1010.cx

  • The D Brief: European leaders visit Trump; Summit reax; Armed troops to patrol DC; DOD’s battery plans; And a bit more.

    ·

    White House officials won’t yet share publicly what they learned during Friday’s private summit between Donald Trump and Vladimir Putin in Alaska. That information is likely to trickle out this week after an urgent and highly unusual entourage of European leaders descends on Washington for talks with Trump and Ukrainian President Volodymir Zelenskyy. 

    But Trump alluded to some likely aspects, including conceding Crimea to Russia and blocking Ukraine’s path to membership in the NATO alliance, writing Sunday evening on social media. 

    Summit recap: After talking with Putin, Trump announced he’s dropped his demand for a ceasefire and insisted direct negotiations for a peace agreement were the best way forward. Trump’s main leverage—additional sanctions against Russia and its petroleum customers like India—would likely end peace negotiations and continue the war for at least 12 to 18 months, Secretary of State Marco Rubio said on “Face the Nation” from CBS News on Sunday. 

    Trump reax: “Because of what happened today, I think I don’t have to think about [further sanctions on Russia] now. I may have to think about it in two weeks or three weeks or something, but we don’t have to think about that right now,” the president told Sean Hannity of Fox shortly after his meeting with Putin. 

    Putin’s most consistently-reported demand is full control of Ukraine’s Donetsk oblast, analysts at the Institute for the Study of War write. However, ISW cautions, “Ukrainian forces would not be able to conduct a safe and orderly withdrawal from unoccupied Donetsk Oblast in accordance with Putin's demand without a full ceasefire across the entire theater.” Thus, “A Ukrainian withdrawal would likely result in large force concentrations along major Ukrainian thoroughfares and defensive structures that Russian aviation, drones, and artillery would likely target upon the expiration of a ceasefire.”

    Notable: Without a Ukrainian withdrawal, “Seizing the remainder of Donetsk Oblast would likely be a difficult and years-long effort for Russian forces rather than a quick effort as Putin likely aims to portray, as Russian forces remain unable to secure operationally significant advances or advance faster than foot pace,” ISW writes. 

    Also worth noting: Putin’s reported “offer of a Russian law forbidding a future invasion of Ukraine is not credible because Russia has already twice broken previous binding international commitments not to invade and because Putin has shown that he can freely change Russian law as he desires,” ISW warned Sunday. 

    Visiting Washington today: European Commission president Ursula von der Leyen, French president Emmanuel Macron, Italian prime minister Giorgia Meloni, German chancellor Friedrich Merz, NATO chief Mark Rutte, British prime minister Keir Starmer, and Finnish president Alexander Stubb.

    Second opinions: All that transatlantic travel “suggests that something went very wrong in Alaska if this many European leaders are coming to Washington on short notice,” former Naval War College professor Tom Nichols wrote on social media. 

    No cards for Trump? “No wonder all of Trump’s negotiating deadlines for Russia have passed, to no effect, and no wonder the invitation to Anchorage produced no result,” Anne Applebaum writes for The Atlantic. “Trump, to use the language he once hurled at Zelensky, has no cards.” 

    View from London: “With Russia’s economy on the ropes, Trump remains bafflingly unwilling to apply the maximum economic pressure on Russia that would mean summits like those held yesterday are more likely to yield the success Donald Trump craves,” said Tom Keatinge, Director of the Centre for Finance and Security at the London-based Royal United Services Institute.

    “Putin may have successfully neutralised the idea of a ceasefire by hinting at a broader deal he knows will take time to negotiate,” said RUSI’s Matthew Savill. “If Putin cannot bait Trump into a further round of bilateral strategic summits, he will be content if Trump grows tired of the whole thing and effectively walks away,” said RUSI's Director of International Security Neil Melvin.

    Washington reax: “Putin got everything he wanted: a photo op legitimizing his war crimes, no ceasefire, and no sanctions or new weapons for Ukraine,” said Democratic Sen. Chris Murphy of the Foreign Relations Committee. 

    Murphy’s SFR colleague Jeanne Shaheen of New Hampshire: “Trump promised to end this war on Day One and instead he has let Putin cross one red line after another with impunity. No deal is better than a bad deal,” Shaheen said in a statement. “Trump’s continued reluctance to hold Putin to account means that Ukrainians will continue to die, Putin continues to act without consequences and our deterrence against would-be aggressors in Beijing is weakened.”

    Republican Sen. Lindsey Graham says the war could be over by Christmas. “If in fact there is a trilateral meeting between President Trump, President Zelensky and Putin, then I am cautiously optimistic that this war will end well before Christmas,” the South Carolina lawmaker mused this weekend. “If that meeting fails to materialize, I think President Trump may have to go all in to punish those who buy cheap Russian oil and gas, propping up Putin’s war machine,” he said. 

    Senate Armed Services Committee ranking member Jack Reed, D-Rhode Island: “Validating [Putin’s] illegal landgrab in Ukraine and legitimizing Russia’s invasion would be a bad precedent that sets the stage for future conflict. Instead of caving to Putin, the U.S. should join our allies in levying tough, targeted new sanctions on Russia to intensify the economic pressure…Trump must not abandon the Ukrainian people and cater to Russian aggressors, or it will only embolden America’s adversaries and invite more aggression.”

    Latest from Ukraine: Russian strikes overnight killed seven Ukrainians in Kharkiv, “the youngest being a girl who is only a year and a half old, and dozens have been injured, including children,” President Zelenskyy said on social media Monday. Elsewhere “In Zaporizhzhia, missile strikes injured 20 people and killed three,” he added, calling the actions “a demonstrative and cynical Russian strike” because “They are aware that a meeting is taking place today in Washington that will address the end of the war.”

    For the DC insider: There is a “Tiny White House Club Making Major National-Security Decisions,” veteran reporters Missy Ryan, Jonathan Lemire, Nancy Youssef, and Michael Scherer wrote Friday for The Atlantic. The “core” team includes Vice President JD Vance, Marco Rubio, and Susan Wiles, while “Stephen Miller plays a key role on issues related to homeland security,” and real estate billionaire Steve Witkoff watches issues affecting Russia and Israel. Meanwhile, “on military matters, the president pulls in [Pete] Hegseth and General Dan Caine, the chairman of the Joint Chiefs of Staff.”

    The perks: “The more centralized setup allows Trump’s impulses—his disregard for historic alliances, his love of dealmaking, and his focus on perceived abuses of American largesse—to drive U.S. policy.” 

    The downside: “By discarding a process designed to surface different views and analyze moves from all sides, [Trump] has increased the risk of unintended consequences.” Read the rest (gift link), here. 

    Related reading: 

    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1965, some 5,000 Marines assaulted a Viet Cong base in Operation Starlite, the U.S. military’s first large offensive action of the Vietnam War.

    Trump 2.0

    Update: The National Guard will carry weapons while deployed in the nation’s capital over the next several weeks, the Wall Street Journal reported Saturday, two days after the Army had announced the troops’ weapons would “remain in the armory” unless or until needed. 

    Rewind: Trump ordered the troops to Washington ostensibly to tame Washington’s allegedly out-of-control crime, according to Trump—though actual crime in the city is at its lowest point in decades.

    Historian’s reax: “Under the guise of fighting crime, the administration has quite literally turned guns on the American people,” observed Heather Cox Richardson of Boston College, writing Sunday.  

    Sen. Chris Murphy, D-Connecticut: “Trump's takeover of DC policing is just a stunt to distract people (and the press!) from his refusal to release the Epstein files and his upcoming massive health insurance premium hikes,” he told NBC on Sunday. 

    ICYMI: “This is not what the military of our country was designed to do, at all,” said one soldier assigned to protect federal agents in California two months ago, speaking to Shawn Hubler of the New York Times in mid-July. “The moral injuries of this operation, I think, will be enduring,” they predicted of the allegedly heavy-handed military response just before summer began. 

    Mapped: See where Trump’s forces are patrolling inside Washington, D.C., via this interactive from the Washington Post. Peter Baker of the New York Times writes, “Spoiler alert: They're not where the crime is.”

    New: The Republican governors of Ohio, West Virginia, and South Carolina say they’re sending hundreds more National Guard troops to D.C. “West Virginia said it was deploying 300 to 400 Guard troops, while South Carolina pledged 200 and Ohio says it will send 150 in the coming days, marking a significant escalation of the federal intervention,” the Associated Press reported, and called the deployments “a power play that the president has justified as an emergency response to crime and homelessness, even though city officials have noted that violent crime is lower than it was during Trump’s first term in office.” 

    • By the way: A combined 43 cities in those three states have higher rates of violent crime than Washington, D.C., as Philip Bump illustrated Saturday with data from the FBI. 

    Update: The man charged with assaulting a Border Patrol agent with a sandwich is an Air Force veteran, reports Military-dot-com. Sean Charles Dunn, 37, who was charged with a felony and arrested Wednesday after allegedly throwing a Subway sandwich was once an active-duty staff sergeant, a cyber transport systems specialist who entered the service in July 2006 and separated in May 2011. A bit more, here.

    And in hoagie-hurler jokes: “Federal agent assaulted by sandwich admitted to Mayo Clinic.” (h/t @XBradTC)

    ICE industrial complex update: The Washington Post obtained White House plans to double what is already expected to be “the largest immigrant detention system in the world” here in the U.S.—with a capacity of around 107,000 people with 125 new or expanded detention camps this calendar year. “The expansion is funded by an unprecedented $45 billion detention budget approved last month by Congress,” and largely spread across Texas, Louisiana, California and Georgia.

    Notable: “Geo Group, ICE’s largest contractor and a company with close ties to the Trump administration, is in line to receive at least nine new or modified detention contracts with a total estimated value of over $500 million a year, the documents show…CoreCivic, the other largest private prison operator, would receive at least 12 contracts worth more than $500 million a year under the ICE plan—also roughly doubling that company’s annual revenue from ICE.”

    Also: “The government is also planning to dramatically expand its capacity for detaining parents and children in what could amount to the nation’s largest family detention program in decades,” the Post adds. Read on, here. 

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Technical Details of SAP 0-Day Exploitation Script for RCE Revealed

    ·

    , ,

    Cybersecurity researchers have unveiled the inner workings of an exploit script targeting a critical zero-day vulnerability in SAP NetWeaver’s Visual Composer Metadata Uploader, now designated as CVE-2025–31324. This flaw stems from a missing authorization check on the HTTP endpoint /developmentserver/metadatauploader, enabling unauthenticated file uploads that can lead to remote code execution (RCE) under the SAP […]

    The post Technical Details of SAP 0-Day Exploitation Script for RCE Revealed appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Bragg Confirms Cyber Attack – Hackers Accessed Internal IT Systems

    ·

    , ,

    Bragg Gaming Group has confirmed a significant cybersecurity incident that compromised the company’s internal IT infrastructure early Saturday morning, August 16, 2025. 

    The online gaming technology provider discovered unauthorized network intrusion attempts that successfully breached their security perimeter, prompting immediate activation of incident response protocols.

    Key Takeaways
    1. Bragg Gaming Group experienced a cybersecurity breach with hackers accessing the company's internal IT systems.
    2. Preliminary investigations indicate no customer personal information or payment data was compromised.
    3. The company has engaged immediate containment protocols.

    Internal Network Breach 

    Initial forensic analysis conducted by Bragg’s security team indicates that threat actors gained unauthorized access to the company’s internal computer environment through what appears to be a targeted attack vector. 

    The breach primarily affected internal systems within Bragg’s network infrastructure, though the company’s preliminary investigation suggests the attack remained contained within their corporate IT environment.

    Security experts retained by Bragg are currently conducting comprehensive network traffic analysis and system log reviews to determine the exact method of intrusion. 

    The company has implemented immediate containment measures, including network segmentation protocols and enhanced monitoring of all data flows across its Remote Games Server (RGS) technology platform. 

    Critical gaming infrastructure, including the Bragg Hub content delivery platform and Player Account Management (PAM) systems, underwent immediate security audits to ensure operational integrity.

    Bragg has deployed a multi-layered incident response strategy, engaging independent cybersecurity specialists to conduct thorough vulnerability assessments and implement additional security hardening measures. 

    The company’s security operations center has been placed on high alert, with continuous monitoring protocols activated across all network endpoints and server clusters.

    Despite the security breach, Bragg confirmed that no customer personal information or payment data appears to have been compromised during the incident. 

    The company’s data encryption protocols and access control mechanisms apparently prevented unauthorized data exfiltration from customer-facing systems. 

    All gaming operations across Bragg’s regulated markets, including their iCasino and sportsbook platforms, remain fully operational with no service disruptions reported.

    The company has initiated mandatory security awareness training for all personnel and is conducting comprehensive penetration testing across its entire technology stack. 

    The swift response to the cybersecurity incident demonstrates the company’s commitment to maintaining robust security protocols while ensuring minimal disruption to its global gaming operations.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Bragg Confirms Cyber Attack – Hackers Accessed Internal IT Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Ghost-tapping Attacks Steal Customers’ Cards Linked to Services Like Apple Pay and Google Pay

    ·

    , ,

    A sophisticated new cybercriminal technique known as “ghost-tapping” has emerged as a significant threat to contactless payment systems, enabling Chinese-speaking threat actors to exploit stolen payment card details linked to mobile wallet services such as Apple Pay and Google Pay.

    This innovative attack vector leverages Near Field Communication (NFC) relay tactics to facilitate retail fraud, allowing cybercriminals to transform digital theft into physical goods through an elaborate network of mules and automated systems.

    The ghost-tapping ecosystem represents a convergence of traditional phishing techniques with cutting-edge NFC relay technology, creating an end-to-end fraud operation that spans multiple countries and involves various criminal roles.

    Unlike conventional card fraud that relies solely on online transactions, ghost-tapping enables criminals to conduct in-person purchases at retail stores, making detection significantly more challenging for traditional fraud monitoring systems.

    The technique allows threat actors to relay payment information from compromised cards loaded onto mobile devices to separate payment terminals in real-time, effectively bypassing physical proximity requirements.

    Recent data from Singapore authorities illustrates the scale of this emerging threat, with 656 reports of compromised payment cards involving mobile wallets recorded between October and December 2024, resulting in losses exceeding $1.2 million SGD.

    Of these incidents, at least 502 cases specifically involved compromised cards linked to Apple Pay, demonstrating the particular vulnerability of popular mobile payment platforms to this attack method.

    Recorded Future analysts identified key threat actors operating on Telegram platforms, particularly @webu8, who advertises specialized burner phones and ghost-tapping services to Chinese-speaking criminal syndicates.

    Overview of ghost-tapping campaign involving mobile wallets (Source – Recordedfuture)

    Through extensive research and direct engagement with these threat actors, analysts uncovered a sophisticated criminal infrastructure that extends across Southeast Asia, with operations centered in Cambodia and China but targeting victims globally.

    Technical Infrastructure and Attack Methodology

    The ghost-tapping attack chain begins with cybercriminals using automated systems to harvest payment card credentials through phishing campaigns and mobile malware.

    These stolen credentials are then systematically added to contactless payment wallets on burner phones using proprietary software that can bypass traditional authentication measures.

    The process involves sophisticated automation capabilities, as evidenced by observed attempts to add compromised DBS Bank cards to Apple Pay at precise four to eight-minute intervals, demonstrating the industrial scale of these operations.

    # Automated card addition attempt simulation
import time
import requests

def attempt_card_addition(card_details, wallet_service):
    """
    Simulates automated attempts to add stolen card to mobile wallet
    """
    for attempt in range(1, 10):
        response = wallet_service.add_card(card_details)
        if response.status == "success":
            return True
        elif "enable_mobile_wallets" in response.message:
            # Wait for security feature timeout
            time.sleep(600)  # 10 minute window
        else:
            time.sleep(240)  # 4 minute interval before retry
    return False

    The technical foundation of ghost-tapping relies on NFC relay tools such as NFCGate, an Android application originally designed for legitimate NFC traffic analysis but repurposed for criminal activities.

    The attack requires two mobile devices with NFCGate installed and a server configured to relay traffic between locations.

    When a money mule approaches a point-of-sale terminal, the system can relay tokenized card data in real-time from the attacker’s infrastructure to the mule’s device, enabling unauthorized transactions without the physical presence of the original card.

    Overview of the ghost-tapping technique (Source – Recordedfuture)

    The criminal ecosystem supporting ghost-tapping operations extends beyond simple card theft to encompass a sophisticated supply chain involving multiple specialized roles.

    Cybercriminals like @webu8 operate as suppliers, providing not only burner phones loaded with stolen credentials but also offering phone recycling services to maximize operational efficiency.

    These threat actors sell devices for approximately $500 USDT when loaded with ten compromised payment cards, establishing a clear economic model that incentivizes large-scale operations.

    Payment card authentication systems face particular challenges when confronting ghost-tapping attacks, as the technique exploits legitimate NFC communication protocols.

    The automation observed in these attacks suggests that criminals have developed sophisticated methods to overcome security features implemented by banks, including multi-factor authentication and time-limited approval windows.

    Even security measures such as requiring mobile app authentication can be circumvented when criminals have gained access to victims’ banking credentials through comprehensive phishing campaigns or mobile malware infections.

    Luxury goods purchased from various retail stores using ghost-tapping techniques (Source – Recordedfuture)

    The geographical distribution of ghost-tapping operations reflects the global nature of modern cybercrime, with criminal syndicates based in Cambodia and China orchestrating attacks that target victims worldwide while deploying mules to conduct fraudulent purchases in countries with robust retail infrastructure.

    This international scope complicates law enforcement efforts and enables criminals to exploit jurisdictional gaps in cybercrime prosecution, making ghost-tapping a particularly resilient threat to the global payment ecosystem.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Ghost-tapping Attacks Steal Customers’ Cards Linked to Services Like Apple Pay and Google Pay appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Linux Kernel Netfilter Vulnerability Let Attackers Escalate Privileges

    ·

    , , ,

    A critical vulnerability in the Linux kernel’s netfilter ipset subsystem has been discovered that allows local attackers to escalate privileges to root-level access. 

    The flaw, identified in the bitmap:ip implementation within the ipset framework, stems from insufficient range validation when processing CIDR notation in IP address ranges. 

    This missing bounds check enables attackers to trigger out-of-bounds memory writes in kernel space, ultimately providing a pathway to full system compromise. 

    Key Takeaways
    1. Critical vulnerability in Linux kernel's netfilter ipset subsystem allows attackers to trigger out-of-bounds memory writes.
    2. Attackers with local access can exploit this flaw to gain root privileges.
    3. Immediately update to patched kernel versions.

    The vulnerability affects kernel versions up to 6.12.2 and has been addressed through a recently released patch that implements proper range validation across all code paths.

    Linux Kernel Netfilter Vulnerability

    SSD Secure Disclosure reports that the security flaw resides in the bitmap_ip_uadt function within the net/netfilter/ipset/ip_set_bitmap_ip.c file, where insufficient validation occurs when processing CIDR-based IP ranges. 

    The ipset subsystem, designed for high-performance packet filtering in conjunction with iptables and nftables, uses bitmap data structures to efficiently manage sets of IPv4 addresses. 

    When users specify IP ranges using CIDR notation through the netfilter netlink interface, the vulnerable code path fails to verify that the calculated IP range falls within the allocated bitmap boundaries.

    The root cause emerges when the tb[IPSET_ATTR_CIDR] attribute is present but tb[IPSET_ATTR_IP_TO] is absent. 

    In this scenario, the ip_set_mask_from_to function calculates new ip and ip_to values based on the CIDR mask, but unlike the explicit range case, no validation ensures the resulting ip value doesn’t underflow below map->first_ip. 

    Linux Kernel netfilter Vulnerability

    This creates a situation where crafted CIDR values can cause integer underflow, leading to out-of-bounds array access when the calculated index is truncated from u32 to u16 during bitmap operations.

    Exploitation of this vulnerability requires local access but no special privileges, making it particularly dangerous in multi-user environments or containerized systems. 

    Attackers can leverage the netfilter netlink socket interface to send maliciously crafted ipset commands that trigger the vulnerable code path. 

    By carefully constructing bitmap:ip set creation and addition operations with specific CIDR values, attackers can achieve controlled out-of-bounds writes beyond the allocated bitmap memory region.

    The exploitation technique involves creating multiple bitmap:ip objects to establish a predictable memory layout, then using the out-of-bounds write primitive to overwrite critical kernel data structures. 

    Specifically, attackers can modify the members pointer of adjacent bitmap_ip objects, transforming the limited write primitive into arbitrary memory write capabilities.

    Linux Kernel netfilter Vulnerability

    The proof-of-concept demonstrates overwriting the core_pattern kernel parameter, which controls how core dumps are processed, allowing attackers to execute arbitrary commands with root privileges when triggering a segmentation fault.

    The vulnerability’s impact extends beyond simple privilege escalation, as successful exploitation grants attackers complete control over the affected system. 

    This includes the ability to install rootkits, modify system configurations, access sensitive data, and potentially pivot to other systems on the network. 

    Linux Kernel netfilter Vulnerability

    Organizations running affected kernel versions should prioritize applying the available patch, which addresses the issue by implementing a comprehensive range validation that checks both ip < map->first_ip and ip_to > map->last_ip conditions regardless of how the IP range is specified.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Linux Kernel Netfilter Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • X-VPN’s August Update Lets Mobile Users Choose Servers in 26 Regions with Military-Grade AES-256 Encryption

    ·

    , ,

    San Francisco, CA – August 12, 2025 — Addressing the growing demand for data privacy in financial workflows, X-VPN has rolled out an update to its mobile application, now offering free users the ability to manually choose from 26 server regions globally. In addition, the previously paywalled Kill Switch feature is now unlocked for all iOS and Android users.

    This move is designed to give individuals more control over their data routing and exposure — especially those who depend on mobile networks to access financial apps, monitor investments, or execute trades on the move.

    “We believe privacy shouldn’t be gated behind a paywall or a sign-up form,” said Sandra Mitchell, Content Editor at X-VPN. “This update brings essential tools to everyone, regardless of technical background or budget.”

    Control Your Connection: 26 Server Regions to Choose From

    Prior to this update, X-VPN’s free mobile users were auto-assigned to a server. Now, users can choose from 26 regions across North America, Europe, Asia, and Oceania, granting more transparent access control for content and connection quality.

    As of August 2025, free server regions include

    • North America (13) : Canada, United States (New York, Dallas, Miami, Atlanta, Los Angeles, Seattle, Chicago, St. Louis, Fremont, Phoenix, Ashburn, Washington D.C.)
    • Europe (11) : United Kingdom, France, Spain, Netherlands, Poland, Norway, Germany, Finland, Latvia, Lithuania, Czech Republic (Prague)
    • Asia (1) : Singapore
    • Oceania (1) : Australia

    Users can view and switch their chosen server region directly in the app interface. No registration, payment, or personal data input is required.

    How AES-256 Encryption Shields You in Real Time

    When you’re checking investments on public Wi-Fi or trading on the go, even a moment of exposure can be risky. X-VPN’s use of AES-256 — the same encryption trusted by militaries and governments — scrambles your data with near-impenetrable protection.

    Even if attackers intercept the traffic, they can’t read it. This ensures that financial details, passwords, and communications stay unreadable, even in high-risk environments.

    Combined with Safe Browsing and Everest Protocol, X-VPN builds a strong barrier between your data and the outside world.

    Security Without Gaps: No Logs + Kill Switch Protection

    X-VPN’s strict no-log policy means it doesn’t store what you do online — no activity records, no connection history.

    And with the newly available Kill Switch for free users, your connection is never left unguarded. If the VPN drops, all traffic is instantly blocked to prevent leaks.

    Together, these features give users a secure tunnel for internet use — with no risk of traceable data. Whether banking on public Wi-Fi or reviewing reports in transit, users gain peace of mind knowing their digital steps are protected at all times.

    Kill Switch: A Safety Net for Unstable Networks

    The newly available Kill Switch feature blocks all internet traffic when the VPN connection drops, helping prevent real IP exposure and ensuring sensitive data doesn’t leak during a moment of disconnection.

    The feature can be activated within the app under:

    Settings → Security → Kill Switch

    It’s off by default but once enabled, it runs continuously — particularly helpful in volatile network environments like cafés, airports, or international hotels.

    VPN disconnections can go unnoticed, leaving users vulnerable as traffic silently reverts to an unencrypted state. Kill Switch mitigates this by immediately cutting off all data flow until a secure tunnel is reestablished — a crucial safety net for professionals handling sensitive data on public or unstable networks.

    Why This Update Matters to Users

    In today’s digital world—even casual users face a growing threat to their personal cybersecurity. The FBI’s 2024 Internet Crime Report shows that losses from cybercrime soared past $16 billion, a 33% surge from 2023, underscoring how attackers increasingly target everyday individuals.

    Meanwhile, globally, the average cost of a data breach hit approximately $4.88 million in 2024, reflecting the serious financial consequences of inadequate protection.

    By offering manual server selection, X‑VPN empowers users to maintain stability and control over their connections—even when using unknown or shared networks.

    The Kill Switch feature adds another layer of protection by instantly blocking all traffic if the VPN drops, preventing unencrypted data leaks.

    Together, these features give security-minded users a reliable, private, and encrypted experience—whether surfing, streaming, or simply staying connected—without exposing their data to eavesdroppers or cyber threats.

    Fast Setup, No Registration, No Payment Required

    To try the new features:

    1. Download or update the X-VPN app on App Store or Google Play.
    2. Open the app and tap “Location” on the home screen.
    3. Choose a region from the free server list.
    4. Connect and browse securely.

    If you prefer direct access, the app is also available here:

    Download X-VPN for iOS | Download X-VPN for Android

    Setup takes seconds, and no account creation is necessary.

    Privacy Without a Paywall

    Most VPN providers restrict key features — like server selection or failover protection — to paid users. X-VPN’s latest release reflects a broader industry movement: making digital safety tools universally accessible.

    Security analysts suggest this could pressure competitors to reevaluate what counts as “basic protection,” particularly as financial data and mobile transactions become even more intertwined.

    About X-VPN

    With over 50 million users in more than 200 countries, X-VPN develops intuitive and robust tools for protecting user privacy, securing digital activity, and improving online access across all platforms.

    Contact

    X-VPN Team
    📧 support@xvpn.io
    🌐 xvpn.io

    The post X-VPN’s August Update Lets Mobile Users Choose Servers in 26 Regions with Military-Grade AES-256 Encryption appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • APT SideWinder Actor Profile – Recent Attacks, Tactics, Techniques, and Procedures

    ·

    , , , ,

    APT SideWinder, also known as Rattlesnake, Razor Tiger, and T-APT-04, is a nation-state advanced persistent threat (APT) group active since at least 2012 and believed to originate from India.

    Noted for targeting military, government, and strategic business entities, particularly in South Asia, SideWinder’s operational footprint has recently expanded to critical infrastructure in the Middle East and Africa.

    Who is APT SideWinder?

    SideWinder is distinguished by its persistent and adaptive cyber-espionage operations. The group’s primary motives revolve around intelligence gathering targeting national defense, diplomatic, financial, maritime, and nuclear sectors.

    Alias NamesSuspected CountryYears ActiveFocus RegionsTypical Victims
    Rattlesnake,
    T-APT-04,
    Razor Tiger,
    APT-C-17    		India2012–PresentSouth Asia, Middle East, Africa, Southeast AsiaMilitary, Government, Maritime, Nuclear,
    Logistics, Telecom, Financial Institutions

    Recent campaigns indicate an aggressive shift toward government, logistics, and especially maritime infrastructure in the Indian Ocean and Mediterranean Sea.

    SideWinder—also tracked as APT-C-17, Razor Tiger, Rattlesnake, Baby Elephant, Leafperforator, and T-APT-04—is suspected of operating from India based on persistent focus on Pakistan, China, Nepal, Bangladesh, and other geopolitical rivals, plus linguistic and infrastructure clues.

    SideWinder APT Milestones.
    SideWinder APT Milestones.
    • Primary motivation: long-term political and military intelligence gathering.
    • Typical victims: defence ministries, foreign affairs departments, armed-forces e-mail systems, and, since 2024, maritime logistics operators and nuclear-power agencies.
    • Infrastructure depth: more than 400 live domains and hundreds of sub-domains supporting download sites, C2 nodes, and phishing portals at any given time.

    Overview of APT SideWinder

    Operational Approach

    SideWinder orchestrates well-planned spear-phishing campaigns, leveraging geo-fenced payloads and regionally tailored lures. Exploitation of legacy Microsoft Office vulnerabilities (notably CVE-2017-11882, CVE-2017-0199) is a hallmark of its campaigns.

    The group uses sophisticated multi-stage loader delivery mechanisms, frequently deploying obfuscated JavaScript, malicious Office documents, and weaponized RTF/LNK files.

    SideWinder Attack Chain
    SideWinder Attack Chain

    Infection Chain Diagram

    A detailed diagram mapping SideWinder’s attack orchestration:

    Victimology has expanded markedly since 2022, when Kaspersky logged over 1,000 SideWinder intrusions in 18 months. By 2025, the actor was simultaneously running campaigns against port authorities in Egypt, logistics firms in Djibouti, and nuclear-power regulators in South Asia.

    Analyzing SideWinder’s Tactics, Techniques, and Procedures (TTPs)

    SideWinder’s TTPs are mapped comprehensively to the MITRE ATT&CK framework, leveraging a mix of fileless, modular payloads, document exploitation, and C2 sophistication.

    1. Initial Access

    • Spear-phishing emails: Weaponized Office documents or ZIP files, tailored to individual organizations and regions, often with geofenced delivery.
    • Exploitation: Remote template injection triggers embedded exploit code for CVE-2017-0199 and CVE-2017-11882, resulting in initial payload execution.

    2. Execution, Persistence, and Evasion

    • Multi-Stage Loaders: Obfuscated JavaScript/.NET, leveraging shellcode-based loaders to download modular implants like StealerBot and WarHawk backdoor.
    • DLL Side-Loading: Hijacking legitimate system binaries for stealthy execution.
    • Fileless Malware: Implants loaded directly into memory (RAM-resident) to evade disk-based detection.

    3. Command and Control (C2)

    • Infrastructure: 400+ domains, dynamic subdomains, HTTPS-encrypted communications, Telegram for data exfiltration, periodic infrastructure changes for detection evasion.

    4. Post-Exploitation Modules

    • StealerBot: Modular espionage tool providing keystroke logging, screenshot capture, credential harvesting, data exfiltration, persistent access, and secondary malware deployment.
    • WarHawk Backdoor: Advanced loader with kernel-level injection, time zone checks, and dedicated modules for download/execute, command execution, and file exfiltration.

    5. Lateral Movement

    • Credential Harvesting: RDP, browser credentials, and access escalation to adjacent systems.
    • Rapid Adaptation: SideWinder modifies malware within hours post-detection, alters file and infrastructure naming for persistence.
    MITRE ATT&CK StageExample Techniques (IDs)SideWinder Implementation
    Initial AccessPhishing (T1566.001), Exploit Public-Facing App (T1190)Targeted spear-phishing, document exploits
    ExecutionUser Execution (T1204.002), Scripting (T1059.007)Weaponized attachments, script loaders
    PersistenceDLL Side-Loading (T1073), Fileless Malware (T1055.003)Side-loaded binaries, RAM-resident implants
    Defense EvasionObfuscated Files (T1027), Dynamic C2 (T1105)Obfuscated payloads, rapid infrastructure changes
    Credential AccessCredential Dumping (T1003), Browser Credential Theft (T1555)StealerBot credential harvesting
    DiscoverySystem Information Discovery (T1082), Network Discovery (T1046)Recon modules post-compromise
    Collection & ExfiltrationData Staged (T1074), Exfiltration to C2 (T1041)Data theft, screenshots, exfil via HTTPS/Telegram
    Command and ControlEncrypted C2 (T1071.001), External Remote Services (T1133)HTTPS/Tor, Telegram, custom protocols
    Impact & Lateral MovementRemote Services (T1021), Execution via API (T1106)Move within network, maintain persistent espionage

    Notable Attacks and Campaigns

    Real-World Attack Examples

    YearTarget/RegionAttack Vector & PayloadOutcome/Impact
    2013Indian Embassy, KabulPhishing with malicious DOC/RTFData exfiltration, diplomatic intelligence loss
    2015Pakistani Air ForceSpear-phishing, exploit chain, custom backdoor implantSensitive military files exfiltrated
    2018Ukrainian Military WebsiteMalicious script, credential harvesting via info stealerTactical intelligence compromised
    2024Sri Lanka CB & Govt AgenciesGeofenced spear-phishing, Office exploit to StealerBotPersistent access, financial and government espionage
    2024Maritime Sector (Djibouti, Egypt)Phishing, compromised documents, agile infrastructure, StealerBot, WarHawkStrategic infrastructure mapping, logistics planning theft
    2025Pakistan Cabinet DivisionISO bundles, LNK, WarHawk backdoor, kernel injection, timezone checksCobalt Strike deployment, access maintained in local time zone

    APT SideWinder exemplifies a modern, adaptive, and regionally effective cyber espionage threat. By continuously improving its toolkit (e.g., StealerBot, WarHawk), leveraging fileless persistence, and targeting geopolitical interests, SideWinder remains a persistent risk for government, defense, maritime, and financial sectors across Eurasia and Africa.

    • Primary motivation: long-term political and military intelligence gathering.
    • Typical victims: defence ministries, foreign affairs departments, armed-forces e-mail systems, and, since 2024, maritime logistics operators and nuclear-power agencies.
    • Infrastructure depth: more than 400 live domains and hundreds of sub-domains supporting download sites, C2 nodes, and phishing portals at any given time.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post APT SideWinder Actor Profile – Recent Attacks, Tactics, Techniques, and Procedures appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Bragg Confirms Cyberattack, Internal IT Systems Breached

    ·

    , , ,

    Bragg Gaming Group (NASDAQ: BRAG, TSX: BRAG), a prominent content and technology provider in the online gaming industry, has disclosed a cybersecurity incident that compromised its internal computer systems over the weekend. The company discovered the breach on August 16, 2025, and has immediately implemented containment measures while engaging independent cybersecurity experts to assist with […]

    The post Bragg Confirms Cyberattack, Internal IT Systems Breached appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • DoJ Seizes $2.8M in Crypto from Zeppelin Ransomware Group

    ·

    , , , ,

    The Department of Justice has announced a significant victory against cybercriminals, seizing over $2.8 million in cryptocurrency and additional assets from a Zeppelin ransomware operation. The coordinated law enforcement action targeted Ianis Aleksandrovich Antropenko, who faces federal charges for his role in deploying ransomware attacks against victims worldwide, including numerous American organizations and businesses. Major […]

    The post DoJ Seizes $2.8M in Crypto from Zeppelin Ransomware Group appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

    ·

    Power doesn’t just disappear in one big breach. It slips away in the small stuff—a patch that’s missed, a setting that’s wrong, a system no one is watching. Security usually doesn’t fail all at once; it breaks slowly, then suddenly. Staying safe isn’t about knowing everything—it’s about acting fast and clear before problems pile up. Clarity keeps control. Hesitation creates risk. Here are this

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶