Matthias Schulze's Avatar

Matthias Schulze

@percepticon

PhD in political science, studying infosec, cyber conflict & information war at IFSH. Self-taught hacker & blue team. Blog and podcast about my work over at https://percepticon.de or https://ioc.exchange/@percepticon

811
Followers
313
Following
2,388
Posts
25.08.2023
Joined
Posts Following

Latest posts by Matthias Schulze @percepticon

Preview
Alleged India-linked espionage campaign targeted Pakistan, Bangladesh, Sri Lanka An espionage campaign last year targeted government agencies and critical infrastructure operators in Pakistan, Bangladesh and Sri Lanka, the cybersecurity firm Arctic Wolf said.

Alleged India-linked espionage campaign targeted Pakistan, Bangladesh, Sri Lanka #cybersecurity #infosec

06.03.2026 15:59 👍 0 🔁 0 💬 0 📌 0

The Maduro raid will encourage the dangerous notion that daring operations and decapitation strikes can help conclude a major conflict. Capturing or killing an enemy leader, the theory goes, will trigger chaos and collapse resistance. History, however, suggests otherwise.‘

06.03.2026 07:46 👍 49 🔁 6 💬 3 📌 1
Preview
Exclusive: US investigation points to likely US responsibility in Iran school strike, sources say Military investigators believe it is likely that U.S. forces were responsible for an apparent strike on an Iranian girls' school that killed scores of children on Saturday, two U.S. officials told Reu...

Reuters Exclusive

"U.S. military investigators believe it is likely that U.S. forces were responsible for an apparent strike on an Iranian girls' school."

"The strike would rank among the worst cases of civilian casualties in decades of U.S. conflicts in the ​Middle East."

06.03.2026 02:50 👍 9929 🔁 5231 💬 622 📌 627
Nancy Youssef, ..guil @ X.com
@nancyayoussef
The preliminary Pentagon cost estimate of the war in Iran is $1 billion a day, a congressional official told me.
12:20 PM • 3/4/26 • 44K Views

Nancy Youssef, ..guil @ X.com @nancyayoussef The preliminary Pentagon cost estimate of the war in Iran is $1 billion a day, a congressional official told me. 12:20 PM • 3/4/26 • 44K Views

Preliminary Pentagon cost estimate of the war in Iran is $1 BILLION a day. So far.

04.03.2026 19:15 👍 1654 🔁 716 💬 128 📌 337
Preview
Russia weaponizes MEGA and EU rifts in its information operation to spread Union collapse narrative Two coordinated campaigns and five tiers of distribution. More than thirty outlets across fourteen countries. One goal: convince Europeans their union is already finished, that the EU is collapsing, and incite hatred toward Brussels. The information operation started with ‘pseudo-analytical’ articles in Russian state media (sanctioned in the EU), followed by disinformation websites (like Pravda and Front) and amplified by pro-Kremlin media in Europe and anti-EU posts on multiple Telegram channels. When a new alliance under the MEGA (Make Europe Great Again) banner gathered in Brussels on February 2, 2026, the event was real. The politicians were real. The speeches were real. What happened in the 72 hours that followed was a planned information operation of foreign influence. A precisely timed, multilingual, cross-platform amplification campaign pushed one specific reading of that conference into living rooms across Germany, Slovakia, France, Hungary, Poland, Spain, the Netherlands, Finland, Estonia, Belgium, and the Czech Republic. At the same time, a second campaign was feeding those same audiences a story about the EU’s top leadership tearing itself apart from the inside. The two campaigns ran in parallel, targeted different anxieties, and were carried by many of the same outlets. This is not a story about invented facts. The MEGA conference did take place. The friction between Ursula von der Leyen and Kaja Kallas is real and has been reported by mainstream European media. What makes this a disinformation operation is something more precise: real events were selected, stripped of context, and amplified through a network of outlets that disguised where the content came from. The facts were twisted to suit the Kremlin’s agenda. The goal was not to fabricate reality but to reshape how people understand it — to turn a fringe political conference into proof that the EU is illegitimate and to turn a management disagreement between two officials into evidence of imminent collapse. And to make Russia’s role in any of this completely invisible. On February 6, 2026, the Russian state news agency RIA Novosti published an opinion piece by Petr Akopov, a Russian propagandist and political commentator who writes regularly for the outlet. The article was titled “Europe Against the European Union: Brussels Knows What It Is Doing.” Its opening line was the slogan that would travel across more than twenty websites in six languages over the following three days: “We love Europe and therefore despise the European Union.” Akopov attributed the line to Filip Dewinter, the leader of the Belgian far-right party Vlaams Belang, who had co-hosted the MEGA founding conference in Brussels. Dewinter’s actual statement at the event was that “the future of Europe lies in nation states, not in liberal globalism.” Around that statement, Akopov built a political argument presented as analysis: that the EU’s support for Ukraine in the Russian-Ukrainian war is not about values or security but about manufactured fear, an “artificially inflated fear” designed by European elites to hold together a bloc that would otherwise fall apart on its own. Those at the MEGA conference, he wrote, “advocate for true European unity, including all of Greater Europe — from Russians to Portuguese.” EU leaders, by contrast, want to “unite Europeans on the basis of fear and hatred.” This framing does specific political work. It erases Russia’s responsibility for the Russian-Ukrainian war entirely. It reframes European support for Ukraine as elite manipulation. And it positions a far-right Brussels conference as the authentic voice of European civilisation. RIA Novosti published the piece, and it was simultaneously promoted through RT DE, the German-language branch of the Russian state broadcaster RT, which is banned across the EU. RT DE published it on its website and, to get around its YouTube ban, distributed the accompanying video through Odysee, a platform RT uses specifically as a workaround to spread its video reports. The video opened with the same words as the article. * https://ria.ru/20260206/evropa-2072575129.html  * https://de.rt.com/meinung/269542-mega-europa-gegen-eu/  * https://odysee.com/@RTDE:e/MEGA-ein-Europa-gegen-die-EU:0  What happened next is the most visible evidence of coordination. Within hours of the RIA Novosti article going live, the Russian outlet News Front published translations of Akopov’s piece in six languages across its network of country-specific websites. The French version appeared at 14:00, Slovak at 15:00, Polish at 16:00, Hungarian at 17:00, German at 18:00, and Spanish at 19:00. Six languages, five consecutive hours, all carrying the same text, all crediting “Petr Akopov, RIA Novosti” at the bottom. No independent newsroom publishes the same article in six languages within five hours. This was not journalism. It was an anti-EU information operation disguised as journalism. * https://sk.news-front.su/2026/02/06/mega-europa-vs-eu/  * https://fr.news-front.su/2026/02/06/rendre-sa-grandeur-a-leurope-leurope-contre-lunion-europeenne/  * https://pl.news-front.su/2026/02/06/make-europe-great-again-europa-przeciwko-unii-europejskie j/  * https://hu.news-front.su/2026/02/06/tegyuk-ujra-naggya-europat-europa-az-eupai-unio-ellen/  * https://de.news-front.su/2026/02/06/make-europe-great-again-europa-gegen-die-europaische-union/  * https://es.news-front.su/2026/02/06/hacer-que-europa-vuelva-a-ser-grande-europa-contra-la-union-europea/  Two days later, on February 8, a second Russian network joined the operation. News Pravda runs under country-specific domain names — germany.news-pravda.com, francais.news-pravda.com, belgium.news-pravda.com, poland.news-pravda.com — designed to read as local news to anyone who encounters them without prior knowledge. The German edition published the full Akopov article with a note buried at the bottom: “Translated from Russian. The article was originally published by RIA Novosti on February 6, 2026. That disclosure existed. But a reader arriving at a site called deutsch.news-pravda.com is not primed to look for it. * https://germany.news-pravda.com/world/2026/02/08/230325.html  * https://francais.news-pravda.com/world/2026/02/08/721220.html  * https://deutsch.news-pravda.com/world/2026/02/08/603759.html  * https://belgium.news-pravda.com/fr/world/2026/02/08/10478.html  * https://poland.news-pravda.com/world/2026/02/06/228652.html  * https://news-pravda.com/world/2026/02/06/2059447.html  * https://deutsch.news-pravda.com/world/2026/02/06/601778.html  The Belgium edition of News Pravda added content from the X account Brainless Partisans, which has 113,900 followers. That account published its version of the anti-EU framing sourced from a Telegram channel, and it spread directly on X as well. “Brussels is no longer a capital, it is an ideological archive center,” Brainless Partisans wrote. And further: “Permanent conflict with Russia makes no strategic sense for Europe, except to artificially maintain a Union held together only by fear. And fear, like any drug, requires ever-stronger doses. Until the overdose.” * https://x.com/BPartisans/status/2020484702017044907  * https://x.com/BPartisans/status/2020484852542312532  By February 9, the Akopov article had arrived at a set of websites that present themselves as ‘alternative’ European media. The German site Krisenfrei published the full piece under the byline “Von Pjotr Akopow (rtdeutsch)” and included a detailed author biography identifying Akopov as a RIA Novosti political observer. The two Slovak pro-Kremlin sites Infovojna and Slovanské Noviny published identical versions of the article, both crediting “Autor: Pjotr Akopov / Zdroj: ria.ru / sk.news-front.su” at the bottom of the page. Three steps in the chain, printed in plain sight, invisible to anyone who did not know what to look for. * https://krisenfrei.com/mega-ein-europa-gegen-die-eu/  * https://www.infovojna.com/article/mega-europa-vs-eu  * https://slovanskenoviny.sk/mega-europa-vs-eu/  The final distribution layer was Telegram, where content moved fastest and its origin was least visible. At least eleven channels distributed the Akopov article in German, Polish, and Slovak between February 7 and 9, with subscriber counts ranging from a few hundred to over eleven thousand. The largest, Spravy Slovakia, had 11,346 subscribers and was linked directly to the News Front Slovak edition. The RT DE Live Newsticker had 1,150 subscribers and was linked to rt.com directly. MT News Deutsch had 3,086 subscribers. Fresse Frei, with 1,464 subscribers, described itself as publishing RT DE podcasts, its name being a crude wordplay on the German word for press freedom. RT Deutsch had 4,844 subscribers. Matroschka Today, with 598 subscribers, posted the full RT article text alongside a link to the Odysee video. Echte Nachrichten had 1,550 subscribers. Just Now News had 1,107. Prawda PL, with 386 subscribers, carried the Polish version. Zwischenspeicher had 216. At the other end of the scale, a channel called Kremllieferservice—which translates directly as “Kremlin Delivery Service”—posted the same article with a link to an RT mirror domain. That a channel would name itself after its own function is either unusual self-awareness or a complete absence of concern about being identified. Either way, the name is accurate. Every channel in this network is linked to an RT domain, a News Front page, or a European proxy site. None linked to independent reporting. * https://t.me/spravy_slovakia/25643  * https://t.me/rt_de_live_newsticker/22665  * https://t.me/MTnews_Deutsch/26513  * https://t.me/fresse_frei/4966  * https://t.me/echtenachrichten/43102  * https://t.me/matroschka_today/86946  * https://t.me/pravdaplcom/52432  * https://t.me/rtdeutsch_rtde/33151  * https://t.me/kremllieferservice/33154  * https://t.me/zwischenspeicher/176112  * https://t.me/justnow_news/40096  The operation also had a version built for a different audience. On February 7, the journal InterAffairs.ru, published by the Russian International Affairs Council — a think tank with close state ties — released an English-language conference report on MEGA, presenting it as a legitimate political development. The piece described the alliance as “dedicated to defending Western civilisation” and repeated the claim that Starmer, Macron, and Merz had “repeatedly jeopardized” Trump’s efforts regarding the Russian-Ukrainian war, citing conference speakers as its source. Nothing was framed as contested. This was the version of the operation built for policy circles and analytical audiences who would dismiss RT but might forward an InterAffairs.ru link to a colleague without checking where the journal sits institutionally. * https://en.interaffairs.ru/article/europe-is-waking-up-from-its-liberal-slumber-a-make-europe-great-again-mega-inaugural-conferen/  While the MEGA content was moving through its network, a second operation was running in parallel. Its target was the working relationship between European Commission President Ursula von der Leyen and EU foreign policy chief Kaja Kallas. The tensions between the two are real. Western mainstream outlets reported on friction over institutional authority, including a dispute about the Mediterranean region portfolio. But the version of this story that circulated through Russian and pro-Kremlin-position media was built on a single anonymous claim that appeared first on a platform linked to Russian intelligence services. On January 31, 2026, the Strategic Culture Foundation published a lengthy article by Dutch writer Sonja van den Ende. The Strategic Culture Foundation has been designated by both the EU and the United States as a channel linked to Russian intelligence, used to give disinformation the appearance of geopolitical analysis. Van den Ende’s piece described the EU as a “self-imposed island of isolation where the appearance of a good life and democracy is maintained by politically funded media.” It argued that the friction between von der Leyen and Kallas “usually means the end of a bloc, organisation, or country.” And it quoted an anonymous senior EU official saying that Kallas “privately calls von der Leyen a dictator, but she can do little about it.” That anonymous claim, on that platform, became the factual anchor for everything that followed. One detail in the text travelled intact to every site that republished it. Throughout the article, von der Leyen is referred to not by her name or title but as “Führerin” — a German word with direct and unmistakable associations with the Nazi period. The word appeared repeatedly and was copied verbatim across Switzerland, Germany, the Czech Republic, Finland, and Estonia. It was designed to trigger a specific emotional response in German-speaking audiences, and it worked as designed every time it was republished. * https://strategic-culture.su/news/2026/01/31/how-eu-politicians-live-in-own-bubble-enemies-their-isolated-eu-island/  On February 1, 2026, the day after the Strategic Culture publication, three major Russian state outlets published the story within hours of each other. None had conducted independent reporting. All three cited Strategic Culture as their source. RIA Novosti described the disagreement between von der Leyen and Kallas as evidence of “the approaching collapse of the EU.” Izvestia ran the headline “Strategic Culture Points to the Harm for the EU of the Von der Leyen and Kallas Disagreements,” naming the source in the headline itself — an editorial choice that functions as a public legitimisation signal for the platform. Lenta.ru wrote that the conflict had pushed Europe to live on a “voluntary island of isolation, inventing countless enemies around itself.” A platform linked to Russian intelligence published a claim on January 31. Three state outlets amplified it the next day. The direction of travel is clear. * https://ria.ru/20260201/ssora-2071495442.html  * https://iz.ru/2035066/2026-02-01/sc-ukazala-na-vred-dlia-es-raznoglasii-fon-der-liaien-i-kallas  * https://lenta.ru/news/2026/02/01/es-predrekli-raskol-iz-za-konflikta-kallas-i-fon-der-lyayen/  From the Russian state layer, the campaign moved into Europe through the same network that had carried the MEGA content and through several additional sites. News Front SK published the Slovak translation on February 1 at 15:00, within hours of the Russian state wave. The Slovak site Oral.sk republished the same content the same day. * https://sk.news-front.su/2026/02/01/strategic-culture-nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu/   * https://oral.sk/nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu/  The story then spread through the Slovak and Czech cluster. Slovanské Noviny, Infovojna, CZ24.news, and Infokuryr all published versions crediting Strategic Culture or News Front as their source. * https://slovanskenoviny.sk/staty-eu-na-cele-s-eurokomisiou-su-coraz-viac-izolovane-od-zvysku-sveta-a-vytvaraju-si-nespocetne-mnozstvo-nepriatelov-po-celej-planete/  * https://www.infovojna.com/article/staty-eu-na-cele-s-eurokomisiou-su-coraz-viac-izolovane-od-zvysku-sveta-a-vytvaraju-si-nespocetne-mnozstvo-nepriatelov  * https://cz24.news/nevrazivost-medzi-von-der-leyen-a-kallas-by-mohla-znicit-eu-strategic-culture/  * https://www.infokuryr.cz/n/2026/02/10/jak-politici-eu-ziji-ve-vlastni-nepratelske-bubline-na-svem-izolovanem-ostrove-eu/  In the German-language zone, three sites published texts that were identical word for word. Uncutnews in Switzerland, Krisenfrei in Germany, and DDBnews in Germany ran the same article, with the only difference being that DDBnews attributed it to an author named simply “Uwe” with no surname. Three outlets, one text, zero original journalism. * https://uncutnews.ch/wie-eu-politiker-in-ihrer-eigenen-feindesblase-auf-ihrer-isolierten-eu-insel-leben/  * https://krisenfrei.com/wie-eu-politiker-in-ihrer-eigenen-blase-von-feinden-auf-ihrer-isolierten-eu-insel-leben/  * https://www.ddbnews.de/wie-eu-politiker-in-ihrer-eigenen-feindesblase-auf-ihrer-isolierten-eu-insel-leben/  In France, the piece appeared on Newsnet. In Hungary, Pestisracok published it under the headline “Catfight — The Von der Leyen and Kallas Brawl Foreshadows the End of the EU,” adding a local editorial voice while keeping the core narrative intact. In the Netherlands, Sonja van den Ende—the same author who had written the original Strategic Culture piece—published an expanded Dutch version on Indignatie.nl under the headline “Europe’s Submission to Uncle Sam,” adding anti-American material while keeping the EU disintegration framing at the centre. * http://www.newsnet.fr/302926  * https://pestisracok.hu/vilagugar/2026/02/cicaharc-von-der-leyen-kallas-balheja-eu-veget  * https://indignatie.nl/europas-onderwerping-aan-uncle-sam/  Van den Ende’s reach across European outlets tells its story. The same author supplied content to at least seven outlets across six countries: Uncutnews in Switzerland, Indignatie in the Netherlands, Krisenfrei and DDBnews in Germany, Infokuryr in the Czech Republic, and the Finnish and Estonian editions of eestieest.com. One author, one original text, seven outlets, and six languages are all served by the same author. That is a distribution network with a house author. The Finnish publication fi.eestieest.com and the Estonian publication eestieest.com both translated the article in full and published it for audiences in two NATO members on Russia’s immediate border. And the claim at the centre — that Kallas privately called von der Leyen a dictator — was published in Estonian. Kaja Kallas is Estonian. Her standing in her home country, where she is most known and where reputational damage would land hardest, was not an incidental choice of target. That was the point. * https://fi.eestieest.com/Kuinka-EU-poliitikot-elävät-oman-vihollisensa-kuplassa-eristyneellä-EU-saarellaan/  * https://eestieest.com/kuidas-el-i-poliitikud-elavad-omaenda-vaenlase-mullis-oma-isoleeritud-el-i-saarel/   Looked at separately, each campaign could be explained away. Fringe websites covering a political conference. Some editorial overlap between small alternative outlets. A story about EU leadership tensions that spread across a few countries. Taken alone, the coincidences could be dismissed. Looking at them together, the picture is different. The same Slovak sites — News Front SK, Infovojna, Slovanské Noviny, Oral.sk — amplified both campaigns. The same German sites — Krisenfrei, DDBnews — amplified both. These are not outlets that happened to cover two overlapping stories. They are standing relay infrastructure that activates whenever a Russian narrative needs European distribution, regardless of the topic. The timelines are not coincidental. In the MEGA campaign, RIA Novosti publishes on February 6, News Front follows in six languages the same day, News Pravda follows on February 8, and European proxy sites follow on February 9. In the Kallas and von der Leyen campaign, Strategic Culture publishes on January 31, Russian state media follows on February 1, and European amplifiers follow within 24 to 72 hours. In both cases the direction of travel is always the same — from Moscow outward, not from European civil society inward. And both campaigns pointed to the same conclusion. The MEGA campaign told European audiences that their leadership is the enemy of real European values and that the Russian-Ukrainian war is a manufactured crisis. The von der Leyen and Kallas campaign told those same audiences that the institution is already tearing itself apart from the inside. Together they constructed a single message: the EU is antidemocratic, isolated, and collapsing. The question of what should come instead was left carefully unanswered. It did not need to be asked. Sowing the doubt was enough.

Russia weaponizes MEGA and EU rifts in its information operation to spread Union collapse narrative #cybersecurity #infosec

06.03.2026 03:45 👍 1 🔁 0 💬 0 📌 0
Preview
When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I The post When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I appeared first on Lieber Institute West Point.

When Red Lines Cross Blue Lines: Cyber Attacks on Poland’s Water Infrastructure – Part I #cybersecurity #infosec

05.03.2026 23:10 👍 0 🔁 0 💬 0 📌 0
Preview
Vulnerability monitoring service secures public-sector websites faster An automated scanning system has cut the time it takes to fix cybersecurity vulnerabilities across public sector IT systems, reducing median remediation time for general cyber vulnerabilities from 53 days to 32, and slashing DNS-specific average fix times from 50 days to eight. The results come from the UK government’s newly launched vulnerability monitoring service (VMS), which continuously scans more than 6,000 public bodies from doctors’ offices and ambulance trusts to hospitals and the Legal Aid Agency, tracking every identified weakness until it is resolved. The service detects around 1,000 types of vulnerabilities and processes approximately 400 confirmed findings a month, the government said. “Cyber-attacks aren’t abstract threats, they delay National Health Service appointments, disrupt essential services, and put people’s most sensitive data at risk,” said UK Minister for Digital Government Ian Murray in a statement announcing the results at the annual Government Cyber Security and Digital Resilience conference. “When public services struggle it’s families, patients and frontline workers that feel it.” Murray also unveiled a £210 million ($266 million) Cyber Action Plan and the launch of a first-ever government Cyber Profession, a program to recruit, train, and retain security talent across public services. Favorable comparison Paul McKay, VP principal analyst at Forrester, said the numbers compare favorably against private sector benchmarks. “These median fix times are generally better than the figures vulnerability management vendors publish in benchmark studies, which log average fix time ranging from a few weeks to several months depending on vulnerability criticality and whether it is known to be exploited in other organizations,” McKay said. The bigger problem in most organizations is not detection speed but communication, McKay said. Security teams that can’t explain why a specific finding matters tend to see vulnerabilities pile up unresolved. “Lots of security teams struggle to do this, overwhelming technology teams with lists of thousands of vulnerabilities with unrealistic SLA timeframes to fix them,” he said. The gap between average and best-in-class performance, he added, comes down to one thing: “The ability to cleanly articulate why vulnerabilities matter in terms of the business impact and show real rather than theoretical risk exposure.” That clarity of communication, McKay said, matters more than the tools an organization deploys. Tools good, talk better The UK government’s VMS uses a combination of commercial and proprietary scanning tools to detect vulnerabilities in internet-facing assets. But McKay cautions against drawing the wrong conclusion from the results. “Process, accountability and taking ownership for explaining why this matters to the resilience of the business is far more important than the technical tooling,” he said. “Building a robust prioritization approach and a strong trusted relationship with peer stakeholders responsible for doing the work of patching and applying fixes, matters far more than the specific tooling chosen.” The UK’s VMS alerts responsible organizations with “specific, actionable guidance” on each finding, rather than generating raw vulnerability feeds, and tracks progress until the issue is closed. The government cited DNS vulnerabilities as a specific example. Before the VMS, a weakness in a government DNS record could sit undetected for nearly two months. The service has closed that window to eight days. The statement also added that the service will expand to cover additional vulnerability categories, with fix times expected to fall further as it matures. The UK’s National Audit Office (NAO), however, flagged a challenge the VMS alone cannot fix. The workforce challenge Word of the success of VMS comes a month after the NAO reported that the cyber threat to government is “severe and advancing quickly,” concluding that resilience levels were lower than previously estimated, and determined the government would not meet its own 2025 cyber resilience targets. It identified skills gaps as the single biggest risk to building lasting cyber resilience. The government said the new Cyber Profession is a direct response to those findings. Co-branded with the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT), it will “establish a dedicated Cyber Resourcing Hub, a government Cyber Academy, an apprenticeship scheme, and structured career pathways” aligned with UK Cyber Security Council standards. Manchester will serve as the primary hub, the statement added. “The launch of the government Cyber Profession will help attract and retain the most talented professionals with the top-tier skills needed to keep the UK safe online,” NCSC CEO Richard Horne said in the statement. DSIT did not respond to requests for additional technical detail on the VMS by the time of publication.

Vulnerability monitoring service secures public-sector websites faster #cybersecurity #infosec

05.03.2026 18:31 👍 0 🔁 0 💬 0 📌 0
Preview
Iran's cyberwar has begun 'Expect elevated activity for the foreseeable future' Iranian hackers have launched spying expeditions, digital probes, and distributed denial of service (DDoS) attacks in the wake of the US and Israel launching missile strikes over the weekend, and security researchers urge organizations to expect more cyber intrusions as the war continues.…

Iran's cyberwar has begun #cybersecurity #infosec

05.03.2026 15:58 👍 1 🔁 1 💬 1 📌 0
Preview
Cyber Command disrupted Iranian comms, sensors, top general says U.S. Cyber Command conducted online attacks against Iranian communications systems that the country’s top general said set the stage for the joint bombing campaign with Israel.

Cyber Command disrupted Iranian comms, sensors, top general says #cybersecurity #infosec

05.03.2026 03:44 👍 2 🔁 0 💬 0 📌 0
Preview
Cyber, Space Commands were among 'first movers' in strikes on Iran: top general ]]>

Cyber, Space Commands were among 'first movers' in strikes on Iran: top general #cybersecurity #infosec

04.03.2026 23:10 👍 1 🔁 1 💬 0 📌 0
Preview
Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience Aeternum operates on smart contracts, making its command-and-control (C&C) infrastructure difficult to disrupt. The post Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience appeared first on SecurityWeek.

Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience #cybersecurity #infosec

04.03.2026 18:31 👍 1 🔁 0 💬 0 📌 0
Preview
APT37 hackers use new malware to breach air-gapped networks North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance. [...]

APT37 hackers use new malware to breach air-gapped networks #cybersecurity #infosec

04.03.2026 15:58 👍 0 🔁 0 💬 0 📌 0

You don't need to hack a device when you can get all you need from real-time data brokerages

The personal data surveillance economy has now become fully integrated into the operations of the police state

Only rigorous and independent oversight of both sectors can preserve rights & freedoms

03.03.2026 16:31 👍 51 🔁 21 💬 1 📌 0
Preview
WLAN-Sicherheitslücke AirSnitch: Client-Isolation selbst in WPA3-Enterprise ausgehebelt Die WLAN-Sicherheitslücke AirSnitch umgeht die WLAN-Client-Isolation, selbst WPA3-Enterprise ist betroffen. Der Artikel WLAN-Sicherheitslücke AirSnitch: Client-Isolation selbst in WPA3-Enterprise ausgehebelt erschien zuerst auf TARNKAPPE.INFO

WLAN-Sicherheitslücke AirSnitch: Client-Isolation selbst in WPA3-Enterprise ausgehebelt #cybersecurity #infosec

04.03.2026 03:44 👍 1 🔁 0 💬 0 📌 0
Preview
Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement New research has found that Google Cloud API keys, typically designated as project identifiers for billing purposes, could be abused to authenticate to sensitive Gemini endpoints and access private data. The findings come from Truffle Security, which discovered nearly 3,000 Google API keys (identified by the prefix "AIza") embedded in client-side code to provide Google-related services like

Thousands of Public Google Cloud API Keys Exposed with Gemini Access After API Enablement #cybersecurity #infosec

03.03.2026 23:10 👍 0 🔁 0 💬 0 📌 0
Preview
A Possible US Government iPhone-Hacking Toolkit Is Now in the Hands of Foreign Spies and Criminals A highly sophisticated set of iPhone hijacking techniques has likely infected tens of thousands of phones or more. Clues suggest it was originally built for the US government.

A full iOS exploitation toolkit, "Coruna," has been found in the wild, hacking iPhones that visited infected websites, used by Russian spies targeting Ukrainians and thieves targeting Chinese crypto holders. And it may have been originally created for the US government. www.wired.com/story/coruna...

03.03.2026 19:04 👍 126 🔁 105 💬 9 📌 8
Preview
A systematic review on botnet defense mechanisms: past, present and future Volume 10, Issue 1, December 2026, Page 1-27 .

A systematic review on botnet defense mechanisms: past, present and future #cybersecurity #infosec

03.03.2026 18:30 👍 1 🔁 0 💬 0 📌 0
Preview
Cybercom didn’t tell troops to disable location services or uninstall apps, military officials say, after viral message spread amid Iran operation Multiple defense officials told DefenseScoop Sunday that a viral message purporting to be from U.S. Cyber Command wasn’t sent by the command. The message claimed Cybercom was warning troops to turn off location services from their electronic devices and that multiple commercial applications were compromised, all amid the ongoing military operations against Iran. The message — reviewed by DefenseScoop — was circulating in some military circles and social media Sunday. It urged “all U.S. service members” to turn off location services from their electronic devices. It also said that Uber, Snapchat and a food delivery service that operates in the Middle East known as Talabat were “compromised.” “​​Due to operational security concerns, U.S. Cyber Command does not comment nor discuss cyber intelligence, plans, operations, capabilities, or effects,” one official told DefenseScoop, requesting attribution as a Department of War official, the preferred name for the Pentagon under the Trump administration. “The command did not issue messages to US service members to turn off location services on their electronic devices and did not issue messages that applications had been compromised.” The statement did not address where the correspondence originated from and why it was circulating in the military community. Capt. Tim Hawkins, a spokesperson for U.S. Central Command, said the message was “false.” Centcom is responsible for overseeing U.S. military operations in the Middle East. “We have no indication that this rumor is true regarding Uber,” a spokesperson for the company told DefenseScoop. Uber also took to social media to respond to accounts spreading the message, calling it an “unsubstantiated rumor.” Following the launch of joint U.S.-Israel strikes against Iran starting Saturday, false and misleading information about the operation have flooded social media, WIRED reported. U.S. Central Command said Iran had issued “multiple bogus claims” over the last two days about the operation. The origin of the message is unclear, however, and it spread through various military channels on Sunday. An account with more than 40,000 followers posted the message on social media, which had racked up hundreds of thousands of views, and pushed the claim, as did other users. While U.S. officials denied the validity of the message, concerns have previously been raised about Iran’s cyber capabilities. Last summer, the Cybersecurity and Infrastructure Security Agency (CISA) warned that Iranian-affiliated cyber actors “often exploit targets of opportunity” based on unpatched or outdated software.  The so-called 12-day War between Iran and Israel last year revealed how Tehran-linked actors used “a broad range of operations designed to exert psychological pressure, collect tactical intelligence, enforce deterrence against third countries, and maintain domestic control,” according to the Middle East Institute. MEI said Iran had also “intensified its psychological operations through the use of AI to generate and disseminate disinformation.”  The new military campaign against Iran that was launched Saturday, known as Operation Epic Fury, is ongoing. U.S. Central Command said Sunday that three U.S. service members were killed during the operation. Cybercom referred DefenseScoop to the Pentagon for comment Sunday. Spokespeople for Snapchat and Talabat did not immediately respond to the publication’s questions. The post Cybercom didn’t tell troops to disable location services or uninstall apps, military officials say, after viral message spread amid Iran operation appeared first on DefenseScoop.

Cybercom didn’t tell troops to disable location services or uninstall apps, military officials say, after viral message spread amid Iran operation #cybersecurity #infosec

03.03.2026 15:59 👍 2 🔁 2 💬 0 📌 0
Preview
Who is the Kimwolf Botmaster “Dort”? In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher’s home. This post examines what is knowable about Dort based on public information. A public “dox” created in 2020 asserted Dort was a teenager from Canada (DOB August 2003) who used the aliases “CPacket” and “M1ce.” A search on the username CPacket at the open source intelligence platform OSINT Industries finds a GitHub account under the names Dort and CPacket that was created in 2017 using the email address jay.miner232@gmail.com. Image: osint.industries. The cyber intelligence firm Intel 471 says jay.miner232@gmail.com was used between 2015 and 2019 to create accounts at multiple cybercrime forums, including Nulled (username “Uubuntuu”) and Cracked (user “Dorted”); Intel 471 reports that both of these accounts were created from the same Internet address at Rogers Canada (99.241.112.24). Dort was an extremely active player in the Microsoft game Minecraft who gained notoriety for their “Dortware” software that helped players cheat. But somewhere along the way, Dort graduated from hacking Minecraft games to enabling far more serious crimes. Dort also used the nickname DortDev, an identity that was active in March 2022 on the chat server for the prolific cybercrime group known as LAPSUS$. Dort peddled a service for registering temporary email addresses, as well as “Dortsolver,” code that could bypass various CAPTCHA services designed to prevent automated account abuse. Both of these offerings were advertised in 2022 on SIM Land, a Telegram channel dedicated to SIM-swapping and account takeover activity. The cyber intelligence firm Flashpoint indexed 2022 posts on SIM Land by Dort that show this person developed the disposable email and CAPTCHA bypass services with the help of another hacker who went by the handle “Qoft.” “I legit just work with Jacob,” Qoft said in 2022 in reply to another user, referring to their exclusive business partner Dort. In the same conversation, Qoft bragged that the two had stolen more than $250,000 worth of Microsoft Xbox Game Pass accounts by developing a program that mass-created Game Pass identities using stolen payment card data. Who is the Jacob that Qoft referred to as their business partner? The breach tracking service Constella Intelligence finds the password used by jay.miner232@gmail.com was reused by just one other email address: jacobbutler803@gmail.com. Recall that the 2020 dox of Dort said their date of birth was August 2003 (8/03). Searching this email address at DomainTools.com reveals it was used in 2015 to register several Minecraft-themed domains, all assigned to a Jacob Butler in Ottawa, Canada and to the Ottawa phone number 613-909-9727. Constella Intelligence finds jacobbutler803@gmail.com was used to register an account on the hacker forum Nulled in 2016, as well as the account name “M1CE” on Minecraft. Pivoting off the password used by their Nulled account shows it was shared by the email addresses j.a.y.m.iner232@gmail.com and jbutl3@ocdsb.ca, the latter being an address at a domain for the Ottawa-Carelton District School Board. Data indexed by the breach tracking service Spycloud suggests that at one point Jacob Butler shared a computer with his mother and a sibling, which might explain why their email accounts were connected to the password “jacobsplugs.” Neither Jacob nor any of the other Butler household members responded to requests for comment. The open source intelligence service Epieos finds jacobbutler803@gmail.com created the GitHub account “MemeClient.” Meanwhile, Flashpoint indexed a deleted anonymous Pastebin.com post from 2017 declaring that MemeClient was the creation of a user named CPacket — one of Dort’s early monikers. Why is Dort so mad? On January 2, KrebsOnSecurity published The Kimwolf Botnet is Stalking Your Local Network, which explored research into the botnet by Benjamin Brundage, founder of the proxy tracking service Synthient. Brundage figured out that the Kimwolf botmasters were exploiting a little-known weakness in residential proxy services to infect poorly-defended devices — like TV boxes and digital photo frames — plugged into the internal, private networks of proxy endpoints. By the time that story went live, most of the vulnerable proxy providers had been notified by Brundage and had fixed the weaknesses in their systems. That vulnerability remediation process massively slowed Kimwolf’s ability to spread, and within hours of the story’s publication Dort created a Discord server in my name that began publishing personal information about and violent threats against Brundage, Yours Truly, and others. Dort and friends incriminating themselves by planning swatting attacks in a public Discord server. Last week, Dort and friends used that same Discord server (then named “Krebs’s Koinbase Kallers”) to threaten a swatting attack against Brundage, again posting his home address and personal information. Brundage told KrebsOnSecurity that local police officers subsequently visited his home in response to a swatting hoax which occurred around the same time that another member of the server posted a door emoji and taunted Brundage further. Dort, using the alias “Meow,” taunts Synthient founder Ben Brundage with a picture of a door. Someone on the server then linked to a cringeworthy (and NSFW) new Soundcloud diss track recorded by the user DortDev that included a stickied message from Dort saying, “Ur dead nigga. u better watch ur fucking back. sleep with one eye open. bitch.” “It’s a pretty hefty penny for a new front door,” the diss track intoned. “If his head doesn’t get blown off by SWAT officers. What’s it like not having a front door?” With any luck, Dort will soon be able to tell us all exactly what it’s like. Update, 10:29 a.m.: Jacob Butler responded to requests for comment, speaking with KrebsOnSecurity briefly via telephone. Butler said he didn’t notice earlier requests for comment because he hasn’t really been online since 2021, after his home was swatted multiple times. He acknowledged making and distributing a Minecraft cheat long ago, but said he hasn’t played the game in years and was not involved in Dortsolver or any other activity attributed to the Dort nickname after 2021. “It was a really old cheat and I don’t remember the name of it,” Butler said of his Minecraft modification. “I’m very stressed, man. I don’t know if people are going to swat me again or what. After that, I pretty much walked away from everything, logged off and said fuck that. I don’t go online anymore. I don’t know why people would still be going after me, to be completely honest.” When asked what he does for a living, Butler said he mostly stays home and helps his mom around the house because he struggles with autism and social interaction. He maintains that someone must have compromised one or more of his old accounts and is impersonating him online as Dort. “Someone is actually probably impersonating me, and now I’m really worried,” Butler said. “This is making me relive everything.”  

Who is the Kimwolf Botmaster “Dort”? #cybersecurity #infosec

03.03.2026 03:44 👍 1 🔁 0 💬 0 📌 0
Preview
OpenClaw, but in containers: Meet NanoClaw A smaller, security-conscious take on the viral AI agent platform Interview  Ideally, you shouldn't have to defend yourself against your own AI agent. But we don't live in an ideal world and an unrestrained agent can cause a ton of damage.…

OpenClaw, but in containers: Meet NanoClaw #cybersecurity #infosec

02.03.2026 23:10 👍 3 🔁 2 💬 0 📌 0
Preview
Inside the plan to kill Ali Khamenei Israel spent years hacking Tehran’s traffic cameras and monitoring bodyguards ahead of the assassination of Iran’s supreme leader

Ok, krass: »Nearly all the traffic cameras in Tehran had been hacked for years, their images encrypted and transmitted to servers in Tel Aviv and southern Israel, according to two people familiar with the matter.« www.ft.com/content/bf99...

02.03.2026 18:49 👍 156 🔁 57 💬 6 📌 11

Fast 400 IT-Wissenschaftler*innen aus 30 Ländern warnen vor #Altersverifizierung für Social Media.

".. we fear that, if implemented without careful consideration of the
technological hazards and societal impact, the new regulation might cause more harm than good."

#Social-Media-Verbot

02.03.2026 19:32 👍 130 🔁 51 💬 1 📌 4

Just last week the German government gutted the heating law which was supposed to drive a transition away from gas.

The timing could not have been worse: Gas prices are up 50% today and this crisis could worsen significantly. This will happen again and again and the consumer pays the price.

02.03.2026 16:16 👍 594 🔁 253 💬 19 📌 20
Preview
KI-Modelle enttarnen Online-Pseudonyme in Minuten ZÜRICH / LONDON (IT BOLTWISE) – Forschungen zeigen, dass KI-Modelle in der Lage sind, pseudonyme Internetnutzer schnell und kostengünstig zu identifizieren. Diese Entwicklung stellt grundlegende Annahmen über die Anonymität im Internet in Frage und könnte weitreichende Folgen für die Privatsphäre haben. Die jüngsten Forschungen von ETH Zürich und Anthropic haben gezeigt, dass kommerziell verfügbare KI-Modelle […] ... den vollständigen Artikel »KI-Modelle enttarnen Online-Pseudonyme in Minuten« lesen Dieser Beitrag KI-Modelle enttarnen Online-Pseudonyme in Minuten erschien als erstes auf IT BOLTWISE® x Artificial Intelligence.

KI-Modelle enttarnen Online-Pseudonyme in Minuten #cybersecurity #infosec

02.03.2026 18:30 👍 1 🔁 1 💬 0 📌 0
Preview
Hacktivists claim to have hacked Homeland Security to release ICE contract data | TechCrunch A hacking group called Department of Peace said they hacked a specific office within Homeland Security to protest ICE’s mass deportation campaign, and the companies aiding it.

NEW: A group of hacktivists calling themselves "Department of Peace" claims to have hacked an office wihin the Department of Homeland Security.

The hacktivists leaked data on more than 6,000 contracts between DHS/ICE and private companies to the transparency website Distributed Denial of Secrets.

02.03.2026 16:17 👍 44 🔁 24 💬 1 📌 2
Preview
Cyberangriffe auf Iran: Unbekannte Hacker senden Botschaften über Gebets-App TEHERAN / LONDON (IT BOLTWISE) – Inmitten eines militärischen Angriffs auf iranische Ziele erhielten Millionen Iraner unerwartete Benachrichtigungen über eine beliebte Gebets-App. Diese Nachrichten forderten zur Kapitulation auf und versprachen Amnestie, was die Spannungen in der Region weiter anheizt. In den frühen Morgenstunden eines Samstags wurden Iraner von einer ungewöhnlichen Serie von Push-Benachrichtigungen überrascht, die […] ... den vollständigen Artikel »Cyberangriffe auf Iran: Unbekannte Hacker senden Botschaften über Gebets-App« lesen Dieser Beitrag Cyberangriffe auf Iran: Unbekannte Hacker senden Botschaften über Gebets-App erschien als erstes auf IT BOLTWISE® x Artificial Intelligence.

Cyberangriffe auf Iran: Unbekannte Hacker senden Botschaften über Gebets-App #cybersecurity #infosec

02.03.2026 15:59 👍 1 🔁 0 💬 0 📌 0

Amateurs study tactics; professionals study logistics.

01.03.2026 16:13 👍 56 🔁 16 💬 0 📌 1

In war games the movie the #AI ultimately is smart enough to exit the game. Our current LLMs are not that smart…

27.02.2026 17:16 👍 3 🔁 0 💬 2 📌 0
Preview
Exclusive | Government Agencies Raise Alarm About Use of Elon Musk’s Grok Chatbot Warnings about xAI’s safety and reliability preceded the Pentagon’s decision to approve Grok for use in classified settings.

Duh

Government Agencies Raise Alarm About Use of Elon Musk’s Grok Chatbot (Gift article)
www.wsj.com/politics/nat...

27.02.2026 16:24 👍 2 🔁 3 💬 0 📌 0

Trump’s billionaire allies will now own CNN, Fox News, CBS, WaPo, WSJ and NY Post — plus 185+ local tv stations and news in 100 markets.

They also control X, Facebook, Instagram, Threads, WhatsApp, TikTok, Truth and Twitch.

This is all by design to manipulate and surveil us.

Pay attention.

27.02.2026 14:48 👍 2048 🔁 969 💬 110 📌 56