• A newly observed cyber campaign linked to the Iran-aligned threat group Nimbus Manticore (also tracked as UNC1549 and Smoke Sandstorm) is targeting aerospace and defense organizations using a deceptive recruitment workflow that delivers custom malware through a sophisticated sideloading chain. The operation highlights the group’s continued reliance on social engineering combined with stealthy execution techniques […]

    The post Nimbus Manticore APT Uses Fake Jobs to Deliver Custom Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A large-scale software supply chain attack has compromised multiple official npm packages under the @redhat-cloud-services scope, exposing thousands of developers and CI/CD environments to credential theft. Security researchers at Aikido confirmed that 96 malicious versions across 32 packages were published on June 1, 2026, with combined weekly downloads exceeding 116,000. Red Hat Cloud Services npm […]

    The post Red Hat Cloud Services npm Packages Hijacked in Credential-Theft Malware Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • PRAGUE, Czech Republic–A small but growing number of European officials and analysts are saying what four years ago was unthinkable: Ukraine isn’t just surviving its grueling war with Russia, it is in some ways thriving and may even be on a path to victory.

    This isn’t yet captured in headlines—for example, about last weekend’s barrage of Russian drones and missiles around Ukraine—but in the details, like how some 90 percent were intercepted.

    Several long-term trends have shifted in Ukraine’s favor, and the core reason is its fierce focus on AI and robotics.

    In the crucible of war, Ukraine has developed drones and ground robots that can hold territory—even take it back. Some are fully controlled by humans, like supply robots and medical-evacuation vehicles. But an increasing number are controlled in at least some aspects by dozens of AI products, from guidance packages on aerial drones to decision aids at the highest levels. Take the TFL-1 module, which can enable a one-way drone to function autonomously after a human has selected its target, reducing its susceptibility to jamming and other defenses. Its manufacturer, a Ukrainian company called The Fourth Law, says TFL-1 makes a drone four times more likely to hit its target.

    Just as important as the tech are the new tactics. Given unusual latitude to experiment, Ukrainian fighters began to develop robot-forward infantry concepts, like combined-arms attacks by airborne and ground systems, “more than a year ago. Right now, we're massively starting to implement this,” said Davyd Aloian, deputy secretary of the National Security and Defence Council of Ukraine, the coordinating body on domestic and international security, in an interview.

    Ukraine and its partners are also steaming ahead on new concepts for highly autonomous defenses against Russian drones, combining ISR sensors and AI to detect and identify enemy drones in less time and with more certainty. 

    “All of the systems are being linked with each other and with people” to create a distributed network with interceptor drones at various locations to be activated when needed, Aloian said. “One day we will have only like 10 guys who are just going to be responsible for approving interception. And it will automatically go direct to the target.”

    The human operators will be dispersed as well. “Everything can be controlled from Kyiv, Lviv, from cities in other countries,” he said.

    Ukraine’s advantages go beyond weapons and tactics. It is more willing than Russia—or even Kyiv’s Western backers—to rebuild its doctrine, acquisition, and resupply systems around autonomous warfare. 

    Countries that fail to follow suit risk disaster, one of Ukraine’s top dronemakers warned attendees at the GLOBSEC conference here.

    “It's not what happened to Ukraine”—meaning Russia’s barrage of Shahed drones—that “should scare us in Europe,” said Swarmer CEO Serhii Kupriienko. 

    Instead, Kupriienko said, people should be scared by how quickly a middling military—in this case, Ukraine’s—developed the ability to inflict precise, devastating, and long-range damage. 

    “We are behind by literally 10 years or 20 years” in some defense-technology areas, such as satellite imagery, Kupriienko said, and yet his country has climbed a capability curve that just two years ago seemed insurmountable. So could others, he said.

    “The answer is always AI solutions and integrating the AI into even the daily routine work within the bureaucracy,” he said. 

    Ukraine has also developed a defense industry that can keep up with the Russian threat. Its success is reflected not only on the battlefield, but in the growing number of foreign investors who see potential in defense products developed in and with Ukraine.

    “We have evolved since 2022, the industry has and our defense has as well. Right now we are able to provide not only [large quantities of drone] assets but everything what is needed to build out the ecosystem,” including parts and production, training, modification, etc. Aloian said.

    Strike drones FTW

    Ukraine’s strike drones, more than any other factor, have helped counter a key Russian advantage: a large population of economically desperate young men and a comparative willingness to discount the cost of their deaths. Vladimir Putin has drawn hundreds of thousands into service with upfront bonuses and insurance benefits, which has provided numerical superiority on Ukrainian battlefields along with “considerable stimulus for the ailing Russian economy,” writes expatriate economist Vladislav Inozemtsev, who calls the system “deathonomics.”

    But human waves are ineffective if drones kill soldiers faster than they can be replaced at the front—and that has become the case, analysts at the Institute for the Study of War wrote this week.

    “Ukraine's successful mid-range and frontline drone strike campaigns are limiting Russia's ability to transport personnel to the frontline and to supply and sustain frontline positions,” they wrote. 

    Putin must now “convince an increasingly tired Russian populace not only to support a fifth year of war but also to accept involuntary mobilization for a war that has already cost Russia well over a million casualties.”

    Ukraine’s deep-strike capabilities have changed the game in other ways as well. Oil infrastructure deep in Russian territory is no longer safe, giving Kyiv leverage over Moscow’s export revenues no matter what the White House does with sanctions relief. Even more humiliating, the drone threat forced Putin to hold his annual Victory Day parade this month without Soviet-esque ranks of tanks and missiles.

    “Believe us. We were in the occupation of the Soviet Union for 50 years, and we know how important” the Victory Day parade is,” Estonian foreign minister Margus Tsahkna told the GLOBSEC audience. “For the first time, Putin was not able to wage this parade. This is the facade actually collapsing. And Putin is losing face among the Russian people, not only among us.”

    “Putin thought that Ukraine was a question of five days. And, let's be frank, we, too, we said, ‘Five days, and then it's finished,’” said Xavier Bettel, Luxembourg's deputy prime minister. “In fact, the resilience of the Ukrainians was a big surprise for all of us.”

    Changing fortunes

    To understand how dramatically Ukraine’s prospects have changed, consider that in March, then-ODNI director Tulsi Gabbard, testified that the U.S. intelligence community believed that Russia had the “upper hand” in the conflict.

    Now Ukrainian officials and other observers have begun to worry about a premature sense of victory among Ukraine’s foreign backers. Kyiv still depends on aid and imported weapons. Last week, Ukrainian President Volodymyr Zelenskyy said the government continues to be “very persistent” in its efforts to secure advanced Patriot missiles from the United States. “I believe [the U.S.] must act quicker,” he told reporters during a visit to Sweden.

    Some European governments, however, are ever more eager to forge deeper ties with their continent’s new defense leader—not just for Ukraine’s sake but for their own. 

    “It means enlargement processes for the European Union, for NATO in the future,” Estonia’s Tsahkna said. It means security guarantees not only to Ukraine and for Ukraine, but the other way around, because actually Ukraine is the largest military power in Europe at the moment, and increasing as well its industrial base.”

    As for the Ukrainian government, declaring victory will require more than the cessation of hostilities. The invading country must be left “much weaker,” so that it can’t re-arm as it did after its 2014 invasion of Crimea, Aloian said.

    “If there's going to be a ceasefire, there will be very harsh conditions and difficult negotiations for the taking off of the sanctions, and when it will be,” he said. Otherwise, Russia will “renew all of those processes [of military buildup] before the full-scale invasion.”

    “Right now, they're aiming like about 30 percent of their economy for the defense industry,” which is too much, he said. 

    Even the downfall of Putin, who has led Russia since the end of the 20th century, would be insufficient.

    “The change of the regime shouldn’t just be only external. It should be also internal,” he said.

    If it happens, much of the credit will go to the makers and operators of Ukraine’s drones.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Password manager Dashlane has disclosed that “fewer than” 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an “external” threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Consider the history of any recent corporate scandal, and it is quite possible to guess what the story…

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pentagon leaders cut their department’s workforce by more than 10 percent with little regard for the effects—and still has no plans to assess them, according to a congressional watchdog report released on Friday. 

    The department shed 78,000 civilian employees in 2025 through a mix of voluntary resignations, involuntary layoffs, and a hiring freeze that resulted in nearly 60,000 fewer new hires than in recent years, the report found.

    “But we found that DOD didn’t consistently analyze the impacts of these reductions, either in 2025 or in prior years,” according to the report. “DOD also doesn’t have a plan to assess lessons learned from its 2025 workforce reductions.”

    In their response to the report, Defense officials agreed that they should “develop and implement a plan for collecting and sharing lessons learned from the Department's implementation of workforce reduction efforts.” 

    The officials did not indicate whether that would happen. 

    Soon after Defense Secretary Pete Hegseth took office, the Pentagon announced it would cut 5 to 8 percent of its civilian workforce. Within a year, the number swelled to about 110,000—about 14 percent of DOD civilians—including laid-off probationary employees, deferred resignations, and voluntary early retirements. Some 30,000 people were hired for a short list of jobs exempted from the hiring freeze, putting the net loss at just over 10 percent.

    Of the 28 Defense agencies, offices, and other organizations targeted for workforce cuts by the Trump administration’s fiscal 2026 budget request, at least three did not give the required explanation to Congress about why and how the cuts would be made, GAO found.

    Those were the Joint Staff, Defense Threat Reduction Agency, and the Defense Contract Audit Agency, according to the report. 

    “According to component officials, DOD had not provided guidance for when and how to conduct and document this analysis,” the GAO found.

    And further, the GAO found, the Pentagon didn’t plan to assess how the cuts affected productivity.

    In March, the Partnership for Public Service published a survey that found morale among DOD employees has tanked during the current administration. 

    Only 9 percent of Army Department employees agreed that “Secretary of War Pete Hegseth’s political leadership team generates high levels of motivation in the workforce,” the survey found, the most satisfied of any of the large government agencies surveyed.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Replenishing munitions stockpiles doesn’t end with simply producing more of them. There are persistent challenges with mixing, manufacturing, integrating and discovering new energetic materials—the chemical compounds that make up explosives, propellants, and munitions. On Thursday, the Navy broke ground on a new facility to help. 

    The Maryland Energetics Innovation Hub is meant to furnish lab space where companies can test new tech, such as high-performance computers to run simulations. It is under construction an hour or so from the Pentagon by the Naval Surface Warfare Center in Indian Head, Md., and the American Center for Manufacturing & Innovation, or ACMI. 

    “This initiative ensures that NSWC Indian Head Division remains at the forefront of energetics innovation, scale-up, and production,” Capt. Stephen Duba, the warfare center’s commanding officer, said in a statement. “By bringing together government and industry partners in a collaborative environment, we can accelerate the development and fielding of critical capabilities that strengthen the Navy’s arsenal and the larger munitions industrial base.”

    The Navy awarded ACMI $50 million to bring companies working in munitions and energetics closer to the service’s technical expertise. The group aims to raise another $150 million for the project.

    The MEIH will focus on eight technical areas: developing new energetics materials, high-performance computing; non-destructive test and evaluation; integration with drones or unmanned systems; automating energetic processing and assembly; creating new manufacturing processes for propulsion systems and warheads; analyzing energetics obsolescence, and producing high-precision, high-throughput non-energetic components.

    The plan is to finish the first two buildings of the larger facility within nine months, John Burer, ACMI’s founder, told Defense One. 

    The White House and Pentagon have made production of munitions—both exquisite and expendable—a clear priority for the near future. Earlier this year, the Pentagon stood up the Congressionally-mandated Joint Energetics Transition Office, which is charged with developing strategies for investment in and implementation of new and legacy materials needed for weapons and propulsion systems.  

    Defense tech hubs have already sprouted around the country, in Austin, Texas; Rhode Island’s Unity Park and Quonset Point; and the Louisiana coastline. MxD, a Pentagon manufacturing partner, has a 22,000-square-foot hub in Chicago. 

    The Maryland hub is the second facility the Navy and ACMI have embarked on. The first was the National Security Industrial Hub near NSWC’s installation in Crane, Indiana, which is focused on munitions and energetics. The Pentagon is spending $75 million to help erect the Indiana campus, which broke ground earlier this year.

    The Maryland and Indiana facilities both are using private capital for “industrial facility build outs,” Burer said. 

    “The objective of the Maryland Energetics Innovation Hub is around process development and technology development around energetics, which would be developed there, but then scale and be relevant in many other places across the United States—qualifying new second sources of supply, which is a special thing that they have the ability to do at the nation's only government-owned, government-operated arsenal for the Navy, at Indian Head,” he said. 

    That munitions campus in Indiana is around 1,100 acres, while the Maryland hub would be a fraction of that. 

    “What makes this campus special is the ability to facilitate private-public partnerships between the tenants and Indian Head to make use of specialist capabilities that they have behind the fence,” such as mixing energetic materials, Burer said. “To build a solid rocket motor campus, for example, which is one of the specialties behind the gate at Indian Head, you need many, many hundreds of acres…That's what scaled production needs. But refining the processes at a pilot scale. It's smart to do that in a smaller footprint campus, in a collaborative way, which is what they're aiming to do here.”

    The southern Maryland-based hub builds on an ecosystem of energetics companies working in the region, but could foster new growth and partnerships for companies designing military technology, said William Durant, CEO and president of the not-for-profit Energetics Technology Center, which will have space at the MEIH and help connect companies looking to work with the Navy. 

    “We want to see and help enable the companies that are coming in—that are best suited to meet any of those eight technical capability areas—[be] successful,” Durant said. 

    Over the next year, they plan to have a set of companies and a roadmap to execute solutions in those research and development areas. 

    “We want to see, in 16 to 18 months, who are the performers, what that's going to look like to meet the needs of the Navy…and then there are specific products and things that they're going to want that are needed today in the warfighter,” Durant said.

     While there’s no fixed number, the aim is to have about ten companies join the hub, whether they take up long-term residence or cycle in and out, he said. 

    “Whatever is most important in supporting warfighter success. If that means a company comes in for six months, great! If that means that a company now needs to take up residency for five years, great! And now, does that mean we need to build another facility?”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • When a predator contacts a child through an online platform, the details of how it happened often expose…

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and deliver a self-propagating worm. “This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta’s “AI support assistant” bot into resetting account passwords.

    A screenshot from a video released on Telegram claiming to show how Meta’s AI customer support bot could be tricked into resetting a target’s password.

    On May 31, word began to spread on several Telegram instant message channels that Meta’s AI bot would happily add an email address to an existing account as part of the bot’s standard password reset flow.

    A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target’s usual hometown, requesting a password reset for the account, and then choosing to chat with Meta’s AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset.

    The Telegram account that posted the video also linked to screenshots of pro-Iran images, videos and messages that defaced the hacked Instagram accounts, saying hackers had used the exploit to hijack a number of valuable (read: short) Instagram account names that allegedly have a resale value of more than a half million dollars.

    Meta has not responded to requests for comment on the video’s claims, but the company reportedly did acknowledge the dormant Instagram account for the Obama White House was briefly compromised. The security blog thecybersecguru.com reports that Meta pushed an emergency patch over the weekend, and clarified that no back end database was breached.

    “Instagram has notoriously poor human support infrastructure,” Cybersecguru wrote. “Recovering a locked account – especially a high-value one can take weeks of back-and-forth with an automated ticketing system. Meta’s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership. The assistant, presumably, was supposed to reduce friction for legitimate users stuck in account-access hell.”

    Ian Goldin, a threat researcher at Lumen’s Black Lotus Labs, said we’re entering unchartered security territory as more large online platforms start allowing AI chatbots to handle sensitive account recovery requests. Just like human customer support employees can be social engineered into providing unauthorized access to someone’s account, AI bots are equally eager to help and vulnerable to persuasion and trickery, he said.

    “AI chatbots create interesting new attack surface, and we’re likely going to see a lot more of these kinds of attacks,” Goldin said.

    Securing your various online accounts means taking full advantage of the most secure form of multi-factor authentication (MFA) offered (such as a passkey or security key). In this case, even using the least robust form of MFA that Instagram offers — a one-time code sent via SMS — likely would have blocked the exploit: The hackers who released the video on Telegram said their exploit failed to work against any accounts that had MFA enabled.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶