lack of focus.”
Amid a shift in national security strategies from the Indo-Pacific to the southern border, the former Special Forces colonel also criticized the push to focus on one adversary or challenge at a time. “Where’s the leadership? We spend a trillion dollars a year on national security. We can do more than one thing.”
Miller offered his comments during a discussion on ubiquitous digital surveillance in the region, where Sean Berg, a former deputy commander of Special Operations Command Pacific, said China “is already in phase three of that war: dominate” while “we still think of ourselves in phase zero: shaping.”
[[Related Posts]]
But when quantum decryption becomes practical, Berg said, China will be able to read untold oceans of once-secure messages that it has intercepted and filed away, then use them to gain unprecedented understanding of the patterns of U.S. forces.
“Whoever gets quantum first and is able to use that metadata to go back and figure out and predict every single move that the U.S. is about to make, whether it's an air crew landing and going to the same hotel, whether it is the fleet gearing up, and all the Copenhagen being bought out from 7-Eleven from a Ranger battalion,” he said.
The challenge of open data and ubiquitous surveillance is particularly relevant in the Pacific, where Rob Christian, the former command chief warrant officer for 311th Signal Command, pointed out that China “is the largest technically advanced enemy we’ve ever seen and could imagine, and they also own the majority of the infrastructure.”
Twenty years ago, operators could use burner phones, get local SIM cards, or even turn phones off to “hide in the noise.” But “hiding in the noise now is much more difficult when you think about the layer of AI and analytics on top of things that are out there and all the stuff we’ve dumped out there through our travels,” Christian said. “I think the challenge is slowly kind of morphing into, ‘OK, you’ve got to project, but you’ve also got to protect’.”
Panel moderator Mike Stokes, vice president of strategic engagements and marketing for Ridgeline, called the issue one of “digital signature warfare.”
“It’s almost its own domain, where we need to think about the adversary’s capabilities to collect on us and our ability to counter those threats as its own doctrine and policy,” Stokes said.
Berg said that one problem is that success looks like nothing is happening. Even if the U.S. government funded an identity-management campaign “that had all of the both offensive and defensive capabilities that would be integral in the technical surveillance to both protect and then understand how we’re being surveilled, the metric that would come out of that is nothing. Nothing would happen. Adversaries would not violate people’s sovereignty. There would be no crossing the border. There would be no economic coercion that would happen. There would be no bilateral manipulation of currency happening. And when you are fighting for dollars, telling the HASC or the SASC or the Appropriations Committee, ‘Yes, for the $1.3 billion, how much nothing would you like, Madam Senator?’ It’s a terrible argument to make.”
Additionally, the “bread and butter” of special operations is working with partner nations, and in every exercise, “you go into the [Joint Operations Center], you throw up your slides, and the first thing all the partners do is this,” he said, holding his phone up high above his head and pretending to take photos of the listening audience. “They start taking pictures of the slides and then sending them over Line or WhatsApp. That’s the end-to-end encryption on a Huawei backbone… The entire digital infrastructure and economic backbone of this entire theater is owned by the PRC.”
So what can commanders do? Christian suggested they “train and try…and then let yourself be exposed and fail forward, because that’s the only way your troops are gonna learn.”
Miller’s advice to commanders: “Stop saying you don't have any money. That's complete bull,” he said. “I do believe operational commanders should have a lot more money to work through their things, but…please, I'm begging commanders to stop saying that.” And, he said, meet with companies that may have solutions to their problems.
“Right now, all we’re trying to do is fight World War II in the Pacific. That’s exactly our operational concept,” Miller said. “There are pockets of brilliance, kids that get it, but you know, we’re still fundamentally organized to refight the Cold War, which really was refighting World War II in the Pacific. So…we’re fighting an uphill battle on that.”
.webp)
.webp)
.webp)
.webp)