ADMIN.FOUNDATION

  • Drones to Diplomas: How Russia’s Largest Private University is Linked to a $25M Essay Mill

    ·

    , , , , , , , , , , , , , , , , , , , , , , , ,

    A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious ties to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine.

    The Nerdify homepage.

    The link between essay mills and Russian attack drones might seem improbable, but understanding it begins with a simple question: How does a human-intensive academic cheating service stay relevant in an era when students can simply ask AI to write their term papers? The answer – recasting the business as an AI company – is just the latest chapter in a story of many rebrands that link the operation to Russia’s largest private university.

    Search in Google for any terms related to academic cheating services — e.g., “help with exam online” or “term paper online” — and you’re likely to encounter websites with the words “nerd” or “geek” in them, such as thenerdify[.]com and geekly-hub[.]com. With a simple request sent via text message, you can hire their tutors to help with any assignment.

    These nerdy and geeky-branded websites frequently cite their “honor code,” which emphasizes they do not condone academic cheating, will not write your term papers for you, and will only offer support and advice for customers. But according to This Isn’t Fine, a Substack blog about contract cheating and essay mills, the Nerdify brand of websites will happily ignore that mantra.

    “We tested the quick SMS for a price quote,” wrote This Isn’t Fine author Joseph Thibault. “The honor code references and platitudes apparently stop at the website. Within three minutes, we confirmed that a full three-page, plagiarism- and AI-free MLA formatted Argumentative essay could be ours for the low price of $141.”

    A screenshot from Joseph Thibault’s Substack post shows him purchasing a 3-page paper with the Nerdify service.

    Google prohibits ads that “enable dishonest behavior.” Yet, a sprawling global essay and homework cheating network run under the Nerdy brands has quietly bought its way to the top of Google searches – booking revenues of almost $25 million through a maze of companies in Cyprus, Malta and Hong Kong, while pitching “tutoring” that delivers finished work that students can turn in.

    When one Nerdy-related Google Ads account got shut down, the group behind the company would form a new entity with a front-person (typically a young Ukrainian woman), start a new ads account along with a new website and domain name (usually with “nerdy” in the brand), and resume running Google ads for the same set of keywords.

    UK companies belonging to the group that have been shut down by Google Ads since Jan 2025 include:

    –Proglobal Solutions LTD (advertised nerdifyit[.]com);
    –AW Tech Limited (advertised thenerdify[.]com);
    –Geekly Solutions Ltd (advertised geekly-hub[.]com).

    Currently active Google Ads accounts for the Nerdify brands include:

    -OK Marketing LTD (advertising geekly-hub[.]net⁩), formed in the name of Olha Karpenko, a young Ukrainian woman;
    –Two Sigma Solutions LTD (advertising litero[.]ai), formed in the name of Olekszij (Alexey) Pokatilo.

    Google’s Ads Transparency page for current Nerdify advertiser OK Marketing LTD.

    Mr. Pokatilo has been in the essay-writing business since at least 2009, operating a paper-mill enterprise called Livingston Research alongside Alexander Korsukov, who is listed as an owner. According to a lengthy account from a former employee, Livingston Research mainly farmed its writing tasks out to low-cost workers from Kenya, Philippines, Pakistan, Russia and Ukraine.

    Pokatilo moved from Ukraine to the United Kingdom in Sept. 2015 and co-founded a company called Awesome Technologies, which pitched itself as a way for people to outsource tasks by sending a text message to the service’s assistants.

    The other co-founder of Awesome Technologies is 36-year-old Filip Perkon, a Swedish man living in London who touts himself as a serial entrepreneur and investor. Years before starting Awesome together, Perkon and Pokatilo co-founded a student group called Russian Business Week while the two were classmates at the London School of Economics. According to the Bulgarian investigative journalist Christo Grozev, Perkon’s birth certificate was issued by the Soviet Embassy in Sweden.

    Alexey Pokatilo (left) and Filip Perkon at a Facebook event for startups in San Francisco in mid-2015.

    Around the time Perkon and Pokatilo launched Awesome Technologies, Perkon was building a social media propaganda tool called the Russian Diplomatic Online Club, which Perkon said would “turbo-charge” Russian messaging online. The club’s newsletter urged subscribers to install in their Twitter accounts a third-party app called Tweetsquad that would retweet Kremlin messaging on the social media platform.

    Perkon was praised by the Russian Embassy in London for his efforts: During the contentious Brexit vote that ultimately led to the United Kingdom leaving the European Union, the Russian embassy in London used this spam tweeting tool to auto-retweet the Russian ambassador’s posts from supporters’ accounts.

    Neither Mr. Perkon nor Mr. Pokatilo replied to requests for comment.

    A review of corporations tied to Mr. Perkon as indexed by the business research service North Data finds he holds or held director positions in several U.K. subsidiaries of Synergy University, Russia’s largest private education provider. Synergy has more than 35,000 students, and sells T-shirts with patriotic slogans such as “Crimea is Ours,” and “The Russian Empire — Reloaded.”

    The president of Synergy University is Vadim Lobov, a Kremlin insider whose headquarters on the outskirts of Moscow reportedly features a wall-sized portrait of Russian President Vladimir Putin in the pop-art style of Andy Warhol. For a number of years, Lobov and Perkon co-produced a cross-cultural event in the U.K. called Russian Film Week.

    Synergy President Vadim Lobov and Filip Perkon, speaking at a press conference for Russian Film Week, a cross-cultural event in the U.K. co-produced by both men.

    Mr. Lobov was one of 11 individuals reportedly hand-picked by the convicted Russian spy Marina Butina to attend the 2017 National Prayer Breakfast held in Washington D.C. just two weeks after President Trump’s first inauguration.

    While Synergy University promotes itself as Russia’s largest private educational institution, hundreds of international students tell a different story. Online reviews from students paint a picture of unkept promises: Prospective students from Nigeria, Kenya, Ghana, and other nations paying thousands in advance fees for promised study visas to Russia, only to have their applications denied with no refunds offered.

    “My experience with Synergy University has been nothing short of heartbreaking,” reads one such account. “When I first discovered the school, their representative was extremely responsive and eager to assist. He communicated frequently and made me believe I was in safe hands. However, after paying my hard-earned tuition fees, my visa was denied. It’s been over 9 months since that denial, and despite their promises, I have received no refund whatsoever. My messages are now ignored, and the same representative who once replied instantly no longer responds at all. Synergy University, how can an institution in Europe feel comfortable exploiting the hopes of Africans who trust you with their life savings? This is not just unethical — it’s predatory.”

    This pattern repeats across reviews by multilingual students from Pakistan, Nepal, India, and various African nations — all describing the same scheme: Attractive online marketing, promises of easy visa approval, upfront payment requirements, and then silence after visa denials.

    Reddit discussions in r/Moscow and r/AskARussian are filled with warnings. “It’s a scam, a diploma mill,” writes one user. “They literally sell exams. There was an investigation on Rossiya-1 television showing students paying to pass tests.”

    The Nerdify website’s “About Us” page says the company was co-founded by Pokatilo and an American named Brian Mellor. The latter identity seems to have been fabricated, or at least there is no evidence that a person with this name ever worked at Nerdify.

    Rather, it appears that the SMS assistance company co-founded by Messrs. Pokatilo and Perkon (Awesome Technologies) fizzled out shortly after its creation, and that Nerdify soon adopted the process of accepting assignment requests via text message and routing them to freelance writers.

    A closer look at an early “About Us” page for Nerdify in The Wayback Machine suggests that Mr. Perkon was the real co-founder of the company: The photo at the top of the page shows four people wearing Nerdify T-shirts seated around a table on a rooftop deck in San Francisco, and the man facing the camera is Perkon.

    Filip Perkon, top right, is pictured wearing a Nerdify T-shirt in an archived copy of the company’s About Us page. Image: archive.org.

    Where are they now? Pokatilo is currently running a startup called Litero.Ai, which appears to be an AI-based essay writing service. In July 2025, Mr. Pokatilo received pre-seed funding of $800,000 for Litero from an investment program backed by the venture capital firms AltaIR Capital, Yellow Rocks, Smart Partnership Capital, and I2BF Global Ventures.

    Meanwhile, Filip Perkon is busy setting up toy rubber duck stores in Miami and in at least three locations in the United Kingdom. These “Duck World” shops market themselves as “the world’s largest duck store.”

    This past week, Mr. Lobov was in India with Putin’s entourage on a charm tour with India’s Prime Minister Narendra Modi. Although Synergy is billed as an educational institution, a review of the company’s sprawling corporate footprint (via DNS) shows it also is assisting the Russian government in its war against Ukraine.

    Synergy University President Vadim Lobov (right) pictured this week in India next to Natalia Popova, a Russian TV presenter known for her close ties to Putin’s family, particularly Putin’s daughter, who works with Popova at the education and culture-focused Innopraktika Foundation.

    The website bpla.synergy[.]bot, for instance, says the company is involved in developing combat drones to aid Russian forces and to evade international sanctions on the supply and re-export of high-tech products.

    A screenshot from the website of synergy,bot shows the company is actively engaged in building armed drones for the war in Ukraine.

    KrebsOnSecurity would like to thank the anonymous researcher NatInfoSec for their assistance in this investigation.

    Update, Dec. 8, 10:06 a.m. ET: Mr. Pokatilo responded to requests for comment after the publication of this story. Pokatilo said he has no relation to Synergy nor to Mr. Lobov, and that his work with Mr. Perkon ended with the dissolution of Awesome Technologies.

    “I have had no involvement in any of his projects and business activities mentioned in the article and he has no involvement in Litero.ai,” Pokatilo said of Perkon.

    Mr. Pokatilo said his new company Litero “does not provide contract cheating services and is built specifically to improve transparency and academic integrity in the age of universal use of AI by students.”

    “I am Ukrainian,” he said in an email. “My close friends, colleagues, and some family members continue to live in Ukraine under the ongoing invasion. Any suggestion that I or my company may be connected in any way to Russia’s war efforts is deeply offensive on a personal level and harmful to the reputation of Litero.ai, a company where many team members are Ukrainian.”

    Update, Dec. 11, 12:07 p.m. ET: Mr. Perkon responded to requests for comment after the publication of this story. Perkon said the photo of him in a Nerdify T-shirt (see screenshot above) was taken after a startup event in San Francisco, where he volunteered to act as a photo model to help friends with their project.

    “I have no business or other relations to Nerdify or any other ventures in that space,” Mr. Perkon said in an email response. “As for Vadim Lobov, I worked for Venture Capital arm at Synergy until 2013 as well as his business school project in the UK, that didn’t get off the ground, so the company related to this was made dormant. Then Synergy kindly provided sponsorship for my Russian Film Week event that I created and ran until 2022 in the U.K., an event that became the biggest independent Russian film festival outside of Russia. Since the start of the Ukraine war in 2022 I closed the festival down.”

    “I have had no business with Vadim Lobov since 2021 (the last film festival) and I don’t keep track of his endeavours,” Perkon continued. “As for Alexey Pokatilo, we are university friends. Our business relationship has ended after the concierge service Awesome Technologies didn’t work out, many years ago.”

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by an

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

    ·

    A new agentic browser attack targeting Perplexity’s Comet browser that’s capable of turning a seemingly innocuous email into a destructive action that wipes a user’s entire Google Drive contents, findings from Straiker STAR Labs show. The zero-click Google Drive Wiper technique hinges on connecting the browser to services like Gmail and Google Drive to automate routine tasks by granting them

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

    ·

    A critical security flaw has been disclosed in Apache Tika that could result in an XML external entity (XXE) injection attack. The vulnerability, tracked as CVE-2025-66516, is rated 10.0 on the CVSS scoring scale, indicating maximum severity. “Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Here’s What GPA You Need To Study In The Cybersecurity Field

    ·

    This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Dec. 5, 2025

    – Read the full story in Bolde

    High school students and parents, listen up!

    Some fields are skyrocketing in demand, offering promising career prospects and competitive salaries. However, gaining entry into college programs often requires a solid GPA to ensure you’re prepared for the rigorous coursework ahead. Cybersecurity is one of the most in demand fields that require you to study hard to ensure you get the GPA you need to make your academic dreams a reality, according to a recent Bolde article.

    In an age where data breaches are increasingly common, cybersecurity is more critical than ever. This field focuses on protecting computer systems and networks from digital attacks. To enter a reputable cybersecurity program, you’ll need a GPA of around 3.0, with more competitive programs requiring higher. The coursework includes computer science, network security, and ethical hacking.

    Beyond academic credentials, problem-solving skills and an analytical mindset are essential. According to Cybersecurity Ventures, the field is expected to see millions of unfilled jobs in the coming years, underscoring the growing demand. Internships and certifications can significantly boost your employability in this fast-paced industry. If you’re someone who loves a good challenge and wants to keep data safe, cybersecurity is an exciting and ever-evolving field to consider.

    The tech industry is booming, and computer science is at the heart of it all. Whether you’re interested in software development, AI, or cybersecurity, a degree in computer science can open countless doors. Most reputable programs look for a GPA of at least 3.0, although the more competitive institutions may require a 3.5 or higher. The curriculum is heavy on math and logic, so it’s critical to bring your analytical A-game.

    Bolde also takes a look at other in demand fields including nursing, data science, finance, engineering, psychology, business administration, environmental science, marketing, education, and healthcare administration.

    Read the Full Story

    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post Here’s What GPA You Need To Study In The Cybersecurity Field appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SMS Phishers Pivot to Points, Taxes, Fake Retailers

    ·

    , , , , , , , , ,

    China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

    Over the past week, thousands of domain names were registered for scam websites that purport to offer T-Mobile customers the opportunity to claim a large number of rewards points. The phishing domains are being promoted by scam messages sent via Apple’s iMessage service or the functionally equivalent RCS messaging service built into Google phones.

    An instant message spoofing T-Mobile says the recipient is eligible to claim thousands of rewards points.

    The website scanning service urlscan.io shows thousands of these phishing domains have been deployed in just the past few days alone. The phishing websites will only load if the recipient visits with a mobile device, and they ask for the visitor’s name, address, phone number and payment card data to claim the points.

    A phishing website registered this week that spoofs T-Mobile.

    If card data is submitted, the site will then prompt the user to share a one-time code sent via SMS by their financial institution. In reality, the bank is sending the code because the fraudsters have just attempted to enroll the victim’s phished card details in a mobile wallet from Apple or Google. If the victim also provides that one-time code, the phishers can then link the victim’s card to a mobile device that they physically control.

    Pivoting off these T-Mobile phishing domains in urlscan.io reveals a similar scam targeting AT&T customers:

    An SMS phishing or “smishing” website targeting AT&T users.

    Ford Merrill works in security research at SecAlliance, a CSIS Security Group company. Merrill said multiple China-based cybercriminal groups that sell phishing-as-a-service platforms have been using the mobile points lure for some time, but the scam has only recently been pointed at consumers in the United States.

    “These points redemption schemes have not been very popular in the U.S., but have been in other geographies like EU and Asia for a while now,” Merrill said.

    A review of other domains flagged by urlscan.io as tied to this Chinese SMS phishing syndicate shows they are also spoofing U.S. state tax authorities, telling recipients they have an unclaimed tax refund. Again, the goal is to phish the user’s payment card information and one-time code.

    A text message that spoofs the District of Columbia’s Office of Tax and Revenue.

    CAVEAT EMPTOR

    Many SMS phishing or “smishing” domains are quickly flagged by browser makers as malicious. But Merrill said one burgeoning area of growth for these phishing kits — fake e-commerce shops — can be far harder to spot because they do not call attention to themselves by spamming the entire world.

    Merrill said the same Chinese phishing kits used to blast out package redelivery message scams are equipped with modules that make it simple to quickly deploy a fleet of fake but convincing e-commerce storefronts. Those phony stores are typically advertised on Google and Facebook, and consumers usually end up at them by searching online for deals on specific products.

    A machine-translated screenshot of an ad from a China-based phishing group promoting their fake e-commerce shop templates.

    With these fake e-commerce stores, the customer is supplying their payment card and personal information as part of the normal check-out process, which is then punctuated by a request for a one-time code sent by your financial institution. The fake shopping site claims the code is required by the user’s bank to verify the transaction, but it is sent to the user because the scammers immediately attempt to enroll the supplied card data in a mobile wallet.

    According to Merrill, it is only during the check-out process that these fake shops will fetch the malicious code that gives them away as fraudulent, which tends to make it difficult to locate these stores simply by mass-scanning the web. Also, most customers who pay for products through these sites don’t realize they’ve been snookered until weeks later when the purchased item fails to arrive.

    “The fake e-commerce sites are tough because a lot of them can fly under the radar,” Merrill said. “They can go months without being shut down, they’re hard to discover, and they generally don’t get flagged by safe browsing tools.”

    Happily, reporting these SMS phishing lures and websites is one of the fastest ways to get them properly identified and shut down. Raymond Dijkxhoorn is the CEO and a founding member of SURBL, a widely-used blocklist that flags domains and IP addresses known to be used in unsolicited messages, phishing and malware distribution. SURBL has created a website called smishreport.com that asks users to forward a screenshot of any smishing message(s) received.

    “If [a domain is] unlisted, we can find and add the new pattern and kill the rest” of the matching domains, Dijkxhoorn said. “Just make a screenshot and upload. The tool does the rest.”

    The SMS phishing reporting site smishreport.com.

    Merrill said the last few weeks of the calendar year typically see a big uptick in smishing — particularly package redelivery schemes that spoof the U.S. Postal Service or commercial shipping companies.

    “Every holiday season there is an explosion in smishing activity,” he said. “Everyone is in a bigger hurry, frantically shopping online, paying less attention than they should, and they’re just in a better mindset to get phished.”

    SHOP ONLINE LIKE A SECURITY PRO

    As we can see, adopting a shopping strategy of simply buying from the online merchant with the lowest advertised prices can be a bit like playing Russian Roulette with your wallet. Even people who shop mainly at big-name online stores can get scammed if they’re not wary of too-good-to-be-true offers (think third-party sellers on these platforms).

    If you don’t know much about the online merchant that has the item you wish to buy, take a few minutes to investigate its reputation. If you’re buying from an online store that is brand new, the risk that you will get scammed increases significantly. How do you know the lifespan of a site selling that must-have gadget at the lowest price? One easy way to get a quick idea is to run a basic WHOIS search on the site’s domain name. The more recent the site’s “created” date, the more likely it is a phantom store.

    If you receive a message warning about a problem with an order or shipment, visit the e-commerce or shipping site directly, and avoid clicking on links or attachments — particularly missives that warn of some dire consequences unless you act quickly. Phishers and malware purveyors typically seize upon some kind of emergency to create a false alarm that often causes recipients to temporarily let their guard down.

    But it’s not just outright scammers who can trip up your holiday shopping: Often times, items that are advertised at steeper discounts than other online stores make up for it by charging way more than normal for shipping and handling.

    So be careful what you agree to: Check to make sure you know how long the item will take to be shipped, and that you understand the store’s return policies. Also, keep an eye out for hidden surcharges, and be wary of blithely clicking “ok” during the checkout process.

    Most importantly, keep a close eye on your monthly statements. If I were a fraudster, I’d most definitely wait until the holidays to cram through a bunch of unauthorized charges on stolen cards, so that the bogus purchases would get buried amid a flurry of other legitimate transactions. That’s why it’s key to closely review your credit card bill and to quickly dispute any charges you didn’t authorize.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity in Agentic Commerce: Safeguarding the Autonomous Future

    ·

    Building a Secure Foundation for the Future of Autonomous Transactions

    –Dr. Alissa Abdullah, Deputy Chief Security Officer, Mastercard

    San Jose, Calif. – Dec. 4, 2025

    Agentic commerce is changing the way we shop and interact online. Imagine telling your digital assistant to find the best deal on running shoes, make the purchase, and arrange delivery—all without you having to do a thing. This isn’t just a glimpse of the future; it’s happening now. At Mastercard, we’re excited about the possibilities, but we also know that security must keep pace with innovation.

    What Is Agentic Commerce—and Why Does Security Matter?

    Agentic commerce uses advanced AI agents to act on your behalf, making decisions and completing transactions autonomously. These agents can access sensitive information, negotiate with merchants, and handle complex tasks across different platforms. The benefits are clear: speed, personalization, and convenience. But with these advances come new cybersecurity challenges that we need to tackle head-on.

    How Mastercard Is Protecting Agentic Commerce

    At Mastercard, we focus on four key areas to keep agentic commerce secure:

    1. Identity and Authentication
      We make sure AI agents can reliably verify who you are before taking any action. Multi-factor authentication and ongoing identity checks help prevent unauthorized transactions and keep your accounts safe.
    2. Data Privacy
      Agents handle a lot of personal and financial data. Protecting this information is a top priority. We use advanced encryption and privacy-preserving technologies to secure your data, whether it’s being sent or stored.
    3. Transaction Security
      Autonomous payments need strong protocols to block interception or fraud. Our Agent Pay solution and the Agent Payments Protocol (AP2) are designed to authenticate every transaction and provide traceability, so you can trust the process from start to finish.
    4. Accountability and Transparency
      When agents act independently, it’s important to have clear records of every action. Our systems log all activity, making it easier to resolve disputes and assign responsibility if something goes wrong. You also have control over what your agents can do and can review your transaction history anytime.

    Building Trust in Autonomous Agents

    Trust is the foundation of agentic commerce, but as these systems grow, it’s essential to achieve trust at scale. At Mastercard, we’re committed to building security into every layer of our systems—from the AI models that make decisions to the payment protocols that move your money. 

    We also believe security is a shared responsibility. Consumers should stay informed about how their data is used and take advantage of available controls. Businesses need to invest in cybersecurity and foster transparency.

    Looking Ahead

    Agentic commerce isn’t just a technological leap—it’s a transformation of the digital economy. As AI agents become more capable, cyber attackers will look for new ways to exploit them. Our job is to stay ahead of these threats, continuously improving our defenses and empowering users to transact with confidence.

    If you’re interested in a deeper dive into the architecture, protocols, and real-world examples of agentic commerce, I encourage you to read the latest Mastercard Signals report. 

    At Mastercard, we believe the future of commerce should be both innovative and secure. By prioritizing cybersecurity, we’re helping unlock the full potential of autonomous agents—making commerce faster, smarter, and safer for everyone.

    –Dr. Alissa Abdullah, Deputy Chief Security Officer, Mastercard

    SPONSORED BY MASTERCARD

    Mastercard works to connect and power an inclusive digital economy that benefits everyone, everywhere by making transactions safe, simple, smart and accessible. Using secure data and networks, partnerships and passion, our innovations and solutions help individuals, financial institutions, governments and businesses realize their greatest potential. Our decency quotient, or DQ, drives our culture and everything we do inside and outside of our company.

    The post Cybersecurity in Agentic Commerce: Safeguarding the Autonomous Future appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • How To Reframe Cybersecurity Budget Requests And Get Them Approved

    ·

    This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Dec. 4, 2025

    – Read the full story from BreachLock

    Cybersecurity is no longer considered a “technical issue managed by IT departments, according to IBM. Rather, it “dominates concerns among the C-suite.”

    A recent survey names “cyber incidents” as the number one global business risk.

    These findings indicate the rising profile of cybersecurity and underscore that it is well on its way to becoming a strategic imperative and leadership priority.

    Despite this, security staff in many organizations struggle to get cybersecurity budgets approved by senior leaders.

    To stay ahead of adversaries and their cyber-weapons of mass destruction, companies must also continuously test existing controls against real-world threats.

    Knowing that security gaps exist and how to patch them is one thing, but getting the funds approved to implement these patches can be a challenge. A blog post from the experts at BreachLock explores how technical security practitioners and leaders can leverage insights from offensive security tools to obtain cybersecurity budget approval.

    With continuous pentesting and adversarial exposure validation (AEV), security teams have a unique opportunity to reframe budget requests from opinion-based “we think we need this” requests to evidence-based requests focused on business impact, dramatically increasing the likelihood of leadership approval.

    Will businesses actually approve the spend? Cybersecurity Ventures predicts that the world will spend $522 billion on cybersecurity products and services in 2026.

    Read the Full Story

    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post How To Reframe Cybersecurity Budget Requests And Get Them Approved appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The US needs more than troops at a Syrian airbase to constrain ISIS, Iran

    ·

    The U.S. proposal to establish a military presence at an airbase near Damascus is a welcome sign of deepening cooperation with Syria’s new government, but it may be insufficient to secure regional U.S. interests. A Damascus presence should complement—not replace—the U.S. partnership with the Syrian Democratic Forces, or SDF, which remains essential to preventing a resurgence of the Islamic State, or  ISIS, and constraining Iranian activity.

    The ISIS challenge is concentrated in northeastern Syria, where detention facilities hold about 9,000 ISIS fighters and family members. Nearly 85 percent of the fighters are held in two prisons near Hasakah and Shaddadi. These facilities are vulnerable targets, as shown by the 2022 Hasakah prison break that took two weeks to contain, even with U.S. air and intelligence support. The SDF, aided by U.S. funding and training, has carried the primary burden of physically securing these sites for more than a decade.

    But the threat extends beyond the northeast’s detention sites. In March, an ISIS suicide bomber attacked a church in Damascus, killing 25 and injuring 63. Syrian authorities recently disrupted two ISIS plots targeting President Sharaa and arrested more than 70 ISIS suspects in nationwide raids. And the  In January, ISIS-inspired attack in New Orleans—along with multiple arrests of ISIS-inspired Americans in recent months—illustrates the group’s continued ability to radicalize individuals far beyond Syria. These developments underscore why maintaining pressure on ISIS and supporting local partners remains essential.

    The United States should continue to build on the “by, with, and through” partnership that has made the SDF the most effective counter-ISIS force in Syria. Sustaining this relationship—through training, intelligence sharing, and support to detention operations—is the best way to prevent ISIS from reconstituting. It also signals to regional partners that the United States remains committed to a stable transition in Syria rather than stepping back prematurely.

    [[Related Posts]]

    At the same time, Washington must push for greater international burden-sharing in managing detained ISIS fighters. Only 36 countries have repatriated any nationals from northeast Syria, while 21 have yet to begin. Prolonged detention increases the risk of radicalization and creates a long-term humanitarian and security challenge for the region. Iraq’s repatriation of roughly 25,000 citizens—about 80 percent of Iraqis detained in Syria—demonstrates what committed action can achieve. The United States should apply the same diplomatic urgency it uses in negotiating criminal deportation agreements to secure fiscal contributions and accelerate repatriation efforts, easing pressure on the SDF and reducing the long-term threat posed by these populations.

    Broader counterterrorism objectives also depend on preventing Iranian rearmament of Hezbollah, which would destabilize the region. Israeli intelligence reports indicate that the group has begun restoring supply lines through Syrian territory. Although Iran and Hezbollah have suffered setbacks—and Russia’s diminished role has further constrained their operating space—Tehran continues to seek opportunities to rebuild its networks.

    This makes it vital for the United States to sustain its partnership with the SDF, which, according to the Lead Inspector General for Operation Iraqi Freedom, currently controls most Iraqi-border crossings in eastern Syria—positioning it as the first line of defense against the flow of Iranian weapons into Lebanon. Beyond the SDF partnership, Washington should work with the Syrian government and Israel to disrupt these flows. Washington’s provision of intelligence, deconfliction, and diplomatic coordination to the Syrians and Israelis can complicate and disrupt Iran’s efforts. Strengthening these channels of cooperation with the new Syrian government is especially important now as Syria seeks to consolidate control and demonstrate its independence from Tehran.

    Syria’s shift away from Iran and Russia and toward greater cooperation with Western partners presents a strategic opportunity. The government has a vested interest in limiting extremist groups, restoring security, and preventing Syria from becoming a conduit for Iranian influence. Its decision to join the Global Coalition to Defeat ISIS demonstrates a willingness to work with international partners, and the Interior Ministry has already carried out joint counter-ISIS missions with U.S. troops. This alignment of interests remains nascent, but it offers a real chance for the United States to advance both counterterrorism priorities and regional stability.

    ISIS prison breaks and Iranian rearmament are preventable, but averting them requires sustaining the SDF partnership, advancing international burden sharing, and countering Iranian weapons flows. Leaving before Syria can stand on its own will not end America’s involvement in the country—it will simply set the stage for a more costly return.

    Thomas Bergeson, a retired U.S. Air Force lieutenant general, served as deputy commander of U.S. Central Command. He participated in the Jewish Institute for National Security of America’s 2023 Generals and Admirals program.

    Jonah Brody is a policy analyst at JINSA. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Air Force leaders axe major China-focused organizational efforts, new memo reveals

    ·

    Air Force leaders are axing more major organizational changes started under the Biden administration such as reorienting commands, creating new offices, and shifting combat forces for a potential fight with China, the service’s top leaders said Tuesday.

    The service will no longer stand up Air Development Command, which aimed to subsume Air Education and Training Command and further combine the service’s force-development efforts, consolidate its functional managers, and create several new centers of excellence for certain career fields. Instead, AETC will retain its name and responsibilities, Air Force Secretary Troy Meink and Chief of Staff Gen. Ken Wilsbach said in a press release that described a memo sent to their service the previous day.

    Nor will the service reorient Air Combat Command to “focus on generating and presenting ready forces,” but rather keep it working to “organize, train, and equip combat ready Airmen,” the release said.

    The service will: 

    • Stop establishing its Air Base Wing concept.
    • Cancel plans for a new Program Assessment and Evaluation Office to handle resource analysis.
    • Not create an Air Force Materiel Command Information Dominance Systems Center, Air Force Nuclear Systems Center, or an Air Dominance Systems Support Center to sustain and improve aircraft and intercontinental ballistic missiles. 

    These steps are the latest in Meink and Wilsbach’s efforts to undo “Reoptimization for Great Power Competition," a 24-point plan released in early 2024 by then-Air Force Secretary Frank Kendall. Execution of the plan, which aimed to prepare the Air Force for a potential fight against China, was put on hold in February by Defense Secretary Pete Hegseth.

    [[Related Posts]]

    For months, it wasn’t clear what initiatives Meink, who took office in May, would keep or gut. In September, the Air Force secretary told reporters that he was “getting close” to making decisions on the reorganization plans tied to China, but hinted that he wasn’t “a big believer in the competition side of the house.”

    In the press release, he and Wilsbach appeared to allude to the Trump administration’s decisions to shift national-security focus to the Americas. 

    “As our adversaries and the strategic environment continue to evolve, our approach to ensuring a credible and ready force must also adjust. Air superiority is not guaranteed,” the service leaders wrote. “Through flexibility and clear-eyed assessment, our Air Force will continue to fly, fix, and fight now and into the future.”

    In October, the service spiked plans for a new Integrated Capabilities Command intended to speed up the acquisition of new technologies and weapons. 

    One former defense official familiar with the past efforts said it wasn’t clear how the current Air Force leaders intend to improve such integration.

    “There's different ways to solve that problem and it is not shocking to me that they would choose a different way than what was chosen by the previous team, but the question remains. How are you going to do it?” the former defense official said. “The announcements that I've seen do not explain how it's going to be done, and so my concern would be if they just don't do it, if they don't provide that integration function, it will knock back our ability to compete with China.”

    The official added that Hegseth’s mandate to reduce the number of general and flag officers across the military services likely sealed the fate for many of those commands and centers the Air Force hoped to create.

    The memo also scraps a plan to to change Air Forces Central Command and Air Forces Northern Command/Air Forces Space from numbered Air Forces into Service Component Commands that report to the Air Force Secretary through the Air Force Chief of Staff.

    Those will remain as numbered Air Forces. Similarly, Air Forces Southern Command will remain the air component to U.S. Southern Command and the 12th Air Force will be re-established as a numbered Air Force inside Air Combat Command, the release said.

    The memo noted that Meink and Wilsbach were keeping some elements of the reoptimization plan, including keeping warrant officers focused on cyber missions, wing units of actions, large-scale exercises and keeping various smaller integrated development and capabilities offices. 

    The former defense official said it was encouraging to see some of those ideas kept, and believes some of those smaller offices could take on some roles that those centers would have taken on for the service’s integration efforts.

    “They can beef up those organizations to perform more of the functions that you would have seen, for example, in the system centers,” the former defense official said. “That's certainly a possible solution, and I hope they do that.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶