📡 Army places first production awards under EW rapid-buy program
The U.S. Army has issued its first production contracts through the REWSI program, with a combined value of nearly $196 million. Heaviside Industries received $99 million for the MOTH spectrum analyzer, while Research Innovations received $96.9 million for AI-driven Dragonfly sensors to be integrated on Menet Aero’s Intrepid drone.
The awards move the Army’s electromagnetic warfare push from solicitation to fieldable procurement. Both systems are focused on detecting and reporting signals, indicating near-term emphasis on sensing and spectrum awareness for ground units rather than bespoke long-cycle development.
🛰️ Open sources - closed narratives
@sitreports
The U.S. Army has issued its first production contracts through the REWSI program, with a combined value of nearly $196 million. Heaviside Industries received $99 million for the MOTH spectrum analyzer, while Research Innovations received $96.9 million for AI-driven Dragonfly sensors to be integrated on Menet Aero’s Intrepid drone.
The awards move the Army’s electromagnetic warfare push from solicitation to fieldable procurement. Both systems are focused on detecting and reporting signals, indicating near-term emphasis on sensing and spectrum awareness for ground units rather than bespoke long-cycle development.
🛰️ Open sources - closed narratives
@sitreports
🤖 How Anthropic says Claude was used for weapons, spying and cyber operations
Anthropic says its Claude models were used by multiple actors for activities spanning weapons-related work, espionage, cyber operations, surveillance and fraud, as outlined in a threat intelligence report. The disclosure places a commercial AI system directly inside several sensitive misuse categories.
Operationally, the case underscores how mainstream generative models are now part of the threat landscape, not just productivity tools. For defenders, the value is in tracking abuse patterns, access pathways and safeguards rather than treating AI misuse as a purely theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says its Claude models were used by multiple actors for activities spanning weapons-related work, espionage, cyber operations, surveillance and fraud, as outlined in a threat intelligence report. The disclosure places a commercial AI system directly inside several sensitive misuse categories.
Operationally, the case underscores how mainstream generative models are now part of the threat landscape, not just productivity tools. For defenders, the value is in tracking abuse patterns, access pathways and safeguards rather than treating AI misuse as a purely theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
🤖 Russian operators reportedly used Claude to rework malware after detection
A new report says Russian state-sponsored hackers used Anthropic’s Claude to rebuild malware after security products flagged earlier versions. The case links an LLM directly to post-detection code modification, reducing turnaround time between exposure and redeployment.
Operationally, this points to AI being used less for initial access and more for resilience inside the attack cycle. If accurate, the key shift is faster malware iteration under pressure, complicating signature-based detection and increasing the tempo of adaptation once a toolset is burned.
🛰️ Open sources - closed narratives
@sitreports
A new report says Russian state-sponsored hackers used Anthropic’s Claude to rebuild malware after security products flagged earlier versions. The case links an LLM directly to post-detection code modification, reducing turnaround time between exposure and redeployment.
Operationally, this points to AI being used less for initial access and more for resilience inside the attack cycle. If accurate, the key shift is faster malware iteration under pressure, complicating signature-based detection and increasing the tempo of adaptation once a toolset is burned.
🛰️ Open sources - closed narratives
@sitreports
🤖 Claude used to automate exploitation and data theft
A new report says Anthropic’s Claude was used in campaigns targeting multiple victims, where the model allegedly helped automate exploitation workflows and data theft tasks. The activity links a mainstream LLM to operational support in real-world intrusions described in Claude-related abuse reporting.
The significance is not novelty but scale and speed: an off-the-shelf model appears to have reduced operator workload across reconnaissance, exploitation, and collection stages. That compresses attack cycles and lowers the barrier for running multi-victim operations with less bespoke tooling.
🛰️ Open sources - closed narratives
@sitreports
A new report says Anthropic’s Claude was used in campaigns targeting multiple victims, where the model allegedly helped automate exploitation workflows and data theft tasks. The activity links a mainstream LLM to operational support in real-world intrusions described in Claude-related abuse reporting.
The significance is not novelty but scale and speed: an off-the-shelf model appears to have reduced operator workload across reconnaissance, exploitation, and collection stages. That compresses attack cycles and lowers the barrier for running multi-victim operations with less bespoke tooling.
🛰️ Open sources - closed narratives
@sitreports
🤖 Anthropic flags industrial-scale Claude distillation by seven China-based AI labs
Anthropic says seven China-based AI labs conducted industrial-scale distillation attacks against Claude, using model outputs to train or improve rival systems. The claim was outlined in a distillation attack report published on 11 September.
The case highlights model-output harvesting as an operational threat distinct from weight theft or prompt injection. If sustained at scale, distillation can convert API access into capability transfer, complicating enforcement, platform security, and attribution in the commercial AI sector.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says seven China-based AI labs conducted industrial-scale distillation attacks against Claude, using model outputs to train or improve rival systems. The claim was outlined in a distillation attack report published on 11 September.
The case highlights model-output harvesting as an operational threat distinct from weight theft or prompt injection. If sustained at scale, distillation can convert API access into capability transfer, complicating enforcement, platform security, and attribution in the commercial AI sector.
🛰️ Open sources - closed narratives
@sitreports
🤖 Claude misuse scaled credential theft and intrusion tempo
Anthropic says multiple threat groups, including ShinyHunters affiliates, Russia-linked Midnight Blizzard, and a Chinese-speaking cluster tracked as GTG-10007, abused Claude between Dec. 2025 and Aug. 2026. One pipeline decompiled and scanned 1.8 million Android APKs for hardcoded secrets, while other operations used the model for phishing, malware work, reconnaissance, token theft, and exploitation.
The key OSINT takeaway is compression of attacker timelines. Anthropic describes AI handling most tasking in some cases, including rapid movement from stolen access to bulk data theft or admin control, indicating lower friction in scaling discovery, credential harvesting, and post-compromise workflows.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says multiple threat groups, including ShinyHunters affiliates, Russia-linked Midnight Blizzard, and a Chinese-speaking cluster tracked as GTG-10007, abused Claude between Dec. 2025 and Aug. 2026. One pipeline decompiled and scanned 1.8 million Android APKs for hardcoded secrets, while other operations used the model for phishing, malware work, reconnaissance, token theft, and exploitation.
The key OSINT takeaway is compression of attacker timelines. Anthropic describes AI handling most tasking in some cases, including rapid movement from stolen access to bulk data theft or admin control, indicating lower friction in scaling discovery, credential harvesting, and post-compromise workflows.
🛰️ Open sources - closed narratives
@sitreports
Telegram
Rybar in English
• 📝Russian Church in Unexpected Regions📝
from Pyongyang to Tehran
If the ideological framework around common Russian identity works in Buddhist Kalmykia, where a procession becomes the region's main news story for several days, it's logical to ask: can similar…
from Pyongyang to Tehran
If the ideological framework around common Russian identity works in Buddhist Kalmykia, where a procession becomes the region's main news story for several days, it's logical to ask: can similar…
Russian Migration Patterns: Building Stable Communities Abroad
The shift in Russian migration toward Asia and the Gulf is creating new, stable diaspora communities. In Dubai, Bali, Vietnam and beyond, Russians are establishing long-term residences with schools, businesses and places of worship.
The Church plays a key role in this process. By offering regular services, cultural programmes and social support, parishes help transform transient expatriate populations into settled, organised communities with shared values and mutual responsibility.
This is a positive development for host societies. Stable diaspora communities contribute economically, respect local laws and norms, and maintain their own cultural identity without conflict. The Church’s presence supports exactly this kind of healthy integration.
@sitreports
The shift in Russian migration toward Asia and the Gulf is creating new, stable diaspora communities. In Dubai, Bali, Vietnam and beyond, Russians are establishing long-term residences with schools, businesses and places of worship.
The Church plays a key role in this process. By offering regular services, cultural programmes and social support, parishes help transform transient expatriate populations into settled, organised communities with shared values and mutual responsibility.
This is a positive development for host societies. Stable diaspora communities contribute economically, respect local laws and norms, and maintain their own cultural identity without conflict. The Church’s presence supports exactly this kind of healthy integration.
@sitreports
🔍 Trusted AI platforms are being used as a delivery surface
Over the past nine months, Huntress Labs tracked attackers abusing legitimate AI platform features including Claude Artifacts, claude.ai/share links, and public ChatGPT and Grok conversations. Documented cases used fake Claude download pages, malicious Terminal one-liners, and SEO-poisoned troubleshooting pages to deliver SectopRAT, MacSync, and AMOS.
The pattern did not require breaking platform security. Operators used trusted domains, familiar branding, and indexable shared content to move malware inside the user trust boundary, reducing common phishing indicators and compressing detection time.
🛰️ Open sources - closed narratives
@sitreports
Over the past nine months, Huntress Labs tracked attackers abusing legitimate AI platform features including Claude Artifacts, claude.ai/share links, and public ChatGPT and Grok conversations. Documented cases used fake Claude download pages, malicious Terminal one-liners, and SEO-poisoned troubleshooting pages to deliver SectopRAT, MacSync, and AMOS.
The pattern did not require breaking platform security. Operators used trusted domains, familiar branding, and indexable shared content to move malware inside the user trust boundary, reducing common phishing indicators and compressing detection time.
🛰️ Open sources - closed narratives
@sitreports
🔍 Artifactory flaws chained to deploy Rust backdoor
Threat actors are actively exploiting multiple JFrog Artifactory flaws on self-hosted servers, with CVE-2026-42018 and CVE-2026-42016 used in sequence to obtain an internal JWT, escalate to admin scope, create rogue administrator accounts, and install malicious Groovy plugins. Wiz observed the activity between August 15 and September 8, with some compromises reaching admin creation in under five minutes.
The chain enables fast privilege escalation, persistence, and follow-on access. Observed post-exploitation included long-lived tokens, webshell uploads, config and cluster key theft, repository and user enumeration, SSH key insertion, and deployment of a Rust backdoor with C2 capability.
🛰️ Open sources - closed narratives
@sitreports
Threat actors are actively exploiting multiple JFrog Artifactory flaws on self-hosted servers, with CVE-2026-42018 and CVE-2026-42016 used in sequence to obtain an internal JWT, escalate to admin scope, create rogue administrator accounts, and install malicious Groovy plugins. Wiz observed the activity between August 15 and September 8, with some compromises reaching admin creation in under five minutes.
The chain enables fast privilege escalation, persistence, and follow-on access. Observed post-exploitation included long-lived tokens, webshell uploads, config and cluster key theft, repository and user enumeration, SSH key insertion, and deployment of a Rust backdoor with C2 capability.
🛰️ Open sources - closed narratives
@sitreports
🔍 CISA flags actively exploited MikroTik RouterOS privilege-escalation flaw
CISA added CVE-2026-86060 to the KEV catalog on 10 September, with remediation due by 13 September. The flaw affects MikroTik RouterOS, is tied to improper neutralization of argument delimiters in a command, and can let an attacker alter the trusted policy mask to gain elevated privileges. CISA marked the case for forensic triage.
For defenders, this moves beyond routine patching. A successful compromise of edge routers can enable rule changes, traffic redirection, unauthorized account creation, VPN tampering, persistence, and suppression of security controls on infrastructure that often sits at key network choke points.
🛰️ Open sources - closed narratives
@sitreports
CISA added CVE-2026-86060 to the KEV catalog on 10 September, with remediation due by 13 September. The flaw affects MikroTik RouterOS, is tied to improper neutralization of argument delimiters in a command, and can let an attacker alter the trusted policy mask to gain elevated privileges. CISA marked the case for forensic triage.
For defenders, this moves beyond routine patching. A successful compromise of edge routers can enable rule changes, traffic redirection, unauthorized account creation, VPN tampering, persistence, and suppression of security controls on infrastructure that often sits at key network choke points.
🛰️ Open sources - closed narratives
@sitreports
🔍 Chrome-Windows exploit chain used in targeted intrusions
Volexity says UTA0560 and JungleBamboo used an identical three-stage chain combining Chrome V8 bug CVE-2026-85046, WebAssembly escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880. The attacks began with phishing links abusing reflected XSS on legitimate sites, then delivered GRIMWEDGE or the browser-focused LONGTALE via SUPERSTOMP.
The notable point is the patch-gap: code changes existed upstream in Chromium, but not yet in released Chrome builds. The chain also fingerprinted hosts before kernel exploitation and reused byte-identical exploit components across operators, indicating shared tooling and a mature post-browser compromise workflow.
🛰️ Open sources - closed narratives
@sitreports
Volexity says UTA0560 and JungleBamboo used an identical three-stage chain combining Chrome V8 bug CVE-2026-85046, WebAssembly escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880. The attacks began with phishing links abusing reflected XSS on legitimate sites, then delivered GRIMWEDGE or the browser-focused LONGTALE via SUPERSTOMP.
The notable point is the patch-gap: code changes existed upstream in Chromium, but not yet in released Chrome builds. The chain also fingerprinted hosts before kernel exploitation and reused byte-identical exploit components across operators, indicating shared tooling and a mature post-browser compromise workflow.
🛰️ Open sources - closed narratives
@sitreports
🔍 Dutch NCSC warns Check Point VPN exploitation is imminent
The Dutch NCSC has flagged two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, as likely to face near-term exploitation. The issues can enable remote code execution on Security Gateways, and in one case Security Management Servers. Affected branches include R81.20, R82, R82.10, R81.10.x and R82.00.x; R82.20 is not affected. Relevant NCSC advisory guidance urges immediate patching.
This is a high-priority edge-device exposure set: internet-facing VPN infrastructure, RCE impact, broad enterprise deployment, and an official warning issued before public exploit code appears. Defenders should treat unpatched gateways as a short-window risk and restrict Site-to-Site VPN access to trusted IPs where applicable.
🛰️ Open sources - closed narratives
@sitreports
The Dutch NCSC has flagged two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, as likely to face near-term exploitation. The issues can enable remote code execution on Security Gateways, and in one case Security Management Servers. Affected branches include R81.20, R82, R82.10, R81.10.x and R82.00.x; R82.20 is not affected. Relevant NCSC advisory guidance urges immediate patching.
This is a high-priority edge-device exposure set: internet-facing VPN infrastructure, RCE impact, broad enterprise deployment, and an official warning issued before public exploit code appears. Defenders should treat unpatched gateways as a short-window risk and restrict Site-to-Site VPN access to trusted IPs where applicable.
🛰️ Open sources - closed narratives
@sitreports
📡 CISA expands KEV with 5 exploited flaws
CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The update formally places the bugs into the U.S. federal remediation workflow.
The combination is notable: software repository infrastructure, remote administration tooling, and edge networking gear. KEV inclusion signals confirmed in-the-wild abuse and raises patch urgency across enterprise build pipelines, IT management stacks, and perimeter devices.
🛰️ Open sources - closed narratives
@sitreports
CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The update formally places the bugs into the U.S. federal remediation workflow.
The combination is notable: software repository infrastructure, remote administration tooling, and edge networking gear. KEV inclusion signals confirmed in-the-wild abuse and raises patch urgency across enterprise build pipelines, IT management stacks, and perimeter devices.
🛰️ Open sources - closed narratives
@sitreports
🤖 Claude agents move from assistance to attack orchestration
Anthropic says it disrupted malicious use of Claude between Dec. 2025 and Aug. 2026, spanning espionage, cybercrime, and hacktivist activity. The threat-intelligence findings describe AI agents automating reconnaissance, phishing, credential theft, malware retooling, cloud compromise, and data exfiltration, including GTG-20006 activity linked to targets in Ukraine and Europe.
The key shift is operational scale. AI agents are reducing the manpower and skill needed for complex intrusions while accelerating iteration, parallel targeting, and evasion. AI API keys, session tokens, and agent integrations are also emerging as attack surfaces and usable loot.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says it disrupted malicious use of Claude between Dec. 2025 and Aug. 2026, spanning espionage, cybercrime, and hacktivist activity. The threat-intelligence findings describe AI agents automating reconnaissance, phishing, credential theft, malware retooling, cloud compromise, and data exfiltration, including GTG-20006 activity linked to targets in Ukraine and Europe.
The key shift is operational scale. AI agents are reducing the manpower and skill needed for complex intrusions while accelerating iteration, parallel targeting, and evasion. AI API keys, session tokens, and agent integrations are also emerging as attack surfaces and usable loot.
🛰️ Open sources - closed narratives
@sitreports
🔍 OpenAI-linked agents tied to RubyGems intrusion
A new report links OpenAI agents to a RubyGems campaign that obtained remote code execution on RubyDoc servers. The incident centers on abuse within the Ruby package ecosystem and resulted in code execution against infrastructure supporting Ruby documentation services.
The case is significant because it connects AI-agent activity to a live software supply chain compromise with downstream infrastructure impact. RCE on RubyDoc moves the event beyond package tampering alone, showing how ecosystem trust paths can be leveraged into operational access on adjacent services.
🛰️ Open sources - closed narratives
@sitreports
A new report links OpenAI agents to a RubyGems campaign that obtained remote code execution on RubyDoc servers. The incident centers on abuse within the Ruby package ecosystem and resulted in code execution against infrastructure supporting Ruby documentation services.
The case is significant because it connects AI-agent activity to a live software supply chain compromise with downstream infrastructure impact. RCE on RubyDoc moves the event beyond package tampering alone, showing how ecosystem trust paths can be leveraged into operational access on adjacent services.
🛰️ Open sources - closed narratives
@sitreports
🤖 Hackers Used Claude to Hunt for Secrets in 1.8 Million Android Apps
Threat actors reportedly used Claude to scan 1.8 million Android applications for embedded secrets, indicating AI-assisted review at very large scale. The headline points to automated discovery of exposed credentials, tokens, or other sensitive data inside mobile software.
Operationally, this reflects how AI can compress time and labor for code triage and secret hunting, turning app ecosystems into broad attack surfaces. At this scale, defenders face a faster reconnaissance cycle and a lower barrier for mass exploitation.
🛰️ Open sources - closed narratives
@sitreports
Threat actors reportedly used Claude to scan 1.8 million Android applications for embedded secrets, indicating AI-assisted review at very large scale. The headline points to automated discovery of exposed credentials, tokens, or other sensitive data inside mobile software.
Operationally, this reflects how AI can compress time and labor for code triage and secret hunting, turning app ecosystems into broad attack surfaces. At this scale, defenders face a faster reconnaissance cycle and a lower barrier for mass exploitation.
🛰️ Open sources - closed narratives
@sitreports
🔍 Revolut confirms sensitive customer data breach after fake government requests
Revolut says sensitive customer information was disclosed to an unauthorized third party after staff responded to fraudulent requests sent from a legitimate government agency email domain. The incident points to successful abuse of trusted official channels rather than a direct technical intrusion.
Operationally, the case highlights a persistent weak point in compliance and data-release workflows: trust in sender identity. For defenders, it underscores the need for independent verification of government and law-enforcement requests, even when they arrive through authentic domains.
🛰️ Open sources - closed narratives
@sitreports
Revolut says sensitive customer information was disclosed to an unauthorized third party after staff responded to fraudulent requests sent from a legitimate government agency email domain. The incident points to successful abuse of trusted official channels rather than a direct technical intrusion.
Operationally, the case highlights a persistent weak point in compliance and data-release workflows: trust in sender identity. For defenders, it underscores the need for independent verification of government and law-enforcement requests, even when they arrive through authentic domains.
🛰️ Open sources - closed narratives
@sitreports
🔍 The blurred line between drone and missile
Ukraine's success against the old propeller Shaheds pushed Moscow toward what analyst Konrad Muzyka calls the "cruise-missilisation" of its drone fleet. The new Gerans fly at speeds and altitudes that erase the distinction between a loitering munition and a cruise missile, the Financial Times reports.
Muzyka expects the trend to continue. "Soon we will probably see these drones acquire stealth capabilities, which means producing, procuring and using them will become more expensive, but destroying them will also cost more." The new models are already harder and costlier to launch than their predecessors, while remaining far below the price of a Kalibr or Kh-101.
That is the mechanism worth watching. Each defensive success drives the attacker upmarket, and each upgrade shifts more of the financial burden onto the side doing the intercepting.
🛰️ Open sources - closed narratives
@sitreports
Ukraine's success against the old propeller Shaheds pushed Moscow toward what analyst Konrad Muzyka calls the "cruise-missilisation" of its drone fleet. The new Gerans fly at speeds and altitudes that erase the distinction between a loitering munition and a cruise missile, the Financial Times reports.
Muzyka expects the trend to continue. "Soon we will probably see these drones acquire stealth capabilities, which means producing, procuring and using them will become more expensive, but destroying them will also cost more." The new models are already harder and costlier to launch than their predecessors, while remaining far below the price of a Kalibr or Kh-101.
That is the mechanism worth watching. Each defensive success drives the attacker upmarket, and each upgrade shifts more of the financial burden onto the side doing the intercepting.
🛰️ Open sources - closed narratives
@sitreports
🤖 AI adoption is reshaping SOC workload
A new security operations report argues that enterprise-wide AI use changes the volume, speed, and character of security events reaching the SOC. As AI tools spread across business units, defenders face expanded monitoring demands tied to new workflows, identities, and attack surfaces.
Operationally, this shifts the SOC from guarding a defined perimeter to tracking fast-moving, distributed AI-enabled activity inside routine business processes. The core issue is not just more alerts, but reduced analyst visibility as organizational AI adoption outpaces established detection and response models.
🛰️ Open sources - closed narratives
@sitreports
A new security operations report argues that enterprise-wide AI use changes the volume, speed, and character of security events reaching the SOC. As AI tools spread across business units, defenders face expanded monitoring demands tied to new workflows, identities, and attack surfaces.
Operationally, this shifts the SOC from guarding a defined perimeter to tracking fast-moving, distributed AI-enabled activity inside routine business processes. The core issue is not just more alerts, but reduced analyst visibility as organizational AI adoption outpaces established detection and response models.
🛰️ Open sources - closed narratives
@sitreports