• Ransomware operators introduced a custom-built data exfiltration tool, signaling a notable evolution in attack techniques. Unlike most ransomware groups that rely on publicly available utilities such as Rclone or MegaSync, Trigona affiliates are now using a proprietary tool to steal sensitive data with greater precision and stealth. Trigona, active since late 2022, operates as a […]

    The post Ransomware Gang Unveils Custom Data-Theft Tool appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly identified cyber threat group, UNC6692, is using a clever mix of social engineering and custom malware to infiltrate corporate networks. By impersonating IT helpdesk personnel on Microsoft Teams, these hackers trick employees into downloading a sophisticated malware suite that steals sensitive company data. The Social Engineering Trap The attack begins with an aggressive […]

    The post Hackers Impersonate IT Helpdesk Staff to Breach Firms via Microsoft Teams appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers at Socket have uncovered a major supply chain compromise affecting the Bitwarden CLI. Attackers successfully abused a GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code into the popular password manager’s npm package. This breach is part of the broader, ongoing Checkmarx supply chain campaign. Bitwarden CLI Compromised The compromised package, identified […]

    The post Bitwarden CLI Compromised After Malicious GitHub Actions Workflow appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a September exercise on a Florida airfield, members of the 10th Special Forces Group launched a drone assault that mirrored the “spiderweb” attack that Ukraine had recently staged against Russia. The defenders were counter-drone troops from across the U.S. military, trained for a week on tech that the Pentagon has spent billions to develop. 

    U.S. counter-drone efforts haven’t been the same since.

    “What I would tell you is that it helped us develop our priorities,” said Brig. Gen. Matt Ross, who leads Joint Interagency Task Force 401, the Pentagon’s counter-drone clearinghouse.

    Dubbed Operation Clear Horizon, the exercise at Eglin Air Force Base sought to replicate conditions and weapons seen on the battlefields of Ukraine.

    The special operators “had lessons learned from Ukraine in Eastern Europe and they came back and they said, ‘This is what we're seeing on the battlefield’,” Ross said.

    In their mock assault, the special operators used a wide range of drones, from small to large, and many that were resistant to jamming and radar.

    “They flew drones that were regular [radio-frequency], commercial drones. They flew drones that had directional antennas on them so they're harder to jam, drones that were frequency hopping so they have a more resilient connection” against electromagnetic attack, Ross said Tuesday at the Sea-Air-Space event. “They went up to Group 3 drones” and down to Group 1s. “We used fiber optically-controlled drones…We used drones controlled by LTE, the cellular network,” enabling operators in Colorado to launch against targets in Florida, a first for the U.S. military.

    That effort to replicate the battlefield of Ukraine is a big departure from the way the department usually tests its technology against drones.  

    Because the electro-magnetic effects used against drones interfere with airplane guidance and cellular service, the military can only test them in very particular circumstances. Even the most recent counter-drone tests—such as August’s T-REX exercise at Camp Atterbury, Indiana, and the Army’s FlyTrap exercise last November in Germany—don’t do so. Instead, they mostly test concepts for bringing down drones without using million-dollar missiles. 

    What’s more, data from such tests don’t usually fully inform the planning of other exercises and experiments, according to participants and observers of such events. Between September and December, Ross said, 67 tests were conducted by the services, combatant commands, the Pentagon’s research office, and other DOD outfits. 

    “It was all well-intentioned. But we couldn't see all of that data in a way that would allow informed comparisons between different systems that were tested at different venues,” he said.

    Even if circumstances make it hard to test jamming defenses against UAVs, the military still needs to drill against drones built to elude radar as well. What the U.S. really needs now is continuously up-to-date understanding of how U.S. tactics and gear would perform on a battlefield like Ukraine. That’s what the task force is trying to do.

    “We were over in Ukraine about six weeks ago, talking to the Unmanned Systems Force [sic], watching how they defend Kyiv on any given night, understanding what they have along the forward line of troops,” Ross said. “Then we've looked at those most promising technologies and we referenced their performance data in Ukraine instead of internal department testing and evaluation.”

    That’s leading to changes in how the U.S. buys equipment to take down drones and plans defenses for installations and forces. 

    The September exercise in Florida showed that U.S. drone defenders needed a way to combine the data coming in from far-flung radars, drones, and counter-drone systems.

    “If you look at the Department of War installations across the panhandle of Florida, we should be able to identify a [drone] track from the west and pass it between installations,” Ross said.

    Now, the U.S. has a single drone-tracking software solution and interface across the services, he said. (Defense One has asked for details.)

    “If you were to go to a location where you have multiple services working together, and even other federal agencies or international partners, we have seamless air domain awareness and the ability to sense connect any sensor with any effector”—that is, a drone-downing system, Ross said.

    The exercise also revealed a need to focus more on long-range drones that can damage  “high-payoff targets, which are going to be command-and-control, logistics, or air defense,” he said.

    For smaller drones—Groups 1 and 2—the U.S. must develop interceptor drones that cost less than today’s expensive defense missiles.

    Ukraine has already absorbed such lessons, which the task force is now passing to U.S. commanders, including those in the Middle East. 

    “We've procured some of those systems now to start integrating across the Department of War,” he said. “In the past six weeks, we've committed over $600 million to this problem, specifically for the rapid integration of new counter [unmanned aerial system] technology.”

    In the 2027 budget proposal, the Pentagon is requesting $75 billion for new drone technology, a sum larger than the annual GDP of some countries and the current budget of the U.S. Marine Corps. 

    If those numbers seem far apart, it’s because the United States has highly-effective missiles to take down drones. But they were designed to take down missiles, and they’re expensive. But Ross says that getting the most out of both efforts means linking them together in a way that traditional long-range fires teams and missile-defense units have not been, historically. 

    Offensive and defensive drone operations are “inextricably, inextricably linked,” he said. 

    The threat, however, is evolving far faster than annual budgets. Ross took issue with the idea, advanced by some senior military leaders, that today’s drones are analogous to the IEDs of the Iraq and Afghanistan wars. No commercial market spurred the evolution of IEDs, nor could software and data spur improved performance.

    “For IEDs, you had no commercial application for that technology. With unmanned systems, and specifically with autonomy, there's so many commercial applications that we're going to see this accelerated development in this space,” he said. “That's going to cause us concerns, from a security perspective.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The White House Office of Science and Technology Policy on Thursday accused China and other foreign entities of engaging in “deliberate, industrial-scale campaigns to distill U.S. frontier AI systems,” and said that the Trump administration will be taking steps to safeguard domestic artificial intelligence products. 

    In a memo to federal agencies, the White House office warned that these distillation campaigns — in which an attacker sends a deluge of requests to an AI model to train a knockoff version of it — are allowing bad actors to steal proprietary information from U.S. companies.

    “Models developed from surreptitious, unauthorized distillation campaigns like this do not replicate the full performance of the original,” the memo said. “They do, however, enable foreign actors to release products that appear to perform comparably on select benchmarks at a fraction of the cost.”

    Anthropic in February accused three Chinese-based AI companies — DeepSeek, Moonshot AI and MiniMax — of overwhelming its Claude model with 16 million exchanges from roughly 24,000 fraudulent accounts. 

    Those allegations came the same month that OpenAI sent a letter to members of the House China Select Committee that said, in part, that it had seen evidence “indicative of ongoing attempts by DeepSeek to distill frontier models of OpenAI and other US frontier labs, including through new, obfuscated methods.”

    Thursday’s memo does not cite any specific companies engaged in distillation campaigns against U.S. AI firms. But OSTP Director Michael Kratsios said in an X post that “these foreign entities are using tens of thousands of proxies and jailbreaking techniques in coordinated campaigns to systematically extract American breakthroughs.”

    OSTP told agencies that the Trump administration will be taking a series of steps to expand engagement with U.S. companies and crack down on foreign-based distillation campaigns. 

    These include sharing more information with the private sector about attempts to conduct large-scale distillation attacks, enabling companies “to better coordinate against such attacks;” partnering with firms to develop a set of best practices to counter these campaigns; and looking at developing new steps to hold foreign actors accountable for their actions. 

    The memo said these actions are consistent with the White House’s AI Action Plan, which was released in July 2025 and emphasizes the importance of “preventing our adversaries from free-riding on our innovation and investment.”

    The White House’s warning about China-based distillation campaigns is the latest salvo in the U.S. and China’s ongoing competition to lead the global AI race. It also comes as major American AI firms have rolled out what they say are advanced AI models that have exquisite cybersecurity capabilities that could cause national security risks if they fall into the wrong hands.

    Retired Gen. Paul Nakasone, who led the NSA and U.S. Cyber Command, said the administration may consider export controls, diplomatic protests and tailored technology restrictions as potential responses to the distillation efforts.

    “And we’re going to be very, very careful about how we’re going to share that [AI technology] with a series of different partners,” he said, speaking at a Wednesday roundtable with reporters in Nashville when asked about the campaigns. Nakasone now leads Vanderbilt University’s Institute of National Security.

    Given China’s increasingly bellicose tone toward Taiwan, and the potential for preemptive actions against the U.S. in advance of a full-scale invasion of that country, lawmakers have also been worried about how technology advances will ultimately benefit Beijing. Through China’s military-civil fusion strategy, the country has moved to enhance its military strength by removing barriers with its commercial sector.

    President Donald Trump and Chinese President Xi Jinping are scheduled to meet next month in Beijing for a summit to discuss a host of issues, including export controls on semiconductors and IP theft.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The attacker’s blind spot just disappeared

    Mayuresh Ektare, Senior Vice President, Product Management

    San Jose, Calif. – Apr. 23, 2026

    Today’s attackers largely treat software as a black box. Some study open-source software (OSS) to tailor their techniques, but doing this at scale has always been practically impossible, which created a natural ceiling on adversarial precision. Mythos removes that ceiling entirely.

    Because frontier LLMs are trained on virtually all public code — every kernel, every library, every line in every public repo — they intimately understand OSS like the human developer who built it. With a context window no human can match, these models can detect zero-day vulnerabilities and generate sophisticated multi-stage, multi-chaining exploits that human attackers simply could not achieve manually.

    What’s still hard for attackers — for now.

    LLMs have limited exposure to first-party enterprise code. Proprietary codebases remain largely opaque to these models, which means their attack surface advantage is currently concentrated in open source. That’s a narrow but temporary comfort.

    Three areas where the old playbook no longer holds:

    Supply chain attacks are no longer a hygiene issue — they’re an existential one. CVE volume in OSS is about to explode. The window between vulnerability disclosure and working exploit has collapsed from weeks to hours. Teams that lack a rapid, automated remediation process will find their backlog become unmanageable.

    Exposure management in AppSec must be rebuilt from the ground up. As the raw CVE counts explode, they become noise. What matters is whether the vulnerable library is invoked at runtime, whether the vulnerable function is actually reachable, whether a compensating control can be deployed immediately at runtime, and whether that control creates downstream risk elsewhere. Prioritization at this granularity, at this volume, cannot be done manually.

    Modernizing the SOC is no longer a roadmap item — it is the response plan. Some vulnerabilities will eventually go unaddressed. Bad actors have always been relentless, and now with tools like Mythos, they will also be very fast. When exploits are developed in hours, you have to operate with the assumption that at some point, they will get in.

    The real question is that when they do, how quickly will you find out, and how fast can you respond? Security teams are drowning in data to find the answer to that question. Modern detection technologies generate an enormous volume and variety of alerts across fragmented tools. The result is severe alert fatigue, analyst burnout, and most dangerously, real threats slipping through the noise. These won’t be isolated incidents anymore, as when threats are detected in milliseconds (at machine speed), triage and response cannot happen at human scale.

    This is precisely why AI adoption is so uniquely urgent in the SOC. It is the one place in the cybersecurity workflow where the data is too noisy, the time pressure is too intense, and the stakes are way too high for humans to manage alone. In the SOC, AI-augmented workflows provide more than a productivity boost, they determine whether a breach is contained in minutes or discovered in months.

    J.P. Morgan has noted that Mythos represents a direct tailwind for AI SOC companies. Stellar Cyber happens to be one of the very few vendors in this space that isn’t a closed ecosystem and supports other tools as first class citizens in its platform. We’ve long believed the Human-Augmented Autonomous SOC is the next frontier in SecOps. Mythos didn’t just move that horizon closer, it collapsed it.

    Mayuresh Ektare, Senior Vice President, Product Management


    About Stellar Cyber

    Stellar Cyber’s Open XDR Platform delivers comprehensive, unified security without complexity, empowering lean security teams of any skill level to secure their environments successfully. With Stellar Cyber, organizations reduce risk with early and precise identification and remediation of threats while slashing costs, retaining investments in existing tools, and improving analyst productivity, delivering an 8X improvement in MTTD and a 20X improvement in MTTR. The company is based in Silicon Valley. For more information, visit https://stellarcyber.ai.

    The post Anthropic’s Mythos Preview Just Changed The Threat Landscape In Ways The Security Industry Isn’t Fully Prepared For appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts. “As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an account

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NASHVILLE—The Army thinks its Apache helicopters, developed a half-century ago to kill Soviet tanks, might offer a solution to enemy drones two or three orders of magnitude smaller.

    As the service races to mold a counter-drone strategy based on lessons from Ukraine and now Iran, it is testing AH-64s armed with rockets and proximity-fuzed shells against drones weighing over 50 pounds, officials said recently during the Army Aviation Warfighting Summit.

    The idea came straight from the force, Maj. Gen. Clair Gill, who heads the Army Aviation Center of Excellence, said  April 15. He credited Daniel York, a recently retired chief warrant officer-5 and Apache training manager, with the idea to test out the Apache’s counter-unmanned prowess during Operation Flyswatter last year, using some air-to-ground missiles, Hellfires, and 30mm proximity rounds.

    “Everybody here is familiar with the JIATF-401”—the Pentagon’s counterdrone task force—and how much energy the Department of War is putting against counter-unmanned aerial systems,” Gill told an audience. “We can be very valuable to that. And I'm proud to say…we're giving that to our warfighters that are forward right now.”

    That includes the 12th Combat Aviation Brigade, which recently tested its Apaches in aerial counter-drone operations.

    “The UAS threat has defined the conflict in Ukraine, and as we see, also back in the [U.S. Central Command area of operations],” said Lt. Gen. Hank Taylor, the U.S. military representative to NATO, said April 16. “This is not just about protecting our forces. It's about enduring, and ensuring that we control the airspace, and that we can protect all of our forces.”

    All of the services have been looking at more efficient ways to down drones, from jamming to lasers, beyond shooting missiles at quadcopters. The Army thinks Apache munitions are a good fit, especially for Group 3 UAS and above—that is, drones that weigh from about 55 pounds to more than 1,000.

    “Engaging Group 3-5 UAS with an Apache using cost-effective munitions like 30mm or guided rockets preserves high-end, expensive ground interceptors for more complex threats,” Brig. Gen. David Phillips, the Army’s deputy Portfolio Acquisition Executive for air maneuver, told Defense One. 

    The Apache’s ability to run down targets and fire smaller rounds make it an efficient and cost-effective counter-UAS system, Phillips said.

    “An Apache can rapidly reposition to intercept incoming threats across a massive operational footprint, effectively adding to our ground-based air and missile defense umbrella,” he said. “Furthermore, the Apache is highly cost-efficient in this role. When our crews engage these larger UAS, they aren't necessarily using high-end anti-armor missiles,” he said. “Using a relatively inexpensive rocket or a burst of 30mm to down a Group 3 or 4 drone is an incredibly favorable cost-exchange ratio.” 

    To that end, Gill said, the Army has placed a big order for 30mm proximity-fuze ammunition with Northrop Grumman. 

    “We had 600 rounds total,” he said. “They’ve produced 1,000 rounds already this month, and they’ll produce another 1,000, and they're going to ramp their rate up probably five times that.”

    The Apache’s prospective new mission comes as the Army is retiring its AH-64D models, moving them to other functions while continuing to buy AH-64Es.

    “The Apache’s proven reliability as a c-UAS platform doesn't change our entire procurement strategy, but it strongly validates the direction we are already heading with the AH-64E Version 6 and beyond,” Phillips said.

    What will change, he added, is the way the Army prioritizes missions for its attack helicopters.

    “From an employment perspective, we are no longer looking at Army aviation solely for close air support, reconnaissance, or anti-armor missions,” Phillips said. “We are now able to integrate attack aviation directly into the theater air defense design. The Apache is a flying sensor and shooter for the joint force.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Defense Department has completed its $1 billion investment in L3Harris Technologies’ missile-making unit, ahead of a planned initial public offering later this year.

    DOD’s capital infusion is a convertible preferred security that will convert into common equity if, as planned, the IPO turns the company's Missile Solutions business into an independent, publicly-traded company. DOD is also receiving warrants to purchase additional shares.

    L3Harris said Thursday it will retain roughly 80% ownership of the new company.

    Missile Solutions houses much of the defense portfolio of Aerojet Rocketdyne, which L3Harris acquired in 2023 to enter the solid-rocket-motor and munitions markets. Aerojet was one of the two primary providers of rocket propulsion systems for missile and space launch programs, along with the Orbital ATK business acquired by Northrop Grumman in 2018.

    Suppliers are increasing hard-pressed to meet demand for solid rocket motors and munition stockpiles has grown because of the wars in Ukraine and the Middle East.

    DOD’s direct investment in the Missile Solutions business follows other defense-related equity-stake acquisitions, in rare earth mineral suppliers and the chipmaker Intel. The Trump administration has so far made direct investments in 10 companies.

    Executives said the Missile Systems unit intends to spend most of the DOD funds and the proceeds from its IPO to expand and improve its rocket factories in Camden, Arkansas; Huntsville, Alabama; and Orange, Virginia.

    On Thursday, members of L3Harris' executive team rang the opening bell at the New York Stock Exchange.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NASHVILLE—Joint Chiefs Chairman Gen. Dan Caine said Thursday that autonomous weapons are going to be a “key and essential part of everything we do” when asked about how such tools would fit into the future of warfare.

    Speaking during a fireside chat at Vanderbilt University’s Asness Summit on Modern Conflict and Emerging Threats, Caine said, “We are doing a lot of thinking about this in the joint force right now” on how autonomous tech would be applied to areas like drones and command-and-control operations.

    His remarks signal that the U.S. military is keen on crafting plans to further adopt artificial intelligence tools and other evolving technologies that would automate national security decisions made in the Defense Department.

    “Probably everybody in this room uses some flavor of a [large language model] every single day,” he said, adding the same can’t be said for staff in the halls of the Pentagon. “So, we have to really normalize this and become early adopters.”

    The remarks come as observers weigh tensions between the Pentagon and Anthropic, which recently unveiled a powerful frontier AI model, Mythos Preview, that was held back from public release over cybersecurity risks, paired with a new initiative to study its effects on global networks. 

    Intelligence community units have expressed interest in Mythos, Nextgov/FCW previously reported. The NSA, a component of the DOD, has been granted access to it, Axios reported Sunday.

    Earlier this year, Anthropic declined to ease restrictions against its tools being used for domestic surveillance or fully autonomous weapons for Pentagon use, triggering a “supply chain risk” designation from the Defense Department and a White House order that all federal agencies phase out their uses of Anthropic tools. 

    The company has legally challenged the move, and a federal judge issued a temporary injunction on the designation and ban in late March. The government has said it intends to appeal the injunction. 

    This week, President Donald Trump said in a CNBC interview that the company is “shaping up” and can “be of great use” in the future, a sign that tensions between Anthropic and the government may be easing up. 

    The use of AI in military operations often draws scrutiny because it can speed up battlefield decisions while blurring human accountability, and it can raise doubts about whether such systems would reliably comply with the laws of war. Lawmakers have asked the Pentagon whether AI systems were used in a deadly strike on an Iranian school during the opening hours of the U.S.-Israel war against Tehran.

    Caine also said U.S. government agencies need to be “better buyers” for the private sector. “We have to write better contracts,” he said, elaborating that current acquisition frameworks are slowing contract workflows.

    Contracts should be structured so risk is shared between buyers and sellers with the goal of bringing better outcomes for servicemembers, he added.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶