1010.cx

  • Contractors fear retaliation if they try to recover shutdown costs

    ·

    Contractors who sell to the federal government have certain rights to recoup costs inflicted by the federal shutdown, but will they dare to exercise them?

    “After the DOGE actions to eviscerate USAID and pretty much punish many, many agencies and terminate thousands of contracts, I think the contractor community is tentative to actually enforce their rights,” David Dixon, an attorney at Pillsbury Winthrop Shaw Pittman, said Thursday as part of the law firm's DC Disrupted webinar series.

    Dixon said contractors are asking him a question that reveals the depth of their anxiety: Will the government retaliate for simply asking to be reimbursed for costs caused by the shutdown?

    The processes for recovering costs are well-established; they include administrative means such as “requests for equitable adjustment.” Contractors use this process to seek compensation when government delays or changes increase their costs or extend timelines.

    “These are regular administrative functions that every contractor should be aware of and should be able to process,” Dixon said. “Requesting an equitable adjustment should be a standard action that shouldn’t cause retaliation at all.”

    But contractors are currently caught in a legal and operational vise created by the Anti-Deficiency Act, which prohibits agencies from spending money that hasn’t been allocated.

    This means agency contracting officers cannot award new contracts, modify existing ones or exercise contract options.

    Dixon shared a story of a company that completed work for a Federal Supply Schedule renewal on the eve of the shutdown. The company was negotiating large orders with customers.

    But then the shutdown hit. The contracting officer could not exercise the option and the contract expired. The orders could not be awarded.

    “What do they do with their employees now that they can’t get this contract?” Dixon said.

    That is just one example of the mounting losses contractors face. Financial damage can accumulate in multiple ways:

    • Idle labor costs.
    • Storage expenses if deliverables stack up in warehouses.
    • Engineering delays as teams wait for approvals.
    • Contract termination risks because missed deadlines can trigger contract cancellations.

    Contractors may have mechanisms to recovers some costs, but the Trump administration has created an atmosphere of fear.

    “There was a belief among folks in the administration at the beginning of this shutdown that they could effectively create a little bit of pain for Democratic constituencies by canceling government funding, particularly grants,” said Craig Saperstein, another Pillsbury attorney.

    The Office of Management and Budget made early moves to focus on “what we would think of as blue states or blue areas of states,” he said.

    The tactic has brought little pressure on Democrats to come to the negotiating table. But Saperstein said the message to contractors is clear – the Trump administration is willing to use federal funding as a political weapon.

    "A lot of times clients are finding they don’t want to rock the boat because the landscape’s just too uncertain,” said Aaron Ralph, a third Pillsbury attorney. “They have other awards they want to continue performing on.”

    Despite the fear, contractors should not abandon their rights.

    Dixon laid out three steps contractors should be taking:

    1. Understand your contracts. Review the clauses that govern suspension of work, stop work orders, delay of work, and changes. Make sure your contract staff understand these clauses.
       
    2. Document everything. Add memos to files noting what the government was supposed to do, when they did not do it and what the effect was. Accounting line items should track costs needed to be recovered.
       
    3. Consider timing strategically. Contracts require that companies notify contracting officers within 30 days if they need to make a request for equitable adjustment. Companies should also keep in mind that the Contract Disputes Act gives contractors six years to submit claims from the date they accrue. As Dixon said, "it's not the end of the world" if the customer does not negotiate.

    “If you are fearful right now because of the uncertainty in this administration, you should make the request for equitable adjustment as soon as possible,” he said. “But you can wait it out a little bit if you need to.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • What ‘House of Dynamite’ gets right and wrong about nuclear command and control

    ·

    I have studied nuclear weapons for my entire adult life and I have watched more than a hundred movies with nuclear weapons in them—from Dr. Strangelove to Austin Powers, from The Day After to several Mission Impossible movies. I also served as Special Assistant to the President of the United States and Senior Director at the National Security Council responsible for things like nuclear arms control and policy. In short, I am a nuclear nerd and know a lot about nuclear weapons.

    So I sat down to watch the new Netflix movie A House of Dynamite by Kathryn Bigelow knowing a few things about nuclear weapons in the real world and in the movies. And overall, I liked the movie it because it gets so many things right. Yet at the same time, this is not a movie for experts and nuclear wonks to love, because it gets so many other things wrong.

    But as we say in government memos, the bottom line up front is they do get right perhaps the most important message: nuclear operators and officials like to project that they will always have perfect knowledge, get every decision right, and have every answer at their fingertips. In reality, it is certain that officials will not know enough, that they will get a lot of things wrong, and that the answer all along has been: do everything you can now to avoid a world where nuclear weapons can ever be used.

    What it does well: The movie does very well on the process and the technology. They make the Nuclear Handbook—the binder with options for nuclear launches and strikes—look like the actual Nuclear Handbook. They make the offices for the Secretary of Defense, for the commander of U.S. Strategic Command, and even the President’s deep underground nuclear bunker look very authentic. A few liberties are taken, but the access they got to the White House and the facilities help it look and seem as realistic as any movie I have ever seen.

    If I get one question more than any other from friends and family about my time at the White House, they want to know if it looks like The West Wing. And they are always disappointed when I say no: the Situation Room in the TV show was awesome, but the facilities in House of Dynamite are much closer to the truth.

    Another thing the movie does well is portray the reality that America’s ability to shoot down incoming missiles is not very good. Perhaps my favorite line in the whole movie is from the defense secretary who says “$50 billion and the best you can do is a coin toss.” For analysts of U.S. missile defense efforts, we wish it were only $50 billion and as good as a 50-percent chance of intercepting an incoming missile.

    What it does poorly: There is one major flaw in the movie, and that is the stereotype that the military leaders will be gung-ho to launch, and only some plucky civilian will be able to slow them down. This is neither how I have found the military leaders with whom I have worked, nor does the scenario painted in the movie justify the positions taken in the plot. Without giving anything away, the danger the U.S. faces is not one that would justify or likely even lead a gung ho military advisor telling the President he needed to launch any immediate retaliation.  It is a shame, because some slight changes in the script could have made that stark reality and the dangerous premise of rapid launch, hair trigger responses more realistic. I will be curious to hear from laymen friends and family if they think that plot device misses the mark.

    Lastly, the script makes some officials and personnel look great—from the situation room staff to the Secret Service—but makes others look weak and dithering. Sure, people can have off days, and a crisis can try even the best of minds. But trotting out the trope of people in high positions who do not take their jobs seriously, who do not know what they are supposed to be doing, and relying on that for a plot device is a little offensive to me. In reality, even the best people at their best in a nuclear crisis (or even a simulation) can make mistakes, misspeak, or get it wrong. An audience could come away from the film thinking a competent staff and president might have done better. Maybe. But maybe not.

    In academia and think tanks, we debate nuclear strategy and doctrine, programs and numbers in a cold manner filled with certainty and conviction. There is a longstanding appreciation that discussing weapons of mass destruction capable of destroying humanity is often only possible by adopting cold, distanced language peppered with phrases like “collateral damage” and “single-shot kill probabilities.” So it is not surprising that in those debates, there is often an underlying assumption of ideal conditions, reliable communications, complete knowledge of the scenario, and confidence that decisions made will be well executed.

    In House of Dynamite, no one can find the National Security Advisor. The secretary of defense drops off the call unexpectedly at a key moment. No one knows why the network of satellites the U.S. relies on to detect launches did not see the missile, so no one is really sure who it belongs to.  On the basis of no evidence, they assume the missile is nuclear. And so the plot centers quietly but aptly on a key reality that often the experts and officials themselves forget or choose to ignore: people and knowledge are often imperfect. We assume all of the fingers on nuclear-launch buttons are rational, that phones and computers will work when needed, that people will be awake and around when called upon, and that on a sunny weekday, the president will be able to speak with and get informed advice from the right people in 20 minutes or less.

    The reality is that time is limited and perfection elusive, and so some changes have been made to the nuclear system over the past 20 years. Officials and advisors have worked hard to reduce the need to respond to almost any attack immediately and to give the president or surviving successor time to make more informed decisions. But even with these changes, more must be done to create more reliable command-and-control systems, to ensure the ability of the government to survive an attack, to ensure leaders can talk to each other in crisis, and do more of it before a crisis strikes, to avoid nuclear weapons from ever being launched. It is a good thing that the United States and a number of other nuclear states have stated that a nuclear war cannot be won and must never be fought. It would be better if we believed it, and stopped the ongoing effort to prepare for one. Over the next 30 years, the U.S. alone will likely spend more than $2 trillion on nuclear weapons and missile defenses. Yet we lack a good sense of what might actually deter Russia, China, North Korea, or Iran from ever using a nuclear weapon against the U.S. or its friends and allies.  By building more weapons and underinvesting in the real security that comes from nuclear risk reduction and stability, we ensure that the next generation too will be forced to live in a House of Dynamite.

    Jon Wolfsthal is is the Director of Global Risk at the Federation of American Scientists.  

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anduril’s drone wingman makes first flight, following software delays

    ·

    Anduril’s robot wingman has notched its first flight Friday, more than a month after the neoprime defense contractor blamed software woes and a push to make the inaugural takeoff semi-autonomous for the delay. 

    The takeoff happened at a testing location in California, the Air Force said in an emailed news release. Anduril’s prototype for the service’s combat collaborative combat aircraft competition has now joined one from General Atomics  going from concept to first flight in less than two years.

    “This milestone demonstrates how competition drives innovation and accelerates delivery,” said Air Force Secretary Troy Meink in a statement. “These flights are giving us the hard data we need to shape requirements, reduce risk, and ensure the CCA program delivers combat capability on a pace and scale that keeps us ahead of the threat.”

    After General Atomics announced their successful first flight in late August, Anduril executives said in September that they wanted to make its first drone wingman flight test semi-autonomous, and blamed the delay on software problems. 

    Friday’s first flight was semi-autonomous, the company confirmed, and it built the software for the CCA. General Atomics’ drone wingman flight in August was not semi-autonomous.

    “YFQ-44A was not designed to be a remotely-piloted aircraft, and that is not how we are operating it — from first flight and forever onward,” an Anduril news release said. “All of our taxi and flight tests have been and will continue to be semi-autonomous. This is a new age of air power; there is no operator with a stick and throttle flying the aircraft behind the scenes.” 

    General Atomics spokesperson C. Mark Brinkley congratulated Anduril on its milestone. 

    “This is a really small aviation community, and we all have friends and professional relationships on both sides, so it's good to see their hard work rewarded with success,” Brinkley said. “It's been a great week for the Air Force CCA program. Congratulations all around."

    The Air Force’s competitive first increment production design is scheduled to be awarded in 2026.

    Last month, Lockheed Martin announced it aimed to fly a CCA candidate of its own by 2027 which may compete in future competitions. Additionally, Boeing announced earlier this month it was designing a tiltrotor drone wingman to support the Army’s helicopter fleet. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Stolen Credentials and Valid Account Abuse Fuel the Financially Motivated Attacks

    ·

    , ,

    Throughout the first half of 2025, financially motivated threat actors have shifted their approach to intrusions, abandoning traditional implant-heavy methods in favor of a more cost-effective strategy.

    Rather than deploying sophisticated malware payloads, attackers are leveraging stolen credentials and valid account access to establish persistence within target networks across multiple industries.

    The FortiGuard Incident Response team responded to dozens of engagements, revealing a consistent pattern where adversaries gain initial access through compromised credentials, which are either harvested via phishing campaigns, purchased from Initial Access Brokers, or obtained through password reuse and infostealer malware distribution.

    Fortinet analysts identified that attackers exploit three primary initial access techniques to compromise networks.

    External remote services, particularly VPN infrastructure, serve as the most prevalent entry point, allowing adversaries to authenticate using stolen credentials and progress laterally through victim environments.

    Additionally, threat actors exploit public-facing applications using n-day vulnerabilities to deploy legitimate remote management tools such as AnyDesk, Atera, Splashtop, and ScreenConnect.

    Compromised credentials purchased from underground markets range from $100 to $20,000 depending on organizational size and geographic location, making this approach economically attractive for threat actors operating across developed and emerging economies.

    Lateral Movement and Persistence Tactics

    Once inside networks, Fortinet researchers noted that adversaries employ manual, operator-driven lateral movement using built-in tools including Remote Desktop Protocol (RDP), Server Message Block (SMB), and Windows Remote Management (WinRM).

    This manual approach enables attackers to blend with legitimate administrator activity, significantly complicating detection efforts.

    Victim Industries (Source – Fortinet)

    Adversaries maintain persistence by installing their own instances of remote access tools and leveraging privileged credentials obtained through Mimikatz execution and Zerologon exploitation for elevated account access.

    Data exfiltration occurs through direct file transfers via RDP and RMM interface drag-and-drop capabilities, leaving minimal forensic artifacts compared to conventional web-based exfiltration methods.

    In observed cases, attackers configured VPN infrastructure without multi-factor authentication, granting unrestricted network access and enabling rapid encryption of hypervisor infrastructure for ransomware deployment.

    This low-complexity, high-return methodology allows financially motivated adversaries to operate undetected for extended periods while avoiding the detection signatures commonly associated with malware-centric intrusions.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Stolen Credentials and Valid Account Abuse Fuel the Financially Motivated Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ‘Cautious’ optimism follows top warship builder’s productivity, workforce wins

    ·

    The country’s largest builder of warships is keeping more of its shipyard workers after boosting wages and hiring better-qualified recruits, said HII CEO Chris Kastner on Thursday. 

    “From a labor perspective, we have hired over 4,600 shipbuilders year-to-date and our retention rates have improved at both shipyards. At Newport News, we’ve seen an increase in experienced hires following the wage investment this summer and increased hiring from regional workforce development pipelines, which provides more proficient incoming shipbuilders,” Kastner said during the company’s third-quarter earnings call. “These are important steps to stabilize and level up the experience of our workforce.” 

    Earlier this year, HII said it would hire fewer new or green shipyard workers and increase pay to attract more seasoned talent—an effort supported by the Navy’s maritime industrial base funding. So far, the strategy seems to be paying off at HII’s Newport News yard in Virginia; the company is still in union negotiations at its Ingalls facility in Mississippi. Kastner was light on details when asked about wage increases for workers in the pending agreement.  

    “We’re in discussions with the union at Ingalls. That union agreement expires next year. We’re hoping to get that in place [by the] beginning of next year—maybe [the] end of this year,” he said. “It makes it a bit more complicated because we have to engage with the union to get that done.” 

    HII is also on track for an overall 15 percent throughput increase compared to 2024—thanks in part to labor improvements and more outsourcing. Kastner said wage bumps at Newport News reduced attrition and led to hiring of more experienced workers. 

    “It’s been pretty positive at Newport News and the effect of those wages has been positive and in reduced attrition. We’re probably most excited about repositioning the experience level of the workforce, where we have more experience,” he said. “We’re also hiring about 50 percent out of what we call the pipeline, which are the regional workforce development centers, the apprentice schools, and the high school programs, which is very positive. Newport News labor is doing well, kind of cautiously optimistic and we hope to keep it going.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Beware of Malicious ChatGPT Apps That Records Users Action and Steals Sensitive Data

    ·

    , ,

    The explosive growth of artificial intelligence has created an unexpected security threat as cybercriminals exploit ChatGPT’s popularity through counterfeit mobile applications.

    Recent security research uncovered sophisticated malicious apps masquerading as legitimate ChatGPT interfaces, designed to harvest sensitive user data and monitor digital activities without consent.

    These fraudulent applications have infiltrated third-party app stores, targeting users seeking convenient access to AI-powered chatbots.

    The malicious applications employ convincing branding techniques that mirror authentic ChatGPT interfaces, complete with recognizable logos and functional designs.

    Once installed, these trojanized apps execute hidden surveillance routines while maintaining the appearance of working AI assistants.

    The threat intensifies as millions worldwide download unofficial AI applications from unverified sources, unaware of embedded spyware compromising their devices.

    Appknox analysts identified these malicious ChatGPT clones during comprehensive mobile security research examining AI-themed applications across distribution platforms.

    The security team discovered that threat actors weaponize brand trust as an attack vector, exploiting widespread ChatGPT familiarity to compromise user devices.

    Analysis revealed these counterfeits implement full malware frameworks capable of persistent surveillance and credential theft.

    Technical examination showed network communications masked through domain fronting using legitimate cloud infrastructure from Amazon Web Services and Google Cloud.

    This sophisticated obfuscation allows malicious traffic to blend with normal communications, evading security detection.

    Infection Mechanism and Data Exfiltration

    The malware deployment begins with convincing app store listings featuring polished graphics and descriptions promising enhanced ChatGPT functionality.

    Upon installation, malicious applications request extensive permissions including SMS access, contact databases, call logs, and account credentials.

    These requests appear legitimate, masking true surveillance capabilities. Analysis revealed code obfuscation using the Ijiami packer to encrypt malicious payloads.

    Decompiled packages contained folders labeled “secondary-program-dex-jars” housing executables that decrypt after installation—characteristic trojan loader signatures.

    The malware maintains persistence through embedded native libraries ensuring background execution continues after users close the interface.

    Network logs demonstrated systematic exfiltration targeting one-time passwords, banking verification codes, and address book contents.

    Stolen credentials enable attackers to intercept multi-factor authentication and infiltrate corporate systems. Researchers noted these techniques parallel established spyware families including Triout and AndroRAT.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Beware of Malicious ChatGPT Apps That Records Users Action and Steals Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI Unveils Aardvark: GPT-5 Agent That Finds and Fixes Code Flaws Automatically

    ·

    OpenAI has announced the launch of an “agentic security researcher” that’s powered by its GPT-5 large language model (LLM) and is programmed to emulate a human expert capable of scanning, understanding, and patching code. Called Aardvark, the artificial intelligence (AI) company said the autonomous agent is designed to help developers and security teams flag and fix security vulnerabilities at

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data

    ·

    , ,

    In mid-2025, researchers discovered a sophisticated campaign orchestrated by the Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) targeting organizations relying on Motex LANSCOPE Endpoint Manager.

    The attackers exploited a previously unknown zero-day vulnerability tracked as CVE-2025-61932, which grants remote adversaries the ability to execute arbitrary commands with SYSTEM privileges.

    This marks the group’s continued targeting of Japanese asset management software, following their successful exploitation of SKYSEA Client View in 2016.

    JPCERT/CC publicly disclosed the vulnerability on October 22, 2025, prompting urgent action from organizations worldwide.

    The campaign reveals a meticulously orchestrated attack chain combining multiple malware families and legitimate tools to establish persistence and exfiltrate sensitive information.

    Sophos researchers identified that the attackers leveraged the zero-day to achieve initial access on vulnerable internet-facing LANSCOPE servers, then pivoted to lateral movement within compromised networks.

    The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-61932 to its Known Exploited Vulnerabilities Catalog the same day the advisory was published, confirming active exploitation in the wild.

    Comparison of internal function names in the 2023 (left) and 2025 (right) Gokcpdoor samples (Source – Sophos)

    Sophos analysts identified the Gokcpdoor malware as the primary command and control mechanism employed throughout this operation.

    The 2025 variant represents a significant evolution from earlier versions, discontinuing support for the KCP protocol while implementing advanced multiplexing communication capabilities using third-party libraries for command-and-control communications.

    Advanced Persistence Through Malware Multiplexing

    Sophos researchers identified two distinct Gokcpdoor variants tailored for specific operational purposes.

    The server variant maintains open listening ports specified within its embedded configuration, typically using ports 38000 or 38002, to establish incoming remote access channels.

    Execution flow utilizing OAED Loader (Source – Sophos)

    The client variant, conversely, initiates connections to hard-coded command and control servers, establishing secure communication tunnels that function as persistent backdoors.

    To complicate forensic analysis and evade detection, the threat actors deployed the OAED Loader malware, which injects payloads into legitimate executables according to embedded configurations.

    On certain compromised hosts, the attackers substituted Gokcpdoor entirely with the Havoc command and control framework, demonstrating operational flexibility.

    For data exfiltration and lateral movement, BRONZE BUTLER abused legitimate tools including goddi (Go dump domain info), remote desktop applications, and 7-Zip archiving utility.

    The attackers further leveraged cloud storage services including io and LimeWire accessed through web browsers during remote sessions, successfully stealing confidential organizational data.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack

    ·

    A suspected nation-state threat actor has been linked to the distribution of a new malware called Airstalk as part of a likely supply chain attack. Palo Alto Networks Unit 42 said it’s tracking the cluster under the moniker CL-STA-1009, where “CL” stands for cluster and “STA” refers to state-backed motivation. “Airstalk misuses the AirWatch API for mobile device management (MDM), which is now

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Venezuela targets picked?; STRATCOM nom pressed on tests; USAF fighter plan; New Guard quick-reaction forces; And a bit more.

    ·

    The Trump administration has chosen military installations inside Venezuela to attack, “and the strikes could come at any moment,” the Miami Herald reported Friday—hours after the Wall Street Journal first reported the available targeting. 

    The attacks “will seek to destroy military installations used by the drug-trafficking organization the U.S. says is headed by Venezuelan strongman Nicolás Maduro and run by top members of his regime,” with the goal of “decapitat[ing] the cartel’s hierarchy,” the Herald reports. 

    “If President Trump decides to move forward with airstrikes…the targets would send a clear message to Venezuelan leader Nicolás Maduro that it is time to step down,” U.S. officials told the Journal.

    Update: U.S. military officials “do not know precisely who they have killed in multiple military strikes against alleged drug smuggling boats in the Caribbean” since the attacks began on Sept. 1, Politico reported Thursday following a classified briefing for lawmakers in the House Armed Services Committee. 

    Notable: “The briefing came just one day after Democratic lawmakers were shut out of a similar closed-door Senate meeting on the boat strikes,” the New York Times reports. 

    Sen. Mark Warner of Virginia, the senior Democrat on the Senate Intelligence Committee: “When an administration decides it can pick and choose which elected representatives get the understanding of their legal argument of why this is needed for military force and only chooses a particular party, it ignores all the checks and balances.” Read on, here.

    Additional reading: “UN human rights chief says US strikes on alleged drug boats are ‘unacceptable,’” the Associated Press reported Friday. 

    STRATCOM nominee takes heat hours after Trump’s nuclear-test bombshell. The morning after President Donald Trump vowed to “start testing our Nuclear Weapons,” his pick to lead U.S. Strategic Command fielded questions from senators who wondered what the president meant and what the nominee planned to do about it. Vice Adm. Richard Correll, a submariner and STRATCOM’s deputy commander, vows to give his best military advice. Defense One’s Lauren C. Williams reports.

    ICBM test planned? It appears the U.S. military is about to test an unarmed intercontinental ballistic missile over the Pacific next week, as it does periodically, Dutch researcher Marko Langbroek flagged on social media Friday. 

    New: SpaceX tipped to win $2B for Golden Dome satellites. Wall Street Journal: “The funding was included in the tax-and-spending bill that Trump signed in July, but wasn’t publicly linked to a contractor. The planned ‘air moving target indicator’ system could eventually field as many as 600 satellites,” according to “people familiar with the matter.” More, here.

    Air Force: We need more money to buy the fighter jets we need. Clarifying a report sent to Congress last week, a service official said the Air Force plans to have nearly 1,400 manned tactical aircraft by 2030, about one-quarter more than the 1,160 it has today. But it would need 1,558 to achieve its missions with high confidence and low risk—a goal that would require more funding from Congress. Defense One’s Thomas Novelly reports from the Thursday briefing, here.

    Related: The Senate confirmed fighter pilot Gen. Kenneth Wilsbach to be the Air Force’s next chief of staff. Wilsback will replace Gen. David Allvin, who  unexpectedly announced his retirement in August, halfway through his customary four-year term. Task & Purpose reports, here.

    Moving into generals’ houses. Political appointees Stephen Miller, Kristi Noem, Defense Secretary Pete Hegseth, and Secretary of State Marco Rubio have moved onto military bases, “where they are shielded not just from potential violence but also from protest,” the Atlantic reported on Thursday. The New York Times has more, here.

    Coverage continues below…

    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1956, the United Kingdom and France began bombing Egypt to force the reopening of the Suez Canal.

    Developing: The National Guard is scrambling to staff and train entirely new “quick reaction forces” by the end of the year, Aaron Glantz of the Guardian reported Wednesday. The effort began in earnest on October 8, when National Guard Army Maj. Gen. Ronald Burkett quietly launched the initiative, which extends from an executive order Trump signed on August 25.

    This means every state is now “required to train 500 national guard members, for a total of 23,500 troops nationwide,” Glantz writes. That’s a sizable uptick from administration plans two months ago reportedly featuring just two groups of 300 troops stationed in Alabama and Arizona as a “Domestic Civil Disturbance Quick Reaction Force.”

    Each state is expected to “be able to deploy a fourth of all their troops within eight hours and all of those assigned to the units within a day,” AP reported Thursday, citing the new memo. “To help with that goal, units will be provided 100 sets of crowd control equipment as well as two full-time trainers by the National Guard Bureau.” 

    Since Guard troops are not trained in handling civil disturbances, they will need to attend special courses in “crowd management techniques,” “domestic civil disturbance training,” and “proper use of baton and body shields,” the memo says. 

    Worth noting: It’s not yet clear exactly how these forces will be dispatched since the U.S. military is forbidden by law from conducting law enforcement activities domestically. The Trump administration has already run afoul of that 150-year-old law with its June deployments of Marines and Guard troops to help immigration enforcement operations in the Los Angeles area—an assignment later found by District Judge Charles Breyer to be in violation of U.S. law. The White House appealed that decision, which moved the case to the 9th Circuit Court.  

    Historian reax: “The establishment of a domestic quick reaction force to quell civil disturbances at a time when there are no civil disturbances that can’t be handled easily by existing law enforcement suggests the administration is expecting those conditions to change,” warned Heather Cox Richardson of Boston College, writing Thursday. 

    Update: Despite the government shutdown, U.S. troops will receive their  next paycheck. Newsweek reported this week “The money comes from multiple sources, including $2.5 billion redirected from the administration’s summer tax cut legislation, $1.4 billion from a military procurement account and another $1.4 billion from research and development.”

    See also: “Who is Timothy Mellon, the billionaire who reportedly donated $130M to help pay troops?” via The Hill, reporting Monday. 

    Additional reading: 

    Lastly this week, Ukraine isn’t just hurling attack drones; they’re waging real robot warfare, Defense One’s Patrick Tucker reported Thursday after the release of a recent report from the London-based Royal United Services Institute. 

    What’s going on: “Political developments in Washington interrupted the provision of military-technical assistance, disrupting Ukraine’s ability to coherently plan the equipping of its forces with its international partners. As a result, Ukraine doubled down on a method which delivered results and was under its control: drones,” RUSI’s Jack Watling writes. “Two dedicated UAV regiments, and two non-standard brigades of the Armed Forces of Ukraine…are pioneering the use of novel equipment,” as in air and ground drones.

    Parallel to this, the U.S. and other European militaries are developing new battle-robot concepts around Ukraine’s experiences, Tucker reports. NATO and Ukraine recently tested new ways to counter UAVs. This effort, led by the NATO-Joint Analysis, Training And Education Centre, “aims to keep the alliance on the cutting edge and to support Ukraine,” a NATO official said. But the war in Ukraine has revealed the obsolescence of the way the large militaries of NATO members do many things, from force design to acquisitions to battlefield maneuver. Continue reading, here. 

    Frontline dispatch: Ukrainian soldiers have turned their drone war with Russia into an incentivized game, the New York Times reported Friday. “Wound a Russian soldier? Eight points. Kill one? That is good for 12. A Russian drone pilot is worth more: 15 points for wounding one, and 25 points for a kill. Capturing a Russian soldier alive with the help of a drone is the jackpot: 120 points.”

    How it works: “Teams compete for points to acquire Ukrainian-made gear, including basic surveillance drones and larger drones carrying powerful explosives, through an internal Amazon-style weapons store called Brave1 Market…The more points a unit gets, the better stuff it can buy, ensuring that resources are directed to the teams that best use them.” Story (gift link), here. 

    For your ears only, Patrick Tucker unpacked what he learned during a recent trip to Latvia and Estonia regarding the European Union’s emerging plans for a “drone wall” to defend against an increasing number of Russian aerial incursions. Find that podcast episode on our site, at Spotify, or wherever you listen to podcasts. 

    And here are two leftover links we didn’t get to this week, but you might still like to read over the weekend: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶