Open Source Intel
Iranian Parliament Speaker Ghalibaf.
“Time is running out⏳” https://twitter.com/Osint613/status/2042331928913719633/photo/1
tweet
Iranian Parliament Speaker Ghalibaf.
“Time is running out⏳” https://twitter.com/Osint613/status/2042331928913719633/photo/1
tweet
This media is not supported in your browser
VIEW IN TELEGRAM
Open Source Intel
Levin on ceasefire: "I wouldn't have done it but he's done it and he's smarter than I am… This government has to go."
MacCallum adds: "It’s pretty clear the same guys are in charge. We have not had a regime change." https://twitter.com/Osint613/status/2042331954394108061/video/1
tweet
Levin on ceasefire: "I wouldn't have done it but he's done it and he's smarter than I am… This government has to go."
MacCallum adds: "It’s pretty clear the same guys are in charge. We have not had a regime change." https://twitter.com/Osint613/status/2042331954394108061/video/1
tweet
Open Source Intel
NOW 🔴
Long range fire from Hezbollah towards Haifa, Israel https://twitter.com/Osint613/status/2042332335572394419/photo/1
tweet
NOW 🔴
Long range fire from Hezbollah towards Haifa, Israel https://twitter.com/Osint613/status/2042332335572394419/photo/1
tweet
WarMonitor
We’re about to weaken Europe’s security just to satisfy one man’s ego.
tweet
We’re about to weaken Europe’s security just to satisfy one man’s ego.
White House official: Trump is considering withdrawing some US troops from Europe - @SkyNewsArabia_B tweet
X (formerly Twitter)
Wladimir van Wilgenburg (@vvanwilgenburg) on X
White House official: Trump is considering withdrawing some US troops from Europe - @SkyNewsArabia_B
This media is not supported in your browser
VIEW IN TELEGRAM
Status-6 (War & Military News)
Ukrainian drones are attacking targets in the area of Russia-occupied town of Perevalsk located in Luhansk Oblast, eastern Ukraine.
Multiple explosions reported by the locals. https://twitter.com/Archer83Able/status/2042333428951978174/video/1
tweet
Ukrainian drones are attacking targets in the area of Russia-occupied town of Perevalsk located in Luhansk Oblast, eastern Ukraine.
Multiple explosions reported by the locals. https://twitter.com/Archer83Able/status/2042333428951978174/video/1
tweet
Open Source Intel
An Israeli Air Force F-15I departed for strikes in Lebanon yesterday armed with a full load of 7 GBU-31 JDAM 2,000 pound precision bombs. https://twitter.com/Osint613/status/2042333877562151357/photo/1
tweet
An Israeli Air Force F-15I departed for strikes in Lebanon yesterday armed with a full load of 7 GBU-31 JDAM 2,000 pound precision bombs. https://twitter.com/Osint613/status/2042333877562151357/photo/1
tweet
The Spectator Index
BREAKING: Iran’s new Supreme Leader Mojtaba Khamenei says in written message said that his country 'did not seek war and we do not want it' but that 'we will not renounce our legitimate rights under any circumstances, and in this respect, we consider the entire resistance front as a whole'.
tweet
BREAKING: Iran’s new Supreme Leader Mojtaba Khamenei says in written message said that his country 'did not seek war and we do not want it' but that 'we will not renounce our legitimate rights under any circumstances, and in this respect, we consider the entire resistance front as a whole'.
tweet
Nuno Felix
These are important steps. Implement them.
tweet
These are important steps. Implement them.
🚨 BREAKING: The FBI has successfully extracted deleted Signal messages from a suspect's iPhone via notification storage, the place where all your notifications are stored for up to one month.
Notification storage stores data from all messaging apps, it's a big flaw in iOS. But there's a way to turn it off... tweet
X (formerly Twitter)
International Cyber Digest (@IntCyberDigest) on X
🚨 BREAKING: The FBI has successfully extracted deleted Signal messages from a suspect's iPhone via notification storage, the place where all your notifications are stored for up to one month.
Notification storage stores data from all messaging apps, it's…
Notification storage stores data from all messaging apps, it's…
Media is too big
VIEW IN TELEGRAM
Open Source Intel
Hezbollah says it launched a missile at the Israeli city of Karmiel, apparently using an Iranian‑made Fath‑360 tactical short‑range ballistic missile. https://twitter.com/Osint613/status/2042335533687329168/video/1
tweet
Hezbollah says it launched a missile at the Israeli city of Karmiel, apparently using an Iranian‑made Fath‑360 tactical short‑range ballistic missile. https://twitter.com/Osint613/status/2042335533687329168/video/1
tweet
Nuno Felix
RT @alexplitsas: Update: I have spoken to Shelly. She is recovering and being treated for some injuries. That is the reason she has not answered if you’ve tried to be in touch. She will speak when she is ready and asks for privacy in the interim
She lost everything
Help: https://www.gofundme.com/f/support-a-journalist-in-a-world-that-needs-us-on-the-ground
tweet
RT @alexplitsas: Update: I have spoken to Shelly. She is recovering and being treated for some injuries. That is the reason she has not answered if you’ve tried to be in touch. She will speak when she is ready and asks for privacy in the interim
She lost everything
Help: https://www.gofundme.com/f/support-a-journalist-in-a-world-that-needs-us-on-the-ground
tweet
OSINT
Photo
Nuno Felix
RT @FBILosAngeles: Russian General Staff Main Intelligence Directorate (GRU) cyber actors are exploiting vulnerable routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information. The U.S. Department of Justice and the FBI recently disrupted a GRU network of compromised small-office home-office (SOHO) routers used to facilitate malicious DNS hijacking operations. The FBI and the following partners are releasing this announcement to warn the public and encourage network defenders and device owners to take actions to remediate and reduce the attack surface of similar edge devices: U.S. National Security Agency (NSA) and international partners from Canada, Czech Republic, Denmark, Estonia, Finland, Germany, Italy, Latvia, Lithuania, Norway, Poland, Portugal, Romania, Slovakia, and Ukraine.
Understanding the DNS Hijacking Operations
Since at least 2024, Russian GRU 85th Main Special Service Center (85th GTsSS) cyber actors — also known as APT28, Fancy Bear, and Forest Blizzard — have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224. The GRU actors changed the devices' dynamic host configuration protocol (DHCP) / domain name system (DNS) settings to introduce actor-controlled DNS resolvers. Connected devices, including laptops and phones, inherit these modified settings. The actor-controlled infrastructure resolves and captures lookups for all domain names. The GRU provides fraudulent DNS answers for specific domains and services — including Microsoft Outlook Web Access — enabling adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning. These AitM attacks would allow the actors to see the traffic unencrypted.
The GRU has harvested passwords, authentication tokens, and sensitive information including emails and web browsing information normally protected by secure socket layer (SSL) and transport layer security (TLS) encryption. The GRU has indiscriminately compromised a wide pool of U.S. and global victims and then filtered down impacted users, especially targeting information related to military, government, and critical infrastructure.
Tips to Protect Yourself
The FBI and partners have released relevant guidance and technical indicators, including NCSC-UK cybersecurity advisory "APT28 exploit routers to enable DNS hijacking operations" on 7 April 2026 and CISA's Edge Device Security webpage.
Users of SOHO routers are encouraged to upgrade end-of-support devices, update to latest firmware versions, change default usernames and passwords, and disable remote management interfaces from the Internet. All users should carefully consider certificate warnings in web browsers and email clients.
Organizations that allow remote work should review relevant policies regarding how employees access sensitive data, such as using VPNs and hardened application configurations. Additionally, organizations may consider incentivizing employees to upgrade outdated personal devices involved in remote access.
Report It
If you suspect you have been targeted or compromised by a Russian GRU cyber intrusion, report the activity to your local FBI field office or file a complaint with the IC3. Be sure to provide details about your router, including device type and DHCP configurations.
Visit http://IC3.gov for additional details.
tweet
RT @FBILosAngeles: Russian General Staff Main Intelligence Directorate (GRU) cyber actors are exploiting vulnerable routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information. The U.S. Department of Justice and the FBI recently disrupted a GRU network of compromised small-office home-office (SOHO) routers used to facilitate malicious DNS hijacking operations. The FBI and the following partners are releasing this announcement to warn the public and encourage network defenders and device owners to take actions to remediate and reduce the attack surface of similar edge devices: U.S. National Security Agency (NSA) and international partners from Canada, Czech Republic, Denmark, Estonia, Finland, Germany, Italy, Latvia, Lithuania, Norway, Poland, Portugal, Romania, Slovakia, and Ukraine.
Understanding the DNS Hijacking Operations
Since at least 2024, Russian GRU 85th Main Special Service Center (85th GTsSS) cyber actors — also known as APT28, Fancy Bear, and Forest Blizzard — have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224. The GRU actors changed the devices' dynamic host configuration protocol (DHCP) / domain name system (DNS) settings to introduce actor-controlled DNS resolvers. Connected devices, including laptops and phones, inherit these modified settings. The actor-controlled infrastructure resolves and captures lookups for all domain names. The GRU provides fraudulent DNS answers for specific domains and services — including Microsoft Outlook Web Access — enabling adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning. These AitM attacks would allow the actors to see the traffic unencrypted.
The GRU has harvested passwords, authentication tokens, and sensitive information including emails and web browsing information normally protected by secure socket layer (SSL) and transport layer security (TLS) encryption. The GRU has indiscriminately compromised a wide pool of U.S. and global victims and then filtered down impacted users, especially targeting information related to military, government, and critical infrastructure.
Tips to Protect Yourself
The FBI and partners have released relevant guidance and technical indicators, including NCSC-UK cybersecurity advisory "APT28 exploit routers to enable DNS hijacking operations" on 7 April 2026 and CISA's Edge Device Security webpage.
Users of SOHO routers are encouraged to upgrade end-of-support devices, update to latest firmware versions, change default usernames and passwords, and disable remote management interfaces from the Internet. All users should carefully consider certificate warnings in web browsers and email clients.
Organizations that allow remote work should review relevant policies regarding how employees access sensitive data, such as using VPNs and hardened application configurations. Additionally, organizations may consider incentivizing employees to upgrade outdated personal devices involved in remote access.
Report It
If you suspect you have been targeted or compromised by a Russian GRU cyber intrusion, report the activity to your local FBI field office or file a complaint with the IC3. Be sure to provide details about your router, including device type and DHCP configurations.
Visit http://IC3.gov for additional details.
tweet
😱1
This media is not supported in your browser
VIEW IN TELEGRAM
WarTranslated
In Kazan, Republic of Tatarstan RF, sirens are wailing - locals are in shock that their "Special Military Operation" has reached so far. https://twitter.com/wartranslated/status/2042337307261304850/video/1
tweet
In Kazan, Republic of Tatarstan RF, sirens are wailing - locals are in shock that their "Special Military Operation" has reached so far. https://twitter.com/wartranslated/status/2042337307261304850/video/1
tweet
🤣1
Open Source Intel
The IDF says Hezbollah launched a limited salvo of rockets from Lebanon toward the Haifa area.
Some were intercepted, while others were permitted to land in open terrain.
No injuries have been reported.
tweet
The IDF says Hezbollah launched a limited salvo of rockets from Lebanon toward the Haifa area.
Some were intercepted, while others were permitted to land in open terrain.
No injuries have been reported.
NOW 🔴
Long range fire from Hezbollah towards Haifa, Israel https://twitter.com/Osint613/status/2042332335572394419/photo/1 tweet
The Spectator Index
Netanyahu says, 'There is no ceasefire in Lebanon. We are continuing to strike Hezbollah with force, and we will not stop until we restore your security'. https://twitter.com/spectatorindex/status/2042337509712203833/photo/1
tweet
Netanyahu says, 'There is no ceasefire in Lebanon. We are continuing to strike Hezbollah with force, and we will not stop until we restore your security'. https://twitter.com/spectatorindex/status/2042337509712203833/photo/1
tweet
Open Source Intel
Khamenei Jr:
“All must know that, by Almighty God’s will, we definitely won’t allow the criminal aggressors who attacked our country to go unpunished.” https://twitter.com/Osint613/status/2042337816558850317/photo/1
tweet
Khamenei Jr:
“All must know that, by Almighty God’s will, we definitely won’t allow the criminal aggressors who attacked our country to go unpunished.” https://twitter.com/Osint613/status/2042337816558850317/photo/1
tweet
WarMonitor
"Quick, take cover in the ballroom!"
tweet
"Quick, take cover in the ballroom!"
The White House is urging a federal appeals court to allow construction to continue on President Trump's $400 million ballroom, arguing it will help provide protection both for the president's family and the country as a whole. https://www.nbcnews.com/politics/white-house/trump-ballroom-national-security-necessity-vital-first-family-safety-rcna267482?cid=sm_npd_nn_tw_ma&taid=69d80540b797b600012722e4&utm_campaign=trueanthem&utm_medium=social&utm_source=twitter tweet