Share

More LATAM Reports

The 2024 test involved pulsed-energy exposure, causing immediate effects like dizziness and cognitive issues. Norwegian officials informed the Central Intelligence Agency, leading to engagements with Pentagon and White House personnel.

Sources familiar with the experiment noted it did not support foreign targeting of U.S. officials but illustrated pulsed-energy devices’ capacity to influence human biology.

In a related development, the Pentagon acquired a portable device in late 2024 through a Homeland Security Investigations undercover operation, funded by the Department of Defense. The device, containing Russian components, underwent testing for over a year to assess replication of anomalous health incident symptoms.

Officials indicated its directed-energy emission potential, though no confirmed ties to foreign actors exist. This adds to nearly 1,500 reported cases across 96 countries, with declines in new incidents by 2025.

Inquiry into Norwegian Directed-Energy Device

Read more

Share

More Cyber/Tech Reports

The attacks targeted operational technology and industrial control systems at over 30 wind and solar farms, a combined heat and power plant serving nearly half a million customers, and a manufacturing firm producing energy components.

“The malicious cyber activity caused loss of view and control between facilities and distribution system operators, destroyed data on human machine interfaces (HMIs), and corrupted system firmware on OT devices. While the affected renewable energy systems continued production, the system operator could not control or monitor them according to their intended design.” - CISA

Attackers exploited vulnerable FortiGate firewalls with default credentials to access networks, then used remote desktop protocol and virtual network computing for lateral movement before deploying custom wiper malware called DynoWiper to encrypt files and disrupt communications.

While no interruptions to power or heat occurred, the event exposed risks in distributed renewable energy systems and prompted recommendations for enhanced edge device security.

CERT Polska’s incident report from January 30 detailed the assaults occurring in morning and afternoon hours on December 29. The malware aimed to cause irreversible data destruction, but endpoint detection tools at the combined heat and power plant blocked execution.

Polish authorities attributed the operation to the Russian-linked group Static Tundra, also known as Electrum or Berserk Bear, based on infrastructure overlaps and tactics matching prior campaigns.

Incident Details

Read more

Share

More Reports

This scheme, commonly referred to as ATM jack-potting, is alleged to have caused multi-million-dollar losses across multiple states, with proceeds reportedly directed to support Tren de Aragua operations.

In a separate but concurrent action, a Bangladeshi national was indicted for allegedly operating online marketplaces that sold high-resolution digital templates used to produce counterfeit U.S. identity documents, including passports, social security cards, and driver’s licenses. Law enforcement executed seizure of multiple associated domains as part of the disruption effort.

Simultaneously, the FBI renewed public warnings concerning an expected increase in holiday shopping scams. These schemes exploit seasonal consumer behavior through fabricated urgency, limited-time offers, appeals to fear, demands for secrecy, and instructions to use irreversible payment methods such as gift cards, cryptocurrency, or cash delivered by couriers.

Refer a friend

These coordinated law enforcement actions reflect ongoing federal priorities to disrupt both sophisticated cyber-enabled financial crime by designated transnational criminal organizations and persistent social-engineering schemes targeting the public during periods of heightened economic activity.

Operational Patterns and Methods Employed

Read more

Share

More Sci-Tech Reports

This backdoor targets VMware vSphere and Windows environments to establish long-term persistence. The malware enables stealthy access through multiple encryption layers and facilitates lateral movement within networks.

Affected organizations are primarily in government services and information technology sectors. BRICKSTORM’s self-monitoring function ensures automatic re-installation if disrupted.

The alert highlights ongoing compromises where actors obtain legitimate credentials by capturing system backups or Active Directory data. They exfiltrate sensitive information and target VMware platforms to steal virtual machine snapshots for credential extraction.

Refer a friend

In one confirmed case, intruders accessed a web server in the demilitarized zone before moving to an internal vCenter server to implant the malware. Seven additional BRICKSTORM samples show variations in capabilities, underscoring its adaptability. Communications are concealed using DNS-over-HTTPS and SOCKS proxies.

Intruders employ advanced tactics to evade detection, including nested TLS encryption and WebSockets. Persistence mechanisms allow the malware to restart automatically upon interruption.

BRICKSTORM is a custom ELF Go-based backdoor for stealthy access, persistence, and command and control. It uses self-watching for reinstallation if disrupted, multiple encryption layers like HTTPS, WebSockets, and nested TLS. DNS-over-HTTPS mimics web traffic with public resolvers such as Cloudflare, Google, and Quad9.

Interactive shells, file manipulation, and SOCKS proxy enable lateral movement. Some samples act as SOCKS proxies or use VSOCK for virtual machine communication with self-signed certificates.

Analysis of eight samples reveals variants for VMware vSphere and Windows. The joint Malware Analysis Report provides indicators of compromise and detection signatures. Network defenders are urged to scan for BRICKSTORM using provided YARA and Sigma rules.

Actors gain access via web shells, move laterally using RDP and SMB with service accounts, copy Active Directory databases, escalate via sudo, and drop BRICKSTORM in /etc/sysconfig/. Modifications to init files ensure execution on boot.

In a detailed incident, access began in April 2024 and persisted through at least September 3, 2025. Lateral movement included jump servers and Active Directory Federation Services for key exfiltration.

Blocking unauthorized DNS-over-HTTPS providers is recommended to reduce unmonitored traffic. Inventory of network edge devices should include monitoring for suspicious connectivity.

Proper segmentation restricts traffic from demilitarized zones to internal networks. If similar activity is detected, incidents should be reported to the agency’s operations center. The guidance emphasizes hunting for intrusions and applying mitigations promptly. Critical infrastructure operators face heightened risks from such state-sponsored activities.

Read more

Share

More Cyber/Tech Reports

The operation represented an imminent threat to the agency's protective operations. The protective intelligence investigation led to the discovery of more than 300 co-located Subscriber Identity Module servers and 100,000 Subscriber Identity Module cards across multiple sites. The devices were concentrated within 35 miles of the United Nations General Assembly underway in New York City.

The timing, location, and potential for significant disruption to New York telecommunications prompted the agency to move quickly. In addition to carrying out anonymous telephonic threats, these devices could be used to conduct a wide range of telecommunications attacks.

This includes disabling cell phone towers, enabling denial of services attacks, and facilitating anonymous, encrypted communication between potential threat actors and criminal enterprises.

While forensic examination of these devices is ongoing, early analysis indicates cellular communications between nation-state threat actors and individuals who are known to federal law enforcement.

Investigation Details

Read more

Share

More Cyber Reports

The decision followed an internal review initiated upon discovering the program's existence, which exposed the department to security risks despite compliance with contracting regulations. Hegseth described the move in terms of national security priorities. The program, intended to support cloud maintenance, had operated until revelations in 2025 prompted action.

The review's initial findings confirmed the program's vulnerabilities, leading to its halt. A formal letter of concern was issued to Microsoft, documenting concerns regarding trust and demanding a third-party audit of all code and submissions involving Chinese nationals.

According to Hegseth, this audit would be conducted without charge to U.S. taxpayers. Additionally, an internal investigation will assess any potential negative impacts on DOD cloud systems from the program's participants.

Refer a friend

Related Cybersecurity Advisory

A joint cybersecurity advisory released on August 27, 2025, by U.S. agencies including the NSA, CISA, FBI, and international partners, details Chinese state-sponsored actors compromising networks worldwide for espionage.

The advisory identifies actors using names like Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, and GhostEmperor, targeting telecommunications, transportation, lodging, and military infrastructure.

These operations involve exploiting routers and networks to maintain persistent access, linked to Chinese companies such as Sichuan Juxinhe Network Technology Co. Ltd., Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd.

The advisory provides mitigation guidance, including hunting for malicious activity and applying TTPs to reduce risks. It notes overlaps with industry reporting on APT actors observed since 2021.

This context highlights broader concerns about Chinese cyber activities, which align with the risks cited in the Pentagon's program termination on the same day.

No direct link between the advisory's specific actors and the Microsoft program is stated, but the timing and focus on network compromises underscore related security issues.

Program Background and Risks:

Read more

Share

More Cyber/Tech Reports

This occurred through an unconditional block on TCP port 443, the standard network channel for secure web browsing that ensures encrypted data transfer between users and websites.

China's internet censorship system, known as the Great Firewall, inserted forged TCP RST+ACK packets—signals that abruptly end network connections—to stop both incoming and outgoing traffic on this port.

Technical reviews show that the device responsible for the block had features unlike those seen in earlier documented parts of the Great Firewall, such as increasing TCP window sizes in the inserted packets.

The disruption blocked access to many foreign websites and applications that rely on HTTPS, the protocol for secure online communications that protects information like login details and financial transactions.

This affected operations for organizations connected to China, including interruptions to platforms from companies such as Apple and Tesla. Checks during the event confirmed the issue was limited to port 443, with no interference on other common network channels.

Evaluations based on available data point to an internal cause, such as a setup error or a test of network controls, rather than outside interference. The short length of the outage and its focus on one port suggest it was not a planned widespread restriction.

Acronym Index

GFW: Great Firewall

HTTPS: Hypertext Transfer Protocol Secure

IP: Internet Protocol

RST+ACK: Reset + Acknowledge

SYN: Synchronize

SYN+ACK: Synchronize + Acknowledge

TCP: Transmission Control Protocol

TTL: Time to Live

Details of the Block:

Read more

Share

More Cyber/Tech Reports

During tests conducted in New Mexico, the program transmitted over 800 watts of power using a laser over a distance of 5.3 miles (8.6 kilometers).

This demonstration lasted 30 seconds and delivered more than one megajoule of energy in total across the test campaign. The receiver converted the optical energy back into electrical power, marking a step forward in energy delivery without physical connections.

Refer a friend

The tests involved ground-based transmitter and receiver systems, with the laser beam passing through the densest part of the atmosphere, which absorbs and scatters light, making transmission more challenging. Despite this, the system outperformed previous records, such as 230 watts over 1.06 miles (1.7 kilometers) and an undisclosed amount over 2.3 miles (3.7 kilometers).

The attached video, shared from the U.S. Naval Research Laboratory, demonstrates the SCOPE-O (Safe and Continuous Power Beaming Optical) project, an earlier initiative focused on optical power beaming using a direct-energy laser to transmit electrical power wirelessly over shorter distances, such as approximately 500 watts across 1,000 meters (0.62 miles).

While SCOPE-O established foundational advancements in safe and continuous energy delivery, it shares the same core laser-based optical method as DARPA's Persistent Optical Wireless Energy Relay (POWER) program, which extended capabilities to over 800 watts at 8.6 kilometers (5.3 miles) in 2025.

The technologies differ primarily in scale and application, with SCOPE-O serving as a proof-of-concept that informed the broader POWER effort for enhanced range and power in military and civilian contexts.

The achievement highlights advancements in laser technology and photovoltaic conversion, where photovoltaic cells (devices that convert light into electricity, similar to solar panels but optimized for laser wavelengths) played a key role.

Technical Details, Analysis:

Read more

Share

More Reports On Asia

The event severed the country’s limited connection to the World Wide Web, affecting key services such as the Foreign Ministry and Air Koryo. Researchers monitoring North Korea’s digital infrastructure noted that connectivity through both China and Russia was impacted, suggesting an internal issue rather than an external cyberattack.

Refer a friend

This incident highlights the reclusive state’s tightly controlled digital environment, where internet access is restricted to a small elite while the general population relies on a government-managed internal intranet (a private internal network as opposed to the global internet).

Impact, Scope and Analysis:

Read more

Share

See Recent Reports

The concern follows recent incidents where cables in the region have been cut, highlighting vulnerabilities in the global network that carries the vast majority of international data.

Cables have been severed in both the Indo-Pacific near Taiwan and the Baltic Sea around Norway. Notably, Chinese and Russian vessels were observed near the sites of these incidents. China has stated that at least one of these events was accidental.

Taiwan's Ministry of Foreign Affairs stated, "China has unveiled a tool with global consequences: a cable cutter capable of severing the sturdiest undersea cables. Taiwan, constantly under threat, knows what this means. 95% of data flows undersea & the world must act to defend this vital infrastructure."

What the Cutter Is, and What It Does

Read more

Share

More Reports On Cyber/Tech

ORNL’s device encodes qubits on photons, generating entangled qubit pairs essential for quantum networks, akin to classical transistors. This development marks a step towards a quantum internet, potentially utilizing existing fiber-optic infrastructure for stable, secure communication.

The integrated chip features components like microring resonators and polarization splitter-rotators to generate and manipulate broadband polarization-entangled photons.

This advancement could help mass-produce quantum devices, reducing the cost and complexity of current systems and paving the way for widespread quantum internet use. Support for this research came from various institutions, including the Department of Energy, National Science Foundation, and Air Force Research Laboratory.

Read more

Share

See All Cyber/Tech Reports

This cutting-edge technology will support the Cyberspace Defense Forces, potentially enhancing military capabilities in code breaking and processing large volumes of data.

The project, hailed by the Polish military as the first quantum computer built from scratch in Poland, is being spearheaded by the Warsaw University of Technology.

It involves collaboration with the Military University of Technology, the Military Institute of Armament Technology, the Silesian University of Technology, and the Sonovero R&D company. The investment for this groundbreaking endeavor exceeds PLN 50 million (approximately $12 million USD), according to the Polish news agency RP.

Spokesman for the Cyberspace Defense Forces Component Command Col. Przemysław Lipczyński says that the prototype will be finished by the end of 2025.

Refer a friend

"We want quantum algorithmics to become an important area of ​​analyzing the security of cryptographic algorithms – next to statistics and cryptanalysis," the spokesman said.

RP also cited the spokesman as saying, "Quantum sensors will enable the detection of minimal disturbances in electromagnetic fields, which may be useful for identifying unauthorized communication devices, jamming attacks or signal interception attempts.

Another quantum technology being considered for use in the military is quantum key distribution (QKD), which is a response to the potential threat from other quantum computers to the security of encrypted information."

The Polish Cyberspace Defense Forces said in a statement. "Work on the construction of a quantum computer for special and military IT applications is nearing completion at the Warsaw University of Technology.

This will be the first Polish unique quantum computer infrastructure built from scratch. Currently, work is underway to synchronize physical elements and control systems."

Polish Cyberspace Defense Forces Indicate Its Quantum Computer May Involve Artificial Intelligence, How Could AI Benefit From Quantum Computing?

Read more

Share

All Cyber/Tech Reports

The researchers released a Chinese-language peer reviewed research paper published on September 30th in the Chinese Journal of Computers, run by the China Computers Federation (CCF) that said the machine used a technique known as quantum annealing, which it says has a unique quantum tunneling effect and can jump out of a situation where traditional intelligence algorithms “are very easy to trap people”.

The paper states, “The principle of the D-Wave dedicated quantum computer, quantum annealing, with its unique quantum tunneling effect, can jump out of the situation where traditional intelligent algorithms are very easy to trap people. Partial extremes can be regarded as a class of artificial intelligence algorithms with global optimization capabilities.”

It later expounds upon this by saying, “Quantum -annealing is the fundamental principle behind D-Wave special quantum computing, It has a unique -quantum tunneling effect that can jump out of the local extremes that traditional intelligent algorithms are prone to fall into. It can be considered a class of artificial intelligence algorithms with -global optimization-seeking capability”.

Researchers: Canada’s D-Wave Advantage Quantum Computer Which Can Be Rented For $2,000 An Hour Capable Of Cracking RSA, AES Encryption:

Read more

Share

Read All Cyber/Tech News

The alleged data stolen included: Full names, phone numbers, home addresses, physical address history (up to 3 decades), and social security numbers.

Those who used data opt-out services did not show up in the database, according to a class-action lawsuit filed in U.S. District Court in Fort Lauderdale. Records offered by the hackers in an online forum included data from citizens from the United States, Canada, and the United Kingdom.

The breach was detailed in a class action complaint that was filed in Florida against the NPD background-checking agency, alleging that the agency was exposed to a data breach around April of 2024.

National Public Data's website says that they obtain "information from various public record databases, court records, state and national databases, and other repositories nationwide".

The information allegedly leaked by NPD had been scraped from sources that were not public and the one who filed the complaint alleged this was done without their permission, or the permission of billions of others whose data was exposed during the breach.

Class Action Lawsuit Document Regarding The Alleged Breach

The following is the class action lawsuit document regarding the alleged data breach. No PDF document was available so I took screenshots of all 50 pages and embedded them into a PDF document, then extracted the text and spent many hours formatting the text by hand so that text versions could be available.

I have included multiple versions of the lawsuit document as PDF files and attached below, for those who wish to see it in various formats such as images or text:

Read more

Share

Reports On Critical Infrastructure

In light of both the increase in reported attacks on the water supply and an increase in vulnerabilities found in the country's water systems, the EPA urged water systems to act immediately to take steps to protect the nation's drinking water.

Refer a friend

Not only have cyberattacks become more frequent and severe against critical infrastructure, but the EPA says that around 70% of the water utilities inspected by the federal government over the last year were in violation of cybersecurity standards put into place to prevent attacks on the systems.

McCabe said in many cases systems are not doing what they should be doing and have no available plans for vulnerability prevention. As the water systems often rely on computers with operating systems, some of the ways the utilities failed the standards:

• Failing to change default passwords for equipment

• Failing to lock out system access to ex-employees

Cyberattacks on water systems can lead to numerous problems with either the water supply or the alteration of the chemical composition of the water to hazardous levels:

• Interruption in the water treatment process

• Interruption in the water storage process

• Damage to valves that control the water flow

• Damage to the water pumps

• Altering of the water's chemical composition

• Change of chemical levels to dangerous amounts

“In many cases, systems are not doing what they are supposed to be doing, which is to have completed a risk assessment of their vulnerabilities that includes cybersecurity and to make sure that plan is available and informing the way they do business,” McCabe stated.

McCabe: Cyberattacks On Water Infrastructure Are Not Just Private Individuals, Many Government-Backed Entities. FDA: Every US Critical Infrastructure Sector Has Been Targets Of Cyberattacks

Read more

Share

Read All Cyber/Tech Reports

The testing of the Manta Ray was carried out in California after the prototype's subsections were transported to the test location from its original build location in Maryland.

According to DARPA, the "Testing demonstrated at-sea hydrodynamic performance, including submerged operations using all the vehicle’s modes of propulsion and steering: buoyancy, propellers, and control surfaces". 

The DARPA program manager for the Manta Ray Dr. Kyle Woerner said of the test, "Our successful, full-scale Manta Ray testing validates the vehicle’s readiness to advance toward real-world operations after being rapidly assembled in the field from modular subsections". 

He added, “The combination of cross-country modular transportation, in-field assembly, and subsequent deployment demonstrates a first-of-kind capability for an extra-large UUV". 

“Shipping the vehicle directly to its intended area of operation conserves energy that the vehicle would otherwise expend during transit,” Woerner said.

Refer a friend

“Once deployed, the vehicle uses efficient, buoyancy-driven gliding to move through the water. The craft is designed with several payload bays of multiple sizes and types to enable a wide variety of naval mission sets.”

DARPA says that the Manta Ray aims to "develop and demonstrate a new class of long-duration, long-range, payload-capable UUVs ready for persistent operations in dynamic maritime environments". 

"DARPA is engaging with the U.S. Navy on the next steps for testing and transition of this technology."

It added, "A second Manta Ray performer, PacMar Technologies, is continuing testing of its full-scale energy harvesting system in 2024". 

What Is The Manta Ray Program?

Read more

Share

Read All Cyber/Tech Reports

According to FBI Director Chris Wray, the risks posed by the Chinese government to the United States previously spoken of in previous reports are no longer “over the horizon” but are “upon us now”.

“I'm talking about everything from indiscriminate hacking to economic espionage to transnational repression to fentanyl and the precursor chemicals that are coming out of China and ending up in our communities. 

What we're facing today is the CCP [Chinese Communist Party] throwing its whole government into undermining the security of the rule-of-law world,” Wray said.

The threat posed by China is not just in one area, but “a combined counterintelligence, cybersecurity, and criminal threat,” he added, and said, “Part of that threat is driven by the CCP's aspirations to wealth and power”.

Wray said that China has no reservations about “stealing their way to the top”, hitting just about every U.S. industry including:

• Biotech Industry

• Aviation Field

• Advanced Technologies

• Artificial Intelligence (AI)

• Healthcare Industry

• Agricultural Industry

• Intellectual Property

• Technology Industry

• Research Industry

“You could close your eyes and pull an industry or sector out of a hat and, chances are, Beijing has targeted it,” Wray said.

“The PRC is engaged in the largest and most sophisticated theft of intellectual property and expertise in the history of the world, leveraging its most powerful weapons, starting with cyber.”

He then added a sense of scale about China’s cyber related activities and said, “If all of the FBI’s cyber agents and cyber intelligence analysts focused exclusively on China—and not on ransomware, Iran, or Russia—Chinese hackers would still outnumber FBI cyber personnel by at least 50 to 1”.

“And that's probably a conservative estimate because the Chinese government is also showing a penchant for hiring cybercriminals to do its bidding—in effect, cyber mercenaries—further supplementing its cyber workforce,” he added.

US Senate Reauthorizes Section 702 Of The Foreign Intelligence Surveillance Act

At the end of December of last year, Wray had urged lawmakers to renew the FBI's ability to gather electronic data under Section 702 of the Foreign Intelligence Surveillance Act, or FISA before the law expired at the end of 2023, saying that allowing it to expire would be tantamount to "unilateral disarmament".

On April 20th, 2024 the White House announced that the Biden Administration reauthorized Section 702, extending it to 2026. Although the FBI says that it is necessary for maintaining national security, it had been abused and led to information being collected on an unknown number of American citizens.

What Is Section 702?

Press Secretary for the Department of Defense Pat Ryder said that, “Section 702 of the Foreign Intelligence Surveillance Act, or FISA, allows us to collect vital intelligence, importantly under federal court supervision, of non-U.S. persons who are located abroad who use U.S. communication services and whose communications are assessed by our Intelligence Community to have foreign intelligence value”.

Refer a friend

Section 702 Allows Data Collection On American Citizens Under Certain Conditions, Has Been Abused

Read more

Share

Read All Cyber/Tech Reports

Information that the Department of Justice ordered Google to hand over included:

• User's Account/Viewing Activity

• Telephone Numbers

• Home Addresses

• IP Addresses

• Names

Investigation That Led To The Demand:

An investigation into a user with the handle of “elonmuskwhm” suspected of being involved in money laundering activities which included trading in Bitcoin for another currency led to U.S. agents sending the suspect publicly available YouTube tutorials on mapping with drones using augmented reality software.

The videos in question were never mentioned by name in any of the reports, the only information given about them was that they had to do with mapping with drones using augmented reality software.

The federal authorities then requested data on the users who had viewed the videos, which had been watched by that time around 30,000 times by various people. One live-stream alone had about 130,000 subscribers.

According to documents that were reportedly seen by Forbes, the order was granted by the court but requested that Google not release the information to the public.

It is not currently known whether Google complied with the information request, but Google spokesperson Matt Bryant spoke to Forbes and said that Google routinely pushes back against "over broad" and "inappropriate demands" for user data.

“We examine each demand for legal validity, consistent with developing case law, and we routinely push back against over broad or otherwise inappropriate demands for user data, including objecting to some demands entirely," the Google spokesperson said.

Privacy and civil rights group Surveillance Technology Oversight Project (S.T.O.P.) strongly condemned the request for user information on a video that is "completely legal"

The civil rights group said that STOP "condemns the U.S. Department of Justice for securing a bulk warrant to track every YouTube user who watched completely legal videos about mapping software".

"searching thousands of innocent people to look for one suspect violated the Fourth Amendment," according to STOP.

Browse Internet Privately

Latest "Disturbing" Trend Where Government Agencies Increasingly Transform Warrants Into Digital Dragnets

Read more

Share

Read More Cyber/Tech Reports

The statement by the Ukrainian intelligence agency said, "The railway branch was used by the aggressor state to transport military cargo, in particular engineering ammunition, produced by JSC "Polimer" plant in the city of Chapaevsk, Samara region.

Given the nature of the damage to the railway bridge, its use will be impossible for a long time."

Refer a friend

Regarding the hacking of the Russian Ministry of Defense, the HUR said that as a result of the hack, the agency gained access to the information on the server, including reports, orders, and other sensitive documents. 

Ukraine's Intelligence Agency On Hack, And Attack On Russian Railway Bridge (English Translations):

Read more

Share

“This is a serious disruption of communication between Europe and Asia, where the main damage will be absorbed mainly by communication activities in the Gulf countries and in India,” a translated portion of the report stated.

The Cables Were Targeted About Three Months After Houthi Attacks On Merchant Vessels Began In The Red Sea

Read more