-
A suspected cyber espionage activity cluster that was previously found targeting global government and private sector organizations spanning Africa, Asia, North America, South America, and Oceania has been assessed to be a Chinese state-sponsored threat actor. Recorded Future, which was tracking the activity under the moniker TAG-100, has now graduated it to a hacking group dubbed RedNovember.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
Seven months after telling Ukraine’s president, “You don’t have the cards right now” to fend off Russia’s ongoing invasion, U.S. President Donald Trump surprised observers when he said Tuesday on social media, “I think Ukraine, with the support of the European Union, is in a position to fight and WIN all of Ukraine back in its original form.”Trump did not emphasize direct U.S. support to Ukraine, instead adding with an apparent note of indifference, “We will continue to supply weapons to NATO for NATO to do what they want with them.” He continued, “With time, patience, and the financial support of Europe and, in particular, NATO, the original Borders from where this War started, is very much an option.”
“Putin and Russia are in BIG Economic trouble, and this is the time for Ukraine to act,” Trump said, and concluded, “In any event, I wish both Countries well.”
Context: Trump’s pivot comes after Russian aircraft violated NATO airspace several times this month, including episodes involving Poland, Romania, and Estonia—as well as Finland, Latvia, Lithuania, and Norway, NATO said in a Tuesday statement. “Allies will not be deterred by these and other irresponsible acts by Russia from their enduring commitments to support Ukraine, whose security contributes to ours, in the exercise of its inherent right to self-defence against Russia’s brutal and unprovoked war of aggression,” the alliance’s North Atlantic Council said.
Notable: “[T]here was no sign that Trump's words would be matched by a change in U.S. policy, such as a decision to impose the heavy new sanctions on Moscow,” Reuters reports, writing that Trump’s new position “would ostensibly require Kyiv to expel Russian forces from 20% of its territory, including the Crimean peninsula Moscow has held since 2014, in what would be an extraordinary reversal.”
Capitol Hill reax: “President Trump is delusional,” said Massachusetts Democratic Sen. Ed Markey, writing on social media Tuesday. “Without stronger US support, which Trump has refused to provide, Ukraine will die a slow death,” he said, alleging without elaboration, “Make no mistake: Trump is siding with Putin’s dictatorship over Ukraine’s democracy.”
Second opinion: “Over a month after inviting Putin to the United States with a red carpet welcome, President Trump has nothing to show for it and Putin is actively testing NATO’s resolve,” said Sen. Jeanne Shaheen, D-New Hampshire, in her own statement Tuesday. “President Trump has also yet to deliver on his campaign promise of quickly ending devastating conflicts in Ukraine, Gaza and elsewhere…America needs less bluster and more constructive action from this President to finally bring these conflicts to a close.”
European reax: “[T]he cards are clear for us. We know what we should be doing,” one official told Reuters. And Germany’s top diplomat said Tuesday, “We can achieve much more; not all European states have delivered what they promised Ukraine.”
“It's dawning on Trump, the fact that Putin has been stringing him along,” Jaroslava Barbieri of the Chatham House told the wire service. “I think Trump is also looking for an off-ramp to maintain this image of being an effective peace broker by trying to shift the blame to Russia and the Europeans.”
Frontline dispatch: “To Understand Ukraine at War, Stop by a Gas Station,” Constant Méheut, Olha Konovalova and Brendan Hoffman reported Tuesday for the New York Times (gift link).
Update: Ukrainian attacks on Russian oil refineries have dropped Russian fuel exports close to their lowest level since 2020, with Ukrainian drone attacks disrupting more than one million barrels of oil per day from Russia’s refining capacity, the Financial Times reported Tuesday. “Sixteen of Russia’s 38 refineries have been hit since the start of August, some of them multiple times, including one of Russia’s largest fuel-processing facilities, the 340,000 barrel-a-day plant at Ryazan, close to Moscow,” FT’s Chris Miller reports.
Russia’s new war tax? “Russia's finance ministry proposed raising the rate of value-added tax on Wednesday to 22% from 20% in 2026 to fund military spending in what would be the fifth year of the war in Ukraine,” Reuters reported Wednesday from Moscow.
In an apparent first, Ukraine reportedly used hot-air balloons to attack targets in Russia. “They weren’t very precise,” a Russian defense official told Russia's RBK Wednesday, who said the inflatable Ukrainian drones were spotted or shot down over several Russian regions after midnight Wednesday, including Belgorod, Bryansk, Kaluga, Kursk, Rostov, Ryazan, Samara, Saratov regions, Crimea, and Moscow.
Britain’s top spy said recently that around 250,000 Russian troops have died fighting for Putin’s Ukraine invasion, and Moscow has taken “more than a million casualties” overall, according to Sir Richard Moore’s speech Friday in Istanbul.
In May, the U.S. military’s intelligence agency estimated that 170,000 Russian troops had died, while some 530,000 more had been wounded, Mike Eckel of Radio Free Europe / Radio Liberty noted on social media Sunday.
Happening today: NATO Secretary General Mark Rutte is visiting the U.S. for meetings with world leaders and high-level officials during the UN’s General Assembly this week in New York. Rutte also has a dinner planned with Secretary of State Rubio this evening followed by a scheduled address to cadets at the U.S. Military Academy on Thursday.
Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1968, prime-time news show “60 Minutes” debuted on CBS.
Around the world
“What kind of world do we choose to build together?” United Nations Secretary-General António Guterres asked attendees from around the globe during his remarks Tuesday at the UN’s annual General Assembly in New York City.
The UN, which formed from the ruins of World War II, was established in a spirit of “cooperation over chaos, law over lawlessness, peace over conflict,” Guterres said. But 80 years later, “we have entered an age of reckless disruption,” when “the principles of the United Nations…are under siege,” he warned.
In the days ahead, UN members can choose “a world of raw power—or a world of laws,” he said. “A world that is a scramble for self-interest” and “where might makes right—or a world of rights for all.”
Trump’s message to world leaders: “Your countries are going to hell” because of lax immigration policies, the U.S. president said during his hourlong Tuesday address before the General Assembly. “It’s time to end the failed experiment of open borders. You have to end it now. It’s — I can tell you. I’m really good at this stuff. Your countries are going to hell,” he said.
POTUS: “You’re destroying your countries. They’re being destroyed. Europe is in serious trouble. They’ve been invaded by a force of illegal aliens like nobody’s ever seen before. Illegal aliens are pouring into Europe, and nobody’s doing anything to change it, to get them out. It’s not sustainable.”
“I’ve been right about everything,” Trump told the UN as the New York Times reports he spent much of his time “making and repeating a slew of misleading and false claims” about U.S. manufacturing, renewable energy, electricity prices in the U.S., and Sharia law in London. CNN annotated select portions of the speech in a separate fact check, here.
Historian’s reax: “The speech was a dark fantasy of narcissism and Christian nationalism that struck at the heart of the very concept of the United Nations,” Heather Cox Richardson wrote after Trump’s UNGA remarks. His speech also “depict[ed] a fantasy world in which he had single-handedly saved the world,” with Trump boasting that just last year, “our country was in deep trouble. But today, just eight months into my administration, we are the hottest country anywhere in the world and there is no other country even close.”
Also: One senior foreign diplomat at the UN texted Ishaan Tharoor of the Washington Post, “This man is stark, raving mad. Do Americans not see how embarrassing this is?”
China’s missiles on parade: showpieces or showstoppers? John S. Van Oudenaren and Peter Singer judge five of the weapons debuted earlier this month: new ICBMs, hypersonic missiles, and SAMs. Read that, here.
Iran is rebuilding its missile sites, but lacks crucial rocket-fuel mixers, AP reports off its analysis of satellite photos. “Reconstituting the missile program is crucial for the Islamic Republic, which believes another round of war with Israel may happen. The missiles are one of Iran’s few military deterrents after the war decimated its air defense systems — something that Tehran long has insisted will never be included in negotiations with the West.” Read on, here.
Additional reading:
- “After mechanical challenges, UN says Trump's team to blame for nonworking escalator and teleprompter,” the Associated Press reported Tuesday; Reuters has similar coverage;
- And “Why Can’t Russia and China Agree on the Power of Siberia 2 Gas Pipeline?” Sergey Vakulenko asked Monday for the Carnegie Endowment for International Peace.
Around the Defense Department
Has Space Force cracked the code on faster acquisition? Acquisition reform legislation may be on the way, but Space Force officials say they’re ahead of the curve. “A lot of the concepts and ideas and structure and authorities and processes, we’re already doing,” Lt. Gen. Philip Garrant, leader of Space Systems Command, said in an interview on the sidelines of the AMOS conference in Hawaii.
The service is amid an organizational transformation, aligning acquisition programs with mission areas under units it calls systems deltas. The change, along with the commercial strategy signed in 2024, has changed how the service’s program executives and program directors look at acquisition and commercial providers, Garrant said. Defense One’s Jennifer Hlad reports, here.
Space Force leaders are prepping a threat guide to shape plans and procurement. The document—“a game changer”—will outline expected enemy trends through 2040, Chief of Space Operations Gen. Chance Saltzman said Tuesday at Air & Space Force Association’s Air, Space and Cyber Conference. Defense One’s Tom Novelly has more from Saltzman’s speech, here.
RTX, Shield AI to make the “brains” for the Air Force’s robot wingmen, Aviation Week reports: “The RTX mission autonomy software suite will be integrated into the General Atomics Aeronautical Systems Inc. (GA-ASI) YFQ-42, and Shield AI’s Hivemind-branded system will control the Anduril YFQ-44, sources tell Aviation Week.” More, here.
CENTCOM has a new “innovation task force.” Led by U.S. Central Command’s chief technology officer, the new Rapid Employment Joint Task Force is meant to outfit deployed forces with cutting-edge capabilities, the command announced on Tuesday.
Double-reversal on DACOWITS: Defense Secretary Pete Hegseth has decided to eliminate the Defense Advisory Committee on Women in the Services, just three weeks after sending a memo directing the 75-year-old advisory group to continue operating.
Hegseth now believes the group is “advancing a divisive feminist agenda,” Pentagon spox Kingsley Wilson said Tuesday.
Context: “The former Fox News host, who has previously questioned the role of women in combat, has also shut down a program that boosts the number of women in peace building and conflict prevention efforts, calling it “woke” and “divisive,” Politico reports.
And lastly, here’s the latest reax to the Pentagon’s demand that journalists report only what officials tell them:
- NYT’s David Sanger: “Coming amid a broader push by the administration to clamp down on criticism of Mr. Trump, the scope of Mr. Hegseth’s effort stunned news organizations, which are considering how best to keep the policy from coming into effect, including potential legal challenges.”
- Military Reporters and Editors: “MRE condemns in the strongest possible terms any attempt by this Pentagon or any other entity to curb the press’ freedoms and leave the American public in the dark on what its military is doing at home and abroad,” writes the non-profit journalists’ organization. “The Secretary of Defense and the military are accountable to the American people. A hollowed press corps in the Pentagon will only ensure that fewer answers are provided to the public about how the government spends its taxpayer dollars, where America’s sons and daughters are deploying on behalf of our country and the welfare of military families.”
- Sen. Jack Reed, D-R.I.: “This is an ill-advised affront to free speech and freedom of the press. This goes beyond attempting to suppress criticism—Mr. Hegseth’s goal appears to be eliminating a critical check on government corruption, unlawful practices, and the misuse of taxpayer dollars.”
Additional reading:
- “America Is Blowing Up Boats and Asking Questions Later,” the New York Times editorial board warned in a commentary published Wednesday;
- “Veterans who lack citizenship fear being swept up in Trump's deportations,” AP reported Wednesday;
- And “Navy issues instructions for reporting improper social media use,” Navy Times reported Monday.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Three sophisticated malware families have emerged as significant threats to telecommunications and manufacturing sectors across Central and South Asia, representing a coordinated campaign that exploits legitimate system processes to deliver powerful backdoor capabilities.
RainyDay, Turian, and a new variant of PlugX have been systematically abusing DLL search order hijacking techniques to execute malicious loaders, establishing persistent footholds within targeted networks since 2022.
The convergence of these malware families reveals a sophisticated operation that leverages shared infrastructure and methodologies, suggesting potential collaboration between previously distinct threat actors.
All three malware variants exploit the same legitimate Mobile Popup Application for DLL sideloading, employ identical RC4 encryption keys, and utilize the XOR-RC4-RtlDecompressBuffer algorithm for payload decryption.
This technical overlap indicates either shared development resources or coordinated distribution among the operating groups.
The campaign primarily targets organizations within the telecommunications and manufacturing sectors, focusing on countries throughout Central and South Asia.
The strategic selection of these industries and geographic regions aligns with espionage objectives, particularly given the critical infrastructure and sensitive communications these sectors handle.
.webp)
Comparison between the Naikon and the BackdoorDiplomacy by using the diamond model (Source – Cisco Talos) The sustained nature of the campaign, active since at least 2022 with some components tracing back to 2016, demonstrates the persistent and patient approach characteristic of advanced persistent threat operations.
Cisco Talos analysts identified this campaign through extensive hunting efforts that revealed the interconnected nature of these seemingly separate malware families.
The discovery emerged during investigations into RainyDay backdoor activities, where researchers uncovered the shared abuse of legitimate applications and consistent encryption methodologies across all three families.
This finding enabled attribution assessments linking the activities to known threat groups, specifically Naikon and potentially BackdoorDiplomacy.
The technical sophistication of these attacks extends beyond simple malware deployment, incorporating advanced evasion techniques and persistence mechanisms that allow for long-term network compromise.
Keylogger components embedded within the PlugX variant have demonstrated successful persistence spanning nearly two years in victim environments, highlighting the effectiveness of these tools in maintaining covert access.
The malware families share not only technical implementation similarities but also targeting patterns and operational methodologies that suggest coordinated planning and execution.
DLL Search Order Hijacking Exploitation Mechanism
The core infection mechanism employed by RainyDay, Turian, and the PlugX variant centers on exploiting Windows DLL search order vulnerabilities to achieve code execution through legitimate processes.
.webp)
RainyDay malware flow (Source – Cisco Talos) This technique involves placing malicious DLL files in locations where Windows will load them instead of legitimate libraries, effectively hijacking the normal application loading process.
The malware families achieve this by abusing legitimate applications, specifically targeting the Mobile Popup Application as their primary vehicle for DLL sideloading operations.
When these legitimate applications attempt to load required DLL files, the Windows loader follows a predetermined search order to locate the necessary libraries.
The attackers exploit this behavior by placing their malicious DLL loaders in directories that are searched before the legitimate library locations.
Once the malicious DLL is loaded by the legitimate process, it gains execution context within a trusted application, allowing it to operate with reduced suspicion from security monitoring systems.
The technical implementation involves three distinct loader files, each corresponding to their respective malware families.
.webp)
New PlugX variant malware flow (Source – Cisco Talos) The RainyDay loader targets and decrypts data from “rdmin.src” files, while the PlugX variant processes “Mcsitesdvisor.afx” files, and Turian handles “winslivation.dat” files.
Each loader utilizes XOR encryption as the initial decryption layer before proceeding to more complex payload processing stages.
The shared codebase among these loaders reveals sophisticated development coordination, with all three implementations using the GetModuleFileNameA API to obtain executable paths and reading encrypted data from hardcoded filenames within the infection directory.
The decrypted shellcode follows identical formatting standards, containing RC4-encrypted and LZNT1-compressed data that undergoes a multi-stage unpacking process.
This process ultimately deploys the final malware payload into memory through CALL or JMP instruction execution.
Analysis of Program Database (PDB) paths embedded within the loader samples provides insight into the development process and naming conventions used by the threat actors.
.webp)
Turian malware flow (Source – Cisco Talos) The Turian loader contains paths referencing “icmpsh-master” with Chinese text translating to “provide web version,” suggesting modifications for web-based command and control infrastructure.
These technical artifacts demonstrate the methodical approach taken in developing and customizing these tools for specific operational requirements, while maintaining shared functionality across the different malware families.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Companies in the legal services, software-as-a-service (SaaS) providers, Business Process Outsourcers (BPOs), and technology sectors in the U.S. have been targeted by a suspected China-nexus cyber espionage group to deliver a known backdoor referred to as BRICKSTORM. The activity, attributed to UNC5221 and closely related, suspected China-nexus threat clusters, is designed to facilitate
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In recent months, a sophisticated threat actor leveraging North Korean IT worker employment fraud has surfaced, demonstrating how social engineering can bypass traditional security controls.
The adversary’s modus operandi involves posing as remote software engineers, submitting legitimate-looking résumés, completing coding assessments, and ultimately blending into corporate environments.
Initial signs were subtle: benign emails, genuine code submissions, and standard hiring communications that raised no immediate alarms.
Early in the campaign, a candidate using the alias “Kyle Lankford” applied for a Principal Software Engineer role at a major U.S. healthcare provider.
The recruitment process proceeded normally, with all interactions routed through common platforms such as Gmail and CodeSignal. No malicious URLs were shared, and no malware-laced attachments appeared.
Trellix analysts noted that the complete absence of technical anomalies in these communications enabled the attacker to advance deeper into the organization’s network without triggering endpoint defenses.
Upon completing the coding assessment on July 16, 2025, the applicant sent a polite follow-up email on August 4. Hidden in plain sight, the message contained no unusual headers or attachments:-
From: Kyle Lankford <kyle12lank@gmail.com> To: recruiter@healthprovider.com Subject: Re: CodeSignal Assessment—Principal Software Engineer Date: Mon, 4 Aug 2025 09:19:34 -0400 Hi [Recruiter Name], I hope you had a great weekend. I wanted to follow up regarding the Principal Software Engineer position. I completed the CodeSignal assessment on 7/16 and was wondering if there are any updates or next steps. I look forward to hearing from you. Thank you, KyleDespite the innocuous nature of the emails, Trellix researchers identified the campaign during a proactive threat hunt driven by open-source intelligence.
By correlating over 1,400 email addresses linked to DPRK-operated accounts with internal email telemetry, the security team detected an account that matched multiple risk indicators.
Further analysis confirmed that the job applicant had established legitimate corporate credentials, granting access to internal systems and sensitive data repositories.
Infection Mechanism: Credential-Based Network Infiltration
Unlike traditional malware campaigns that rely on malicious payloads, this threat actor exploits credential-based infiltration to establish a foothold.
Once the imposter’s corporate account was provisioned, the attacker employed standard remote access protocols—such as Secure Shell (SSH) and Remote Desktop Protocol (RDP)—to explore the network.
Using legitimate administrative tools, they mapped out directory structures, harvested service account credentials stored in accessible repositories, and exfiltrated sensitive project files without deploying any detectable malware.
.webp)
Wanted by the FBI (Source – Trellix) This approach not only evades signature-based detection but also leverages existing trust relationships within the environment, making it exceedingly difficult to distinguish the attacker from a genuine employee.
By exploiting the organization’s hiring processes, the adversary bypassed perimeter defenses and insider-threat monitoring.
This case underscores the necessity of integrating behavioral analytics, continuous identity validation, and rigorous background checks into security workflows to mitigate such non-malware–centric attacks.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post New North Korean IT Worker With Innocent Job Application Get Access to Organization’s Network appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybersecurity researchers have disclosed two security flaws in Wondershare RepairIt that exposed private user data and potentially exposed the system to artificial intelligence (AI) model tampering and supply chain risks. The critical-rated vulnerabilities in question, discovered by Trend Micro, are listed below – CVE-2025-10643 (CVSS score: 9.1) – An authentication bypass vulnerability that
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Security researchers have discovered a wave of attacks that use in-memory PE loaders to slip past endpoint detection and response (EDR) systems. In these incidents, threat actors deliver a small downloader to victims via malicious links or attachments. Once executed, the downloader fetches a full Portable Executable (PE) file from a remote server and maps it directly […]
The post Attackers Bypass EDR by Using In-Memory PE Loaders Delivered via Malicious Downloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A person in his forties has been arrested in connection with a cyber-attack that caused days of disruption at several major European airports, including London Heathrow. The National Crime Agency (NCA) confirmed that officers detained the man on Tuesday evening in West Sussex on suspicion of offences under the Computer Misuse Act. He has since […]
The post UK Police Arrest Suspect Tied to Ransomware Attack on European Airports appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A comprehensive security analysis has revealed a widespread vulnerability affecting Firebase-powered mobile applications, with over 150 popular apps inadvertently exposing sensitive user data through misconfigured Google Firebase services. The scope of this security crisis dwarfs previous incidents, potentially affecting thousands of applications with millions of downloads worldwide. Security researcher analysis of approximately 1,200 mobile applications […]
The post Multiple Apps on Google’s Firebase Platform Exposing Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers have discovered a way to exploit Google’s core services, Google Meet, YouTube, Chrome update servers and more using a technique called domain fronting. By making their malicious traffic appear as legitimate connections to high-trust domains, adversaries can tunnel data through Google’s backbone infrastructure without raising suspicion. This research builds on previous demonstrations of tunneling […]
The post Attackers Use Domain Fronting to Tunnel Malicious Traffic via Google Meet, YouTube and Chrome Update Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
