1010.cx

  • Modified OpenSSH Binaries Let Velvet Ant Steal Passwords, Log Commands, and Hide Activity

    ·

    ,

    A long-running, stealthy campaign attributed to the China-nexus actor tracked as Velvet Ant has been found to include deeply engineered backdoors in the authentication stack: modified OpenSSH binaries and tampered PAM modules that exfiltrate credentials, record every executed command, and conceal attacker activity. The discovery, part of Sygnia’s Operation Highland investigation, reveals nearly a decade […]

    The post Modified OpenSSH Binaries Let Velvet Ant Steal Passwords, Log Commands, and Hide Activity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Financially Motivated Hackers Turn Legitimate IT Tools Into Remote Access Payloads

    ·

    ,

    A novel evolution of LLMjacking: a threat actor leveraging a publicly exposed Ollama model server as the reasoning engine for an automated, multi-stage offensive framework. Rather than using the model for chat or resale, the attacker integrated unauthenticated model inference into a VAPT-style pipeline that scans targets, maps vulnerabilities, synthesizes proof-of-concept exploits, and attempts command […]

    The post Financially Motivated Hackers Turn Legitimate IT Tools Into Remote Access Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AI-Generated ClickFix Campaign Delivers SmartRAT Banking Trojan via Fake Brazilian Bank Website

    ·

    , ,

    Multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools.  One striking campaign combined an AI-created fake Brazilian bank site with a ClickFix social-engineering lure to deliver a PowerShell-based remote access trojan Zscaler named SmartRAT. The operation demonstrates how low-cost AI tooling reduces development friction for attackers while preserving sophisticated post-exploitation […]

    The post AI-Generated ClickFix Campaign Delivers SmartRAT Banking Trojan via Fake Brazilian Bank Website appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Defense Business Brief: Tech Summit recap; Invoking the Defense Production Act; and INDOPACOM’s name change

    ·

    The Defense Production Act has entered the munitions chat even as concerns persist about weapons stockpiles spent in the U.S.-Israel war on Iran.  

    “It's not a sudden shift, it's taken us nine months to make this work,” Michael Cadenazzi, the Pentagon’s industrial base policy chief, said during an event Tuesday at the Center for a New American Security on Tuesday. “So that was one of my first chores when I came into the Pentagon back in September was to launch something called a ‘voluntary agreement,’” under the Defense Production Act. 

    Cadenazzi’s comments follow the White House’s quiet invocation of the Defense Production Act. The DPA is up for reauthorization and expires Sept. 30. 

    The Pentagon currently has two such arrangements: the Civil Reserve Air Fleet, where the government can call on commercial airlines and aerospace manufacturers for national needs; and the Voluntary Intermodal Sealift Agreement for maritime vessels, which allows U.S. merchant vessels to participate in exchange for priority access to Defense Department cargoes during peacetime. 

    “This tool and this designation allows us…to talk about different things like electronics, materials, ammonium perchlorate, rocket motors” and bring competing companies in to discuss needs and challenges without worrying about “antitrust rules,” Cadenazzi said. 

    “It's a way for us to communicate and leverage industry using a specific set of authorities. In this particular case, our interest is using voluntary agreements as a way to bring industry in—in an antitrust environment—to go ahead and have conversations with them, for us to articulate problems to them around nasty issues in the supply chain or the industrial base that allow them to communicate and work together, essentially collude, for want of a better term.”

    The DPA authority could also create a steady demand signal, Cadenazzi said, noting voluntary agreements could also be used to include a myriad of defense suppliers, such as tire makers.

    “We want these to be set up as an enduring capability, so expect to see more of these. I want to bring the tires people in to have conversations about tires,” he said. “It's just the gritty underbelly of the industrial base, but I think they deserve a lot more attention, and this is one of the tools we want to bring to bear.”

    Welcome

    You’ve reached the Defense Business Brief, where we dig into what the Pentagon buys, who they’re buying from, and why. Send along your tips, feedback, and cold-plunge soundtrack recommendations to lwilliams@defenseone.com. Check out the Defense Business Brief archive here, and tell your friends to subscribe!

    My D1 Tech Summit takeaway: The Office of Naval Research is working on a strategy to bring new tech to the fleet faster. The plan, which is in its final production stages, will spell out what the service wants and highlight key areas of scientific interest, like having one human controlling a swarm of drones. 

    • “That is a lot harder than people realize because people think, oh, you have one joystick and 100 drones are moving. Well, in practice, that looks like little kids playing soccer…And that's not good enough for our American warfighters,” Rachel Riley, head of naval research, said during Defense One’s annual Tech Summit event Tuesday.  
    • Other challenges with drone swarming include next-generation algorithms and command and control across platforms—which can include the air, sea and subsea.
    • “Folks think that if you can fly a UAV, you can fly a UUV—kind of a different game,” Riley said. The Navy is also “thinking about how can we generate new sensors and effectors that are scalable, feasible at the edge with the right number of compute [that can] fit on a relatively small platform. These are all technical problems that are really gnarly and

    stacking them on top of one another is not linear, it's exponential.”

    • Plus, the Navy is looking to nature for clues on how to control a massive number of robots.
    • “We're still doing some really interesting academic research that has to do with, for example, how insects swarm and how they coordinate,” Riley said, because that can inform a mathematical model that can be applied to maritime drones. 

    Making moves + other news

    • INDOPACOM changed its name back to U.S. Pacific Command.
    • Govini is now Air.
    • The Army direct-commissioned three more tech executives. Oh, and they also bought thousands of IVAS headsets they don’t plan to use…
    • Seaglider maker Regent’s defense division is celebrating its first anniversary as the company finishes up a 255,000-square-foot manufacturing facility in North Kingstown, Rhode Island.
    • The Defense Innovation Unit awarded drone maker Mach Industries a contract for its Runway Independent Maritime Expeditionary Strike, or RIMES, program.

    One last Tech Summit view. We had a stacked line up, with NATO’s top digital transformation official, Maj. Gen. Dominique Luzeaux, and the head of the National Geospatial Intelligence Agency, Rear Adm. Michael Baker. There were also a couple of great industrial base panels led by yours truly: one that tackled startup culture and special operations with Shield AI’s co-founder Brandon Tseng, Ondas’ chairman and CEO Eric Brock, Gregory Coleman of 5Side Strategy; and another on how private capital is influencing the defense sector with Red Cell Partners’ Veronica Daigle, CSIS’s Jerry McGinn, and DIU’s Kedar Pavgi. Visit DefenseOne.com for coverage of the event. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Use Reporter Impersonation to Target C-Suite Executives in Social Engineering Attacks

    ·

    ,

    A recent engagement demonstrates how persuasive pretexts and careful reconnaissance let attackers bypass technical controls by exploiting human trust at the executive level. Rather than inventing a sophisticated exploit, testers impersonated a journalist reporting an anonymous tip about hazardous-waste disposal at a client’s high-profile construction site. The attack relied on credibility, urgency, and conversational email […]

    The post Hackers Use Reporter Impersonation to Target C-Suite Executives in Social Engineering Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious LNK Files Disguised as Job Resumes Target Corporate Employees

    ·

    ,

    Malicious LNK files masquerading as job resumes are being used in targeted campaigns against corporate employees, combining social engineering with multi-stage malware delivery to achieve stealthy persistence and remote access. Attackers craft filenames that include company names and job titles for example, (RESUME)Domestic Company Name_Job Title***.LNK and embed a genuine-looking decoy document inside the shortcut. […]

    The post Malicious LNK Files Disguised as Job Resumes Target Corporate Employees appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Use AI-Generated YouTube Narrators to Promote Crypto Clipper Malware

    ·

    , , , ,

    A sophisticated social‑engineering campaign is leveraging AI‑generated YouTube narrators, ghost accounts across multiple platforms, and manipulated reputation signals to distribute a Rust‑based clipboard hijacker that steals cryptocurrency by replacing wallet addresses on victims’ clipboards. The operation centers on a WordPress phishing hub that advertises “sniper” bots, crash‑game predictors and other get‑rich‑quick tools aimed at crypto […]

    The post Hackers Use AI-Generated YouTube Narrators to Promote Crypto Clipper Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anduril, General Atomics get Air Force contracts to build first drone wingmen

    ·

    Air Force leaders have given initial production contracts to Anduril and General Atomics, which will both build collaborative combat aircraft based on their respective prototypes. Northrop Grumman’s self-financed offering was not selected.

    Several companies also received money to develop software that will compete to pilot the service’s future fleet of drone wingmen.

    The Increment 1 CCA contracts are for three lots of the drone wingmen, Air Force Col. Timothy Helfrich, the portfolio acquisition executive for fighters and advanced aircraft, told reporters during a briefing on Wednesday. He declined to say how many CCAs would be in each lot, nor how much each would cost.

    Helfrich told Defense One in March that the Air Force was beating its goal of buying each CCA for about one-third of the cost of an F-35 fighter jet. The Defense Department is seeking nearly $1 billion to buy CCAs, 2027 budget documents show. 

    The announcement made winners of both Anduril and General Atomics in their two-year battle to furnish the Air Force’s first CCAs.

    But more competitions are underway. Three firms are vying to build the drone wingman’s autonomous software platform. As well, nine vendors are competing for Increment 2 of the CCA program.

    “By moving fast from competitive selection into full-scale manufacturing, we position ourselves

    to field highly credible and combat-ready semi-autonomous systems to stay ahead of the pacing challenge,” Air Force Secretary Troy Meink said in a press release. “These contracts reaffirm our confidence in the strategic path forward for the program to procure over 150 combat capable CCA by the end of the decade.”

    Both Anduril and General Atomics had setbacks while prototyping their CCA variants. 

    In April, General Atomics’ YFQ-42A Dark Merlin crashed at the company’s California airport after an autopilot program error. The incident halted flight testing for a little more than a month. 

    “This is an exciting day for our company and the nation,” General Atomics President David Alexander said in a Wednesday press release. “Moving to production on FQ-42A is the result of an extraordinary partnership and many years of investments between General Atomics and the U.S. Air Force. We’ve been preparing for this order, and manufacturing is already well underway.”

    Anduril’s push for semi-autonomous software led to a months-long delay in notching its first flight. The company got its YFQ-44A Fury prototype off the ground in late October.

    “We have been refining, testing, and iterating on our production system, in parallel with aircraft development, for the past two years. We have already implemented our full rate production processes and tooling on prototype aircraft, identifying and addressing issues during prototyping to streamline the transition into production,” Mark Shushnar, Anduril’s vice president for autonomous airpower, said in a statement. “The Air Force’s decision marks the first time that a new company has won a fighter aircraft program since the 1970s.”

    The “Y” will be dropped from Anduril and General Atomics CCAs names to show they’re no longer prototypes.

    Autonomy contracts

    The Air Force also awarded CCA mission-autonomy production options to six companies. 

    A baseline, six-year contract vehicle was extended to Anduril, General Atomics, Lockheed Martin, Shield AI, Northrop Grumman, and RTX Collins, to create a pool of vendors eligible to build the autonomy software.

    Anduril, Shield AI, and RTX Collins received additional Air Force production contracts and will compete to build the CCA’s final autonomous software. After six months, the Air Force plans to review those firms' initial performance. A second selection will follow that initial review, with a final selection expected by Summer 2027.

    “Mission autonomy is the cornerstone of the CCA concept, and leveraging a competitive, multi-

    vendor environment ensures we capture the latest technology,” Meink said in the news release. “This approach guarantees our airmen are equipped with state-of-the-art capabilities today but keeps the door open for the breakthroughs necessary to maintain air superiority.”

    The Air Force said its software contract will use a “first-of-its-kind” award that is tied directly to reviews from the troops.

    “The Air Force will only pay the entire licensing fee if a vendor provides a combat capability aligned with warfighter needs and feedback,” the news release said. “The licensing approach also allows the Air Force to award software licenses to any of the six vendors within the pool at any point over the next six years.”

    Earlier this year, the Air Force tested the government-owned Autonomy Government Reference Architecture, or A-GR, by  placing RTX Collins software on General Atomics YFQ-42 aircraft and Shield AI’s technology on Anduril's YFQ-44 CCA. Compliance with the A-GRA is mandatory for vendors so the service can enable a mix-and-match approach to the software and hardware, the service said in the news release.

    “Open systems architecture is critical in modern warfare,” Gen. Kenneth Wilsbach, the Air Force chief of staff, said in the news release. “It allows us to capitalize on the most advanced autonomy solutions to ensure we incorporate the best technology in our weapon systems.”

    Late last year, the Air Force announced that nine vendors would receive money to develop a second iteration of CCAs. Helfrich did not have any timeline updates on the Increment 2 competition.

    “The government is always learning through both CCA Increment 2 and Increment 1 and honing in on what is needed from Increment 2,” Helfrich said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA now has full Mythos Preview access, people familiar say

    ·

    The Cybersecurity and Infrastructure Security Agency now has full access to Anthropic’s flagship Mythos Preview model, according to a U.S. official and a second person familiar with the matter.

    The cyberdefense agency received access around a week ago, the official said. Both sources spoke on the condition of anonymity to discuss internal deliberations. 

    The White House Office of the National Cyber Director has not yet set clear parameters for how the agency should use the model, the official added.

    The lack of parameters echoes earlier Nextgov/FCW reporting showing federal tech leaders have privately complained that ONCD has not adequately briefed them on implementing or using the model for vulnerability scanning.

    CISA did not respond to a request for comment. 

    Over the last few months, Anthropic surgically rolled out Mythos Preview to select organizations and recently expanded this effort — dubbed Project Glasswing — to partners in industry and other nations. The model has been distributed through a non-public process on grounds that, in the wrong hands, it can significantly boost adversaries’ hacking capabilities.

    CISA was not included in an initial Mythos rollout, Axios reported in April. Last week, Nextgov/FCW reported that agency access to the model was imminent.

    Mythos Preview is different from Anthropic’s similar-sounding Mythos 5 successor model, which the U.S. effectively banned over the weekend via an export control mechanism alongside the AI company’s Fable 5 model. The move has caused uproar across the cyber and AI community.

    Both Mythos 5 and Mythos Preview have only been made available to vetted providers via Project Glasswing.

    The Trump administration’s approach to AI has shifted in recent months as officials confront an emerging class of models that can rapidly identify vulnerabilities across computer networks, becoming a major driver of discussions over how AI systems could reshape the future of cybersecurity.

    Models like Mythos can help federal agencies identify vulnerabilities faster by analyzing large amounts of software and system data, then surfacing weaknesses and possible attack paths for human defenders to review. Conversely, cyber operators in the intelligence community and Defense Department can also use such models to accelerate their offensive hacking operations.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments

    ·

    An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research. The threat actor also has at their disposal a dedicated WordPress phishing page that acts as the central hub, alongside GitHub and SourceForge projects promoted by fake accounts, a YouTube channel, and a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶