Saab introduced an Australia-developed cloud platform that combines space awareness, mission management and command-and-control tools.

Amazon GuardDuty now supports optional detection rules for Runtime Monitoring. You can enable more than 50 Runtime Monitoring rules that help detect process, file, and network activity that might be routine in one environment but a sign of compromise in another, such as modifying sudoers files or disabling audit logging. The new rules provide detections for Amazon EC2 instances, Amazon EKS, and Amazon ECS on both EC2 and AWS Fargate, and span 13 finding types mapped to MITRE ATT&CK® tactics including persistence, privilege escalation, execution, defense evasion, discovery, exfiltration, and command and control. This release introduces four new finding types: CommandAndControl:Runtime/SuspiciousCommand, CredentialAccess:Runtime/SensitiveFileRead, Discovery:Runtime/SensitiveFileRead, and Exfiltration:Runtime/SuspiciousCommand. To get started, visit the GuardDuty console. You can enable rules in dry-run mode to evaluate detection efficacy before enabling live detection. Custom Detection Rules for Runtime Monitoring is available in all AWS commercial Regions and the AWS GovCloud (US) Regions. To learn more, see Amazon GuardDuty Custom Detection Rules. To receive programmatic updates on new Amazon GuardDuty features and threat detections, subscribe to the Amazon GuardDuty SNS topic.

P7 DarkSword is a new variant of the DarkSword iOS exploit kit, designed to steal cryptocurrency wallet data, iCloud Keychain information, photos, files, and other sensitive data from vulnerable iPhones. In this episode, we explore its stealth techniques, remote command capabilities, malicious websites used for distribution, and the essential security measures every iPhone user should know.

An advanced malware campaign known as TASK#STOMP has recently been discovered, which utilizes a PowerShell-based backdoor to collect business documents, Wi-Fi passwords, clipboard data, and screenshots from compromised computers using a PowerShell backdoor. Moreover, the malware also provides attackers with remote command execution and maintains multiple channels for further access. VBScript files are executed via the legitimate Windows Script Host utility wscript.exe in order to initiate the infection.  In spite of the fact that the exact method of delivery has not been confirmed, phishing or social engineering could be considered possible methods of delivering the script. Following the script's delivery, it sets up a set of scheduled tasks resembling legitimate Windows components, establishing persistence.  By naming these tasks Local Credential Manager, Network Audio Service, Windows Display Manager, and Device Credential Handler, malicious activities can be blended seamlessly with normal system activities. Another persistence mechanism places another VBScript file in the Windows Startup folder, enabling it to run when the user logs in.  Upon launching the malware, it executes two PowerShell components. Among these are sys_loader.ps1, which collects documents, gathers system information, steals Wi-Fi passwords, monitors clipboards, captures screenshots, and executes remote commands. Another persistent command-and-control channel, win_conn.ps1, provides additional collection capability as well as a persistent command-and-control channel.  By monitoring each other and restarting the other process if one is disabled, this setup provides redundancy, making it more difficult to remove the malware if only one process is terminated or a single persistence entry is deleted. In addition to hiding execution activities, timestamp manipulations, and cleanup activities, Task#STOMP can also be used for continuous document theft, increasing the difficulty of detection and forensic investigation.  As opposed to collecting only files that are already present on an infected computer, TASK#STOMP monitors the file system for newly created or modified documents. This enables the collection of business files as they appear and change during an active infection. In addition to obtaining Wi-Fi credentials and clipboard contents, the malware targets saved Wi-Fi credentials as well.  With clipboard monitoring, operators can identify information temporarily copied by users, while screenshot capture allows them to view information displayed on a compromised system. By combining these capabilities with remote command execution, Task#STOMP is able to gather more information about user activity than a conventional file-stealing malware.  A separate command-and-control path, Win_conn.ps1, is maintained by TASK#STOMP in addition to data collection. From win_conn_cfg.dat, the component decodes its configuration and connects to attacker-controlled infrastructure at corecloudfileshare[.]xyz and attachmentsharingdrive[.]xyz. Researcher identification of related traffic can be improved by using a hardcoded authentication token for communication.  Parts of network communication are handled by a compiled C# component. During connection times, connections can proceed when certificates are invalid, self-signed, or otherwise mismatched due to the code disabling TLS certificate validation. This reduces the level of protection usually provided by certificate checks and makes it easier for the malware to communicate with its servers. Additionally, TASK#STOMP alters file timestamps and cleans up activity following execution to provide further anti-forensic measures.  According to the researchers, several files have been backdated to January 15, 2024, but that date is not conclusive of when the campaign began. This date was deliberately inserted by the malware, and therefore cannot be regarded as evidence of the age of the campaign. Securonix has not determined why the malware opens a page associated with irantenders[.]com in Chrome, but the page relates to government contracts and tenders in Iran.  Securonix has not established whether the site indicates a specific victim profile or why it is opened. Researchers have cautioned that the domain alone may not be sufficient to confirm the campaign's geographical or sectoral targeting. Securonix has not linked TASK#STOMP to a known threat group. Due to the use of a single compromised system, it is unclear how the overall campaign scope and duration were determined.  The initial delivery method is also unclear, although similar VBScript campaigns suggest phishing involving archive or disk image attachments as a possible route. To detect an infection, researchers recommend examining suspicious Windows Script Host and PowerShell activity that originates from writable locations, newly created scheduled tasks, and instances where PowerShell invokes the C# compiler from .NET C#.  A suspected infection can be investigated with additional evidence from PowerShell Script Block Logging, AMSI telemetry, and scheduled task records.

The Escalation Loop Recorded Sunday, July 19, 2026The breaking drone exchanges and renewed air-defense engagements across the Persian Gulf demonstrate the dangerous, self-sustaining momentum of an escalation loop. Moving past the daily headlines, we examine the heavy burden placed on tactical radar operators and the stark reality of modern kinetic conflict.#Reflection #PersianGulf #AirDefense #MilitaryAnalysis #CommandAndControl #EscalationLoop #TacticalOperators #NationalSecurity #ThoughtfulAmerican #AGypsysKisshttp://www.tyounis.com

Cybersecurity researchers have disclosed that artificial intelligence (AI) assistants that support web browsing or URL fetching capabilities can be turned into stealthy command-and-control (C2) relays, a technique that could allow attackers to blend into legitimate enterprise communications and evade detection. The attack method, which has been demonstrated against Microsoft Copilot and xAI Grok

The commander of the Air Force 's 613th Air Operations Center in Hawaii, who advocated for more women in such roles, was removed from her position this we

  It is difficult to discern the quiet recalibration of remote access malware that occurs without spectacle, but its consequences often appear in plain sight. The newly identified variant of Remcos RAT illustrates this progression clearly and unnervingly.  In its current architecture, the updated strain focuses on immediacy and persistence instead of serving as passive collectors of stolen information. With its newly designed operational design promoting direct, continuous communication with attacker-controlled infrastructure, it allows for the observation of compromised Windows systems in real time rather than after the incident has occurred. This shift does more than simply represent a routine upgrade. By moving away from the traditional method of locally caching harvested data, the malware reduces the amount of digital residue typically left behind by investigators. By transmitting information in near real time, compromise and exploitation can be minimized.  The latest build enhances this capability by enabling live webcam streaming and instantaneous keystroke transmission, creating active surveillance endpoints on infected machines. Therefore, the variant reinforces a broader trend within the threat landscape which places more importance on speed, stealth, and sustained visibility over simple data exfiltration. According to Point Wild's Lat61 Threat Intelligence Team, the latest Remcos iteration has been designed with a deliberate focus on runtime concealment and forensic minimization in mind. In contrast to the traditional method of embedding webcam footage within the core payload, a streaming module is retrieved and executed only on operator instruction, thereby minimizing its exposure during routine scanning. The handling of command-and-control configuration data, which is decrypted solely in memory, as opposed to writing it to disk, is also significant. In combination with dynamic API resolution, this approach further complicates static analysis. As opposed to hard-coding Windows API references, malware resolves and decrypts them during execution, thereby frustrating signature-based detection and impeding reverse engineering.  Additionally, the variant maintains its stealth posture by systematically removing artifacts associated with persistence mechanisms. Screenshots, audio captures, keylogging outputs, browser cookies, and registry entries are purged prior to termination. The malware may also generate a temporary Visual Basic script to enable the deletion of proprietary or operational files before self-exiting, thereby reducing the residual indicators investigators might otherwise be able to utilize. As researchers observe, the malware has continuously refined its evasion and operational depths, illustrating its continued relevance in the remote access trojan ecosystem.  During the execution phase, the malware conducts privilege assessments in order to determine the level of system access available for subsequent behavior based upon the privilege assessment. By utilizing this conditional logic, decisions regarding privilege escalation are influenced and high-impact actions can be executed, including the modification of protected directories, changes to registry keys, deployment of persistence mechanisms, or interference with security services—activities that typically require elevated privileges. By tailoring its behavior to the access context, the malware enhances its survivability and effectiveness within compromised environments by increasing its survivability and effectiveness. As part of initialization routines, intent is obscured until execution is well underway. As part of the configuration storage process, the binary stores parameters in encrypted or compressed form, allowing parameters to be decrypted only when the command-and-control infrastructure is established. A layered sequence is created by setting persistence mechanisms, dynamically loading APIs, and selectively activating operational capabilities, thus concealing the full range of functionality during preliminary inspection. These architectural decisions reinforce Remcos RAT's primary objective of providing sustained, covered access accompanied by comprehensive data theft. This malware offers capabilities such as credential harvesting, real-time surveillance, and structured data exfiltration, allowing operators to extract sensitive information as well as maintain interactive control over compromised systems.  Remcos' current form represents the next evolution of remote access malware—one where stealth, adaptability, and runtime obfuscation define the next phase in this evolving threat landscape. In addition to its layered execution chain, the malware performs a structured privilege assessment prior to initiating high-impact operations.  By granting elevated rights, it is able to modify registry keys, deploy persistence mechanisms in protected directories, and interfere with or disable local security protocols. In order to prevent multiple concurrent executions of Rmc-GSEGIF, a uniquely named mutex is instantiated, thus ensuring operational stability and reducing the possibility that anomalous behavior may reveal the infection.  Similarly, the command-and-control infrastructure is protected from direct examination. A malware binary does not contain a readable endpoint address, instead it stores an encrypted C2 address within the binary. As the string is reconstructed in memory during runtime, it can be utilized immediately to establish outbound communication via HTTP or raw TCP channels.  Through the application of transient reconstruction, static indicators are minimized and the window for intercepting configuration artifacts prior to network activity is narrowed. Following the completion of surveillance and exfiltration tasks, the malware moves to a cleaning phase intended to reduce the possibility of forensic reconstruction.  The keylogging outputs, screenshots, and audio recordings generated during the operation are systematically deleted, as well as cookies and registry entries associated with persistent access. To complete the self-erasure process, the malware drops a temporary script in the %TEMP% directory which is tasked with deleting remaining executable components before terminating the process.  As a result of this staged removal mechanism, the evidentiary trail is fragmented, further complicating the analysis after the incident. It is noted by Point Wild researchers that incrementally refined yet consistent refinements of these techniques reflect a sustained commitment to operational resilience and stealth.  As Remcos continues to evolve, they point out, Remcos reinforces its status as a flexible and enduring remote access trojan. A security team should intensify monitoring of anomalous outbound network connections and unauthorized registry modifications - indicators that may indicate the presence of run-time-obfuscated threats within enterprise environments.  Among the key elements of the malware’s defensive architecture is the deliberate elimination of plaintext indicators. In the binary, the command-and-control endpoint is not stored in readable form, making it difficult to extract static strings, detect antivirus infections using signatures, and harvest indicators easily. It is instead the C2 address (IP and port) that is encoded as an encrypted byte array during execution, which is subsequently reconstructed in memory by a byte-wise XOR operation before being sent to the networking layer for outbound communication. Further reducing static visibility, the malware dynamically loads WININET.dll at runtime in place of declaring imports beforehand, and uses the decrypted endpoint to communicate via HTTP or TCP.  By implementing a transient reconstruction model, critical infrastructure details are reconstructed in memory in an ephemeral manner. This design philosophy is also applied to its surveillance modules. Keyloggers online follow the same structural logic as offline predecessors, but they do not rely on disk persistence. Instead of writing intercepted keystrokes to local storage, they are packaged in structured payloads and sent directly through the established C2 channel, instead of writing them to local storage. User inputs are intercepted by input hooks, which are streamed to an attacker-controlled infrastructure in real time.  In addition to minimizing forensic artifacts on the victim's file system by bypassing local file creation, the malware offers operators continuous visibility into active sessions, including browser-based interactions and credentials entry fields. As part of modularization, webcam monitoring capabilities remain flexible and minimize the static footprint of the system.  Video capture logic is not embedded in the primary executable; rather, upon receiving a webcam-related command, it retrieves a dedicated Dynamic Link Library from the C2 server. After the module is delivered to memory or temporarily to disk, depending on configuration, the module is dynamically loaded with Windows API functions such as LoadLibrary, and specific exported routines are resolved with GetProcAddress.  A video capture device is initialized, frames are collected, compressed or encoded, and the resulting data is returned to the core process after encoding or compressing. By using the compartmentalized approach, the captured output can be transmitted in segmented form over the existing obfuscated communication channel while maintaining a static signature for the primary payload that does not have to be expanded.  As an example of additional extensibility, credential recovery plugins, including modules that expose functions such as FoxMailRecovery, that are loaded on demand in order to retrieve stored account information from targeted applications, exhibit additional extensibility. In order to execute and handle commands, a structured, text-based protocol is followed, encapsulating instructions and outputs within predefined string tokens prior to transmission.  As a result of invoking specific execution flags, such as /sext, the malware temporarily writes the output of a command to a randomly named file within the malware's working directory when it is invoked. By reading, exfiltrating, and deleting the contents, operational continuity and persistent traces can be maintained. In conjunction with these mechanisms, a coherent architectural strategy is demonstrated that emphasizes runtime decryption, modular capability loading, and artifact suppression.  By making sure sensitive configuration data, surveillance outputs, and auxiliary functionality are either memory-resident or transient, the new Remcos variant emphasizes the importance of security, adaptability, and sustained remote control in compromised Windows environments. These developments take together to illustrate an overall operational shift that cannot be ignored by defenders.  The Remcos variant exemplifies a class of threats designed to run primarily in memory, minimize static indicators, and adapt dynamically to host conditions as needed. The conventional signature-based controls and perimeter-focused monitoring will not be sufficient to provide sufficient protection against runtime-obfuscated activities on their own.  In addition to continuous monitoring of anomalous outbound traffic patterns, suspicious API resolutions in memory, unauthorized registry modifications, and irregular module loading events, security teams should prioritize behavioral detection strategies.  The ability to detect subtle persistence and data exfiltration attempts will be largely dependent on improving endpoint detection and response capabilities, enforcing least privilege access policies, and analyzing telemetry across network and host layers. In an increasingly modular and stealthy environment, proactive detection engineering and disciplined threat hunting will be vital to reducing dwell times and minimizing operational impact.