• The acquisition reforms announced last week by Secretary Pete Hegseth reflect a revolutionary shift in mindset: after decades of aspiring to remain the world’s most advanced force, the U.S. military has finally recognized that adaptability trumps performance.

    Better late than never. The last few years of war in Ukraine, the Red Sea, and Israel have been screaming the lesson that better kit doesn’t guarantee success. In fact, “better” means something different than it did even a decade ago. 

    Rather than faster, bigger, or rangier, the better solution today is one that is already fielded and good enough for the current situation, as we noted in our work with the Pentagon in the runup to the reforms’ release. The only guarantee is that “good enough” will be different in a few weeks or months.

    Build an adaptation pipeline

    The Pentagon has long taken years to envision, specify, manufacture, and deliver systems to warfighters. The fundamental bet was that these exquisite products would remain superior to countermeasures at least as long as it would take to produce their replacements.

    Hegseth’s Nov. 7 directive recognizes the futility of this approach in the modern era. Under the acquisition model announced last week, the pipeline is more important than the product. Any weapon, sensor, or drone will only be relevant for a short time in its current form, so the military needs a robust problem-to-product pipeline that will deliver the next version.

    The secretary announced three transformations that will build his department’s new adaptation pipeline. First, he killed the toothless joint-requirements process that was a rubber stamp for service wishlists. In its place, he established a way to define and rank joint problems from combatant commanders, then tie them to dedicated funding for solutions.

    Second, he ordered the department to give acquisition executives real authority and accountability. Portfolio Acquisition Executives, or PAEs, will own their programs entirely, including funding, development, specifications, contracting, and delivery. They will have the authority to make trade-offs between performance and schedule to field relevant capabilities when they are needed. And if PAEs cannot deliver, senior leaders will replace them.

    And third, Pentagon acquisition will embrace real modularity, rather than the interoperability cosplay of static and proprietary “open architectures.” The new directive requires that systems have machine-readable interface specifications posted in government repositories. Any vendor will be able to build compatible software modules without asking for the system developer’s permission.

    This matters because modern military systems are increasingly software-defined. A missile is basically a collection of computers with explosives. By separately competing modules for everything from seekers and guidance and navigation controls to propulsion, PAEs can swap in appropriate components as new technologies and needs emerge. Our adversaries already do this with commercial parts. We're finally catching up.

    Like the commercial best practices, the new acquisition model will enable adaptation through a continuous integration and delivery pipeline. When interfaces are exposed and government-owned, innovation can happen at the edge, not just in the prime contractors’ labs.

    Stop fighting yesterday’s wars

    Some traditionalists worry that prioritizing timeliness over performance will lead to poor-quality products rushed to meet deadlines. This misunderstands modern military competition, which is about constant adaptation rather than generational, game-changing leaps.

    For example, last month Ukrainian air defenders realized their U.S.-supplied Patriot interceptors were missing incoming ballistic missiles due to a combination of new Russian flight profiles and saturation attacks. U.S. and Ukrainian engineers and operators are now scrambling to reprogram decades-old Patriot software.  

    This wasn’t the first case of 20th-century U.S. designs failing in 21st-century conflict. Less than a year into the war, Ukrainian troops found that Excalibur GPS-guided artillery rounds were no longer hitting their targets. Despite costing more than $100,000 each, the U.S.-supplied rounds could not adapt to use other navigation methods in the face of Russian jamming. Today, Kyiv’s defenders rely on terrain-mapping drones alongside traditional artillery.

    Ukrainian forces are keeping those drones relevant through an even more aggressive adaptation cycle. Every day, soldiers and technicians reprogram radios and control software and evolve tactics to counter the latest Russian jammers and counter-drone systems.

    The U.S. military hasn’t been spared from the adaptation imperative. As Houthi attacks mounted in the Red Sea, U.S. Navy engineers and surface warriors recognized they needed to use shorter-range defenses to avoid burning through a lifetime of Standard missiles in a month. Now guns and jammers take out more drones than do surface-to-air missiles.

    The lesson from these contemporary battlefields is that. Instead of attempting to manufacture weapons for a predicted future, militaries need to use what is available today to solve today’s problems.

    The leap to 21st-century mobilization

    As these contemporary battlefields suggest, the Pentagon needs this new acquisition model to prepare for 21st-century mobilization.

    Within any realistic peacetime budgets, the defense industrial base will never have the capacity to build today’s weapons at the scale needed for sustained confrontations like those in the Red Sea or Ukraine, much less a great power war against China. The U.S. military will need the commercial sector.

    That’s the same approach Secretary Hegseth’s predecessors took during World War II, but the industrial base and the military are very different now. Instead of bombers rolling out of Michigan auto plants, the Pentagon will need contract manufacturers that build everything from MRI machines to vehicle chargers to start assembling drones and missiles by the tens of thousands.

    That only happens if the War Department follows through on modular designs, open interfaces, commercial-first procurement, and prioritizing speed over sophistication. If not, today’s weapon stockpile could be tomorrow’s junkpile.

    Bryan Clark is a Senior Fellow at Hudson Institute.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A leader of a company gathering steam as a data and artificial intelligence provider to the Defense Department has been arrested for allegedly soliciting an underage girl for sex.

    Eric T. Gillespie, the founder and chairman of Govini, has been charged as part of a sting operation by the Pennsylvania attorney general’s office and the Lebanon County, Pennsylvania district attorney’s office.

    A law enforcement agent with the attorney general’s office posing as a preteen girl allegedly connected with Gillespie in an online chat. Gillespie then attempted to arrange a meeting with the girl, according to the attorney general's office.

    Gillespie was charged on Monday with four felony counts and is being held without bail in a Lebanon County jail.

    The charges come as the company has built out its defense business and attracted new private equity investment.

    The company told Washington Technology that Gillespie was placed on administrative leave when the company learned of the charges on Monday.

    “We acknowledge the severity of these charges and as a company will hold all our employees to the highest ethical standards. We stand steadfast in support of all victims of abuse of any kind,” the company said in the statement.

    The company, led by CEO Tara Murphy Dougherty, did not respond to a request for further comment.

    Govini got its start in the federal market in 2011 as a data provider helping companies track contract awards and upcoming procurements. But over time, it has transitioned into a software provider for government agencies with tools to help them manage their acquisition processes.

    The company touts $100 million in annual revenue and attracted a $150 million investment from Bain Capital, which was announced in October. That money is earmarked for investment in Govini’s offerings such as its Ark AI application and the hiring of more tech practitioners.

    “This investment validates not just the current position achieved by our incredibly talented team, but also our long-term goal of fundamentally rewiring how defense and national security communities make decisions with AI and data,” Gillespie said of the Bain investment at the time.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A large phishing campaign has been targeting travelers worldwide, using more than 4,300 fake domains to steal payment card information.

    The operation focuses on people planning vacations or about to check into hotels by sending fake booking confirmation emails that appear to come from trusted travel companies.

    The attackers have created a network of websites that look like real hotel reservation pages, complete with familiar logos and professional layouts, making them difficult to spot as scams.

    The campaign uses a well-built phishing kit that adapts on links sent to victims via email. When someone clicks on a link in the fake email, their browser gets redirected through several websites before landing on the phishing page.

    The emails claim that a hotel reservation must be confirmed within 24 hours to avoid cancellation, creating a sense of urgency that pushes victims to act quickly without carefully checking the details.

    The fake pages mimic major travel brands, including Airbnb, Booking.com, Expedia, and Agoda, using their logos and design elements to appear legitimate.

    The phishing pages (Source - Netcraft)
    The phishing pages (Source – Netcraft)

    Netcraft security researchers identified that the threat actor behind this campaign is Russian-speaking, based on extensive Russian language comments found throughout the phishing kit’s source code.

    The operation began in February 2025 and has steadily grown, with the attacker registering new domains almost daily. One notable spike occurred on March 20, 2025, when 511 domains were registered in a single day.

    The domains follow consistent patterns with phrases like “confirmation,” “booking,” “guestverify,” “cardverify,” or “reservation” appearing in their names, often combined with random numbers.

    The attacker primarily uses four domain registrars: WebNIC, Public Domain Registry, Atak Domain Bilgi Teknolojileri A.S., and MAT BAO Corporation.

    Several hundred domains even reference specific luxury and boutique hotels from around the world, making the scam appear more targeted and convincing to potential victims.

    Redirection Chain and Infection Mechanism

    The phishing attack relies on a complex redirection system that makes it harder to trace and block.

    When victims click the “Confirm Booking” button in the fake email, they don’t go directly to the phishing site.

    Instead, the link first sends them to an old, unused website domain that was originally registered in 2016 for a movie promotion. That site then redirects to a page on Blogspot, Google’s free blogging platform, which finally redirects to the actual phishing page.

    This multi-step redirection chain serves several purposes. It helps the attackers avoid detection by security systems that might flag direct links to malicious sites.

    Using legitimate platforms like Blogspot adds a layer of trust since the intermediate URL appears on a well-known service. The chain also makes it harder for security researchers to track down the final destination and shut down the operation.

    Many real hotels have been impersonated by the attackers (Source – Netcraft)

    Once victims reach the phishing page, they see what appears to be a legitimate hotel booking confirmation form.

    The page displays a fake Cloudflare CAPTCHA that doesn’t actually function but uses Cloudflare branding to build false confidence.

    After passing this fake security check, victims are asked to enter their payment card details including the cardholder name, card number, CVV code, and expiration date.

    The page performs Luhn validation to check if the card number format is correct before attempting to process a fraudulent transaction in the background.

    While this happens, a fake support chat window appears with automated messages telling victims to confirm SMS notifications from their bank, which are actually the real fraud alerts triggered by the unauthorized charges the attackers are attempting.

    The phishing kit includes sophisticated features like support for 43 different languages and real-time polling that sends user keystrokes back to the attacker’s server approximately once per second.

    The pages use a unique identifier called an “AD_CODE” in the URL that determines which travel brand to impersonate, with different codes producing different branding on the same domain.

    This allows the attackers to run multiple campaigns simultaneously using the same infrastructure, targeting different brands and hotels with customized pages for each victim.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Massive Phishing Attack Impersonate as Travel Brands Attacking Users with 4,300 Malicious Domains appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler Gateway products.

    Tracked as CVE-2025-12101, the flaw allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, data theft, or unauthorized actions.

    The vulnerability carries a moderate CVSSv4 score of 5.9, highlighting its network accessibility but reliance on user interaction.

    NetScaler ADC, formerly Citrix ADC, and NetScaler Gateway serve as critical application delivery controllers and secure remote access solutions for thousands of organizations worldwide.

    They handle VPN connections, load balancing, and authentication, making them prime targets for threat actors. This XSS issue stems from improper neutralization of input during web page generation, classified under CWE-79.

    Citrix NetScaler ADC and Gateway Vulnerability

    Exploitation requires specific configurations: the NetScaler must operate as a Gateway (including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or an AAA virtual server for authentication.

    Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-56.73, 13.1 before 13.1-60.32, 13.1-FIPS and NDcPP before 13.1-37.250-FIPS and NDcPP, and 12.1-FIPS and NDcPP before 12.1-55.333-FIPS and NDcPP.

    Notably, versions 12.1 and 13.0 have reached end-of-life (EOL) status, leaving them perpetually vulnerable without support. Customers using Secure Private Access on-premises or hybrid deployments with NetScaler instances face similar risks and must upgrade those components.

    The advisory applies solely to customer-managed appliances; Cloud Software Group handles updates for its managed cloud services and Adaptive Authentication.

    To detect exposure, administrators should inspect their NetScaler configurations for authentication virtual servers (e.g., “add authentication vserver .*”) or Gateway setups (e.g., VPN-related commands).

    While no active exploitation has been reported, the flaw’s simplicity could attract opportunistic attackers, especially in environments with unpatched legacy systems.

    Cloud Software Group urges immediate action: upgrade to patched releases such as NetScaler ADC and Gateway 14.1-56.73 or later, 13.1-60.32 or later for 13.1, 13.1-37.250 or later for FIPS/NDcPP variants, and 12.1-55.333 or later where applicable.

    EOL users should migrate to supported versions to mitigate risks. The company provides fixes without charge but emphasizes that the information is offered “as is,” with no warranties on system impact.

    This disclosure arrives amid heightened scrutiny of supply chain and remote access vulnerabilities, reminding enterprises to prioritize timely patching in their security postures. As threat landscapes evolve, regular configuration audits and version management remain essential defenses.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Citrix NetScaler ADC and Gateway Vulnerability Enables Cross-Site Scripting Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Rachel Riley, the new head of the Office of Naval Research, is more than just an alum of the controversial Department of Government Efficiency, according to current and former military and defense officials. Indeed, they said, the 33-year-old Rhodes Scholar and former McKinsey consultant may have what it takes to bring urgent reform to the Navy’s top R&D office.

    Riley was appointed acting chief of naval research sometime in October after nine months at Health and Human Services. Like DOGE employees across the federal government, she was assigned to HHS with a White House mandate to reduce staff; Politico described her as a “driving force” behind a failed effort to cut 8,000 people. One official told the news site that “No one wanted to work with her anymore,” but another said had helped “reorganize the department in a short period of time” and brought “strong analysis to the problems.”

    And despite DOGE’s record of disruptive change, hasty cuts, fecklessness, and conflicts of interest elsewhere, one former and one current defense official said its members at the Pentagon had a different relationship to their agency. At DOD, the DOGE office is led by Owen West, a former Marine and longtime defense policy expert, not a 19-year-old nicknamed “Big Balls.” 

    Riley earned an MSc in contemporary Chinese studies and a Ph.D in social policy at Oxford, then worked her way up to partner during eight years at McKinsey. 

    She had never worked for the government before January, according to her LinkedIn profile. But Riley has completed significant academic work related to China, which sources we spoke to highlighted as relevant. (She is also a military spouse.) At McKinsey, much of her work focused on helping the government address the challenge of too much bureaucracy, too low a risk tolerance, devotion to committee meetings, and other rigid structures that inhibit timely deployment of technology.

    Three current senior defense officials on background told Defense One in a note that they had full confidence in Riley and particularly the skills she had honed at McKinsey. They pointed out what numerous government reports have also highlighted, that persistent inefficiencies and layers of bureaucracy in Defense Department-led tech research, including time delays, sometimes caused more than a decade to field new capabilities. The Navy’s canceled $500 million electromagnetic railgun program is one example.

    The former defense official said that much of DOD’s work in fields like autonomy and artificial intelligence is simply a slower, more expensive version of what private tech firms already do, often better. 

    “There are entire enterprises within ONR that have never produced anything,” the official said. “They continue to be justified as part of the research enterprise, the kind of thing Anduril would love to stand up a division to deliver on tomorrow, and Silicon Valley would respond to by founding a whole new company.”

    A former military official who worked in drone research noted that billions of dollars going to research projects produces a fielded capability a fraction of the time. “That’s not a great model for the DoD.”

    They said some traditional defense contractors have built side businesses around research contracts that lack any requirement to deliver deployable systems quickly.

    Meanwhile, private capital is rapidly moving in. Venture-backed defense tech is already producing systems faster and cheaper, largely because much of the research is dual-use. In autonomy, for example, private-sector R&D is driving advances that have direct commercial applications, such as self-piloting cargo vessels.

    Venture capitalist Paul Madera made a similar point in December, writing, “Venture capitalists seem to be shifting their investment strategies toward so-called hard tech and deep tech opportunities: hardware products with high technical risk, versus software products with high market risk.”

    The former defense official said ONR devotes too little attention to development timelines, and to asking, “What’s commercially available?” New guidance from the defense secretary’s office echoes that point.

    Given those trends, the former official said, Riley’s experience is highly relevant.

    “The only way to prevent waste is strong leadership willing to say ‘no’ to projects and slaughter sacred cows,” the former defense official said. “And the Navy, with its federated holdover system, is really uncomfortable with that.”

    But Riley, and the new research and engineering leaders at the Pentagon, will also need to recognize that ONR funds research in areas that are crucial to national security yet unlikely to attract commercial R&D: high-level encryption, ocean climate science, marine geosciences, physical oceanography, marine biology, and more. As Congress cuts support to institutions like the National Science Foundation, the Defense Department has become a last refuge for high-risk, high-reward, strategically vital research.

    These are research areas that China prizes highly. But their future in the U.S. remains uncertain.

    Defense One was unable to reach Riley for comment.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • After nearly two months away from their jobs, House lawmakers are returning to vote on a deal to end the 43-day government shutdown, which is the longest in U.S. history. That vote is expected sometime this evening. 

    The deal, which advanced through the Senate Monday evening, would use a continuing resolution (PDF) to fund the Defense Department until Jan. 30. It will also unwind the more than 4,000 layoffs the Trump administration issued during the shutdown. Those reductions in force are currently paused by a federal court, Eric Katz of Government Executive reports

    Bigger picture: “[A]s the possibility of an end to the shutdown draws near, almost no one will be satisfied. Democrats didn’t get the health insurance provisions they demanded added to the spending deal,” the Associated Press reported Wednesday morning. “And Republicans, who control the levers of power in Washington, didn’t escape blame, according to polls and some state and local elections that went poorly for them.”

    ICYMI: Leaders from four of the military’s professional advocacy groups united to ask Congress to re-open the government, provide backpay to civilians who are looking at another missed paycheck, and pass legislation so that in the event of another shutdown, Defense Department civilians won’t be forced to work without pay, Defense One’s Meghann Myers reported Monday. 

    Despite House preparations to vote this evening, the services are looking at a long road to recovery. That’s in large part because the prospect of another CR to patch over a shut down means the services will have to pick and choose which missions to prioritize even more than usual. Read more, here

    Squeezed into that deal to end the shutdown: Funding for the Air Force’s new E-7 Wedgetail radar jet—despite the fact that the service wants to gut the program, Defense One’s Thomas Novelly reported Monday. 

    Background: The E-7 was pitched as a replacement for the service’s aging E-3 Sentry aircraft. Boeing and the Air Force reached an agreement last year for two test planes, to be delivered in 2028 for a substantial $2.6 billion. Those costs have risen by $884 million, according to a June Government Accountability Office report. 

    However, Defense Secretary Pete Hegseth told appropriators this summer that the E-7 was an example of a platform that was “not survivable in the modern battlefield or they don't give us an advantage in a future fight.” Additionally, defense officials this summer said the program was going to be cut “due to significant delays with cost increases.”  

    Expert reax: “If it passes, this is a big win for Boeing, and it shows that many in Congress still have doubts about how quickly the Space Force can deploy the AMTI system it funded in the reconciliation bill a few months ago,” said Todd Harrison, a defense budget expert with the American Enterprise Institute think tank. “This is Congress hedging its bets on the airborne warning mission.” Continue reading, here


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1969, journalist Seymour Hersh broke the story of the My Lai Massacre in Vietnam.

    Around the Defense Department

    New: The British military has paused intelligence-sharing with the Pentagon regarding alleged drug-trafficking boats in the Caribbean region “because it does not want to be complicit in US military strikes and believes the attacks are illegal,” CNN reported Tuesday. The halt in sharing began “over a month ago,” British officials told Natasha Bertrand. 

    Notable: “Several boats hit by the US have either been stationary or were turning around when they were attacked, CNN has reported, undermining the [Trump] administration’s claim that they posed an imminent threat that could not be dealt with through interdiction and arrest.”

    Not just the Brits: Canada “has made clear to the US that it does not want its intelligence being used to help target boats for deadly strikes, the sources told CNN.” 

    And Colombia said it would stop sharing intel with the U.S. over the strikes, President Gustavo Petro announced Tuesday on social media. “Such a measure will be maintained as long as the missile attack on boats in the Caribbean persists. The fight against drugs must be subordinated to the human rights of the Caribbean people,” he wrote. 

    Britain’s MI5 is also annoyed with FBI chief Kash Patel, who reportedly went back on a pledge to keep a key liaison officer in London, the New York Times reported Monday. The report raised eyebrows among longtime intelligence watchers, who noted that disputes between the countries’ intel communities rarely emerge in public.

    On Sunday, the U.S. military attacked and destroyed two more alleged drug trafficking boats in the waters off Latin America, SecDef Hegseth announced on social media the following morning. “Both strikes were conducted in international waters and 3 male narco-terrorists were aboard each vessel. All 6 were killed,” he said. “These vessels were known by our intelligence to be associated with illicit narcotics smuggling, were carrying narcotics, and were transiting along a known narco-trafficking transit route in the Eastern Pacific,” Hegseth claimed. 

    Updated death toll: According to Hegseth and Trump, the U.S. military has killed at least 76 people in almost two dozen strikes since Sept. 2. The New York Times and Military Times are both maintaining a running log of these strikes (though the NYT is typically more up to date). 

    New: The USS Gerald R. Ford carrier is now in the Caribbean region after it was diverted out of the Mediterranean Sea and closer to Venezuela, U.S. Naval Institute News reported Tuesday. Ship spotters located it off the coast of Puerto Rico on Tuesday. 

    By the way: “Ford’s escorts include guided-missile destroyers USS Bainbridge (DDG-96), USS Mahan (DDG-72) and USS Winston Churchill (DDG-81),” USNI writes. There are already at least eight U.S. warships, a nuclear submarine and F-35 aircraft operating in the Caribbean region, Reuters reminds readers. 

    Related reading:Venezuelan military preparing guerrilla response in case of US attack,” Reuters reported separately on Tuesday. 

    Update: ​​Trump’s military occupations of U.S. cities have cost nearly half a billion dollars so far, the Intercept reported Tuesday, citing estimates from the National Priorities Project and Sen. Dick Durbin, D-Ill. 

    The total includes “$172 million spent in Los Angeles, where troops arrived in June; almost $270 million for the occupation of Washington, D.C., which began in August; nearly $15 million for Portland, Oregon, which was announced in September; and more than $3 million for Memphis, Tennessee, and almost $13 million for Chicago, which both began last month,” Nick Turse writes. 

    Those costs could rise, too, considering Trump “has specifically threatened to surge troops into Baltimore, New York City, Oakland, St. Louis, San Francisco, and Seattle to put down supposed rebellions and to aid law enforcement agencies, despite falling crime numbers and pushback by local officials. Troops are also expected to be deployed to New Orleans later this month.” Read more, here

    Related:Trump Administration Plans to Send Border Patrol to Charlotte and New Orleans,” the New York Times reported Tuesday. 

    Meanwhile in the Pacific region, just one prototype won’t cut it anymore, Marine Corps Forces Pacific commander Lt. Gen. Jim Glynn said during a keynote speech at the recent AFCEA TechNet Indo-Pacific conference in Hawaii.

    Glynn: “What we need is: when you come with it, don’t come with one with the intention to take it home with you, and all the data that was collected while we conducted an exercise together. Come with five. Take one or two home and leave three with us, and we’ll continue to work with it. We’ll give you access to all the data that’s coming off of it, and we’ll do everything we can to break it, with the goal of making it better.” 

    He cited the Joint Fires Network as an example, saying that it has evolved over the past five years from “the amalgamation of some prototypes” to a formal program. Defense One’s Jennifer Hlad has more from Honolulu, here

    Additional reading: 

    Middle East

    U.S., Saudi officials rush to finalize defense pact before MBS visits White House. The pact may include the sale of weapons, including F-35 jets, promised as part of a giant package in May. It might also include a U.S. security guarantee of the sort Trump extended to Qatar last month, though “would fall short of a legally binding defense treaty, which would be nearly impossible to pass through the Senate,” Axios wrote. U.S. and Saudi officials have also discussed Riyadh’s desire to normalize relations with Israel, but only if Jerusalem ends its opposition to a deadline for creating a Palestinian state. More, here.

    Next week’s visit will be the first to the U.S. by Crown Prince Mohammed bin Salman since the 2018 murder and dismembering of journalist Adnan Khashoggi, a killing that MBS has called a “mistake” and which U.S. intelligence sources say he directed.

    The negotiations include Trump son-in-law Jared Kushner, who in 2020 launched a private equity firm with a reported $2 billion investment from the Saudi sovereign wealth fund controlled by MBS. Kushner has denied this represents a conflict of interest.

    Trump welcomed al-Qaeda leader-turned-Syrian president to the White House on Monday. New York Times: The Syrian leader has been discreetly cooperating with the U.S.-led coalition against ISIS and Al Qaeda since he took control of a slice of rebel-held territory in northwestern Syria in 2016, according to Syrian officials and Western diplomats who spoke on condition of anonymity in keeping with diplomatic protocol.” Read on, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries. The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit trusted brands like E-ZPass and USPS to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity leaders now face an impossible equation: you need intelligence that’s comprehensive enough to protect your organisation, fresh enough to stop emerging threats, and manageable enough that your team doesn’t drown in false positives.

    Most solutions force you to choose. Some prove you don’t have to. 

    The Intelligence Paradox: Too Much and Never Enough 

    Every CISO knows the struggle. Deploy too few threat feeds, and you’re flying blind, missing critical indicators that could prevent the next breach.

    Deploy too many, and your SOC analysts spend their days buried in alerts, chasing false positives, and burning out before they can focus on genuine threats. 

    This isn’t just an operational headache. It’s a business risk. When analysts are overwhelmed, response times slow. When threat data arrives too late, attackers have already moved.

    When intelligence lacks context, your team wastes hours investigating benign activity while real threats slip through undetected. 

    The balance seems impossible: you need data that’s simultaneously comprehensive and curated, real-time and actionable, detailed and digestible.  

    Business Resilience Happens When Context Meets Speed 

    ANY.RUN’s Threat Intelligence Feeds are made with the key principle in mind. Quality feeds don’t just add data — they transform how your entire cybersecurity operation functions.

    Think of them as your early warning system, your threat hunting compass, and your analyst productivity accelerator rolled into one. 

    ANY.RUN’s TI Feeds: data sources, features, benefits 

     
    Or, probably, imagine combining a microscope with a telegraph. One gives you perfect detail; the other gives you instant transmission. Individually useful, but together? Transformative. 

    But enough with metaphors. ANY.RUN’s TI Feeds solve the data paradox.  
     
    Powered by data from over 15,000 SOCs and researchers using ANY.RUN’s interactive malware sandbox, the feeds deliver live intelligence on real attacks happening right now. Each record is backed by behavioral analysis and real-world evidence. 

    Build resilience with live, contextual intelligence from 15K teams -> Request your TI Feeds trial 

    This combination of context and freshness is critical for decision-makers. It means your analysts don’t waste time chasing false positives or outdated data. They can prioritize real threats, act early, and protect the organization’s assets before risk turns into loss. 
     
    They integrate seamlessly with your SIEM, EDR, firewall, and other security tools, automatically enriching alerts with context and enabling automated response workflows.

    They shift your posture from reactive to proactive, allowing you to block threats before they reach your network rather than scrambling after the breach. 

    For MSSPs managing security across multiple clients, feeds become even more critical. They enable you to scale protection without scaling headcount proportionally, applying lessons learned from one customer’s threat landscape to protect all others instantly. 

    Why Context Matters for Your Bottom Line 

    Context transforms raw data into actionable intelligence. When your SIEM flags a suspicious IP address, generic feeds tell you “this is malicious.” 

    ANY.RUN’s feeds tell you how it’s malicious, what malware family it’s associated with, which attack techniques it employs, and what IOCs you should look for across your environment. 

    For security teams, this means: 

    • Faster triage: Analysts immediately understand threat severity and scope; 
    • Accurate prioritization: Distinguish between critical incidents and low-risk events; 
    • Effective response: Know exactly which containment measures to deploy; 
    • Reduced burnout: Spend time hunting real threats, not chasing shadows. 

    For business leaders, context transforms into: 

    • Lower operational costs: Less time wasted on false positives means better ROI on your security investment; 
    • Faster time-to-resolution: Contextual intelligence accelerates incident response from hours to minutes; 
    • Informed decision-making: Understand your actual risk exposure, not just a list of scary-sounding indicators. 

    When your intelligence reflects the experience of 15,000 SOCs worldwide, you’re no longer reacting in isolation — you’re part of a collective defense network. 

    Why Freshness Is Non-Negotiable 

    Threat actors evolve their techniques daily, launching new campaigns, rotating infrastructure, and modifying malware to evade detection. 

    ANY.RUN’s TI Feeds deliver intelligence with up-to-the-minute freshness because they’re derived from live analysis happening right now — as security teams worldwide investigate active threats using ANY.RUN’s Interactive Sandbox. 

    This real-time advantage means: 

    • Proactive blocking: Stop emerging threats before they become widespread; 
    • Reduced dwell time: Detect active compromises faster with the latest IOCs; 
    • Instant awareness: Gain visibility into novel attack techniques as they emerge; 
    • Competitive protection: Access intelligence that attackers haven’t yet adapted to evade. 

    For MSSPs, this freshness is a competitive differentiator. You can promise clients protection against threats that other providers won’t detect for days—because by the time those threats appear in slower feeds, you’ve already blocked them. 

    Make your next security decision data-driven, turn live threat data into strategic advantage -> Start you trial of ANY.RUN’s TI Feeds 

    TI Feeds: Business Objectives Met 

    ANY.RUN’s Threat Intelligence Feeds deliver business value across multiple dimensions: 

    • Real-World Threat Visibility: You’re receiving data about actual incidents and attacks that are impacting other companies right now. The threats currently investigated by 15,000 SOCs using ANY.RUN’s Interactive Sandbox.  
    • Cost-Effective Scale: ANY.RUN’s Feeds give you enterprise-grade intelligence without enterprise-level overhead.  
    • Regulatory Compliance and Due Diligence: Demonstrate to auditors, board members, and customers that you’re using current, comprehensive threat intelligence.  
    • Improved Detection Rates: Enrich your existing security tools with high-fidelity indicators that dramatically reduce false negatives. Catch threats that generic signature-based detection misses. 
    • Accelerated Incident Response: When a threat is detected, contextual intelligence means your team already knows the attack chain, associated IOCs, and effective countermeasures.  
    • Strategic Planning Support: Aggregate intelligence helps security leaders identify trends, understand your industry’s threat landscape, and make informed decisions about security investments and priorities. 
    • Reduced Analyst Fatigue: Analysts spend time doing interesting, meaningful work instead of drowning in noise. 
    • Interoperability: The feeds integrate seamlessly with your existing security infrastructure: SIEM platforms, threat intelligence platforms, EDR solutions, firewalls, and more.  

    Conclusion 

    Cyber resilience isn’t about having more data — it’s about having the right data at the right moment. ANY.RUN’s Threat Intelligence Feeds provide exactly that: live, contextual insights from real incidents across the globe.

    They help organizations cut through noise, reduce uncertainty, and make every security decision count. 

    The post Why your Business Need Live Threat Intel from 15k SOCs appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated backdoor malware campaign has emerged targeting Windows users through a weaponized version of SteamCleaner, a legitimate open-source utility designed to clean junk files from the Steam gaming platform.

    The malware establishes persistent access to compromised systems by deploying malicious Node.js scripts that maintain continuous communication with command-and-control servers, enabling attackers to execute arbitrary commands remotely.

    The threat actors have weaponized the legitimate SteamCleaner tool, which has not received updates since September 2018, by injecting malicious code into the original source and distributing it through fraudulent websites posing as illegal software repositories.

    Users seeking cracked software or keygens are redirected to GitHub repositories hosting the malware, which is delivered as Setup.exe.

    The malicious installer is signed with a valid digital certificate from Taiyuan Jiankang Technology Co., Ltd., lending false legitimacy to the 4.66MB package and allowing it to bypass initial security scrutiny.

    Upon execution, the malware installs itself in the C:\Program Files\Steam Cleaner\ directory, deploying multiple components including Steam Cleaner.exe (3,472KB), configuration files, and batch scripts.

    SteamCleaner source code released on Github (Source - ASEC)
    SteamCleaner source code released on Github (Source – ASEC)

    ASEC security researchers identified that the attackers maintained the original SteamCleaner functionality while incorporating sophisticated anti-sandbox detection mechanisms.

    The malware performs extensive environmental checks including system information analysis, port enumeration, WMI queries, and process monitoring.

    When a sandboxed environment is detected, the malware executes only the legitimate cleaning functionality without triggering malicious behavior.

    The payload delivery mechanism relies on encrypted PowerShell commands embedded within the malware.

    Malware signature and attribute information (Source - ASEC)
    Malware signature and attribute information (Source – ASEC)

    These commands orchestrate the installation of Node.js on the victim’s system and subsequently download two distinct malicious scripts from separate command-and-control infrastructure.

    Both scripts are registered with the Windows Task Scheduler to ensure persistence, executing automatically at system startup and repeating every hour thereafter.

    Command-and-Control Communication Protocol

    The two Node.js scripts establish bidirectional communication channels with their respective C2 servers through structured JSON payloads.

    When connecting to the C2 infrastructure, the malware transmits comprehensive system reconnaissance data including OS type and version, hostname, system architecture, and a unique machine identifier derived from the device GUID.

    The first script, installed at C:\WCM{UUID}\UUID and registered as Microsoft/Windows/WCM/WiFiSpeedScheduler, connects to multiple C2 domains including rt-guard[.]com, 4tressx[.]com, kuchiku[.]digital, and screenner[.]com.

    This script downloads files from attacker-specified URLs and executes them using CMD or PowerShell processes.

    The second script operates from C:\WindowsSetting{UUID}\UUID with the task name Microsoft/Windows/Diagnosis/Recommended DiagnosisScheduler, communicating with aginscore[.]com.

    This variant employs more aggressive obfuscation techniques and executes commands directly through Node[.]js’s native shell execution function.

    The C2 communication occurs through two primary endpoints: /d for receiving commands and /e for transmitting execution results.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Beware of Malicious Steam Cleanup Tool Attack Windows Machines to Deploy Backdoor Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apache OpenOffice has released version 4.1.16, addressing seven critical security vulnerabilities that enable unauthorized remote document loading and memory corruption attacks.

    These flaws represent a significant security risk to users of the popular open-source office suite. The most severe vulnerabilities involve unauthorized remote content loading without user prompts or warnings.

    Attackers can exploit these weaknesses to load malicious external documents through multiple attack vectors:

    Unauthorized Remote Content Loading

    CVE-2025-64401 allows remote document loading via IFrame elements, while CVE-2025-64402 leverages OLE objects for the same purpose.

    CVE-2025-64403 exploits the Calc spreadsheet application through external data sources, and CVE-2025-64404 abuses background and bullet images.

    Additionally, CVE-2025-64405 manipulates the DDE function to fetch remote content without user interaction.

    These remote content-loading vulnerabilities create opportunities for attackers to deliver malware and steal sensitive information.

    Conduct targeted phishing campaigns by embedding malicious content in seemingly legitimate office documents.

    Memory Corruption and Data Exfiltration

    Beyond unauthorized content loading, CVE-2025-64406 introduces a critical memory corruption vulnerability during CSV file imports.

    This flaw could enable arbitrary code execution if successfully exploited with specially crafted CSV files. OpenOffice concerning the issue is CVE-2025-64407, which enables URL fetching to extract arbitrary INI file values and environment variables.

    This vulnerability enables attackers to extract sensitive configuration data and system information from affected systems.

    Users should update to Apache OpenOffice 4.1.16 immediately to patch these vulnerabilities. The affected versions include all installations before 4.1.16.

    Organizations relying on OpenOffice for document processing should prioritize this update in their patch management schedules.

    The previous version 4.1.15 addressed additional critical issues, including use-after-free vulnerabilities, arbitrary file write capabilities in Base, and macro execution flaws.

    These layered fixes demonstrate ongoing security challenges in the OpenOffice codebase. OpenOffice system administrators should implement the following measures: Deploy version 4.1.16 across all systems, restrict macro execution policies.

    Disable DDE functions when not required and implement network monitoring to detect suspicious document-loading behavior. Users should exercise caution when opening documents from untrusted sources until updates are fully deployed.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple Apache OpenOffice Vulnerabilities Leads to Memory Corruption and Unauthorized Content Loading appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶