Category: Uncategorized

On Nov. 19, 2025, members of Break the Bonds NC, a coalition of Palestine Solidarity organizations, spoke at a North Carolina Investment Authority board meeting to demand the state pension fund divest from all Israeli government bonds. Immediately after the meeting, the state treasurer’s office emailed a link of the pension’s holdings to Ari Rosenberg, a lead Break the Bonds NC organizer. The $6.7 million in Israeli bonds that had been there in June were no longer in the portfolio.

Rosenberg was in disbelief that only five months since the campaign’s launch, the state had already completely divested. But after receiving another email from the treasury confirming that the state pension fund no longer held any Israeli bonds, her disbelief gave way to elation. “I cried really hard,” Rosenberg said. “And then I recorded a message to my comrades being like, ‘You won’t believe this.’”

She wasn’t alone. A few weeks prior, organizers in Minnesota and Michigan received the same good news: that state investment bodies had divested from or declined to reinvest in Israeli bonds. In total, the three states dropped approximately $27 million in bonds.

But Israeli bonds remain a contentious issue in many parts of the country, including New York City, where organizers are pressuring comptroller Mark Levine not to reinvest after former comptroller Brad Lander divested in 2023. Mayor Zohran Mamdani opposes reinvestment, setting the stage for a potential showdown.

While the North Carolina campaign targeted sovereign debt bonds, which are issued directly by the Israeli government, organizers in New York, Michigan and Minnesota targeted another financial instrument, known as “Israel Bonds.”

This investment vehicle originated in the aftermath of the 1948 Nakba, Arabic for “catastrophe,” when Israel was founded on the rubble of ethnically cleansed Palestinian villages. During a time of economic insecurity, Israel’s first prime minister, David Ben-Gurion, conceived of a financial instrument designed specifically for American Jews to materially support Zionism.

Militarized occupation and genocide are expensive: The Israeli Defense Forces have spent $60 billion on military operations since Oct. 7, 2023. To foot the bill, the Development Corporation for Israel, or DCI, a de facto wing of the state that brokers Israel Bond sales, sold more than $1 billion in bonds during the 30 days following Oct. 7. Sales totaled a record $5.7 billion by October 2025, and just last month, Palm Beach County purchased another $350 million in DCI Bonds, boosting its Israel Bonds portfolio to $1 billion. Additionally, between October 2023 and January 2025, the Israeli Ministry of Finance raised $19.4 billion for its war chest through sovereign debt bonds — the financial instrument that the North Carolina State Treasurer divested from.

Israel Bonds “offer a slush fund that insulates the Israeli military and government from the logical, legal and righteous nonviolent economic pressure that institutions can act on to abide by international law,” said Dani Noble, national campaigns manager of Jewish Voice for Peace, or JVP.

The DCI website describes Israel Bonds as “an invaluable and strategic national resource, especially since bonds clients have proven time and again that when Israel is in the midst of a crisis, they do not walk away.” However, at least in some parts of the U.S., that seems to be changing.

Israeli bonds — both DCI and sovereign debt — have become a primary target for organizers seeking an end to local complicity in the Gaza genocide. According to Noble, there are at least 14 different divestment campaigns focused on Israeli bonds around the country, 13 of which started after Oct. 7, 2023. Public opinion is with them: An October 2025 IMEU Policy Project poll found that 76 percent of Democrats support a ban on purchasing Israel bonds.

While they differed in their organizing arena and the type of bonds targeted, the Michigan, Minnesota and North Carolina divestment campaigns shared some common features.

Finding the Money

Before these campaigns launched publicly, divestment organizers developed research strategies that included public records requests and conversations with government officials. This research helped them hone in on specific targets.

Break the Bonds North Carolina — a coalition consisting of Muslims for Social Justice, Palestinian Youth Movement-North Carolina, Durham Educators for Abolition and Liberation, and two local chapters of JVP — formed in February 2024 on the heels of a series of municipal ceasefire resolution wins. Organizers initially conceived of municipal-level campaigns in order to maximize pressure on elected officials. But when they researched state investment laws, they learned that municipalities do not manage their own investments; instead, the State Treasurer manages them. Despite their eagerness to focus locally, Rosenberg said this research revealed they “had to do a statewide campaign, and so we switched to the state pension plan.”

In Michigan, Matt Clark, a labor lawyer and longtime organizer in the Palestine solidarity movement, led the charge on researching Israeli bond holdings, starting in July 2024. He built rapport with a Michigan Treasury Department public relations liaison by presenting himself as a citizen curious about the state pension fund’s international bond holdings. “I didn’t say anything about why I wanted it; I didn’t say anything about Israel Bonds,” Clark said. “I just asked for any information on international bonds.” The treasury department offered to send the entire 90-page pension fund portfolio. Upon digging through it, Clark found Israel Bonds.

The portfolio revealed that the pensions of 550,000 former and current state employees were invested in a $10 million DCI Bond, purchased November 2023 and expiring November 2025. Subsequent FOIA requests showed that the Michigan treasury had invested in Israel Bonds for 30 years.

After receiving this information, Clark began talking with people across Michigan about a potential divestment campaign. He found it difficult to explain the abstruse nature of the Michigan retirement system and of Israel Bonds. “It’s hard to get people’s attention, especially when you’re trying to get your own head around it, but I knew that if I got into this it would become my life,” Clark said.

Eventually he connected with a group called Lansing for Palestine, based in Clark’s hometown. “I showed up to their meeting and didn’t know a single person,” Clark said. “I pitched them on an Israel Bonds campaign and was pleasantly surprised at how enthusiastic they were. And things really went from there. I was lucky enough to find people who were willing to also make this their life for a while.”

Michigan Divest launched in October 2024 with a clear one-year timeline and a simple demand for the Michigan treasury: not to reinvest in Israel Bonds when they expired in November 2025. “It was pretty ambitious; you have to be kind of half out of your mind to think that you can even do this,” Clark said.

While these state-level campaigns were forming, a behind-the-scenes national network of Israeli bonds divestment organizers had coalesced to deepen each other’s research capabilities and share strategy tips, facilitated by JVP, the U.S. Campaign for Palestinian Rights, the American Federation of State, County and Municipal Employees, and the Internationalist Law Center.

Matt Clark credits this network with helping Michigan organizers understand the different types of Israeli bonds, which was crucial to building a statewide strategy. “The technical knowledge about Israel Bonds was really essential,” Clark said. He learned that DCI Bonds are “illiquid,” meaning they are exceedingly difficult to trade before the bond’s maturity date — in this case, November 2025. Organizers knew they had a firm deadline to pile on the political pressure.

Unlike the one-year campaign in Michigan, Minnesotans have been organizing for Israeli bonds divestment for almost two decades. Inspired by the launch of the BDS movement by Palestine civil society groups in 2005, an autonomous group of organizers in Minnesota got to work looking for a suitable target. Through public records requests, they found out that the Minnesota State Board of Investment, or SBI, which manages the state’s three largest public pension funds, held both types of Israeli bonds. A divestment campaign called Minnesota Break the Bonds launched in 2008.

Building the Base

For all three campaigns, signaling sweeping support for divestment was essential. Organizations in the Minnesota-Palestine solidarity ecosystem spent decades building a base of opposition to the state’s Israel holdings, including hosting teach-ins about the SBI.

Break the Bonds NC assembled a statewide coalition in just under one year. At events ranging from political rallies to farmer’s markets, they gathered 4,600 signatures for a petition to State Treasurer Bradford Briner demanding state divestment from Israeli government bonds. They also received 41 organizational endorsements, including from UE Local 150, a public service workers union representing thousands of pension holders.

Labor played an important role in Michigan as well. Michigan Divest was endorsed by multiple local labor unions, including AFT 681 (Dearborn Federation of Teachers), AFT Local 2000 (Wayne County Community College Federation of Teachers), AFT Local 4751 (Lansing Community College Administrative Association) and UAW Local 6000 Region 1A Retirees Subchapter, which all represent state pensioners.

Clark also spoke about Israel Bonds at a Metro Detroit DSA meeting, where he collected signatures for a petition calling on the Michigan treasury to allow the DCI Bonds to mature without reinvesting. Michigan Divest flyered at multiple No Kings rallies across the state in October and collected signatures at a 2025 Pride event in Ferndale. Overwhelmingly, the campaign received positive responses from the public.

“We felt like we really tapped into something, because people are watching this horrible thing happen on their cell phones and wondering, ‘What the hell can I even do?’” Clark said. “I feel like we were able to answer that question.”

Inside-Outside Strategies Take Shape

All three campaigns pursued some combination of an inside-outside strategy. Michigan Divest emphasized “building a warm working relationship with key decision makers,” said campaign organizer Anna Martinez-Hume. The organizers’ warmth paid off, she said, and “they wanted to meet with us again and again. We had a laundry list of key questions, and worked with our coalition in strategizing meetings about what information we wanted to know.” Through these meetings, Michigan Divest learned that the chief investment officer, Jon Braeutigam, is solely responsible for managing assets that represent 1 percent or less of the state pension portfolio and that Israel Bonds fell within those parameters.

That information helped them understand which official they had to convince and guided their outside strategy toward public investment board meetings. “When we showed up to the first investment board meeting, there was not an empty seat in the room,” Clark said. In subsequent meetings, support for Israel Bonds divestment was so widespread that the board had to book a bigger room.

In Minnesota, organizers began by pursuing a lawsuit against the state, on the grounds that the investments funded war crimes and made Minnesota complicit in Israel’s violations of international law. When the lawsuit was thrown out based on lack of standing in November 2012, the group shifted its strategy to a full-blown public pressure campaign targeting the four elected officials helming the SBI: the governor, attorney general, secretary of state and state auditor. MN BDS Community, a statewide clearinghouse for BDS information, formed in 2015 and adopted Minnesota Break the Bonds as its first campaign.

“We had state employees and pensioners testifying before the State Board of Investment for years,” said Bob Goonin, a MN BDS Community organizer. Speakers from American Muslims for Palestine, JVP, the MN Anti-War Committee and other groups made the same case the lawsuit had — that the investments made the SBI complicit in international law violations, genocide and apartheid.

“Especially since we’ve seen starvation used as a weapon of war, teachers have been calling out to the state board saying they don’t want to see children starving in Gaza when they are teaching children here,” Goonin said.

Others appealed to the SBI’s fiduciary responsibility, citing recent credit downgrades that make Israeli bonds a risky investment. “Groups across Minnesota came at this from different angles, but it was really a coordinated effort,” Goonin said. As Israel’s genocide in Gaza escalated over the past two years, more and more Minnesotans protested at SBI meetings.

The SBI reacted by moving its public meetings to a smaller space without live public comment in December 2024. During the March 2025 public meeting, dozens of state troopers guarded the building entrance and blocked parking lots. Goonin saw all of this as a sign that the pressure campaign was working.

Beyond public comment meetings, some organizers focused on meeting with legislators and SBI board members, while others organized actions outside of the governor’s mansion.

In June 2025, before Break the Bonds North Carolina publicly launched, three pension holders with the campaign met with the state treasurer to develop a relationship and express their concern about Israeli bonds. “The treasurer said he was unaware of Israeli bonds and asked for info on them,” Rosenberg said. After organizers sent him information, “he said that he didn’t find the bonds compelling from a risk reward perspective.” Immediately after that meeting, NC Break the Bonds launched its campaign publicly and in October, the treasurer fully divested.

Bonds Broken

Despite the Minnesota SBI, the North Carolina treasurer’s office and Michigan treasury each claiming the divestment moves were purely financial, organizers in all three venues claim they are a clear response to public pressure. “The community’s opposition to the state board holding these Israel bonds was a primary driver in their decision,” Minnesota organizer Bob Goonin said.

In Michigan, victory came in November when the chief investment officer decided not to reinvest in the $10 million Israel Bonds after they expired. Public records requests by Michigan Divest revealed that DCI’s national managing director, Larry Berman, had repeatedly emailed the treasury, pleading with the state to reinvest and even offering rates higher than those publicly available.

“When I saw [the emails], my hair stood up, it was so creepy,” Clark said. “I felt like we saw a shark fin breaching the surface for just a minute. … We know that they’re paying attention. They realize we’re a threat.” The divestment movement in Michigan was threatening enough to break the 30-year financial relationship between Michigan and the state of Israel.

The win in North Carolina was equally significant, considering that the treasurer actively decided to sell the sovereign debt bonds. “I think it shows that these pressure campaigns work,” Rosenberg said. “Investing in Israel is just a bad investment for all the reasons. It’s a bad financial and a bad moral investment.” Rosenberg also believes that the consecutive wins across state lines suggest that state pension managers are communicating with each other.

Making that financial argument was also critical in Minnesota, where organizer Karen Schraufnagel believes the most important factor was appealing to the SBI’s fiduciary responsibility. In October, public records received by the MN BDS Community showed that the SBI had sold or let expire all but $470,000 in Israeli bonds — from a peak of $13.3 million — at a loss of $830,000.

Rosenberg acknowledged that these state divestment wins are “a blip” in comparison to the multi-billion Israeli bonds portfolio,“but every penny matters in this divestment strategy.”

“We recognize it’s really just a little bit of good news, but we needed it,” she added. “You really have to say this is a victory,” Schraufnagel concurred. “But it’s hard to feel enthusiastic when your feed is full of starving children. We have to say good work and go on to the next thing. Five minute celebration and then back to work.”

Across the United States, there are at least 11 other active Israeli bonds divestment campaigns, focusing on a range of institutions. Some campaigns are just launching publicly, such as in Maryland; others have been simmering for years, such as in New York state. “In the wake of the recent victories, we’re seeing unprecedented breakthroughs and possibilities in a variety of communities, from Miami-Dade County, Florida to Indiana, to New York City,” said Dani Noble, the JVP national organizer.

The three victorious campaigns are currently planning the next stage of their divestment strategy. The Michigan Divest coalition is scouring other institutions invested in Israel Bonds, while Minnesota and North Carolina are focused on their state pension funds’ investments in weapons manufacturers and other companies targeted by the BDS Movement for complicity in apartheid and genocide. Regardless of where it turns next, it is clear that the divestment movement is building momentum across the U.S.

Ravie LakshmananFeb 16, 2026

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely question.

Another signal: attackers are mixing old and new methods. Legacy botnet tactics, modern cloud abuse, AI assistance, and supply-chain exposure are being used side by side, whichever path gives the easiest foothold.

Below is the full weekly recap — a condensed scan of the incidents, flaws, and campaigns shaping the threat landscape right now.

⚡ Threat of the Week

Malicious Outlook Add-in Turns Into Phishing Kit — In an unusual case of a supply chain attack, the legitimate AgreeTo add-in for Outlook has been hijacked and turned into a phishing kit that stole more than 4,000 Microsoft account credentials. This was made possible by seizing control of a domain associated with the now-abandoned project to serve a fake Microsoft login page. The incident demonstrates how overlooked and abandoned assets turn into attack vectors. “What makes Office add-ins particularly concerning is the combination of factors: they run inside Outlook, where users handle their most sensitive communications, they can request permissions to read and modify emails, and they’re distributed through Microsoft’s own store, which carries implicit trust,” Koi Security’s Idan Dardikman said. Microsoft has since removed the add-in from its store. 

🔔 Top News

• Google Releases Fixes for Actively Exploited Chrome 0-Day — Google shipped security updates for its Chrome browser to address a flaw that it said has been exploited in the wild. The high-severity vulnerability, tracked as CVE-2026-2441 (CVSS score: 8.8), has been described as a use-after-free bug in CSS that could result in arbitrary code execution. Google did not disclose any details about how the vulnerability is being exploited in the wild, by whom, or who may have been targeted, but it acknowledged that “an exploit for CVE-2026-2441 exists in the wild.” CVE-2026-2441 is the first actively exploited Chrome flaw patched by Google this year.
• BeyondTrust Flaw Comes Under Active Exploitation — A newly disclosed critical vulnerability in BeyondTrust Remote Support and Privileged Remote Access products has come under active exploitation in the wild less than 24 hours after the publication of a proof-of-concept (PoC) exploit. The vulnerability in question is CVE-2026-1731 (CVS score: 9.9), which could allow an unauthenticated attacker to achieve remote code execution by sending specially crafted requests. According to BeyondTrust, successful exploitation of the shortcoming could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user, resulting in unauthorized access, data exfiltration, and service disruption. Data from GreyNoise revealed that a single IP accounted for 86% of all observed reconnaissance sessions so far.
• Apple Ships Patches for Actively Exploited 0-Day — Apple released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw that it said has been exploited in sophisticated cyber attacks against specific individuals on versions of iOS before iOS 26. The vulnerability, tracked as CVE-2026-20700 (CVSS score: 7.8), has been described as a memory corruption issue in dyld, Apple’s Dynamic Link Editor. Successful exploitation of the vulnerability could allow an attacker with memory write capability to execute arbitrary code on susceptible devices. Google Threat Analysis Group (TAG) has been credited with discovering and reporting the bug. The issue has been addressed in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.
• SSHStalker Uses IRC for C2 — A newly documented Linux botnet named SSHStalker is using the Internet Relay Chat (IRC) communication protocol for command-and-control (C2) operations. The SSHStalker botnet relies on classic IRC mechanics, prioritizing resilience, scale, and low-cost C2 over stealth and technical novelty. The toolkit achieves initial access through automated SSH scanning and brute forcing, using a Go binary that masquerades as the popular open-source network discovery utility nmap. Compromised hosts are then used to scan for additional SSH targets, allowing it to spread in a worm-like manner. Also dropped to infected hosts are payloads to escalate privileges using a catalog of 15-year-old CVEs, perform AWS key harvesting, and cryptocurrency mining. “What we actually found was a loud, stitched-together botnet kit that mixes old-school IRC control, compiling binaries on hosts, mass SSH compromise, and cron-based persistence,” Flare said, describing it as a “scale-first operation that favors reliability over stealth.”
• TeamPCP Turns Cloud Infrastructure into Cybercrime Bots — A threat cluster known as TeamPCP is systematically targeting misconfigured and exposed cloud native environments to hijack infrastructure, expand its scale, and monetize its operations through cryptocurrency mining, proxyware, data theft, and extortion. TeamPCP’s modus operandi involves scanning broad IP ranges for exposed Docker APIs, Kubernetes clusters, Redis servers, Ray dashboards, and systems susceptible to the React2Shell vulnerability in React Server Components. Once it gains access to a system, the threat actor deploys malicious Python and Shell scripts that pull down additional payloads to install proxies, tunneling software, and other components that enable persistence even after server reboots. The varied end goals of the operation ensure that TeamPCP has several revenue streams as “every compromised system becomes a scanner, a proxy, a miner, a data exfiltration node, and a launchpad for further attacks,” Flare said. “Kubernetes clusters are not merely breached; they are converted into distributed botnets.”
• State-Sponsored Hackers Use AI at All Stages of Attack Cycle — Google said it found evidence of nation-state hacking groups using its artificial intelligence (AI) chatbot Gemini at nearly every stage of the cyber attack cycle. The findings once again underscore how such tools are being increasingly integrated into malicious operations, even if they don’t equip bad actors with novel capabilities. One major area of concern with AI abuse is automating the development of vulnerability exploitation, allowing attackers to move faster than the defenders, necessitating that companies respond quickly and fix security weaknesses. Gemini is being weaponized in other ways too, Google said, with some bad actors embedding its APIs directly into malicious code. This includes a new malware family called HONESTCUE that sends prompts to generate working code that the malware compiles and executes in memory. The prompts appear benign in isolation and “devoid of any context related to malware,” allowing them to bypass Gemini’s safety filters.
• Nation-State Hackers Go After Defense Industrial Base — Digital threats targeting the defense industrial base (DIB) sector are expanding beyond traditional espionage into supply chain attacks, workforce infiltration, and cyber operations that lend nations a strategic advantage on the battlefield. The development comes as the cyber domain becomes increasingly intertwined with national defense. Google Threat Intelligence Group said the DIB sector faces a “relentless barrage” of cyber operations conducted by state-sponsored actors and criminal groups. These activities are primarily driven by Chinese, Iranian, North Korean, and Russian threat actors. This is also complemented by pre-positioning efforts to gain covert access through zero-day vulnerabilities in edge network devices to maintain persistent access for future strategic advantage. “In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation,” the tech giant said.

‎️‍🔥 Trending CVEs

New vulnerabilities surface daily, and attackers move fast. Reviewing and patching early keeps your systems resilient.

Here are this week’s most critical flaws to check first — CVE-2026-2441 (Google Chrome), CVE-2026-20700 (Apple iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS), CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 (Microsoft Windows), CVE-2026-1731 (BeyondTrust Remote Support and Privileged Remote Access), CVE-2026-1774 (CASL Ability), CVE-2026-25639 (Axios), CVE-2026-25646 (libpng), CVE-2026-1357 (WPvivid Backup & Migration plugin), CVE-2026-0969 (next-mdx-remote), CVE-2026-25881 (SandboxJS), CVE-2025-66630 (Fiber v2), and a path traversal vulnerability in PyMuPDF (no CVE).

🎥 Cybersecurity Webinars

• Quantum-Ready Security: Preparing for Post-Quantum Cryptography Risks — Quantum computing is advancing fast and it could soon break today’s encryption. Attackers are already collecting encrypted data to decrypt later using quantum power. In this webinar, learn how post-quantum cryptography (PQC) protects sensitive data, ensures compliance, and prepares your organization for future threats. Discover practical strategies, hybrid encryption models, and real solutions from Zscaler to secure your business for the quantum era.
• AI Agents Are Expanding Your Attack Surface — Learn How to Secure Them — AI agents are no longer just chatbots; they browse the web, run code, and access company systems. This creates new security risks beyond prompts. In this session, Rahul Parwani explains how attackers target AI agents and what teams can do to protect them in real-world use.
• Faster Cloud Breach Analysis With Context-Aware Forensics — Cloud attacks don’t leave clear evidence, and traditional forensics can’t keep up. In this webinar, learn how context-aware forensics and AI help security teams investigate cloud incidents faster, capture the right host-level data, and reconstruct attacks in minutes instead of days, so you understand what happened and respond with confidence.

📰 Around the Cyber World

• DragonForce Ransomware Cartel Detailed — In a new analysis, S2W detailed the workings of DragonForce, a ransomware group active since December 2023 that operates under a Ransomware-as-a-Service (RaaS) model and promotes itself as a cartel to expand its influence. The group has carried out attacks against 363 companies from December 2023 to January 2026, while affiliating with LockBit and Qilin. DragonForce also maintains the RansomBay service to support affiliates with customized payload generation and configuration options. In addition, it is active on several dark web forums, including BreachForums, RAMP, and Exploit to advertise its RaaS operations and recruit pentesters. “DragonForce has been expanding its operational scope through attacks on other groups as well as through cooperative relationships, which is assessed as an effort to strengthen its position within the ransomware ecosystem,” S2W said.
• New Browser Fingerprinting Technique Uses Ad Block Filters — Aș browser fingerprinting techniques continue to evolve, new research has found that country-specific adblock filter lists installed on the browser can be used to de-anonymize VPN users. The approach has been codenamed Adbleed by security researcher Melvin Lammerts. “Users of ad blockers with country-specific filter lists (e.g., EasyList Germany, Liste FR) can be partially de-anonymized even when using a VPN,” the researcher said. “By probing blocked domains unique to each country’s filter list, we can identify which lists are active, revealing the user’s likely country or language. If 20+ out of 30 probed domains are blocked instantly, we conclude that the country’s filter list is active.”
• China’s Tianfu Cup Makes a Quiet Return in 2026 — China’s Tianfu Cup hacking contest made its return in 2026, and is now being overseen by the government. Tianfu Cup was launched in 2018 as an alternative to the Zero Day Initiative’s Pwn2Own competition to demonstrate critical vulnerabilities in consumer and enterprise hardware and software, industrial control systems, and automotive products. Tianfu Cup attracted attention in 2021 when participants earned a total of $1.88 million for exploits targeting Windows, Ubuntu, iOS, Safari, Google Chrome, Microsoft Exchange, Adobe Reader, Docker, and VMware. While Tianfu Cup skipped 2022, 2024, and 2025, it popped up in 2023 with a focus on domestic products from companies such as Huawei, Xiaomi, Tencent, and Qihoo 360. After a two-year hiatus in 2024 and 2025, Tianfu Cup once again reappeared late last month. According to Natto Thoughts, the hacking competition is now organized by China’s Ministry of Public Security (MPS). With regulations implemented by China in 2021 requiring citizens to report zero-day vulnerabilities to the government, it has raised concerns that Chinese nation-state threat actors have been leveraging the law to stockpile zero-days for cyber espionage operations.
• DoD Employee Indicted for Moonlighting as a Money Mule — A Department of Defense (DoD) employee, Samuel D. Marcus, has been indicted in the U.S. for allegedly serving as a money mule and laundering millions of dollars on behalf of Nigerian scammers. Marcus has been charged with one count of conspiracy to commit money laundering, six counts of illegal monetary transactions, and one count of money laundering. “From approximately July 2023 to December 2025, while employed as a Logistics Specialist with the Department of Defense, the defendant was in direct and regular contact with a group of Nigeria-based fraudsters, who operated under the aliases ‘Rachel Jude’ and ‘Ned McMurray,’ among others,” the U.S. Justice Department (DoJ) said. “These fraudsters engaged in a variety of wire fraud schemes that targeted victims based in the United States, including romance fraud, cyber fraud, tax fraud, financing fraud, and business email compromise schemes, to which victims lost millions of dollars.” The indictment alleged that the defendant and other money mules conducted a series of financial transactions to convert fraud victim funds deposited into their accounts into cryptocurrency and to move those funds into foreign accounts. If convicted, Marcus faces a maximum possible sentence of 100 years’ imprisonment, three years’ supervised release, and a $2 million fine.
• Palo Alto Networks Chose Not to tie TGR-STA-1030 to China — In a report published last week, Reuters said Palo Alto Networks Unit 42 opted not to attribute China to a sprawling cyber espionage campaign dubbed TGR-STA-1030 that it said broke into the networks of at least 70 government and critical infrastructure organizations across 37 countries over the past year. The decision was motivated “over concerns that the cybersecurity company or its clients could face retaliation from Beijing,” the news agency said. It’s worth noting that the campaign exhibits typical hallmarks associated with a typical China-nexus espionage effort, not least because of the use of tools like Behinder, neo-reGeorg, and Godzilla, which have been primarily identified as used by Chinese hacking groups in the past.
• Trend Micro Details New Threat Actor Taxonomy — Trend Micro has outlined a new threat attribution framework that applies standardized evidence scoring, relationship mapping, and bias testing to reduce the risk of misattribution. The naming convention includes Earth for espionage, Water for financially motivated operations, Fire for destructive or disruptive actors, Wind for hacktivists, Aether for unknown motivation, and Void for mixed motivation. “Strong attribution comes from weighing evidence correctly,” Trend Micro said. “Not all evidence carries the same weight, and effective attribution depends on separating high-value intelligence from disposable indicators. Attribution confidence comes from signals that persist over time. Quantifying evidence quality through consistent scoring prevents analysts from overvaluing noise or intuition, helps challenge assumptions, and keeps the focus on signals that genuinely strengthen the overall attribution case rather than isolated data points that do not move it forward.”
• Cryptocurrency Flows to Suspected Human Trafficking Services Surge — Cryptocurrency flows to suspected human trafficking services, largely based in Southeast Asia, grew 85% in 2025, reaching a scale of hundreds of millions across identified services. “This surge in cryptocurrency flows to suspected human trafficking services is not happening in isolation, but is closely aligned with the growth of Southeast Asia–based scam compounds, online casinos and gambling sites, and Chinese-language money laundering (CMLN) and guarantee networks operating largely via Telegram, all of which form a rapidly expanding local illicit ecosystem with global reach and impact,” Chainalysis said.
• Security Flaw in Munge — A high-severity vulnerability has been disclosed in Munge that could allow a local attacker to leak cryptographic key material from process memory, and use it to forge arbitrary Munge credentials to impersonate any user, including root, to services that rely on it for authentication. Munge is an authentication service for creating and validating user credentials that’s designed for use in high-performance computing (HPC) cluster environments. The vulnerability, tracked as CVE-2026-25506 (CVSS score: 7.7), has been present in the codebase for approximately 20 years, per Lexfo. It affects every version up to 0.5.17, and has been addressed in version 0.5.18, released on February 10, 2026. “This vulnerability can be exploited locally to leak the Munge secret key, allowing an attacker to forge arbitrary Munge tokens, valid across the cluster,” Lexfo said. “In a way, this is a local privilege escalation in the context of high-performance computers.”
• New Campaign Distributes Lumma Stealer and Trojanized Chromium-Based Ninja Browser — A large-scale malware campaign has been exploiting trusted Google services, including Google Groups, Google Docs, and Google Drive, to distribute Lumma Stealer and a trojanized Chromium-based Ninja Browser on Windows and Linux systems. The attack chain involves the threat actor embedding malicious download links disguised as software updates, often using URL shorteners, in Google Groups to trick users into installing malware. Central to the attack is the abuse of the inherent trust associated with Google-hosted platforms to bypass conventional security controls and increase the likelihood of successful compromise. “The operation leverages more than 4,000 malicious Google Groups and 3,500 Google-hosted URLs to embed deceptive download links within legitimate-looking discussions, targeting organizations worldwide,” CTM360 said. “The campaign dynamically redirects victims based on the operating system, delivering an oversized, obfuscated Lumma payload to Windows users and a persistence-enabled malicious browser to Linux systems.”
• Disney Agrees to $2.75M Fine for Data Privacy Violations — Walt Disney has agreed to a $2.75 million fine with the U.S. state of California in response to allegations that it broke the state’s privacy law, the California Consumer Protection Act, by making it difficult for consumers to opt out of having their data shared and sold. The company has also agreed to implement opt-out methods that fully stop Disney’s sale or sharing of consumers’ personal information. “Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights,” said California Attorney General Rob Bonta. “California’s nation-leading privacy law is clear: A consumer’s opt-out right applies wherever and however a business sells data — businesses can’t force people to go device-by-device or service-by-service. In California, asking a business to stop selling your data should not be complicated or cumbersome. My office is committed to the continued enforcement of this critical privacy law.”
• Leaked Credentials Exposed Airport Systems to Security Risks — CloudSEK said it discovered login credentials for a European fourth-party airport service portal being circulated on underground forums, potentially allowing threat actors unauthorized access to an unnamed vendor’s Next Generation Operations Support System (NGOSS) systems at approximately 200 airports across multiple countries. “The portal, which served as the central control panel for over 200 client airports, lacked Multi-Factor Authentication (MFA),” CloudSEK said. “No breach occurred — but the potential for one was immediate and severe.”

🔧 Cybersecurity Tools

• SCAM (Security Comprehension Awareness Measure) — It is a benchmark by 1Password that tests how safely AI agents handle sensitive information in real workplace situations. Instead of asking agents to identify obvious scams, it places them inside everyday tasks—email, credentials, web forms—where hidden threats like phishing links and fake domains appear naturally. The goal is to measure whether AI can recognize, avoid, and report risks before damage happens.
• Quantickle — It is a browser-based graph visualization tool designed to help analysts map and explore threat intelligence data. It turns complex relationships—IPs, domains, malware, actors—into interactive network graphs, making patterns, connections, and attack paths easier to see, investigate, and explain.

Disclaimer: These tools are provided for research and educational use only. They are not security-audited and may cause harm if misused. Review the code, test in controlled environments, and comply with all applicable laws and policies.

Conclusion

Taken together, these incidents show how threat activity is spreading across every layer. User tools, enterprise software, cloud infrastructure, and national systems are all in scope. The entry points differ, but the objective stays the same: gain access quietly, then scale impact over time.

The stories above are not isolated alerts. Read as a whole, they outline where pressure is building next and where defenses are most likely to be tested in the weeks ahead.

A town in northern Italy has started celebrating carnival with its annual Battle of the Oranges where people hurl the fruit at each other for fun.

The historic carnival in Ivrea, an old medieval town near Turin, celebrates the legend of Violetta, a miller’s daughter who freed people from a tyrant starving the town.

The colourful battle commemorates the uprising and is played between nine teams on foot, who represent the people who revolted, while the orange throwers on horse-drawn carriages, represent the feudal armies.