• ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

    Elon Musk’s SpaceX has taken money directly from Chinese investors, according to previously sealed testimony, raising new questions about foreign ownership interests in one of the United States’ most important military contractors.

    The recent testimony, coming from a SpaceX insider during a court case, marks the first time direct Chinese investment in the privately held company has been disclosed. While there is no prohibition on Chinese ownership in U.S. military contractors, such investment is heavily regulated and the issue is treated by the U.S. government as a significant national security concern.

    “They obviously have Chinese investors to be honest,” Iqbaljit Kahlon, a major SpaceX investor, said in a deposition last year, adding that some are “directly on the cap table.” “Cap table” refers to the company’s capitalization table, which lists its shareholders.

    Kahlon’s testimony does not reveal the scope of Chinese investment in SpaceX or the identities of the investors. Kahlon has long been close with the company’s leadership and runs his own firm that acts as a middleman for wealthy investors looking to buy shares of SpaceX.

    SpaceX keeps its full ownership structure secret. It was previously reported that some Chinese investors had bought indirect stakes in SpaceX, investing in middleman funds that in turn owned shares in the rocket company. The new testimony describes direct investments that suggest a closer relationship with SpaceX.

    SpaceX has thrived as it snaps up sensitive U.S. government contracts, from building spy satellites for the Pentagon to launching spacecraft for NASA. U.S. embassies and the White House have connected to the company’s Starlink internet service too. Musk’s roughly 42% stake in the company is worth an estimated $168 billion. If he owned nothing else, he’d be one of the 10 richest people in the world.

    National security law experts said federal officials would likely be deeply interested in understanding the direct Chinese investment in SpaceX. Whether there was cause for concern would depend on the details, they said, but the U.S. government has asserted that China has a systematic strategy of using investments in sensitive industries to conduct espionage.

    If the investors got access to nonpublic information about the company — say, details on its contracts or supply chain — it could be useful to Chinese intelligence, said Sarah Bauerle Danzman, an Indiana University professor who has worked for the State Department scrutinizing foreign investments. That “would create huge risks that, if realized, would have huge consequences for national security,” she said.

    SpaceX did not respond to questions for this story. Kahlon declined to comment.

    The new court records come from litigation in Delaware between Kahlon and another investor. The testimony was sealed until ProPublica, with the assistance of lawyers at the Reporters Committee for Freedom of the Press and the law firm Shaw Keller, moved in the spring to make it public. SpaceX fought the effort, but a judge ruled that some of the records must be released. Kahlon’s testimony was publicly filed this week.

    Buying shares in SpaceX is much more difficult than buying a piece of a publicly traded company like Tesla or Microsoft. SpaceX has control over who can buy stakes in it, and the company’s investors fall into different categories. The most rarefied group is the direct investors, who actually own SpaceX shares. This group includes funds led by Kahlon, Peter Thiel and a handful of other venture capitalists with personal ties to Musk. Then there are the indirect investors, who effectively buy stakes in SpaceX through a middleman like Kahlon. (The indirect investors are actually buying into a fund run by the middleman, typically paying a hefty fee.) All previously known Chinese investors in SpaceX fell into the latter category.

    This year, ProPublica reported on an unusual feature of SpaceX’s approach to investment from China. According to testimony from the Delaware case, the company allows Chinese investors to buy stakes in SpaceX so long as the money is routed through the Cayman Islands or other offshore secrecy hubs. Companies only have to proactively report Chinese investments to the government in limited circumstances, and there aren’t hard and fast rules for how much is too much.

    After ProPublica’s report, House Democrats sent a letter to Defense Secretary Pete Hegseth raising alarms about the company’s “potential obfuscation.” “In light of the extreme sensitivity of SpaceX’s work for DoD and NASA, this lack of transparency raises serious questions,” they wrote. It’s unclear if any action was taken in response.

    Kahlon has turned his access to SpaceX stock into a lucrative business. His investor list reads like an atlas of the world. The investors’ names are redacted in the recently unsealed document, but their addresses span from Chile to Malaysia. One is in Russia. At least two are in mainland China. One is in Qatar. (In one email to SpaceX’s chief financial officer, Kahlon said a Los Angeles-based fund had money from the Qatari royal family and was already invested in SpaceX.)

    “You made a big fortune,” a China-based financier wrote to Kahlon four years ago. “Lol something like that. SpaceX has been the gift that keeps on giving,” Kahlon responded. “All thanks to you.”

    Kahlon first met with SpaceX when it was a fledgling startup, according to court records. SpaceX’s CFO, Bret Johnsen, who’s been there for 14 years, testified that Kahlon “has been with the company in one form or fashion longer than I have.” Johnsen also testified that SpaceX has no formal policy about accepting investments from countries deemed adversaries by the U.S. government. But he said he asks fund managers to “stay away from Russian, Chinese, Iranian, North Korean ownership interest” because that could make it “more challenging to win government contracts.”

    There are indications that by 2021, Kahlon was wary of raising funds from China. The U.S. government had grown increasingly concerned about Chinese investments in tech companies, and that June, Kahlon told an associate he was “being picky” with who he’d let buy into a new SpaceX opportunity. “Only people I want to have a relationship with long term. No one from mainland China,” Kahlon said.

    But as he raced to assemble a pool of investors, those concerns appeared to fade away. By November 2021, Kahlon was personally raising money from China to buy SpaceX stakes. He told a Shanghai-based company that if it invested with him, it would get quarterly updates on SpaceX’s business development, “visits to SpaceX, and the opportunities to interview with Space X’s CFO,” court records show.

    The Shanghai company ultimately sent Kahlon $50 million to invest in Musk’s business, according to court records. SpaceX had the deal canceled after the plan became public.

    Alex Mierjeski contributed research.

    This story was originally published by ProPublica.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hegseth expands war on leaks. Washington Post: “The Pentagon plans to impose strict nondisclosure agreements and random polygraph testing for scores of people in its headquarters, including many top officials, according to two people familiar with the proposal and documents obtained by The Washington Post, escalating Defense Secretary Pete Hegseth’s war on leakers and internal dissent.” 

    A draft memo from Deputy Defense Secretary Steve Feinberg says that all troops, civilian employees, and contract workers within the Office of the Defense Secretary and the Joint Staff—likely more than 5,000 people—would be required to sign a nondisclosure agreement that “prohibits the release of non-public information without approval or through a defined process.” 

    Chief Pentagon spokesperson Sean Parnell declined to answer questions about the plan, saying in an email that The Post’s reporting is “untrue and irresponsible.” Read on, here.

    The Trump administration has introduced the limited use of NDAs at other federal departments, including the Veterans Affairs Department and Interior Department.

    Silicon Valley in St. Louis? Movers and shakers in the Gateway City, having welcomed the recently opened National Geospatial-Intelligence Agency campus in the Bottle District, now have their sights set on turning the city into a hub for geospatial startups, arguing, perhaps, that St. Louis and defense technology go together like toasted ravioli and marinara. Defense One’s Lauren C. Williams reports, here.

    Additional reading: 


    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2018, Washington Post journalist and Saudi dissident Jamal Khashoggi was assassinated and cut into pieces with a bone saw during a visit to the Saudi consulate in Istanbul, Turkey.

    Trump 2.0

    Amid a government shutdown, at least 15 government oversight websites were down Wednesday evening, removing access to watchdog reports and required hotline and whistleblower links, Natalie Alms of Nextgov reported. 

    The outages are not due to the shutdown—it's a deliberate move by the White House, whose Office of Management and Budget is withholding funds from the Council of the Inspectors General on Integrity and Efficiency. CIGIE is an independent entity charged by Congress with addressing oversight issues that involve more than one government agency. It provides training for investigators and auditors and acts as a watchdog for the government watchdog community. 

    OMB claims the IGs “have become corrupt, partisan, and in some cases, have lied to the public,” a spokesperson told Nextgov/FCW in a statement. With the websites gone, so is access to the reports of those offices as well as links for whistleblowers. Read more, here. 

    Some of the affected OIG offices have posted to social media to offer phone numbers and alternative online hotline complaint forms. And links to the pre-Oct. 1 versions of the sites are available here. 

    The move is part of the Trump administration’s campaign against the government’s independent watchdogs, which began with Trump’s firing of 17 IGs soon after he took office, a move that a federal judge recently said was an “obvious” violation of the law. 

    On Tuesday, Defense Secretary Pete Hegseth announced a review of the reporting processes for his department’s IG, which is currently investigating him for allegedly using an unsecure, unapproved app to conduct official business in the form of sending strike plans over Signal.

    In a Tuesday memo, Hegseth said IG offices must now decide whether tips are backed by "credible evidence" within seven days and to track any "repeat complainants." Reuters: “One U.S. official who approved of Hegseth's move said the memo could mean fewer frivolous complaints, allowing investigators to focus on more important tips. But critics of the reforms argue they could ultimately hamper oversight, weaken the independence of the IG and put whistleblowers in an impossible situation.” More, here.

    Trump falsely claimed National Guard troops were “in place” in Portland on Wednesday, but “no troops could be seen anywhere around the outside of the ICE facility on South Macadam Avenue,” Portland’s KGW news reported shortly afterward, though they are expected sometime early next week.

    “I'm guessing [Trump] means that the 200 individuals have been selected and sent to Camp Rilea for training,” Sen. Jeff Merkley, D-Oregon, told KGW. “He may also mean the command structure from Northern Command has arrived in Oregon. He may mean that. It's definitely the sort of thing where it would be nice to have the right appointed person clarify those details. We're all trying to get the best information we can, and it's very fuzzy.”

    Trump also falsely claimed “ANTIFA and the Radical Left Anarchists” were attacking federal law enforcement and immigration officers, and “many people have been badly hurt, and even killed” because he said the city is “a NEVER-ENDING DISASTER” that’s “run like a Third World Country.”

    In reality, “The ICE facility in the South Waterfront neighborhood has been the site of small-scale but frequent protests in recent months, leading to a handful of arrests and some complaints about noise and tear gas, though there have been no significant injuries or deaths reported, and nearby residents and Portland police have both described the marches as relatively peaceful,” KGW reports. 

    Local police reax: “The city of Portland is about 145 square miles. This is one city block,” Portland Police Chief Bob Day told reporters Tuesday. “And even the events that are happening down there do not rise to the level of attention that they are receiving.”

    And ICYMI: “Federal officers have arrested just 5 people at Portland ICE building since July 4,” KGW8 reported Tuesday.

    Legal insight: “The Trump administration is hoping no one notices that, although federal law defines ‘domestic terrorism,’ it provides no special authorities against anyone whose behavior meets that definition,” Georgetown University national security law professor Steve Vladeck writes on Substack. 

    He’s talking about Trump’s recent “National Security Presidential Memorandum-7” (NSPM-7), which is a memo signed last Thursday titled “Countering Domestic Terrorism and Organized Political Violence.” That memo, Vladeck says, “reflects a dramatic escalation in the Trump administration’s efforts to cast a whole lot of constitutionally protected speech and political activity as unlawful ‘political violence and intimidation.’” The point of the memo seems to be “to scare, intimidate, cajole, and harass a wide array of non-governmental (and non-profit) organizations into self-censoring—lest they risk triggering the investigations and potential prosecutions the memorandum threatens,” Vladeck writes. 

    On its face, the memo is “an exercise in legally empty but rhetorically dangerous symbolism,” says Vladeck, “one that is trying to coerce more and more individuals and groups to ‘obey in advance,’ even though there are no new substantive rules that they need to actually obey.” Read on, here.

    Additional reading: 

    Russia’s Ukraine war, day 1317

    Developing: The U.S. will soon begin helping Ukraine strike deeper inside Russia via a new intelligence-sharing agreement pertaining to “long-range missile strikes on Russia’s energy infrastructure,” the Wall Street Journal reported Wednesday. “President Trump recently signed off on allowing intelligence agencies and the Pentagon to aid Kyiv with the strikes,” U.S. officials said as Trump’s recent efforts to end Vladimir Putin’s Ukraine invasion have gone nowhere so far. 

    Also pending: Possible U.S. delivery of Tomahawk and Barracuda cruise missiles as well as “other American-made ground- and air-launched missiles that have ranges of around 500 miles,” officials told the Journal. Vice President JD Vance teased the Tomahawk possibility Sunday. The Kremlin’s reaction the following day seemed relatively muted compared to November 2024, e.g., according to Reuters reporting Monday.

    Even without the new intelligence, Ukraine has attacked 21 of Russia’s 38 large oil refineries since January, triggering fuel shortages and price hikes that one gas station manager compared “to the hyperinflation experienced by post-Soviet Russia,” according to the BBC. “In my opinion we haven't had a crisis like this since 1993-1994,” he said. 

    An estimated 38% of Russia’s oil refining capacity is reportedly offline, and about 70% of that was caused by Ukrainian drone strikes, according to Moscow-based newspaper Lenta, reporting Tuesday. 

    Panning out: “Retail petrol prices have surged, while wholesale prices—the cost at which retailers buy from producers—have risen even faster, growing by 40% since January.”

    One large plant near Moscow has been hit five times this calendar year, but August was the busiest month with more than a dozen such attacks. Read more, here. 

    New: Russia appears to have modified its ballistic missiles to better evade Patriot air defense systems, the Financial Times reports. That includes Moscow’s “Iskander-M mobile system, which launches missiles with an estimated range of up to 500km, as well as Kinzhal air-launched ballistic missiles, which can fly up to 480km,” officials said. 

    “The missiles now follow a typical trajectory before diverting and plunging into a steep terminal dive or executing manoeuvres that ‘confuse and avoid’ Patriot interceptors,” according to Ukrainian and western officials. These adjustments appear to have helped Russia attack “At least four drone-making plants in and around Kyiv” over the summer, including “strike on August 28 on a facility producing Turkish Bayraktar drones.” 

    Related: The Polish government believes Russia deliberately sent drones into its airspace last month to test the resolve of the country and its NATO allies—and that such tests will keep coming. That means the Polish military needs a better counter-unmanned systems plan, Foreign Minister Radosław Sikorski told reporters on Wednesday. The European Union is leading that effort, he added, securing $150 billion in loans for member states, as well as joint ventures with Ukraine, whose counter-UAS prowess was born out of necessity in the nearly four years it’s been fighting off Russian drones, Defense One’s Meghann Myers reports. 

    Also this week: Finland said it’s gonna help protect Denmark’s airspace, which is one of several European nations that have experienced suspicious overflights of sensitive sights. 

    Additional reading: “Suspicious drones apparently spied on critical infrastructure,” Germany’s Der Spiegel reported Wednesday, highlighting newly-revealed overflights of German army and naval bases in Sanitz and Rostock as well as defense industry locations elsewhere.

    Around the world

    Lastly: President Trump seems to have quietly committed the U.S. to defending Qatar, according to an executive order Trump signed Monday during Israeli prime minister Benjamin Netanyahu’s visit to the White House. 

    The order is “bizarre,” observed Ankit Panda of the Carnegie Endowment for International Peace, writing Wednesday on Substack. He then focuses on what he says are “two big problems with this from the broader perspective of the practice of U.S. extended deterrence and alliances. First of all—and I’ve expressed this frustration elsewhere—it matters to the United States, its people, and U.S. allies that assurances and extended deterrence relationships are codified in treaties,” he writes. And secondly, “from the vantage point of U.S. treaty allies, these relatively empty assurances to Qatar could be seen as cheapening the value of actually being in a treaty alliance with the United States.”

    After some consideration, he goes on to describe Trump’s order as “a perverse reflection of the domestic political incentives that shape how the United States thinks about its various allied relationships” under the current president, in particular. “I won’t go as far as to argue that this new executive order for the Qataris is a huge problem for American alliances in 2025,” he continues. “[T]hat would be hyperbolic and there are far more obvious culprits. But it’s certainly not the sort of thing that makes the actual treaty allies remember or recognize any value in an actual treaty-based relationship.”

    Second opinion: “An executive order is not a treaty and can be overturned by another president, but the declaration of a military commitment to a foreign nation without ratification by the Senate as the Constitution requires shows the belief of administration officials that they can act as they wish without consulting Congress,” writes Heather Cox Richardson of Boston College. 

    However, “the deal shows just how ill-advised Trump’s illegal demand for, and then receipt of, a $400 million luxury 747-8 from Qatar turned out to be, for now it certainly looks as if Qatar received U.S. military commitments in exchange for a used plane,” she adds. 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • On Tuesday, Defense Secretary Pete Hegseth declared that changes would be coming to the department’s inspector general office. Just hours earlier, the Office of Management and Budget effectively defunded an office that supports and trains oversight employees who root out waste, fraud, and abuse governmentwide. 

    Both moves raised red flags among bipartisan members of Congress and governmental oversight organizations who have been critical of President Donald Trump’s actions against inspectors general since he fired 17 of them during the first days of his second term. 

    “This is not the final step, but we're getting close to the final steps of undoing the entire system of oversight within the executive branch,” said Andrew Bakaj, chief legal counsel for the nonprofit Whistleblower Aid. 

    Hegseth vs. his OIG

    During his Tuesday speech to senior military leaders in Quantico, Virginia, Hegseth said that the IG process “has been weaponized, putting complainers, ideologues and poor performers in the driver's seat.”

    Hegseth, who inveighed against DOD's equal opportunity and military equal opportunity programs, said that there would be: “No more frivolous complaints. No more anonymous complaints. No more repeat complainants. No more smearing reputations. No more endless waiting. No more legal limbo. No more sidetracking careers. No more walking on eggshells.”

    Bakaj argued that the event, at which Trump also spoke, would deter people from whistleblowing. 

    “The atmosphere that was created in the meeting yesterday by the secretary of — still the secretary of Defense, Congress has not changed the name to secretary of War — the secretary of Defense and the president chilled the ability for anybody to come forward,” said Bakaj, who used to work in the DOD IG office. 

    In a memo released after his speech, Hegseth ordered the military secretaries to work with the department IG to make several changes to the IG investigation process including: 

    • Requiring an evaluation to be completed within seven days of receiving a complaint to assess its credibility before launching an investigation. Hegseth also directed the military departments to “explore the use of artificial intelligence with human oversight” to meet such a timeline. 
    • Updating the subject of a complaint, their commander and the complainant every 14 days on the investigation’s status. 
    • “Establish[ing] clear and enforceable procedures to identify and manage complainants who submit multiple complaints without credible evidence, that are frivolous or that knowingly include false information.”

    Faith Williams, the director of the Effective and Accountable Government Program at the Project on Government Oversight, contended that the credibility assessment and regular updates could be beneficial, but the focus on repeat complainants stood out to her. 

    “It reinforced a tone that I had sort of picked up on throughout the memo, which is this assumption that the complaints and information that inspectors general were receiving are somehow false or malicious,” she said. 

    While noting that whistleblower retaliation has been an issue across administrations, Williams argued that the memo recasts how whistleblowers are portrayed. 

    “Whistleblowers perform a critical oversight role. They help report and prevent waste, fraud and abuse of power. And I think many prior administrations, many elected officials, would agree that they're essential,” she said. “This [memo] puts whistleblowers, instead of in a more heroic position, into this more villainous position.”

    In a Wednesday statement, Bakaj argued that the memo would enable “senior officials to dictate timelines and procedures from the top down” and lead to disclosures being “weaponized” against whistleblowers. 

    In speaking with Government Executive, Bakaj also cited one of his former clients as an example of how a repeat complainant can be valuable to an agency. 

    “She was fulfilling an audit role, looking at various contracts, and she had the unique perspective to be able to see when something was going wrong,” he said in an interview. “One of this individual's last disclosures was, in fact, evidence, which ultimately became substantiated, of a multimillion dollar fraud committed by a contractor.” 

    Mark Greenblatt, who was IG at the Interior Department before Trump removed him as part of the mass firing in January, emphasized that IGs are themselves already subject to oversight from Congress and periodic review by other IG offices to ensure fairness. 

    “It's hard for me to believe that IGs can kind of slip one past the goalie on a partisan basis when we have so many guardrails in place,” he said. 

    Hegseth is currently under evaluation by the DOD IG, at the request of Senate Armed Services Chairman Roger Wicker, R-Miss., and ranking member Jack Reed, D-R.I., over his use of Signal to discuss upcoming military operations in Yemen. 

    Withholding funding 

    OMB on Sept. 26 informed the Council of the Inspectors General on Integrity and Efficiency that it would not be apportioned funding for fiscal 2026, according to a letter that Tammy Hull, the IG for the U.S. Postal Service and acting chair of CIGIE, sent to Congress. 

    Hull wrote that CIGIE’s work would not be affected by the ongoing shutdown because of how the agency is funded, but that OMB’s decision is forcing them to furlough 25 employees. She added that the disruption would interrupt congressionally authorized whistleblower hotlines, IG employee training and an oversight body that reviews allegations of wrongdoing against the watchdogs. 

    Senate Appropriations Committee Chair Susan Collins, R-Maine, and Sen. Chuck Grassley, R-Iowa, a longtime IG defender, on Monday sent a letter to OMB Director Russell Vought urging him to “reverse course.” 

    “Effectively defunding CIGIE — contrary to congressional intent — will disrupt numerous important oversight functions, including the Oversight.gov website, whistleblower reporting portals and activities designed to ensure the inspectors general community is held accountable,” they wrote. 

    Grassley announced on Wednesday that OMB has since apportioned $5 million to the Pandemic Response Accountability Committee, a part of CIGIE that investigates fraud in COVID-19 pandemic spending and was extended until 2034 in the One Big Beautiful Bill Act. He and Collins said in a statement that OMB should “promptly apportion funds for CIGIE as well.” 

    But the Trump administration does not seem to be inclined to do that. 

    “Inspectors general are meant to be impartial watchdogs identifying waste and corruption on behalf of the American people. Unfortunately, they have become corrupt, partisan and in some cases, have lied to the public,” an OMB spokesperson said in a statement to Government Executive. “The American people will no longer be funding this corruption.”

    During his first term, Trump fired the IG whose notification to Congress led to his first impeachment. 

    As of Thursday morning, the the CIGIE website is down, as are those webpages of at least 15 agency OIGs that were hosted by CIGIE’s platform. 

    “Without [CIGIE’s] infrastructure, I fear that individual IGs will be isolated, their effectiveness diminished and their ability to protect taxpayer interests severely compromised,” Greenblatt said in a statement. “Defunding CIGIE eliminates the infrastructure that enables inspectors general to coordinate, share best practices and hold federal agencies accountable across government.”

    Greenblatt, a former CIGIE chair, hypothesized that the entity’s effective defunding is due to its 2024 finding that Homeland Security Department inspector general Joseph Cuffari, who was appointed during Trump’s first term, abused his authority and engaged in substantial misconduct. But President Joe Biden took no disciplinary action against him, and Cuffari was spared during January’s mass firing. 

    “Make no mistake: this decision is not about budget efficiency nor streamlining government,” Greenblatt said in his statement. “Over the last few years, Cuffari and his minions have led a long-term and highly destructive campaign to undermine CIGIE and the IG community. I believe this is a direct outgrowth of that dishonest effort.”

    Cuffari filed a lawsuit, which a federal judge dismissed in 2023, alleging that CIGIE’s investigation of him amounted to unlawful harassment. The DHS OIG did not respond to a request for comment. 

    Bakaj of Whistleblower Aid and Williams of POGO in statements Tuesday also condemned the withholding of funding for CIGIE.  

    Congressional Democrats slammed the Trump administration’s actions as well. House Appropriations Committee ranking member Rosa DeLauro, D-Conn., argued that “OMB is choking off resources of the Council of the Inspectors General to halt their operations.” 

    “This moment demands action. The fastest way to restore trust is to guarantee inspectors general true independence — and to finally establish an inspector general at the ‘nerve center of federal spending,’ the Office of Management and Budget,” she said in a statement. “I call on Russ Vought and the Office of Management and Budget to release CIGIE’s funding immediately, and I look forward to working with my colleagues on both sides of the aisle to make sure this never happens again.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The threat actor known as Confucius has been attributed to a new phishing campaign that has targeted Pakistan with malware families like WooperStealer and Anondoor. “Over the past decade, Confucius has repeatedly targeted government agencies, military organizations, defense contractors, and critical industries — especially in Pakistan – using spear-phishing and malicious documents as initial

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new proof-of-concept (PoC) tool named Obex has been released, offering a method to prevent Endpoint Detection and Response (EDR) and other monitoring solutions’ dynamic-link libraries (DLLs) from loading into processes.

    The tool, created by a researcher known as “dis0rder0x00,” is designed to block specified DLLs both during the initial startup of a process and at runtime, potentially allowing malware or red team tools to operate without being detected by security software.

    Obex functions by launching a target application under its debug control. This allows it to intercept critical system operations. Specifically, it hooks the ntdll!LdrLoadDll function, which is responsible for loading DLLs into a process.

    When an application attempts to load a DLL, Obex intercepts the call and checks the DLL’s name against a configurable blocklist.

    If the DLL is on the list, the tool simulates a failed load attempt, preventing the library from being injected into the process.

    If the DLL is not on the list, the loading process is allowed to continue as normal. This technique effectively blinds security tools that rely on injecting their own DLLs into processes to monitor their behavior.

    The tool is written in C and has no external dependencies, making it lightweight and portable. By default, Obex is configured to block amsi.dll, the library for the Antimalware Scan Interface, but users can provide a custom list of DLLs to block.

    The developer has made the tool available on GitHub, positioning it as a technique for security researchers to understand and test evasion methods.

    Security solutions widely use DLL injection to establish user-mode hooks for monitoring API calls and system behavior. Tools like Obex demonstrate methods that can be used to circumvent these defenses.

    While valuable for penetration testers and red teams, such tools also provide defenders and security vendors with important insights into evasion techniques, helping them to develop more resilient detection and protection strategies against sophisticated threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New Obex Tool Blocks EDR Dynamic Libraries From Loading at Runtime appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A proof-of-concept (PoC) exploit has been released for a critical vulnerability chain in VMware Workstation that allows an attacker to escape from a guest virtual machine and execute arbitrary code on the host operating system.

    The exploit successfully chains together an information leak and a stack-based buffer overflow vulnerability to achieve a full guest-to-host escape, one of the most severe types of security flaws in virtualization software.

    The exploit targets vulnerabilities that were first demonstrated at the Pwn2Own Vancouver event in 2023. Security researcher Alexander Zaviyalov of NCC Group recently published a detailed technical analysis and a functional PoC, demonstrating the practical risk posed by these flaws.

    The Two-Stage Attack

    The guest-to-host escape is accomplished by chaining two distinct vulnerabilities found in the virtual Bluetooth device functionality of VMware Workstation. This feature, which is enabled by default, allows a guest VM to use the host’s Bluetooth adapter.

    Information Leak (CVE-2023-20870, CVE-2023-34044): The first stage of the attack leverages a Use-After-Free (UAF) memory leak. By sending specifically crafted USB Request Block (URB) control transfers to the virtual mouse and Bluetooth devices, an attacker can leak memory pointers from the vmware-vmx.exe process on the host.

    This information leak is crucial for bypassing Address Space Layout Randomization (ASLR), a standard security feature that randomizes memory locations to make exploitation more difficult.

      Exploit

      Buffer Overflow (CVE-2023-20869): With ASLR bypassed, the attacker proceeds to the second stage. This involves triggering a stack-based buffer overflow by sending a malicious Service Discovery Protocol (SDP) packet from the guest VM to another Bluetooth device discoverable by the host.

      The overflow allows the attacker to hijack the program’s execution flow, and with the previously leaked memory addresses, they can execute a custom payload on the host system.

        The combination of these vulnerabilities allows an attacker with control over a guest VM to gain full control of the host machine. In the demonstration, the exploit successfully launched a reverse shell from a Linux guest to a fully patched Windows 11 host, effectively compromising the underlying system, Alexander Zaviyalov said.

        The full exploit chain primarily affects VMware Workstation 17.0.1 and earlier versions. The specific vulnerabilities have different patch timelines:

        • The stack-based buffer overflow (CVE-2023-20869) was addressed in version 17.0.2.vmware-workstation-guest-to-host-escape.pdf
        • The memory leak vulnerabilities (CVE-2023-20870 and CVE-2023-34044) were patched across versions 17.0.2 and 17.5.0, respectively.vmware-workstation-guest-to-host-escape.pdf

        Because the complete exploit requires both the buffer overflow and the memory leak, users running version 17.0.1 or older are at the highest risk.

        Mitigations

        The primary recommendation for all users is to update their VMware Workstation software to the latest available version (17.5.0 or newer), which contains patches for all the discussed vulnerabilities.

        For users who cannot immediately update, a potential workaround is to disable the virtual Bluetooth device. This can be done by unchecking the “Share Bluetooth devices with the virtual machine” option in the virtual machine’s USB Controller settings.

        Disabling this feature removes the attack surface exploited by this specific PoC. The detailed research highlights the complexity of modern exploits and underscores the importance of timely patching for virtualization platforms.

        Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

        The post PoC exploit Released for VMware Workstation guest-to-host escape Vulnerability appeared first on Cyber Security News.

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

      1. Cybersecurity researchers have flagged a malicious package on the Python Package Index (PyPI) repository that claims to offer the ability to create a SOCKS5 proxy service, while also providing a stealthy backdoor-like functionality to drop additional payloads on Windows systems. The deceptive package, named soopsocks, attracted a total of 2,653 downloads before it was taken down. It was first

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

      2. Penetration testing is critical to uncovering real-world security weaknesses. With the shift into continuous testing and validation, it is time we automate the delivery of these results. The way results are delivered hasn’t kept up with today’s fast-moving threat landscape. Too often, findings are packaged into static reports, buried in PDFs or spreadsheets, and handed off manually to

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

      3. From unpatched cars to hijacked clouds, this week’s Threatsday headlines remind us of one thing — no corner of technology is safe. Attackers are scanning firewalls for critical flaws, bending vulnerable SQL servers into powerful command centers, and even finding ways to poison Chrome’s settings to sneak in malicious extensions. On the defense side, AI is stepping up to block ransomware in real

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

      4. Google Mandiant and Google Threat Intelligence Group (GTIG) have disclosed that they are tracking a new cluster of activity possibly linked to a financially motivated threat actor known as Cl0p. The malicious activity involves sending extortion emails to executives at various organizations and claiming to have stolen sensitive data from their Oracle E-Business Suite. “This activity began on or

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶

        ¶¶¶¶¶