• Despite two centuries of evolution, the structure of a modern military staff would be recognizable to Napoleon. At the same time, military organizations have struggled to incorporate new technologies as they adapt to new domains – air, space and information – in modern war. 

    The sizes of military headquarters have grown to accommodate the expanded information flows and decision points of these new facets of warfare. The result is diminishing marginal returns and a coordination nightmare – too many cooks in the kitchen – that risks jeopardizing mission command. 

    AI agents – autonomous, goal-oriented software powered by large language models – can automate routine staff tasks, compress decision timelines and enable smaller, more resilient command posts. They can shrink the staff while also making it more effective. 

    As an international relations scholar and reserve officer in the U.S. Army who studies military strategy, I see both the opportunity afforded by the technology and the acute need for change.

    That need stems from the reality that today’s command structures still mirror Napoleon’s field headquarters in both form and function – industrial-age architectures built for massed armies. Over time, these staffs have ballooned in size, making coordination cumbersome. They also result in sprawling command posts that modern precision artillery, missiles and drones can target effectively and electronic warfare can readily disrupt. 

    Russia’s so-called “Graveyard of Command Posts” in Ukraine vividly illustrates how static headquarters where opponents can mass precision artillery, missiles and drones become liabilities on a modern battlefield. 

    Military planners now see a world in which AI agents – autonomous, goal-oriented software that can perceive, decide and act on their own initiative – are mature enough to deploy in command systems. These agents promise to automate the fusion of multiple sources of intelligence, threat-modeling, and even limited decision cycles in support of a commander’s goals. There is still a human in the loop, but the humans will be able to issue commands faster and receive more timely and contextual updates from the battlefield. 

    These AI agents can parse doctrinal manuals, draft operational plans and generate courses of action, which helps accelerate the tempo of military operations. Experiments – including efforts I ran at Marine Corps University – have demonstrated how even basic large language models can accelerate staff estimates and inject creative, data-driven options into the planning process. These efforts point to the end of traditional staff roles. 

    There will still be people – war is a human endeavor – and ethics will still factor into streams of algorithms making decisions. But the people who remain deployed are likely to gain the ability to navigate mass volumes of information with the help of AI agents.

    These teams are likely to be smaller than modern staffs. AI agents will allow teams to manage multiple planning groups simultaneously.

    For example, they will be able to use more dynamic red teaming techniques – role-playing the opposition – and vary key assumptions to create a wider menu of options than traditional plans. The time saved not having to build PowerPoint slides and updating staff estimates will be shifted to contingency analysis – asking “what if” questions – and building operational assessment frameworks – conceptual maps of how a plan is likely to play out in a particular situation – that provide more flexibility to commanders. 

    To explore the optimal design of this AI agent-augmented staff, I led a team of researchers at the bipartisan think tank Center for Strategic & International Studies’ Futures Lab to explore alternatives. The team developed three baseline scenarios reflecting what most military analysts are seeing as the key operational problems in modern great power competition: joint blockades, firepower strikes and joint island campaigns. Joint refers to an action coordinated among multiple branches of a military.

    In the example of China and Taiwan, joint blockades describe how China could isolate the island nation and either starve it or set conditions for an invasion. Firepower strikes describe how Beijing could fire salvos of missiles – similar to what Russia is doing in Ukraine – to destroy key military centers and even critical infrastructure. Last, in Chinese doctrine, a Joint Island Landing Campaign describes the cross-strait invasion their military has spent decades refining.

    Any AI agent-augmented staff should be able to manage warfighting functions across these three operational scenarios.

    The research team found that the best model kept humans in the loop and focused on feedback loops. This approach – called the Adaptive Staff Model and based on pioneering work by sociologist Andrew Abbott – embeds AI agents within continuous human-machine feedback loops, drawing on doctrine, history and real-time data to evolve plans on the fly. 

    In this model, military planning is ongoing and never complete, and focused more on generating a menu of options for the commander to consider, refine and enact. The research team tested the approach with multiple AI models and found that it outperformed alternatives in each case. 

    AI agents are not without risk. First, they can be overly generalized, if not biased. Foundation models – AI models trained on extremely large datasets and adaptable to a wide range of tasks – know more about pop culture than war and require refinement. This makes it important to benchmark agents to understand their strengths and limitations.

    Second, absent training in AI fundamentals and advanced analytical reasoning, many users tend to use models as a substitute for critical thinking. No smart model can make up for a dumb, or worse, lazy user. 

    To take advantage of AI agents, the U.S. military will need to institutionalize building and adapting agents, include adaptive agents in war games, and overhaul doctrine and training to account for human-machine teams. This will require a number of changes. 

    First, the military will need to invest in additional computational power to build the infrastructure required to run AI agents across military formations. Second, they will need to develop additional cybersecurity measures and conduct stress tests to ensure the agent-augmented staff isn’t vulnerable when attacked across multiple domains, including cyberspace and the electromagnetic spectrum. 

    Third, and most important, the military will need to dramatically change how it educates its officers. Officers will have to learn how AI agents work, including how to build them, and start using the classroom as a lab to develop new approaches to the age-old art of military command and decision-making. This could include revamping some military schools to focus on AI, a concept floated in the White House’s AI Action Plan released on July 23, 2025. 

    Absent these reforms, the military is likely to remain stuck in the Napoleonic staff trap: adding more people to solve ever more complex problems.

    This article is republished from The Conversation under a Creative Commons license. Read the original article.

    The Conversation

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity experts discovered a complex supply chain attack that originated from the Python Package Index (PyPI) in a recent disclosure from Zscaler ThreatLabz. The package in question, termed “termncolor,” masquerades as a benign color utility for Python terminals but covertly imports a malicious dependency named “colorinal.” This dependency serves as the initial infection vector, triggering […]

    The post Weaponized Python Package “termncolor” Uses Windows Run Key for Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have lifted the lid on the threat actors’ exploitation of a now-patched security flaw in Microsoft Windows to deploy the PipeMagic malware in RansomExx ransomware attacks. The attacks involve the exploitation of CVE-2025-29824, a privilege escalation vulnerability impacting the Windows Common Log File System (CLFS) that was addressed by Microsoft in April 2025,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • tLab Technologies, a Kazakhstan-based company that specializes in advanced threat prevention, discovered one of the first known phishing attempts in the region that targeted public sector clients in a recent cybersecurity incident. The attack leveraged a professionally crafted fake login page to harvest user credentials, employing Telegram’s Bot API as a covert exfiltration channel. This […]

    The post Threat Actors Exploit Telegram as the Communication Channel to Exfiltrate Stolen Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A series of critical vulnerabilities across multiple internal Intel websites allowed for the complete exfiltration of the company’s global employee database and access to confidential supplier information.

    The flaws, stemming from basic security oversights, exposed the personal details of over 270,000 Intel employees and workers.

    The investigation from Eaton Works revealed that at least four separate internal web applications contained severe security holes, including client-side authentication bypasses, hardcoded credentials, and a lack of server-side validation.

    These vulnerabilities provided four distinct pathways for an unauthorized user to download the entire employee database.

    One of the most significant breaches involved a website for Intel India employees to order business cards. The research discovered it was possible to bypass the corporate Microsoft Azure login prompt by making a simple modification to the site’s JavaScript.

    Once past the login, the researcher found an unauthenticated API that would issue a valid access token. This token could then be used to query a “worker” API.

    By removing the search filter from the API request, the system returned a nearly 1 GB JSON file containing the names, job roles, managers, phone numbers, and mailbox addresses for Intel’s entire global workforce.

    Hierarchy Owners
    Hierarchy Owners

    This pattern of lax security was repeated across other internal systems. A “Product Hierarchy” management website contained hardcoded credentials for its backend services.

    The password, while encrypted, used a notoriously weak AES key—’1234567890123456’—making it trivial to decrypt. This provided a second method to access the same employee database, Eaton Works said.

    Encryption
    Encryption

    Another “Product Onboarding” site, presumed to be used for managing entries on Intel’s public ARK product database, contained a trove of hardcoded secrets, including multiple API keys and even a GitHub personal access token.

    The fourth major vulnerability was found in Intel’s Supplier EHS IP Management System (SEIMS), a portal for managing intellectual property with suppliers. The researcher bypassed the login by modifying the code that checked for a valid token.

    From there, they gained administrative access by manipulating API responses, allowing them to view confidential supplier data, including details of non-disclosure agreements (NDAs).

    Shockingly, the system’s backend APIs accepted a fabricated authorization token with the value “Not Autorized”—a typo that highlighted a complete breakdown in server-side security checks.

    The researcher responsibly disclosed all findings to Intel beginning on October 14, 2024. The company’s bug bounty program policy excludes web infrastructure from monetary rewards, directing such reports to a security email inbox.

    While the researcher received only an automated reply and no direct communication, they confirmed that Intel remediated all the reported vulnerabilities before the standard 90-day disclosure period ended.

    Email response
    Email response

    While no highly sensitive data like social security numbers or salaries were exposed, the breach of employee PII and confidential partner data on such a massive scale represents a significant security lapse for the technology giant.

    Safely detonate suspicious files to uncover threats, enrich your investigations, and cut incident response time. Start with an ANYRUN sandbox trial → 

    The post Intel Websites Exploited to Hack Every Intel Employee and View Confidential Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • White House officials won’t yet share publicly what they learned during Friday’s private summit between Donald Trump and Vladimir Putin in Alaska. That information is likely to trickle out this week after an urgent and highly unusual entourage of European leaders descends on Washington for talks with Trump and Ukrainian President Volodymir Zelenskyy. 

    But Trump alluded to some likely aspects, including conceding Crimea to Russia and blocking Ukraine’s path to membership in the NATO alliance, writing Sunday evening on social media. 

    Summit recap: After talking with Putin, Trump announced he’s dropped his demand for a ceasefire and insisted direct negotiations for a peace agreement were the best way forward. Trump’s main leverage—additional sanctions against Russia and its petroleum customers like India—would likely end peace negotiations and continue the war for at least 12 to 18 months, Secretary of State Marco Rubio said on “Face the Nation” from CBS News on Sunday. 

    Trump reax: “Because of what happened today, I think I don’t have to think about [further sanctions on Russia] now. I may have to think about it in two weeks or three weeks or something, but we don’t have to think about that right now,” the president told Sean Hannity of Fox shortly after his meeting with Putin. 

    Putin’s most consistently-reported demand is full control of Ukraine’s Donetsk oblast, analysts at the Institute for the Study of War write. However, ISW cautions, “Ukrainian forces would not be able to conduct a safe and orderly withdrawal from unoccupied Donetsk Oblast in accordance with Putin's demand without a full ceasefire across the entire theater.” Thus, “A Ukrainian withdrawal would likely result in large force concentrations along major Ukrainian thoroughfares and defensive structures that Russian aviation, drones, and artillery would likely target upon the expiration of a ceasefire.”

    Notable: Without a Ukrainian withdrawal, “Seizing the remainder of Donetsk Oblast would likely be a difficult and years-long effort for Russian forces rather than a quick effort as Putin likely aims to portray, as Russian forces remain unable to secure operationally significant advances or advance faster than foot pace,” ISW writes. 

    Also worth noting: Putin’s reported “offer of a Russian law forbidding a future invasion of Ukraine is not credible because Russia has already twice broken previous binding international commitments not to invade and because Putin has shown that he can freely change Russian law as he desires,” ISW warned Sunday. 

    Visiting Washington today: European Commission president Ursula von der Leyen, French president Emmanuel Macron, Italian prime minister Giorgia Meloni, German chancellor Friedrich Merz, NATO chief Mark Rutte, British prime minister Keir Starmer, and Finnish president Alexander Stubb.

    Second opinions: All that transatlantic travel “suggests that something went very wrong in Alaska if this many European leaders are coming to Washington on short notice,” former Naval War College professor Tom Nichols wrote on social media. 

    No cards for Trump? “No wonder all of Trump’s negotiating deadlines for Russia have passed, to no effect, and no wonder the invitation to Anchorage produced no result,” Anne Applebaum writes for The Atlantic. “Trump, to use the language he once hurled at Zelensky, has no cards.” 

    View from London: “With Russia’s economy on the ropes, Trump remains bafflingly unwilling to apply the maximum economic pressure on Russia that would mean summits like those held yesterday are more likely to yield the success Donald Trump craves,” said Tom Keatinge, Director of the Centre for Finance and Security at the London-based Royal United Services Institute.

    “Putin may have successfully neutralised the idea of a ceasefire by hinting at a broader deal he knows will take time to negotiate,” said RUSI’s Matthew Savill. “If Putin cannot bait Trump into a further round of bilateral strategic summits, he will be content if Trump grows tired of the whole thing and effectively walks away,” said RUSI's Director of International Security Neil Melvin.

    Washington reax: “Putin got everything he wanted: a photo op legitimizing his war crimes, no ceasefire, and no sanctions or new weapons for Ukraine,” said Democratic Sen. Chris Murphy of the Foreign Relations Committee. 

    Murphy’s SFR colleague Jeanne Shaheen of New Hampshire: “Trump promised to end this war on Day One and instead he has let Putin cross one red line after another with impunity. No deal is better than a bad deal,” Shaheen said in a statement. “Trump’s continued reluctance to hold Putin to account means that Ukrainians will continue to die, Putin continues to act without consequences and our deterrence against would-be aggressors in Beijing is weakened.”

    Republican Sen. Lindsey Graham says the war could be over by Christmas. “If in fact there is a trilateral meeting between President Trump, President Zelensky and Putin, then I am cautiously optimistic that this war will end well before Christmas,” the South Carolina lawmaker mused this weekend. “If that meeting fails to materialize, I think President Trump may have to go all in to punish those who buy cheap Russian oil and gas, propping up Putin’s war machine,” he said. 

    Senate Armed Services Committee ranking member Jack Reed, D-Rhode Island: “Validating [Putin’s] illegal landgrab in Ukraine and legitimizing Russia’s invasion would be a bad precedent that sets the stage for future conflict. Instead of caving to Putin, the U.S. should join our allies in levying tough, targeted new sanctions on Russia to intensify the economic pressure…Trump must not abandon the Ukrainian people and cater to Russian aggressors, or it will only embolden America’s adversaries and invite more aggression.”

    Latest from Ukraine: Russian strikes overnight killed seven Ukrainians in Kharkiv, “the youngest being a girl who is only a year and a half old, and dozens have been injured, including children,” President Zelenskyy said on social media Monday. Elsewhere “In Zaporizhzhia, missile strikes injured 20 people and killed three,” he added, calling the actions “a demonstrative and cynical Russian strike” because “They are aware that a meeting is taking place today in Washington that will address the end of the war.”

    For the DC insider: There is a “Tiny White House Club Making Major National-Security Decisions,” veteran reporters Missy Ryan, Jonathan Lemire, Nancy Youssef, and Michael Scherer wrote Friday for The Atlantic. The “core” team includes Vice President JD Vance, Marco Rubio, and Susan Wiles, while “Stephen Miller plays a key role on issues related to homeland security,” and real estate billionaire Steve Witkoff watches issues affecting Russia and Israel. Meanwhile, “on military matters, the president pulls in [Pete] Hegseth and General Dan Caine, the chairman of the Joint Chiefs of Staff.”

    The perks: “The more centralized setup allows Trump’s impulses—his disregard for historic alliances, his love of dealmaking, and his focus on perceived abuses of American largesse—to drive U.S. policy.” 

    The downside: “By discarding a process designed to surface different views and analyze moves from all sides, [Trump] has increased the risk of unintended consequences.” Read the rest (gift link), here

    Related reading: 


    Welcome to this Monday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1965, some 5,000 Marines assaulted a Viet Cong base in Operation Starlite, the U.S. military’s first large offensive action of the Vietnam War.

    Trump 2.0

    Update: The National Guard will carry weapons while deployed in the nation’s capital over the next several weeks, the Wall Street Journal reported Saturday, two days after the Army had announced the troops’ weapons would “remain in the armory” unless or until needed. 

    Rewind: Trump ordered the troops to Washington ostensibly to tame Washington’s allegedly out-of-control crime, according to Trump—though actual crime in the city is at its lowest point in decades.

    Historian’s reax: “Under the guise of fighting crime, the administration has quite literally turned guns on the American people,” observed Heather Cox Richardson of Boston College, writing Sunday.  

    Sen. Chris Murphy, D-Connecticut: “Trump's takeover of DC policing is just a stunt to distract people (and the press!) from his refusal to release the Epstein files and his upcoming massive health insurance premium hikes,” he told NBC on Sunday. 

    ICYMI: “This is not what the military of our country was designed to do, at all,” said one soldier assigned to protect federal agents in California two months ago, speaking to Shawn Hubler of the New York Times in mid-July. “The moral injuries of this operation, I think, will be enduring,” they predicted of the allegedly heavy-handed military response just before summer began. 

    Mapped: See where Trump’s forces are patrolling inside Washington, D.C., via this interactive from the Washington Post. Peter Baker of the New York Times writes, “Spoiler alert: They're not where the crime is.”

    New: The Republican governors of Ohio, West Virginia, and South Carolina say they’re sending hundreds more National Guard troops to D.C. “West Virginia said it was deploying 300 to 400 Guard troops, while South Carolina pledged 200 and Ohio says it will send 150 in the coming days, marking a significant escalation of the federal intervention,” the Associated Press reported, and called the deployments “a power play that the president has justified as an emergency response to crime and homelessness, even though city officials have noted that violent crime is lower than it was during Trump’s first term in office.” 

    • By the way: A combined 43 cities in those three states have higher rates of violent crime than Washington, D.C., as Philip Bump illustrated Saturday with data from the FBI. 

    Update: The man charged with assaulting a Border Patrol agent with a sandwich is an Air Force veteran, reports Military-dot-com. Sean Charles Dunn, 37, who was charged with a felony and arrested Wednesday after allegedly throwing a Subway sandwich was once an active-duty staff sergeant, a cyber transport systems specialist who entered the service in July 2006 and separated in May 2011. A bit more, here.

    And in hoagie-hurler jokes: “Federal agent assaulted by sandwich admitted to Mayo Clinic.” (h/t @XBradTC)

    ICE industrial complex update: The Washington Post obtained White House plans to double what is already expected to be “the largest immigrant detention system in the world” here in the U.S.—with a capacity of around 107,000 people with 125 new or expanded detention camps this calendar year. “The expansion is funded by an unprecedented $45 billion detention budget approved last month by Congress,” and largely spread across Texas, Louisiana, California and Georgia.

    Notable: “Geo Group, ICE’s largest contractor and a company with close ties to the Trump administration, is in line to receive at least nine new or modified detention contracts with a total estimated value of over $500 million a year, the documents show…CoreCivic, the other largest private prison operator, would receive at least 12 contracts worth more than $500 million a year under the ICE plan—also roughly doubling that company’s annual revenue from ICE.”

    Also: “The government is also planning to dramatically expand its capacity for detaining parents and children in what could amount to the nation’s largest family detention program in decades,” the Post adds. Read on, here

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have unveiled the inner workings of an exploit script targeting a critical zero-day vulnerability in SAP NetWeaver’s Visual Composer Metadata Uploader, now designated as CVE-2025–31324. This flaw stems from a missing authorization check on the HTTP endpoint /developmentserver/metadatauploader, enabling unauthenticated file uploads that can lead to remote code execution (RCE) under the SAP […]

    The post Technical Details of SAP 0-Day Exploitation Script for RCE Revealed appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Bragg Gaming Group has confirmed a significant cybersecurity incident that compromised the company’s internal IT infrastructure early Saturday morning, August 16, 2025. 

    The online gaming technology provider discovered unauthorized network intrusion attempts that successfully breached their security perimeter, prompting immediate activation of incident response protocols.

    Key Takeaways
    1. Bragg Gaming Group experienced a cybersecurity breach with hackers accessing the company's internal IT systems.
    2. Preliminary investigations indicate no customer personal information or payment data was compromised.
    3. The company has engaged immediate containment protocols.

    Internal Network Breach 

    Initial forensic analysis conducted by Bragg’s security team indicates that threat actors gained unauthorized access to the company’s internal computer environment through what appears to be a targeted attack vector. 

    The breach primarily affected internal systems within Bragg’s network infrastructure, though the company’s preliminary investigation suggests the attack remained contained within their corporate IT environment.

    Security experts retained by Bragg are currently conducting comprehensive network traffic analysis and system log reviews to determine the exact method of intrusion. 

    The company has implemented immediate containment measures, including network segmentation protocols and enhanced monitoring of all data flows across its Remote Games Server (RGS) technology platform. 

    Critical gaming infrastructure, including the Bragg Hub content delivery platform and Player Account Management (PAM) systems, underwent immediate security audits to ensure operational integrity.

    Bragg has deployed a multi-layered incident response strategy, engaging independent cybersecurity specialists to conduct thorough vulnerability assessments and implement additional security hardening measures. 

    The company’s security operations center has been placed on high alert, with continuous monitoring protocols activated across all network endpoints and server clusters.

    Despite the security breach, Bragg confirmed that no customer personal information or payment data appears to have been compromised during the incident. 

    The company’s data encryption protocols and access control mechanisms apparently prevented unauthorized data exfiltration from customer-facing systems. 

    All gaming operations across Bragg’s regulated markets, including their iCasino and sportsbook platforms, remain fully operational with no service disruptions reported.

    The company has initiated mandatory security awareness training for all personnel and is conducting comprehensive penetration testing across its entire technology stack. 

    The swift response to the cybersecurity incident demonstrates the company’s commitment to maintaining robust security protocols while ensuring minimal disruption to its global gaming operations.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Bragg Confirms Cyber Attack – Hackers Accessed Internal IT Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated new cybercriminal technique known as “ghost-tapping” has emerged as a significant threat to contactless payment systems, enabling Chinese-speaking threat actors to exploit stolen payment card details linked to mobile wallet services such as Apple Pay and Google Pay.

    This innovative attack vector leverages Near Field Communication (NFC) relay tactics to facilitate retail fraud, allowing cybercriminals to transform digital theft into physical goods through an elaborate network of mules and automated systems.

    The ghost-tapping ecosystem represents a convergence of traditional phishing techniques with cutting-edge NFC relay technology, creating an end-to-end fraud operation that spans multiple countries and involves various criminal roles.

    Unlike conventional card fraud that relies solely on online transactions, ghost-tapping enables criminals to conduct in-person purchases at retail stores, making detection significantly more challenging for traditional fraud monitoring systems.

    The technique allows threat actors to relay payment information from compromised cards loaded onto mobile devices to separate payment terminals in real-time, effectively bypassing physical proximity requirements.

    Recent data from Singapore authorities illustrates the scale of this emerging threat, with 656 reports of compromised payment cards involving mobile wallets recorded between October and December 2024, resulting in losses exceeding $1.2 million SGD.

    Of these incidents, at least 502 cases specifically involved compromised cards linked to Apple Pay, demonstrating the particular vulnerability of popular mobile payment platforms to this attack method.

    Recorded Future analysts identified key threat actors operating on Telegram platforms, particularly @webu8, who advertises specialized burner phones and ghost-tapping services to Chinese-speaking criminal syndicates.

    Overview of ghost-tapping campaign involving mobile wallets (Source – Recordedfuture)

    Through extensive research and direct engagement with these threat actors, analysts uncovered a sophisticated criminal infrastructure that extends across Southeast Asia, with operations centered in Cambodia and China but targeting victims globally.

    Technical Infrastructure and Attack Methodology

    The ghost-tapping attack chain begins with cybercriminals using automated systems to harvest payment card credentials through phishing campaigns and mobile malware.

    These stolen credentials are then systematically added to contactless payment wallets on burner phones using proprietary software that can bypass traditional authentication measures.

    The process involves sophisticated automation capabilities, as evidenced by observed attempts to add compromised DBS Bank cards to Apple Pay at precise four to eight-minute intervals, demonstrating the industrial scale of these operations.

    # Automated card addition attempt simulation
    import time
    import requests
    
    def attempt_card_addition(card_details, wallet_service):
        """
        Simulates automated attempts to add stolen card to mobile wallet
        """
        for attempt in range(1, 10):
            response = wallet_service.add_card(card_details)
            if response.status == "success":
                return True
            elif "enable_mobile_wallets" in response.message:
                # Wait for security feature timeout
                time.sleep(600)  # 10 minute window
            else:
                time.sleep(240)  # 4 minute interval before retry
        return False

    The technical foundation of ghost-tapping relies on NFC relay tools such as NFCGate, an Android application originally designed for legitimate NFC traffic analysis but repurposed for criminal activities.

    The attack requires two mobile devices with NFCGate installed and a server configured to relay traffic between locations.

    When a money mule approaches a point-of-sale terminal, the system can relay tokenized card data in real-time from the attacker’s infrastructure to the mule’s device, enabling unauthorized transactions without the physical presence of the original card.

    Overview of the ghost-tapping technique (Source – Recordedfuture)

    The criminal ecosystem supporting ghost-tapping operations extends beyond simple card theft to encompass a sophisticated supply chain involving multiple specialized roles.

    Cybercriminals like @webu8 operate as suppliers, providing not only burner phones loaded with stolen credentials but also offering phone recycling services to maximize operational efficiency.

    These threat actors sell devices for approximately $500 USDT when loaded with ten compromised payment cards, establishing a clear economic model that incentivizes large-scale operations.

    Payment card authentication systems face particular challenges when confronting ghost-tapping attacks, as the technique exploits legitimate NFC communication protocols.

    The automation observed in these attacks suggests that criminals have developed sophisticated methods to overcome security features implemented by banks, including multi-factor authentication and time-limited approval windows.

    Even security measures such as requiring mobile app authentication can be circumvented when criminals have gained access to victims’ banking credentials through comprehensive phishing campaigns or mobile malware infections.

    Luxury goods purchased from various retail stores using ghost-tapping techniques (Source – Recordedfuture)

    The geographical distribution of ghost-tapping operations reflects the global nature of modern cybercrime, with criminal syndicates based in Cambodia and China orchestrating attacks that target victims worldwide while deploying mules to conduct fraudulent purchases in countries with robust retail infrastructure.

    This international scope complicates law enforcement efforts and enables criminals to exploit jurisdictional gaps in cybercrime prosecution, making ghost-tapping a particularly resilient threat to the global payment ecosystem.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Ghost-tapping Attacks Steal Customers’ Cards Linked to Services Like Apple Pay and Google Pay appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical vulnerability in the Linux kernel’s netfilter ipset subsystem has been discovered that allows local attackers to escalate privileges to root-level access. 

    The flaw, identified in the bitmap:ip implementation within the ipset framework, stems from insufficient range validation when processing CIDR notation in IP address ranges. 

    This missing bounds check enables attackers to trigger out-of-bounds memory writes in kernel space, ultimately providing a pathway to full system compromise. 

    Key Takeaways
    1. Critical vulnerability in Linux kernel's netfilter ipset subsystem allows attackers to trigger out-of-bounds memory writes.
    2. Attackers with local access can exploit this flaw to gain root privileges.
    3. Immediately update to patched kernel versions.

    The vulnerability affects kernel versions up to 6.12.2 and has been addressed through a recently released patch that implements proper range validation across all code paths.

    Linux Kernel Netfilter Vulnerability

    SSD Secure Disclosure reports that the security flaw resides in the bitmap_ip_uadt function within the net/netfilter/ipset/ip_set_bitmap_ip.c file, where insufficient validation occurs when processing CIDR-based IP ranges. 

    The ipset subsystem, designed for high-performance packet filtering in conjunction with iptables and nftables, uses bitmap data structures to efficiently manage sets of IPv4 addresses. 

    When users specify IP ranges using CIDR notation through the netfilter netlink interface, the vulnerable code path fails to verify that the calculated IP range falls within the allocated bitmap boundaries.

    The root cause emerges when the tb[IPSET_ATTR_CIDR] attribute is present but tb[IPSET_ATTR_IP_TO] is absent. 

    In this scenario, the ip_set_mask_from_to function calculates new ip and ip_to values based on the CIDR mask, but unlike the explicit range case, no validation ensures the resulting ip value doesn’t underflow below map->first_ip. 

    Linux Kernel netfilter Vulnerability

    This creates a situation where crafted CIDR values can cause integer underflow, leading to out-of-bounds array access when the calculated index is truncated from u32 to u16 during bitmap operations.

    Exploitation of this vulnerability requires local access but no special privileges, making it particularly dangerous in multi-user environments or containerized systems. 

    Attackers can leverage the netfilter netlink socket interface to send maliciously crafted ipset commands that trigger the vulnerable code path. 

    By carefully constructing bitmap:ip set creation and addition operations with specific CIDR values, attackers can achieve controlled out-of-bounds writes beyond the allocated bitmap memory region.

    The exploitation technique involves creating multiple bitmap:ip objects to establish a predictable memory layout, then using the out-of-bounds write primitive to overwrite critical kernel data structures. 

    Specifically, attackers can modify the members pointer of adjacent bitmap_ip objects, transforming the limited write primitive into arbitrary memory write capabilities.

    Linux Kernel netfilter Vulnerability

    The proof-of-concept demonstrates overwriting the core_pattern kernel parameter, which controls how core dumps are processed, allowing attackers to execute arbitrary commands with root privileges when triggering a segmentation fault.

    The vulnerability’s impact extends beyond simple privilege escalation, as successful exploitation grants attackers complete control over the affected system. 

    This includes the ability to install rootkits, modify system configurations, access sensitive data, and potentially pivot to other systems on the network. 

    Linux Kernel netfilter Vulnerability

    Organizations running affected kernel versions should prioritize applying the available patch, which addresses the issue by implementing a comprehensive range validation that checks both ip < map->first_ip and ip_to > map->last_ip conditions regardless of how the IP range is specified.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Linux Kernel Netfilter Vulnerability Let Attackers Escalate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶