ADMIN.FOUNDATION

  • Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware

    ·

    , ,

    Microsoft has issued a warning that both cybercriminals and state-sponsored threat actors are increasingly abusing the features and capabilities of Microsoft Teams throughout their attack chains.

    The platform’s extensive adoption for collaboration makes it a high-value target, with its core functions for messaging, calls, and screen-sharing being weaponized for malicious purposes.

    The extensive collaboration features and global adoption of Microsoft Teams make it a high-value target for both cybercriminals and state-sponsored actors.

    Threat actors abuse its core capabilities, messaging (chat), calls, and meetings, and video-based screen-sharing at different points along the attack chain.

    This raises the stakes for defenders to proactively monitor, detect, and respond. While Microsoft’s Secure Future Initiative (SFI) has strengthened default security, the company emphasizes that defenders must utilize available security controls to harden their enterprise Teams environments.

    Hackers Abuse Teams Features

    Attackers are leveraging the entire attack lifecycle within the Teams ecosystem, from initial reconnaissance to final impact, Microsoft said.

    This involves a multi-stage process where the platform’s trusted status is exploited to infiltrate networks, steal data, and deploy malware.

    Teams Attack Chain
    Teams Attack Chain

    The attack chain often begins with reconnaissance, where threat actors use open-source tools like TeamsEnum and TeamFiltration to enumerate users, groups, and tenants.

    They map organizational structures and identify security weaknesses, such as permissive external communication settings.

    This is followed by resource development, where attackers may compromise legitimate tenants or create new ones, complete with custom branding, to impersonate trusted entities like IT support.

    Once they have established a credible persona, attackers move to initial access. This stage frequently involves social engineering tactics such as tech support scams.

    For example, the threat actor Storm-1811 has impersonated tech support to address fabricated email issues, using the pretext to deploy ransomware.

    Similarly, affiliates of the 3AM ransomware have flooded employees with junk email and then used Teams calls to convince them to grant remote access.

    Malicious links and payloads are also delivered directly through Teams chats, with tools like AADInternals and TeamsPhisher being used to distribute malware like DarkGate.

    Escalation and Lateral Movement

    After gaining a foothold, threat actors focus on maintaining persistence and escalating privileges. They may add their own guest accounts, abuse device code authentication flows to steal access tokens, or use phishing lures to deliver malware that ensures long-term access.

    The financially motivated group Octo Tempest has been observed using aggressive social engineering over Teams to compromise Multi-Factor Authentication (MFA) for privileged accounts.

    With elevated access, attackers begin discovery and lateral movement. They use tools like AzureHound to map the compromised organization’s Microsoft Entra ID configuration and search for valuable data.

    The state-sponsored actor Peach Sandstorm has used Teams to deliver malicious ZIP files and then explored on-premises Active Directory databases.

    If an attacker gains admin access, they can alter external communication settings to establish trust relationships with other organizations, enabling lateral movement between tenants.

    The final stages of the attack involve collection, command and control (C2), exfiltration, and impact. Attackers use tools like GraphRunner to search and export sensitive conversations and files from Teams, OneDrive, and SharePoint.

    Some malware, like a cracked version of Brute Ratel C4 (BRc4), is designed to establish C2 channels using Teams’ own communication protocols to send and receive commands.

    Data exfiltration can occur through Teams messages or shared links pointing to attacker-controlled cloud storage. The ultimate goal is often financial theft through extortion or ransomware.

    Octo Tempest, for instance, has used Teams to send threatening messages to pressure organizations into making payments after successfully gaining control of their systems.

    This demonstrates how the platform can be abused not just as an entry vector, but as a tool for direct financial coercion.

    In response, experts recommend a defense-in-depth strategy, focusing on hardening identity and access controls, monitoring for anomalous activity within Teams, and providing continuous security awareness training to users.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Why Threat Prioritization Is the Key SOC Performance Driver  

    ·

    CISOs face a paradox in their SOCs every day: more data and detections than ever before, yet limited capacity to act on them effectively.

    Hundreds of alerts stream in daily, but without clear prioritization, the team’s focus is scattered.

    Critical incidents risk being buried among lower-value events, slowing response and increasing business exposure.   

    The Cost of Losing Focus

    From a business perspective, the consequences of poor alert management are severe: 

    • Escalating operational costs as analysts spend time on irrelevant signals. 
    • Slower decision-making, leaving critical incidents unresolved for longer. 
    • Broader risk surface, as genuine threats can progress unchecked. 

    Ultimately, a SOC’s effectiveness is not measured by the number of alerts processed, but by how quickly it can identify and neutralize those that pose the greatest risk to the organization. 

    Why Prioritization Is Essential 

    The true driver of SOC performance is the ability to separate signal from noise.

    Prioritization ensures that resources, people, tools, and time, are allocated where they matter most. This requires more than detection; it requires context. 

    Threat context answers fundamental business questions: 

    • Is this alert tied to an active campaign in our industry? 
    • Does it represent a threat capable of financial or reputational harm? 
    • How urgent is the risk compared to others in the queue? 

    Without this context, the SOC cannot align operational focus with business risk. 
     
    The Power of Collective Intelligence 

    This is where solutions like ANY.RUN’s Threat Intelligence Lookup fundamentally change the equation.  

    TI Lookup: explore threats and indicators with 40+ search parameters 

    By aggregating threat data from over 15,000 SOCs globally, the platform creates a real-time intelligence ecosystem providing complete context about an alert: severity, associated campaigns, observed behaviors, fresh IOCs.

    Access to real-time intelligence from a global SOC network means your team sees emerging threats as they develop.  

    Instead of spending 30 minutes researching an indicator across multiple sources, analysts get consolidated intelligence instantly.

    With clear threat prioritization, your team can confidently deprioritize low-risk alerts and concentrate on genuine threats. 
     
    For CISOs, this means: 

    • Faster triage: Analysts spend seconds, not hours, validating alerts. 
    • Risk-based focus: Critical incidents are escalated first, reducing dwell time. 
    • Strategic efficiency: The SOC operates with greater ROI, ensuring investments in people and technology translate directly into stronger resilience. 

    Speed up detection and response to leave both attackers and competition behind Contact ANY.RUN for 50 trial searches in Threat Intelligence Lookup 

    A simple example: a suspicious IP address spotted in system logs can be checked in seconds:  

    destinationIP:”172.67.150.243″ 

    TI Lookup IP search: instant verdict, context, and IOCs 

    An analyst sees that the domain has been tagged as malicious and associated with ongoing phishing campaigns powered by the notorious EvilProxy phishkit.

    They can also browse sandbox analysis sessions, analyze TTPs and trends, and gather IOCs for detection and response.  

    From Reactive to Proactive 

    Effective threat prioritization doesn’t just make your SOC faster: it fundamentally transforms how security operations function. Teams shift from reactive alert processing to proactive threat hunting.

    Analysts spend less time on false positives and more time developing defensive strategies. MTTR for critical incidents drops dramatically. 

    For CISOs, this operational transformation delivers measurable business value: reduced risk exposure, more efficient security spending, and a team that’s engaged rather than exhausted. 

    The Bottom Line 

    In today’s threat landscape, success isn’t about processing more alerts — it’s about processing the right alerts with the appropriate urgency.

    Threat intelligence-driven prioritization provides the context that transforms security operations from overwhelmed to optimized. 

    The organizations winning the security battle aren’t necessarily those with the biggest budgets or the most tools.

    They’re the ones that have mastered the art of intelligent prioritization, leveraging solutions like Threat Intelligence Lookup to cut through noise and focus on threats that actually matter. 

    Start your TI Lookup trial, make your SOC proactive, focused, and efficient 

    The post Why Threat Prioritization Is the Key SOC Performance Driver   appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Digital Risk Protection (DRP) Platforms in 2025

    ·

    , ,

    In today’s digital-first economy, the cyber risk landscape is evolving faster than ever before. Enterprises face threats ranging from phishing campaigns and social engineering to data breaches and brand impersonation. Digital Risk Protection (DRP) platforms are becoming indispensable for businesses to detect, analyze, and mitigate online threats that can impact brand integrity, digital assets, customer […]

    The post Top 10 Best Digital Risk Protection (DRP) Platforms in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • BK Technologies Data Breach – Hackers Compromise IT Systems and Exfiltrate Data

    ·

    , ,

    BK Technologies Corporation, a provider of communications equipment for public safety and government agencies, has disclosed a cybersecurity incident in which an unauthorized third party breached its information technology systems and potentially exfiltrated sensitive data.

    In a recent Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), the company confirmed that it detected the suspicious activity on or around September 20, 2025.

    The investigation is ongoing, but initial findings suggest that data about current and former employees may have been compromised.

    Upon identifying the potential intrusion, BK Technologies immediately launched a response to contain and remediate the threat.

    The company took decisive action by isolating the affected IT systems to halt any further unauthorized activity and prevent lateral movement across its network.

    Incident Detection

    To support its internal teams, BK Technologies engaged the services of external cybersecurity advisors to conduct a thorough investigation.

    According to the filing, these containment and remediation efforts were successful in removing the threat actor from the company’s environment.

    While the incident caused minor disruptions to a limited number of non-critical systems, the company stated that its ability to access impacted information has been restored, and its core business operations have continued without any material interruption.

    While operational continuity was maintained, the investigation has confirmed that the attackers likely accessed and acquired non-public information stored within the company’s systems.

    The primary concern is the potential exposure of sensitive employee data. According to the disclosure, the exfiltrated files may contain records pertaining to individuals who are currently or were previously employed by BK Technologies.

    The company is continuing to investigate the precise nature and full extent of the data theft to understand exactly what information was compromised.

    In line with its legal and regulatory obligations, BK Technologies has already reported the incident to law enforcement authorities and plans to furnish formal notice to all affected parties and relevant regulatory agencies as appropriate.

    Despite the data breach, BK Technologies does not anticipate a material impact on its financial condition or results of operations.

    The company stated in its SEC filing that it expects a significant portion of the direct costs associated with containing, investigating, and remediating the incident to be reimbursed through its insurance coverage.

    Although the investigation is still in progress, the company has taken steps to secure its environment and prevent future occurrences.

    The cautionary statement included in the report notes that the full repercussions of the incident are still being assessed and that risks, including legal, reputational, and financial, could arise as more details emerge.

    The company remains committed to completing its investigation and ensuring all necessary remediation actions are taken.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post BK Technologies Data Breach – Hackers Compromise IT Systems and Exfiltrate Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • BatShadow Group Uses New Go-Based ‘Vampire Bot’ Malware to Hunt Job Seekers

    ·

    A Vietnamese threat actor named BatShadow has been attributed to a new campaign that leverages social engineering tactics to deceive job seekers and digital marketing professionals to deliver a previously undocumented malware called Vampire Bot. “The attackers pose as recruiters, distributing malicious files disguised as job descriptions and corporate documents,” Aryaka Threat Research Labs

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Cyber Threat Intelligence Companies in 2025

    ·

    , ,

    In 2025, cyber threat intelligence companies are more crucial than ever as organizations face increasingly sophisticated attacks from advanced persistent threats, ransomware gangs, and state-sponsored actors. Choosing the best CTI (Cyber Threat Intelligence) provider can mean the difference between preventing an attack and suffering costly breaches. This article explores the Top 10 Best Cyber Threat […]

    The post Top 10 Best Cyber Threat Intelligence Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity”

    ·

    Raleigh, United States, October 7th, 2025, CyberNewsWire Report Shows Cross-Training as Strategic Solution to Operational Friction Between Networking and Cybersecurity Teams  INE Security, a leading provider of cybersecurity training and certifications, today announced the results of a global study examining the convergence of networking and cybersecurity disciplines. “Wired Together: The Case for Cross-Training in Networking […]

    The post INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity” appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity”

    ·

    Raleigh, United States, October 7th, 2025, CyberNewsWire

    Report Shows Cross-Training as Strategic Solution to Operational Friction Between Networking and Cybersecurity Teams 

    INE Security, a leading provider of cybersecurity training and certifications, today announced the results of a global study examining the convergence of networking and cybersecurity disciplines.

    “Wired Together: The Case for Cross-Training in Networking and Cybersecurity” is based on insights from nearly 1,000 IT and cybersecurity professionals worldwide.

    The report documents operational challenges created by this convergence and presents cross-training as the strategic solution.

    “Our research reveals that while three-quarters of professionals recognize networking and cybersecurity as integrated disciplines, the majority still struggle with daily operational friction between these teams,” said Lindsey Rinehart, CEO of INE Security.

    “Organizations with high levels of security and IT complexity face breach costs averaging $1.2 million higher than those with streamlined, integrated environments.

    This isn’t just about future preparedness—it’s about solving problems that are costing organizations money today.”

    The report reveals that only 33% of professionals feel “very well” or “extremely well” prepared to handle the intersection of networking and cybersecurity, while 41% report being only “moderately well” prepared.

    This preparedness gap creates significant operational challenges but also presents strategic opportunities for organizations that invest in cross-domain expertise.

    “Cross-trained professionals don’t just respond to incidents faster—they prevent the implement-break-fix cycles that plague most organizations,” Rinehart added.

    “When teams understand both networking and security domains, projects deploy successfully the first time, emergency rollbacks become rare, and operational costs decrease substantially.”

    Key findings from the report include:

    • Integration Reality: 75% of respondents view networking and cybersecurity as either “completely integrated” (29%) or “highly interconnected” (46%), with only 7% still viewing them as separate disciplines.
    • Preparedness Gap: Only 33% feel well-prepared to handle networking-cybersecurity intersection, creating operational vulnerabilities and increased costs.
    • Collaboration Challenges: While 37% collaborate with counterparts “most of the time” or “always,” 34% collaborate only “sometimes,” and 23% work together “about half the time.”
    • Critical Friction Points: Nearly one in five professionals (18%) identified knowledge gaps as their primary challenge, while organizational misalignment affects nearly a quarter of respondents.
    • Convergence Drivers: 77% cite growing cyber threat complexity as the primary convergence driver, with widespread cloud adoption, remote work, and IoT device proliferation accelerating integration.
    • Six Critical Overlap Areas: Network monitoring, security monitoring, firewalls, configuration management, detection, and access control represent the most significant convergence points where cross-training delivers immediate benefits.

    INE Security’s recommendations for organizations include:

    • Four-Step Cross-Training Implementation: Conduct skill assessments, deploy varied training methodologies, measure impact and ROI, and scale successful programs
    • Enhanced Threat Detection: Develop comprehensive visibility across network architecture and security implications to reduce incident response times
    • Operational Excellence: Streamline workflows to reduce handoffs between specialized teams and eliminate failed implementations
    • Cost Optimization: Reduce downtime costs (averaging $5,600 per minute) through improved incident response and integrated operations

    The report emphasizes that successful cross-training transforms organizational culture by creating common language between teams, enabling balanced decision-making, streamlining operations, and improving talent retention through reduced workplace friction.

    “Breaking down security silos and fostering cross-team cooperation is essential for responding to the accelerating pace of cyber threats,” Rinehart concluded.

    “Organizations that invest in developing professionals who can speak both languages will gain measurable advantages in threat detection, operational efficiency, and business resilience.”

    The full report is available for download at learn.ine.com/report/wired-together.

    About INE Security:

    INE Security is the premier provider of online networking and cybersecurity training and certification.

    Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers.

    INE Security’s cybersecurity certifications are requested by HR departments worldwide, and its suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

    Contact

    Chief Marketing Officer
    Kim Lucht
    INE Security
    press@ine.com

    The post INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity” appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google’s New AI Doesn’t Just Find Vulnerabilities — It Rewrites Code to Patch Them

    ·

    Google’s DeepMind division on Monday announced an artificial intelligence (AI)-powered agent called CodeMender that automatically detects, patches, and rewrites vulnerable code to prevent future exploits. The efforts add to the company’s ongoing efforts to improve AI-powered vulnerability discovery, such as Big Sleep and OSS-Fuzz. DeepMind said the AI agent is designed to be both reactive and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Troops to Chicago; Trump’s partisan speech to sailors; F/A-XX OK?; MDA’s big Golden Dome vehicle; And a bit more.

    ·

    National Guard troops are headed to Chicago and could arrive as soon as Tuesday after a federal judge on Monday scheduled a hearing on the matter for Thursday in order to review what she said was more than 500 pages of filings. 

    The state of Illinois and the city of Chicago sued the Trump administration Monday over the Guard deployment, which would send up to 300 Illinois National Guard soldiers and up to 400 more Guard troops from Texas into Chicago ostensibly to protect Immigration and Customs Enforcement personnel and facilities, but over the objection of the governor of Illinois. “These advances in President Trump’s long-declared ‘War’ on Chicago and Illinois are unlawful and dangerous,” the suit alleges. 

    “The Trump administration is following a playbook: cause chaos, create fear and confusion, make it seem like peaceful protesters are a mob by firing gas pellets and tear gas canisters at night,” Illinois Gov. JB Pritzker said at a press conference Monday. “Why? To create the pretext for invoking the Insurrection Act so that he can send military troops to our city.”

    After a judge paused Guard deployments to Oregon on Sunday, Trump said Monday he’s open to invoking the Insurrection Act, which would authorize the U.S. military to assist civilian state or federal authorities, including police, to put down an insurrection. The act has been invoked just 30 times in the past 230 years; the last time was in 1992 during the Rodney King riots in Los Angeles. “I’d do it if it was necessary,” Trump said Monday. “If people were being killed and courts were holding us up, or governors, or mayors were holding us up.”

    Trump: Chicago is “like a war zone,” the president claimed Monday. (He’s made similar claims about Portland, Ore., though the judge hearing the matter on Sunday did not agree, and described the president’s characterization as “simply untethered to the facts.”) “You can go to Afghanistan, you can go to a lot of different places, and they probably marvel at how much crime we have,” Trump said of Chicago on Monday. 

    Pritzker: “There is no invasion here. There is no insurrection here,” he said Monday. “The folks in the neighborhoods do not want armed troops marching in their streets,” the governor said. 

    Critical reax: Trump’s use of an obscure statute (10 U.S. Code § 12406) to deploy troops over governors’ objections is “unprecedented,” said Hina Shamsi, director of the ACLU National Security Project. That law permits a Guard authorization if “there is a rebellion or danger of a rebellion” against the U.S. government. 

    “I think we've all got to be very, very, very concerned about armed federal agents and troops reporting to the president exercising claims of police power in this country,” Shamsi said, and cited the ruling Sunday from Judge Immergut. “We're only in the first year of this presidency,” and already—as Immergut pointed out Sunday—Trump tried “circumventing a court decision that reasoned that there was no justification” for National Guard troops in Portland. 

    Local reax: In addition to Tuesday’s military-style immigration raid on an apartment complex, “We are also seeing masked, heavily armed federal law enforcement officers, including ICE and Customs and Border Protection, marching through downtown Chicago heavily armed, in camouflage, and in masks threatening people and questioning others who are simply doing nothing more than visiting Millennium Park with their family on a Sunday afternoon,” said Colleen Connell, executive director the ACLU in Illinois. “We also tragically saw ICE agents shoot and kill one person at a traffic stop in Franklin Park, a near-in suburb, and misrepresented what happened at that scene.”

    “I want to be very, very clear that sending heavily armed federal agents and now National Guard troops from potentially thousands of miles away into our beautiful city of Chicago is unnecessary, it's inflammatory, and it puts public safety and human beings at risk,” Connell said Monday. 

    Meanwhile, “The federal deployment of 300 National Guard troops in California has been quietly extended through January 2026,” the New York Times reported Monday, citing court documents filed this weekend in Oregon. 

    Coverage continues below…

    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2001, the U.S. military’s invasion of Afghanistan began.

    Trump delivered another overtly partisan speech to the military on Sunday, this time to sailors aboard the USS George H.W. Bush off the coast of Norfolk, Va., and less than a week since his wandering remarks to generals and admirals during an unprecedented meeting last Monday in Quantico.  

    “Now we’re in Memphis,” Trump said. “And we are going to Chicago,” he told the sailors. “We send in the National Guard…We send in whatever is necessary. People don’t care. They don’t want crime in their cities.” Trump also mocked his predecessor for falling down steps, and declared, “We're not politically correct anymore, just so you understand.”

    “And I want you to know that despite the current Democrat-induced shutdown, we will get our service members every last penny,” the president said. “Don't worry about it. Don't worry about it. Don't worry about it. Do not worry about it. It's all coming. It's coming. And even more, because I'm supporting the across-the-board pay raises for every sailor and service member.” 

    Shutdown trivia: U.S. service members could miss their first paycheck of the shutdown if negotiations drag beyond Oct. 15. 

    “But we have to take care of this little gnat that’s on our shoulder called the Democrats,” the president told members of the Navy. “They want to give all of our money to illegal aliens that pour into the country,” he said Sunday—less than three days after calling Democrats “The Party Of Hate, Evil, And Satan” amid Republican lawmakers and pundits blaming violence in the country on dangerous rhetoric from the left side of the political spectrum. 

    War on drug boats

    Update: The Justice Department’s Office of Legal Counsel has argued in a classified memo “that the president is allowed to authorize deadly force against a broad range of cartels because they pose an imminent threat to Americans,” CNN reported Monday. However, “At the Pentagon, some military lawyers, including international law experts within [DoD’s Office of General Counsel], have raised concerns about the legality of the lethal strikes on suspected drug traffickers,” with multiple current and former JAGs telling CNN “the strikes do not appear lawful.”

    ICYMI: The White House last week told lawmakers they believe the country is in a formal “armed conflict” with drug cartels, and that’s why they feel U.S. troops can kill people in speedboats instead of interdicting and arresting those inside the vessels traveling around the Caribbean Sea, north of Venezuela.  

    New: The New York City Bar Association called the Pentagon’s attacks on boats in Latin America “illegal summary execution” that are “prohibited by both U.S. and international law,” which is to say those military actions are akin to “murders,” the organization said in a statement Monday. 

    The group also asked “Congress to remind the President that he lacks authority to continue to misuse our military forces for similar unlawful attacks on foreign vessels and their civilian crews and that continuation of such attacks is unlawful.”

    For your ears only: Just Security recently posted a new podcast discussion about Trump’s lethal strikes in the Caribbean, which have killed at least 21 people so far. The guests “examine an important new chapter in the use of force against drug cartels” in a discussion that “explores how far presidential powers extend in such contexts.” Listen, here. 

    Extra reading: 

    Around the Defense Department

    OK for F/A-XX? Sources tell Reuters that SecDef Hegseth has approved the Navy’s effort to build a sixth-gen fighter of its own, clearing the way to choose between options offered by Boeing and Northrop Grumman after years of delay.

    Background, from August: “In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo,” Defense One wrote. “But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Cheever’s comments today appear to confirm that F/A-XX is in fact moving ahead.”

    Industry had more than 1,500 questions for the Missile Defense Agency about the gigantic $151-billion, 10-year contract vehicle for work on the ambitious Golden Dome missile-defense project, so officials have pushed the deadline for pitches for slices of the work one week to Oct. 16, Defense One’s Thomas Novelly reports, here.

    The Army established Transformation and Training Command on Thursday, combining missions and assets from the now-deactivated Futures Command and Training and Doctrine Command. The merger is part of the service’s Army Transformation Initiative (ATI) effort announced by Hegseth in May. Breaking Defense has more, here.

    Additional reading: “Marines retire ‘workhorse’ Assault Amphibious Vehicle after 50 years,” Military Times reported Monday.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶